[Rule Tuning] Reduce New Term Rules history_window_start

[Samirbous]

Link to Rule

https://github.com/search?q=repo%3Aelastic%2Fdetection-rules%20(%22now-14d%22%20OR%20%22now-10d%22%20OR%20%22now-15d%22)&type=code

Rule Tuning Type

Performance improvement

Description

Reduce New Term Rules history_window_start to improve New Term rules performance and limit high values only when necessary.

[imays11]

• [Rule Tunings] AWS New Terms History Window Reduction #5479

This should address the AWS rules with slow performance and largest execution window now-14d. There are still rules with now-10d windows but they are not showing any performance issues so I'd like to keep them as is for now, especially because reducing that window could result in higher alert count.