Elastic Security known issues
Duplicate alerts can be produced from manually running threshold rules
Details
On November 12, 2024, it was discovered that manually running threshold rules could produce duplicate alerts if the date range was already covered by a scheduled rule execution.