the differences between "es_notable_events" and "incident_review_lookup"

[kanam]

I'd like to search the status of Incident Review, and have found 2 ways to do it.
1)| inputlookup append=T es_notable_events
2)| inputlookup append=T incident_review_lookup

Other than above 2 ways, many person may look to use "|incident_review" for that.
Maybe "|incident_review" contains 2)| inputlookup append=T incident_review_lookup.

Ideally, I want to display detail information like rule_title,src,user etc.
So I guess 1)| inputlookup append=T es_notable_events is better.
However I'd like to know the differences between "es_notable_events" and "incident_review_lookup".

Best Regards,

[lakshman239]

Your best would be to use the notable macro and get required fields, `notable | fields rule_title, search_name`