# Increasing number of Alerts for Detection Rules

**URL:** <https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064>\
**Category:** Elasticsearch\
**Tags:** detection-rules\
**Created:** [April 9, 2024, 12:12pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064 "2024-04-09T12:12:19Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![uhxqc](https://avatars.discourse-cdn.com/v4/letter/u/a6a055/32.png) [@uhxqc](https://discuss.elastic.co/u/uhxqc)\
**Post date:** [April 9, 2024, 12:12pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/1 "2024-04-09T12:12:19Z")

</div>

Hello, I am currently using the open source version of Elastic.  
I have created a couple of Detection Rules. But the number of alerts I can create per rule is limited to 100.  
If my understanding is correct, the number of alerts are limited by the field "max\_signals" (which defaults at 100) , but I am unsure on how I can change this value in my custom querry rule that I have created in Kibana.  
Any information will be helpful, thank you!

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [April 9, 2024, 4:05pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/2 "2024-04-09T16:05:11Z")

</div>

Welcome, @uhxqc. Thanks for reaching out here. Do you have a code sample of the rule you are creating?

You can modify the field "max\_signals" by using the [create rule API](https://www.elastic.co/guide/en/security/current/rules-api-create.html). You may also want to confirm that you do not set the `max_signals` value higher than the value of [`xpack.alerting.rules.run.alerts.max`](https://www.elastic.co/guide/en/kibana/8.13/alert-action-settings-kb.html#alert-settings).

---

<div class="post-metadata">

**Author:** ![uhxqc](https://avatars.discourse-cdn.com/v4/letter/u/a6a055/32.png) [@uhxqc](https://discuss.elastic.co/u/uhxqc)\
**Post date:** [April 9, 2024, 7:59pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/3 "2024-04-09T19:59:05Z")

</div>

Hello @jessgarson  
I am not using a code sample. I am directly creating the rule on the Kibana UI using 'Security \> Rules \> Detection Rules \> Create rule'.

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [April 9, 2024, 9:01pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/4 "2024-04-09T21:01:29Z")

</div>

Thanks! I have a few follow up questions:

- Do you have a screen shot of what you are entering in here?
- Are you getting an errors or are you simply not seeing the option for `max\_signals"?
- What version are you using?

---

<div class="post-metadata">

**Author:** ![uhxqc](https://avatars.discourse-cdn.com/v4/letter/u/a6a055/32.png) [@uhxqc](https://discuss.elastic.co/u/uhxqc)\
**Post date:** [April 11, 2024, 2:07pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/5 "2024-04-11T14:07:32Z")

</div>

@jessgarson  
I haven't come across 'Max\_Signals' option anywhere in the GUI.  
I am currently using the version 8.11

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [April 11, 2024, 4:31pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/6 "2024-04-11T16:31:52Z")

</div>

Thanks for following up here. I'm going to contact a few coworkers and do some further research on the subject. I'll get back in touch when I hear more.

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [April 11, 2024, 8:41pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/7 "2024-04-11T20:41:54Z")

</div>

Hi @uhxqc,

Have you tried updating using Dev Tools for updating the rule? I think something like this could work:

```auto
PUT /api/detection_engine/rules
{
  "id": "rule-id-here",
  "name": "Updated Detection Rule",
  "description": "Updated description here",
  "risk_score": 50,
  "severity": "high",
  "type": "query",
  "query": "user.name: admin",
  "language": "kuery",
  "index": ["auditbeat-*"],
  "interval": "10m",
  "max_signals": 150,
  "enabled": true,
  "tags": ["updated-tag"]
}
```

---

<div class="post-metadata">

**Author:** ![uhxqc](https://avatars.discourse-cdn.com/v4/letter/u/a6a055/32.png) [@uhxqc](https://discuss.elastic.co/u/uhxqc)\
**Post date:** [April 24, 2024, 3:43pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/8 "2024-04-24T15:43:09Z")

</div>

> [@jessgarson](#):
>
> `"id": "rule-id-here",`

Hello, I've been trying to run this on the Dev Console but I do not know my rule ID.  
Since I have created my rule through the Kibana GUI, I did not initially have to enter any rule ID, is there any query I could use to fetch the rule ID?

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [April 24, 2024, 6:42pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/9 "2024-04-24T18:42:56Z")

</div>

Thanks, @uhxqc! Could [this endpoint work](https://www.elastic.co/guide/en/security/current/rules-api-find.html)?

---

<div class="post-metadata">

**Author:** ![uhxqc](https://avatars.discourse-cdn.com/v4/letter/u/a6a055/32.png) [@uhxqc](https://discuss.elastic.co/u/uhxqc)\
**Post date:** [May 6, 2024, 11:25am UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/11 "2024-05-06T11:25:27Z")

</div>

Hello @jessgarson, The endpoint worked. I was able to find the Rule ID and update the max-signals field as well using Dev Tools 'Put /api/detection\_engine/rules' command.  
The rule is updated and says that it was run again.  
But, the number of alerts created for said rule still seems to be limited to 100 alerts. Is there something I might be missing here?

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [May 6, 2024, 7:35pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/12 "2024-05-06T19:35:18Z")

</div>

Thanks for following up! I reached out to a few others internally and want to test a few things. I'll be back in touch shortly.

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [May 7, 2024, 4:06pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/13 "2024-05-07T16:06:06Z")

</div>

Thanks for following @uhxqc, there is currently an [open bug report](https://github.com/elastic/kibana/issues/164234) for the UI but this should work in the API, do you happen to have the request you used?

---

<div class="post-metadata">

**Author:** ![uhxqc](https://avatars.discourse-cdn.com/v4/letter/u/a6a055/32.png) [@uhxqc](https://discuss.elastic.co/u/uhxqc)\
**Post date:** [June 3, 2024, 1:22pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/14 "2024-06-03T13:22:31Z")

</div>

Hello @jessgarson ,

So far, I've been using Kibana UI to create Detection rules, would using Dev Tools API to create rules help solve this issue?  
Would you have any examples that I could use to create rules using APIs?

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [June 4, 2024, 11:34pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/15 "2024-06-04T23:34:09Z")

</div>

Thanks @uhxqc, this should work. You may want to try something like this:

```auto
PUT /api/detection_engine/rules/_bulk_update
{
  "rules": [
    {
      "id": "<your_rule_id>",
      "max_signals": 10000 
    }
  ]
}

```

You will want to update this to have your disired number for `max_signals` and the rule ID you are you looking to update.

---

<div class="post-metadata">

**Author:** ![uhxqc](https://avatars.discourse-cdn.com/v4/letter/u/a6a055/32.png) [@uhxqc](https://discuss.elastic.co/u/uhxqc)\
**Post date:** [June 10, 2024, 12:40pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/16 "2024-06-10T12:40:23Z")

</div>

Thanks @jessgarson I tried the above command as well, it does not work. Gives an error message saying 'Bad Request' and  
message : request body : Invalid value "{"rules"...

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [June 10, 2024, 9:32pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/17 "2024-06-10T21:32:38Z")

</div>

Thanks for letting me know, have you tried something like this as well:

```auto
PUT /api/detection_engine/rules
{
  "id": "<your_rule_id>",
  "max_signals": <updated_number>
}
```

---

<div class="post-metadata">

**Author:** ![uhxqc](https://avatars.discourse-cdn.com/v4/letter/u/a6a055/32.png) [@uhxqc](https://discuss.elastic.co/u/uhxqc)\
**Post date:** [June 10, 2024, 10:08pm UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/18 "2024-06-10T22:08:44Z")

</div>

@jessgarson This worked, the max\_signals field has been updated. But when I try to run the rule, the number of alerts generated still is exactly 100 and has not increased.

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [June 12, 2024, 1:14am UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/19 "2024-06-12T01:14:38Z")

</div>

Thanks for all the follow up, @uhxqc, you may want to report this as a [bug](https://github.com/elastic/kibana/issues/new?assignees=&labels=bug&projects=&template=Bug_report.md).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2024, 1:14am UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064/20 "2024-07-10T01:14:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.