[FR] Add max_signal note, unit test, and rule tuning (#3669)

rules/integrations/cloud_defend/container_workload_protection.toml

@@ -4,7 +4,7 @@ integration = ["cloud_defend"]
 maturity = "production"
 min_stack_comments = "Initial version of the Container Workload Protection alerts"
 min_stack_version = "8.8.0"
-updated_date = "2023/06/22"
+updated_date = "2024/05/13"
 
 [rule]
 author = ["Elastic"]
@@ -22,6 +22,15 @@ name = "Container Workload Protection"
 risk_score = 47
 rule_id = "4b4e9c99-27ea-4621-95c8-82341bc6e512"
 rule_name_override = "message"
+setup = """## Setup
+
+This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
+
+**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.
+
+To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.
+
+**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects."""
 severity = "medium"
 tags = ["Data Source: Elastic Defend for Containers", "Domain: Container"]
 timestamp_override = "event.ingested"