How to detect and get alerted when detection rules are automatically moved to PAUSED state?

Hi everyone,

We have noticed that when certain detection rules exceed resource consumption limits, Google SecOps automatically transitions them to a PAUSED state (following the LIMITED throttling period). Because paused rules stop evaluating events and generating alerts, we need to monitor these operational status changes closely.

I have two questions regarding identifying and tracking these transitions:

1. Native Notifications: Does Google SecOps support any built-in alerting or notification mechanism (such as in-console alerts, bell notifications, or automated emails) when the platform suspends a rule due to high resource usage?

2. Identification & Auditing: What is the recommended way to capture the exact timestamp when a rule moves to PAUSED? Should we be just polling the SecOps REST API (rules.list / rules.get with executionState)?
    

How are other teams tracking degraded or paused rules to ensure detection coverage isn't silently lost? Any API query examples, or best practices would be greatly appreciated.

Thanks!