Direct OpenSearch document lookup by _id. Sigma-origin alerts have a separate matched event; Suricata-origin alerts don't — their signature match already is the finished detection — so only the alert record below will have content for those. A correlated alert also shows the two real underlying detections it pairs.