When the alerting RBAC pr is merged (https://github.com/elastic/kibana/pull/67157), we can consider modifying the permission for the alerting plugin in SIEM from 'all' to 'read' https://github.com/elastic/kibana/pull/67157/files#r438039912