@nking @ekorhonen @jhwong would any of you be able to provide some insight into the 2 API endpoints and when a user should use them?
So far I have gathered the following details. Please feel free to add more if I missed something.
Alerts | Security Assessment |
- It is a generic endpoint providing alerts for multiple categories
| - The security assessment is just one category of alert
|
- It provides historical data. that means you can even get the alerts that were generated in past.
| - It provides the alerts which are currently open. Only the last snapshot instead of historical.
|
- For Security assessment alerts, there's no way to check if the alert is resolved or not.
| - The status parameter can tell if the rule is passed or not in the present time.
|
- start-time & end-time parameters are required to get the historical data.
| - It will only provide the latest data.
|
- Since the alert endpoint is used for many categories, it provides much more details in the response.
| - Only the details specific to the security alert are provided. but so far, it does the job.
|
- For filtering, only the "query" request param is available.
| - For filtering, multiple params are available. But so far, both ways are equally good.
|
That looks correct to me. A useful way to think the security-assessment endpoint vs. the alerts endpoint is to see the first one as an alias for a subset of the latter with some useful additional filter shortcuts built in.