[Security Solution] Allow users to edit max_signals field for custom rules

x-pack/plugins/alerting/public/plugin.ts

@@ -57,6 +57,7 @@ export interface PluginSetupContract {
 }
 export interface PluginStartContract {
   getNavigation: (ruleId: Rule['id']) => Promise<string | undefined>;
+  getMaxAlertsPerRun: () => number | undefined;
 }
 export interface AlertingPluginSetup {
   management: ManagementSetup;
@@ -69,13 +70,28 @@ export interface AlertingPluginStart {
   data: DataPublicPluginStart;
 }
 
+export interface AlertingUIConfig {
+  rules: {
+    run: {
+      alerts: {
+        max: number;
+      };
+    };
+  };
+}
+
 export class AlertingPublicPlugin
   implements
     Plugin<PluginSetupContract, PluginStartContract, AlertingPluginSetup, AlertingPluginStart>
 {
   private alertNavigationRegistry?: AlertNavigationRegistry;
+  private config: AlertingUIConfig;
+  readonly maxAlertsPerRun?: number;
 
-  constructor(private readonly initContext: PluginInitializerContext) {}
+  constructor(private readonly initContext: PluginInitializerContext) {
+    this.config = this.initContext.config.get<AlertingUIConfig>();
+    this.maxAlertsPerRun = this.config.rules.run.alerts.max;
+  }
 
   public setup(core: CoreSetup, plugins: AlertingPluginSetup) {
     this.alertNavigationRegistry = new AlertNavigationRegistry();
@@ -150,6 +166,9 @@ export class AlertingPublicPlugin
           return rule.viewInAppRelativeUrl;
         }
       },
+      getMaxAlertsPerRun: () => {
+        return this.maxAlertsPerRun;
+      },
     };
   }
 }

x-pack/plugins/alerting/server/index.ts

@@ -7,8 +7,7 @@
 import type { PublicMethodsOf } from '@kbn/utility-types';
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { RulesClient as RulesClientClass } from './rules_client';
-import { configSchema } from './config';
-import { AlertsConfigType } from './types';
+import { AlertingConfig, configSchema } from './config';
 
 export type RulesClient = PublicMethodsOf<RulesClientClass>;
 
@@ -78,8 +77,11 @@ export const plugin = async (initContext: PluginInitializerContext) => {
   return new AlertingPlugin(initContext);
 };
 
-export const config: PluginConfigDescriptor<AlertsConfigType> = {
+export const config: PluginConfigDescriptor<AlertingConfig> = {
   schema: configSchema,
+  exposeToBrowser: {
+    rules: { run: { alerts: { max: true } } },
+  },
   deprecations: ({ renameFromRoot, deprecate }) => [
     renameFromRoot('xpack.alerts.healthCheck', 'xpack.alerting.healthCheck', { level: 'warning' }),
     renameFromRoot(

x-pack/plugins/alerting/server/plugin.ts

@@ -508,6 +508,7 @@ export class AlertingPlugin {
       getAlertIndicesAlias: createGetAlertIndicesAliasFn(this.ruleTypeRegistry!),
       alertsService: this.alertsService,
       uiSettings: core.uiSettings,
+      maxAlertsPerRun: this.config.rules.run.alerts.max,
     });
 
     rulesSettingsClientFactory.initialize({

x-pack/plugins/alerting/server/rules_client/rules_client.ts

@@ -193,6 +193,10 @@ export class RulesClient {
     return this.context.auditLogger;
   }
 
+  public getMaxAlertsPerRun() {
+    return this.context.maxAlertsPerRun;
+  }
+
   public getTags = (params: RuleTagsParams) => getRuleTags(this.context, params);
 
   public getScheduleFrequency = () => getScheduleFrequency(this.context);

x-pack/plugins/alerting/server/rules_client/types.ts

@@ -32,7 +32,7 @@ import {
   RawRuleAlertsFilter,
 } from '../types';
 import { AlertingAuthorization } from '../authorization';
-import { AlertingRulesConfig } from '../config';
+import { ActionsConfig, AlertingRulesConfig } from '../config';
 import { GetAlertIndicesAlias } from '../lib';
 import { AlertsService } from '../alerts_service';
 
@@ -80,6 +80,7 @@ export interface RulesClientContext {
   readonly getAlertIndicesAlias: GetAlertIndicesAlias;
   readonly alertsService: AlertsService | null;
   readonly uiSettings: UiSettingsServiceStart;
+  readonly maxAlertsPerRun: ActionsConfig['max'];
 }
 
 export type NormalizedAlertAction = Omit<RuleAction, 'actionTypeId'>;

x-pack/plugins/alerting/server/rules_client_factory.ts

@@ -26,7 +26,7 @@ import { SECURITY_EXTENSION_ID } from '@kbn/core-saved-objects-server';
 import { RuleTypeRegistry, SpaceIdToNamespaceFunction } from './types';
 import { RulesClient } from './rules_client';
 import { AlertingAuthorizationClientFactory } from './alerting_authorization_client_factory';
-import { AlertingRulesConfig } from './config';
+import { ActionsConfig, AlertingRulesConfig } from './config';
 import { GetAlertIndicesAlias } from './lib';
 import { AlertsService } from './alerts_service/alerts_service';
 import { RULE_SAVED_OBJECT_TYPE } from './saved_objects';
@@ -50,6 +50,7 @@ export interface RulesClientFactoryOpts {
   getAlertIndicesAlias: GetAlertIndicesAlias;
   alertsService: AlertsService | null;
   uiSettings: CoreStart['uiSettings'];
+  maxAlertsPerRun: ActionsConfig['max'];
 }
 
 export class RulesClientFactory {
@@ -73,6 +74,7 @@ export class RulesClientFactory {
   private getAlertIndicesAlias!: GetAlertIndicesAlias;
   private alertsService!: AlertsService | null;
   private uiSettings!: CoreStart['uiSettings'];
+  private maxAlertsPerRun!: ActionsConfig['max'];
 
   public initialize(options: RulesClientFactoryOpts) {
     if (this.isInitialized) {
@@ -98,6 +100,7 @@ export class RulesClientFactory {
     this.getAlertIndicesAlias = options.getAlertIndicesAlias;
     this.alertsService = options.alertsService;
     this.uiSettings = options.uiSettings;
+    this.maxAlertsPerRun = options.maxAlertsPerRun;
   }
 
   public create(request: KibanaRequest, savedObjects: SavedObjectsServiceStart): RulesClient {
@@ -129,6 +132,7 @@ export class RulesClientFactory {
       getAlertIndicesAlias: this.getAlertIndicesAlias,
       alertsService: this.alertsService,
       uiSettings: this.uiSettings,
+      maxAlertsPerRun: this.maxAlertsPerRun,
 
       async getUserName() {
         if (!securityPluginStart) {

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/description_step/index.tsx

@@ -337,6 +337,9 @@ export const getDescriptionItem = (
     return get('isBuildingBlock', data)
       ? [{ title: i18n.BUILDING_BLOCK_LABEL, description: i18n.BUILDING_BLOCK_DESCRIPTION }]
       : [];
+  } else if (field === 'maxSignals') {
+    const value: number = get(field, data);
+    return [{ title: label, description: value }];
   }
 
   const description: string = get(field, data);

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/max_signals/index.tsx

@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo, useCallback } from 'react';
+import type { EuiFieldNumberProps } from '@elastic/eui';
+import { EuiFormRow, EuiFieldNumber } from '@elastic/eui';
+
+import type { FieldHook } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib';
+import * as i18n from './translations';
+import { useKibana } from '../../../../common/lib/kibana';
+
+interface MaxSignalsFieldProps {
+  dataTestSubj: string;
+  field: FieldHook;
+  idAria: string;
+  isDisabled: boolean;
+  placeholder?: string;
+}
+
+export const MaxSignals: React.FC<MaxSignalsFieldProps> = ({
+  dataTestSubj,
+  field,
+  idAria,
+  isDisabled,
+  placeholder,
+}): JSX.Element => {
+  const { setValue, value } = field;
+  const { alerting } = useKibana().services;
+  const maxAlertsPerRun = alerting.getMaxAlertsPerRun() ?? 1000; // Defaults to 1000 in the alerting framework config
+
+  const [isInvalid, error] = useMemo(() => {
+    if (typeof value === 'number' && !isNaN(value)) {
+      if (value <= 0) {
+        return [true, i18n.GREATER_THAN_ERROR];
+      } else if (value > maxAlertsPerRun) {
+        return [true, i18n.LESS_THAN_ERROR(maxAlertsPerRun)];
+      }
+    }
+    return [false];
+  }, [maxAlertsPerRun, value]);
+
+  const handleMaxSignalsChange: EuiFieldNumberProps['onChange'] = useCallback(
+    (e) => {
+      const maxSignalsValue = (e.target as HTMLInputElement).value;
+      // Has to handle an empty string as the field is optional
+      setValue(maxSignalsValue !== '' ? Number(maxSignalsValue.trim()) : '');
+    },
+    [setValue]
+  );
+
+  return (
+    <EuiFormRow
+      data-test-subj={dataTestSubj}
+      describedByIds={idAria ? [idAria] : undefined}
+      fullWidth
+      helpText={field.helpText}
+      label={field.label}
+      labelAppend={field.labelAppend}
+      isInvalid={isInvalid}
+      error={error}
+    >
+      <EuiFieldNumber
+        isInvalid={isInvalid}
+        value={value as EuiFieldNumberProps['value']}
+        onChange={handleMaxSignalsChange}
+        isLoading={field.isValidating}
+        fullWidth
+        data-test-subj="input"
+        placeholder={placeholder}
+        disabled={isDisabled}
+      />
+    </EuiFormRow>
+  );
+};
+
+MaxSignals.displayName = 'MaxSignals';

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/max_signals/translations.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const GREATER_THAN_ERROR = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.stepAboutRule.maxSignalsFieldGreaterThanError',
+  {
+    defaultMessage: 'Max signals must be greater than 0.',
+  }
+);
+
+export const LESS_THAN_ERROR = (maxNumber: number) =>
+  i18n.translate(
+    'xpack.securitySolution.detectionEngine.createRule.stepAboutRule.maxSignalsFieldLessThanError',
+    {
+      values: { maxNumber },
+      defaultMessage: 'Max signals must be less than {maxNumber}.',
+    }
+  );

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/default_value.ts

@@ -33,4 +33,5 @@ export const stepAboutDefaultValue: AboutStepRule = {
   timestampOverride: '',
   threat: threatDefault,
   note: '',
+  maxSignals: 100,
 };

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.test.tsx

@@ -281,6 +281,7 @@ describe('StepAboutRuleComponent', () => {
         },
       ],
       investigationFields: [],
+      maxSignals: 100,
     };
 
     await act(async () => {
@@ -341,6 +342,7 @@ describe('StepAboutRuleComponent', () => {
         },
       ],
       investigationFields: [],
+      maxSignals: 100,
     };
 
     await act(async () => {

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx

@@ -40,6 +40,7 @@ import { useRuleIndices } from '../../../rule_management/logic/use_rule_indices'
 import { EsqlAutocomplete } from '../esql_autocomplete';
 import { MultiSelectFieldsAutocomplete } from '../multi_select_fields';
 import { useInvestigationFields } from '../../hooks/use_investigation_fields';
+import { MaxSignals } from '../max_signals';
 
 const CommonUseField = getUseField({ component: Field });
 
@@ -315,6 +316,18 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
               />
             </EuiFormRow>
             <EuiSpacer size="l" />
+            <EuiFormRow label={I18n.MAX_SIGNALS} fullWidth>
+              <CommonUseField
+                path="maxSignals"
+                component={MaxSignals}
+                componentProps={{
+                  idAria: 'detectionEngineStepAboutRuleMaxSignals',
+                  'data-test-subj': 'detectionEngineStepAboutRuleMaxSignals',
+                  isDisabled: isLoading,
+                }}
+              />
+            </EuiFormRow>
+            <EuiSpacer size="l" />
             {isThreatMatchRuleValue && (
               <>
                 <CommonUseField

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/schema.tsx

@@ -100,6 +100,17 @@ export const schema: FormSchema<AboutStepRule> = {
     ),
     labelAppend: OptionalFieldLabel,
   },
+  maxSignals: {
+    type: FIELD_TYPES.NUMBER,
+    helpText: i18n.translate(
+      'xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldMaxSignalsHelpText',
+      {
+        defaultMessage:
+          'The maximum number of alerts a rule will create per execution. Defaults to 100.',
+      }
+    ),
+    labelAppend: OptionalFieldLabel,
+  },
   isAssociatedToEndpointList: {
     type: FIELD_TYPES.CHECKBOX,
     label: i18n.translate(

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/translations.ts

@@ -90,3 +90,10 @@ export const ADD_RULE_NOTE_HELP_TEXT = i18n.translate(
     defaultMessage: 'Add rule investigation guide...',
   }
 );
+
+export const MAX_SIGNALS = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.maxSignalsLabel',
+  {
+    defaultMessage: 'Max signals',
+  }
+);