Brandon Kobel

> I'm not sure what you mean here. The client exposes the entire Elasticsearch API surface, if you can access the system indices via an API, then you can do...

Do we actually need and benefit from all of these ECS fields added to the existing alerts-as-data indices? Prior to us minimizing the number of alert indices that are created...