Skip to content

Update Max signals value to supported limits #4556

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 16 commits into from
Mar 27, 2025
Merged

Update Max signals value to supported limits #4556

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
3e4dde0
Modify Unit test and update rules
shashank-elastic Mar 21, 2025
b34df64
Modify Unit test and update rules
shashank-elastic Mar 24, 2025
2edae6a
Fix Lint issues
shashank-elastic Mar 24, 2025
fff2995
Fix Lint issues
shashank-elastic Mar 24, 2025
616d892
Merge branch 'main' into issue-4539
shashank-elastic Mar 24, 2025
917af05
Merge branch 'main' into issue-4539
shashank-elastic Mar 24, 2025
157399c
Merge branch 'main' into issue-4539
shashank-elastic Mar 25, 2025
5210a6c
Merge branch 'main' into issue-4539
shashank-elastic Mar 25, 2025
9fe163b
Merge branch 'main' into issue-4539
shashank-elastic Mar 26, 2025
0f5a198
Update rules based on review comments
shashank-elastic Mar 26, 2025
508097b
Update rule intervals based on aggred values
shashank-elastic Mar 26, 2025
c836382
Update a rule from main
shashank-elastic Mar 26, 2025
010aa59
Update windows rule from main
shashank-elastic Mar 26, 2025
9a77790
Review Comments
shashank-elastic Mar 26, 2025
96a77c3
Merge branch 'main' into issue-4539
DefSecSentinel Mar 27, 2025
6f0d2f9
Review Comments
shashank-elastic Mar 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[project]
name = "detection_rules"
version = "1.0.2"
version = "1.0.3"
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
readme = "README.md"
requires-python = ">=3.12"
Expand Down
11 changes: 3 additions & 8 deletions rules/integrations/endpoint/defense_evasion_elastic_memory_threat_detected.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ maturity = "production"
min_stack_comments = "Defend alerting adjustments patch to distinguish prevention and detection."
min_stack_version = "8.16.0"
promotion = true
updated_date = "2025/02/06"
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
Expand All @@ -20,7 +20,7 @@ index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 10000
max_signals = 1000
name = "Memory Threat - Detected - Elastic Defend"
note = """## Triage and analysis

Expand Down Expand Up @@ -102,13 +102,8 @@ Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17f
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).

### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.

**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.

To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.

**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects.
For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "high"
tags = ["Data Source: Elastic Defend", "Tactic: Defense Evasion", "Resources: Investigation Guide"]
Expand Down
11 changes: 3 additions & 8 deletions rules/integrations/endpoint/defense_evasion_elastic_memory_threat_prevented.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ maturity = "production"
min_stack_comments = "Defend alerting adjustments patch to distinguish prevention and detection."
min_stack_version = "8.16.0"
promotion = true
updated_date = "2025/02/06"
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
Expand All @@ -20,7 +20,7 @@ index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 10000
max_signals = 1000
name = "Memory Threat - Prevented- Elastic Defend"
note = """## Triage and analysis

Expand Down Expand Up @@ -101,13 +101,8 @@ Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17f
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).

### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.

**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.

To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.

**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects.
For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "high"
tags = ["Data Source: Elastic Defend", "Tactic: Defense Evasion", "Resources: Investigation Guide"]
Expand Down
11 changes: 3 additions & 8 deletions rules/integrations/endpoint/elastic_endpoint_security.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ creation_date = "2020/07/08"
integration = ["endpoint"]
maturity = "production"
promotion = true
updated_date = "2025/03/20"
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
Expand All @@ -17,7 +17,7 @@ index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 10000
max_signals = 1000
name = "Endpoint Security (Elastic Defend)"
note = """## Triage and analysis

Expand Down Expand Up @@ -75,13 +75,8 @@ Related rules:
- Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17fbce)

### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.

**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.

To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.

**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects.
For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "medium"
tags = ["Data Source: Elastic Defend", "Resources: Investigation Guide"]
Expand Down
11 changes: 3 additions & 8 deletions rules/integrations/endpoint/elastic_endpoint_security_behavior_detected.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ maturity = "production"
min_stack_comments = "Defend alerting adjustments patch to distinguish prevention and detection."
min_stack_version = "8.16.0"
promotion = true
updated_date = "2025/02/06"
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
Expand All @@ -20,7 +20,7 @@ index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 10000
max_signals = 1000
name = "Behavior - Detected - Elastic Defend"
note = """## Triage and analysis

Expand Down Expand Up @@ -85,13 +85,8 @@ Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17f
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).

### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.

**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.

To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.

**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects.
For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "medium"
tags = ["Data Source: Elastic Defend", "Resources: Investigation Guide"]
Expand Down
11 changes: 3 additions & 8 deletions rules/integrations/endpoint/elastic_endpoint_security_behavior_prevented.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ maturity = "production"
min_stack_comments = "Defend alerting adjustments patch to distinguish prevention and detection."
min_stack_version = "8.16.0"
promotion = true
updated_date = "2025/02/06"
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
Expand All @@ -20,7 +20,7 @@ index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 10000
max_signals = 1000
name = "Behavior - Prevented - Elastic Defend"
note = """## Triage and analysis

Expand Down Expand Up @@ -86,13 +86,8 @@ Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17f
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).

### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.

**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.

To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.

**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects.
For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "low"
tags = ["Data Source: Elastic Defend", "Resources: Investigation Guide"]
Expand Down
11 changes: 3 additions & 8 deletions rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ maturity = "production"
min_stack_comments = "Defend alerting adjustments patch to distinguish prevention and detection."
min_stack_version = "8.16.0"
promotion = true
updated_date = "2025/02/06"
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
Expand All @@ -20,7 +20,7 @@ index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 10000
max_signals = 1000
name = "Malicious File - Detected - Elastic Defend"
note = """## Triage and analysis

Expand Down Expand Up @@ -93,13 +93,8 @@ Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17f
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).

### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.

**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.

To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.

**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects.
For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "medium"
tags = ["Data Source: Elastic Defend", "Tactic: Execution", "Resources: Investigation Guide"]
Expand Down
11 changes: 3 additions & 8 deletions rules/integrations/endpoint/execution_elastic_malicious_file_prevented.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ maturity = "production"
min_stack_comments = "Defend alerting adjustments patch to distinguish prevention and detection."
min_stack_version = "8.16.0"
promotion = true
updated_date = "2025/02/06"
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
Expand All @@ -20,7 +20,7 @@ index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 10000
max_signals = 1000
name = "Malicious File - Prevented - Elastic Defend"
note = """## Triage and analysis

Expand Down Expand Up @@ -93,13 +93,8 @@ Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17f
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).

### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.

**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.

To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.

**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects.
For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "low"
tags = ["Data Source: Elastic Defend", "Tactic: Execution", "Resources: Investigation Guide"]
Expand Down
11 changes: 3 additions & 8 deletions rules/integrations/endpoint/impact_elastic_ransomware_detected.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ maturity = "production"
min_stack_comments = "Defend alerting adjustments patch to distinguish prevention and detection."
min_stack_version = "8.16.0"
promotion = true
updated_date = "2025/02/06"
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
Expand All @@ -20,7 +20,7 @@ index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 10000
max_signals = 1000
name = "Ransomware - Detected - Elastic Defend"
note = """## Triage and analysis

Expand Down Expand Up @@ -84,13 +84,8 @@ Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17f
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).

### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.

**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.

To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.

**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects.
For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "high"
tags = ["Data Source: Elastic Defend", "Tactic: Impact", "Resources: Investigation Guide"]
Expand Down
11 changes: 3 additions & 8 deletions rules/integrations/endpoint/impact_elastic_ransomware_prevented.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ maturity = "production"
min_stack_comments = "Defend alerting adjustments patch to distinguish prevention and detection."
min_stack_version = "8.16.0"
promotion = true
updated_date = "2025/02/06"
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
Expand All @@ -20,7 +20,7 @@ index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 10000
max_signals = 1000
name = "Ransomware - Prevented - Elastic Defend"
note = """## Triage and analysis

Expand Down Expand Up @@ -85,13 +85,8 @@ Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17f
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).

### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.

**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.

To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.

**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects.
For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "high"
tags = ["Data Source: Elastic Defend", "Tactic: Impact", "Resources: Investigation Guide"]
Expand Down
Loading
Loading