Parent issue: https://github.com/elastic/security-team/issues/10106

Detection rules typically fetch 100 source documents at a time to transform into alerts. When these source documents are large, this puts significant memory pressure on both Elasticsearch and Kibana. If the documents are large enough, Elasticsearch and/or Kibana can run out of memory and crash. We should investigate ways that we can limit the total amount of data retrieved at one time to avoid OOM problems.