elastic · Mikaayenson · May 14, 2024 · May 13, 2024 · May 13, 2024 · May 13, 2024
diff --git a/rules/integrations/cloud_defend/container_workload_protection.toml b/rules/integrations/cloud_defend/container_workload_protection.toml
@@ -4,7 +4,7 @@ integration = ["cloud_defend"]
 maturity = "production"
 min_stack_comments = "Initial version of the Container Workload Protection alerts"
 min_stack_version = "8.8.0"
-updated_date = "2023/06/22"
+updated_date = "2024/05/13"
 
 [rule]
 author = ["Elastic"]
@@ -22,6 +22,10 @@ name = "Container Workload Protection"
 risk_score = 47
 rule_id = "4b4e9c99-27ea-4621-95c8-82341bc6e512"
 rule_name_override = "message"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "medium"
 tags = ["Data Source: Elastic Defend for Containers", "Domain: Container"]
 timestamp_override = "event.ingested"

diff --git a/rules/integrations/endpoint/elastic_endpoint_security.toml b/rules/integrations/endpoint/elastic_endpoint_security.toml
@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/06/22"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -23,6 +23,10 @@ name = "Endpoint Security"
 risk_score = 47
 rule_id = "9a1a2dae-0b5f-4c3d-8305-a268d404c306"
 rule_name_override = "message"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "medium"
 tags = ["Data Source: Elastic Defend"]
 timestamp_override = "event.ingested"

diff --git a/rules/promotions/credential_access_endgame_cred_dumping_detected.toml b/rules/promotions/credential_access_endgame_cred_dumping_detected.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Credential Dumping - Detected - Elastic Endgame"
 risk_score = 73
 rule_id = "571afc56-5ed9-465d-a2a9-045f099f6e7e"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "high"
 tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Credential Access"]
 type = "query"

diff --git a/rules/promotions/credential_access_endgame_cred_dumping_prevented.toml b/rules/promotions/credential_access_endgame_cred_dumping_prevented.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Credential Dumping - Prevented - Elastic Endgame"
 risk_score = 47
 rule_id = "db8c33a8-03cd-4988-9e2c-d0a4863adb13"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "medium"
 tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Credential Access"]
 type = "query"

diff --git a/rules/promotions/endgame_adversary_behavior_detected.toml b/rules/promotions/endgame_adversary_behavior_detected.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Adversary Behavior - Detected - Elastic Endgame"
 risk_score = 47
 rule_id = "77a3c3df-8ec4-4da4-b758-878f551dee69"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "medium"
 tags = ["Data Source: Elastic Endgame"]
 type = "query"

diff --git a/rules/promotions/endgame_malware_detected.toml b/rules/promotions/endgame_malware_detected.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Malware - Detected - Elastic Endgame"
 risk_score = 99
 rule_id = "0a97b20f-4144-49ea-be32-b540ecc445de"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "critical"
 tags = ["Data Source: Elastic Endgame"]
 type = "query"

diff --git a/rules/promotions/endgame_malware_prevented.toml b/rules/promotions/endgame_malware_prevented.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Malware - Prevented - Elastic Endgame"
 risk_score = 73
 rule_id = "3b382770-efbb-44f4-beed-f5e0a051b895"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "high"
 tags = ["Data Source: Elastic Endgame"]
 type = "query"

diff --git a/rules/promotions/endgame_ransomware_detected.toml b/rules/promotions/endgame_ransomware_detected.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Ransomware - Detected - Elastic Endgame"
 risk_score = 99
 rule_id = "8cb4f625-7743-4dfb-ae1b-ad92be9df7bd"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "critical"
 tags = ["Data Source: Elastic Endgame"]
 type = "query"

diff --git a/rules/promotions/endgame_ransomware_prevented.toml b/rules/promotions/endgame_ransomware_prevented.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Ransomware - Prevented - Elastic Endgame"
 risk_score = 73
 rule_id = "e3c5d5cb-41d5-4206-805c-f30561eae3ac"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "high"
 tags = ["Data Source: Elastic Endgame"]
 type = "query"

diff --git a/rules/promotions/execution_endgame_exploit_detected.toml b/rules/promotions/execution_endgame_exploit_detected.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Exploit - Detected - Elastic Endgame"
 risk_score = 73
 rule_id = "2003cdc8-8d83-4aa5-b132-1f9a8eb48514"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "high"
 tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Privilege Escalation"]
 type = "query"

diff --git a/rules/promotions/execution_endgame_exploit_prevented.toml b/rules/promotions/execution_endgame_exploit_prevented.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Exploit - Prevented - Elastic Endgame"
 risk_score = 47
 rule_id = "2863ffeb-bf77-44dd-b7a5-93ef94b72036"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "medium"
 tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Privilege Escalation"]
 type = "query"

diff --git a/rules/promotions/external_alerts.toml b/rules/promotions/external_alerts.toml
@@ -3,7 +3,7 @@ creation_date = "2020/07/08"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -20,6 +20,10 @@ name = "External Alerts"
 risk_score = 47
 rule_id = "eb079c62-4481-4d6e-9643-3ca499df7aaa"
 rule_name_override = "message"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "medium"
 tags = ["OS: Windows", "Data Source: APM", "OS: macOS", "OS: Linux"]
 timestamp_override = "event.ingested"

diff --git a/rules/promotions/privilege_escalation_endgame_cred_manipulation_detected.toml b/rules/promotions/privilege_escalation_endgame_cred_manipulation_detected.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Credential Manipulation - Detected - Elastic Endgame"
 risk_score = 73
 rule_id = "c0be5f31-e180-48ed-aa08-96b36899d48f"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "high"
 tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Privilege Escalation"]
 type = "query"

diff --git a/rules/promotions/privilege_escalation_endgame_cred_manipulation_prevented.toml b/rules/promotions/privilege_escalation_endgame_cred_manipulation_prevented.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Credential Manipulation - Prevented - Elastic Endgame"
 risk_score = 47
 rule_id = "c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "medium"
 tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Privilege Escalation"]
 type = "query"

diff --git a/rules/promotions/privilege_escalation_endgame_permission_theft_detected.toml b/rules/promotions/privilege_escalation_endgame_permission_theft_detected.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Permission Theft - Detected - Elastic Endgame"
 risk_score = 73
 rule_id = "c3167e1b-f73c-41be-b60b-87f4df707fe3"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "high"
 tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Privilege Escalation"]
 type = "query"

diff --git a/rules/promotions/privilege_escalation_endgame_permission_theft_prevented.toml b/rules/promotions/privilege_escalation_endgame_permission_theft_prevented.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Permission Theft - Prevented - Elastic Endgame"
 risk_score = 47
 rule_id = "453f659e-0429-40b1-bfdb-b6957286e04b"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "medium"
 tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Privilege Escalation"]
 type = "query"

diff --git a/rules/promotions/privilege_escalation_endgame_process_injection_detected.toml b/rules/promotions/privilege_escalation_endgame_process_injection_detected.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Process Injection - Detected - Elastic Endgame"
 risk_score = 73
 rule_id = "80c52164-c82a-402c-9964-852533d58be1"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "high"
 tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Privilege Escalation"]
 type = "query"

diff --git a/rules/promotions/privilege_escalation_endgame_process_injection_prevented.toml b/rules/promotions/privilege_escalation_endgame_process_injection_prevented.toml
@@ -3,7 +3,7 @@ creation_date = "2020/02/18"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/17"
+updated_date = "2024/05/13"
 promotion = true
 
 [rule]
@@ -21,6 +21,10 @@ max_signals = 10000
 name = "Process Injection - Prevented - Elastic Endgame"
 risk_score = 47
 rule_id = "990838aa-a953-4f3e-b3cb-6ddf7584de9e"
+setup = """## Setup
+
+The `max_signals` field is set to a value greater than the default value (1000) set by `system_limit`. This is to ensure that all alerts are captured.
+To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` setting in the Kibana config."""
 severity = "medium"
 tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Privilege Escalation"]
 type = "query"

@@ -147,6 +147,21 @@ def build_rule(query, bbr_type="default", from_field="now-120m", interval="60m")
         with self.assertRaises(ValidationError):
             build_rule(query=query, from_field="now-10m", interval="10m")
 
+    def test_max_signals_note(self):
+        """Ensure the max_signals note is present when max_signals > 1000."""
+        max_signal_standard_setup = 'The `max_signals` field is set to a value greater than the default value (1000) ' \
+                                    'set by `system_limit`. This is to ensure that all alerts are captured.\n' \
+                                    'To bypass this default, configure the `xpack.alerting.rules.run.alerts.max` '\
+                                    'setting in the Kibana config.'
+        for rule in self.all_rules:
+            if rule.contents.data.max_signals and rule.contents.data.max_signals > 1000:
+                error_message = f'{self.rule_str(rule)} note required for max_signals > 1000'
+                self.assertIsNotNone(rule.contents.data.setup, error_message)
+                if max_signal_standard_setup not in rule.contents.data.setup:
+                    self.fail(f'{self.rule_str(rule)} expected max_signals note missing\n\n'
+                              f'Expected: {max_signal_standard_setup}\n\n'
+                              f'Actual: {rule.contents.data.setup}')
+
 
 class TestThreatMappings(BaseRuleTest):
     """Test threat mapping data for rules."""
@@ -870,7 +885,8 @@ def test_integration_guide(self):
             note_str = integration_notes.get(integration)
 
             if note_str:
-                self.assert_(rule.contents.data.note, f'{self.rule_str(rule)} note required for config information')
+                error_message = f'{self.rule_str(rule)} note required for config information'
+                self.assertIsNotNone(rule.contents.data.note, error_message)
 
                 if note_str not in rule.contents.data.note:
                     self.fail(f'{self.rule_str(rule)} expected {integration} config missing\n\n'