diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_event_count.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_event_count.ts
index 347b8fa4c5d639..6758c3b7f7d710 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_event_count.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_event_count.ts
@@ -11,7 +11,7 @@ import { getQueryFilter } from '../../../../../common/detection_engine/get_query
 import { singleSearchAfter } from '../single_search_after';
 import { buildEventsSearchQuery } from '../build_events_query';
 
-export const MAX_PER_PAGE = 9000;
+export const MAX_PER_PAGE = 3000;
 
 export const getEventList = async ({
   services,
@@ -47,7 +47,7 @@ export const getEventList = async ({
     services,
     ruleExecutionLogger,
     filter,
-    pageSize: Math.ceil(Math.min(tuple.maxSignals, calculatedPerPage)),
+    pageSize: calculatedPerPage,
     primaryTimestamp,
     secondaryTimestamp,
     sortOrder: 'desc',