I want to archive alerts from Google SecOps SIEM therefore I am still considering a couple of API endpoints to use in order to complete this. I identified legacySearchAlerts and legacySearchRulesAlerts.I noticed that both endpoints doesn´t prvoide the same form of alerts.
My questions are:
- what is the difference between alerts that are provided by both endpoints ?
- Is the difference just in how alerts are presented or does both endpoints provide absolute different data ?
- What is the best choice when it comes to archiving alerts ?
Thank you in advance !
