diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/edit_form.test.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/edit_form.test.tsx
index 7170086e16867..e851f97f21648 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/edit_form.test.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/edit_form.test.tsx
@@ -79,6 +79,8 @@ const renderComponent = async () => {
 const getBooleanValueMock = jest.fn();
 
 describe('EditForm', () => {
+  const mockTriggersActionsUi = triggersActionsUiMock.createStart();
+
   beforeEach(() => {
     jest.clearAllMocks();
 
@@ -92,9 +94,7 @@ describe('EditForm', () => {
         lens: {
           EmbeddableComponent: () => <div data-test-subj="mockEmbeddableComponent" />,
         },
-        triggersActionsUi: {
-          ...triggersActionsUiMock.createStart(),
-        },
+        triggersActionsUi: mockTriggersActionsUi,
         uiSettings: {
           get: jest.fn(),
         },
@@ -178,4 +178,20 @@ describe('EditForm', () => {
 
     expect(onChangeMock).toHaveBeenCalled();
   });
+
+  it('should override default action frequency to `for each alert` instead of `summary of alerts`', async () => {
+    mockTriggersActionsUi.getActionForm = jest.fn();
+
+    await renderComponent();
+
+    expect(mockTriggersActionsUi.getActionForm).toHaveBeenCalledWith(
+      expect.objectContaining({
+        defaultRuleFrequency: {
+          notifyWhen: 'onActiveAlert',
+          summary: false,
+          throttle: null,
+        },
+      })
+    );
+  });
 });
diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/edit_form.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/edit_form.tsx
index ccfbcbd5a4505..f152d0948f5cc 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/edit_form.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/edit_form.tsx
@@ -8,6 +8,7 @@
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 
+import { RuleNotifyWhen } from '@kbn/alerting-plugin/common';
 import { ATTACK_DISCOVERY_SCHEDULES_ALERT_TYPE_ID } from '@kbn/elastic-assistant-common';
 import { getSchema } from './schema';
 import type { AttackDiscoveryScheduleSchema } from './types';
@@ -140,6 +141,11 @@ export const EditForm: React.FC<FormProps> = React.memo((props) => {
             componentProps={{
               ruleTypeId: ATTACK_DISCOVERY_SCHEDULES_ALERT_TYPE_ID,
               messageVariables,
+              defaultRuleFrequency: {
+                notifyWhen: RuleNotifyWhen.ACTIVE,
+                throttle: null,
+                summary: false,
+              },
             }}
           />
         </EuiFlexItem>
diff --git a/x-pack/solutions/security/plugins/security_solution/public/common/components/rule_actions_field/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/common/components/rule_actions_field/index.tsx
index e9d1c452e4e8a..528486db7d0a9 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/common/components/rule_actions_field/index.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/common/components/rule_actions_field/index.tsx
@@ -20,6 +20,7 @@ import type {
 import type {
   RuleAction,
   RuleActionAlertsFilterProperty,
+  RuleActionFrequency,
   RuleActionParam,
 } from '@kbn/alerting-plugin/common';
 import { SecurityConnectorFeatureId } from '@kbn/actions-plugin/common';
@@ -83,6 +84,7 @@ interface Props {
   field: FieldHook;
   messageVariables: ActionVariables;
   summaryMessageVariables: ActionVariables;
+  defaultRuleFrequency?: RuleActionFrequency;
 }
 
 const DEFAULT_ACTION_GROUP_ID = 'default';
@@ -119,6 +121,7 @@ export const RuleActionsField: React.FC<Props> = ({
   field,
   messageVariables,
   summaryMessageVariables,
+  defaultRuleFrequency = NOTIFICATION_DEFAULT_FREQUENCY,
 }) => {
   const [fieldErrors, setFieldErrors] = useState<string | null>(null);
   const form = useFormContext();
@@ -224,14 +227,14 @@ export const RuleActionsField: React.FC<Props> = ({
         updatedActions[index] = {
           ...updatedActions[index],
           frequency: {
-            ...(updatedActions[index].frequency ?? NOTIFICATION_DEFAULT_FREQUENCY),
+            ...(updatedActions[index].frequency ?? defaultRuleFrequency),
             [key]: value,
           },
         };
         return updatedActions;
       });
     },
-    [field]
+    [defaultRuleFrequency, field]
   );
 
   const isFormValidated = isValid !== undefined;
@@ -255,7 +258,7 @@ export const RuleActionsField: React.FC<Props> = ({
         hideActionHeader: true,
         hasAlertsMappings: true,
         notifyWhenSelectOptions: NOTIFY_WHEN_OPTIONS,
-        defaultRuleFrequency: NOTIFICATION_DEFAULT_FREQUENCY,
+        defaultRuleFrequency,
         disableErrorMessages: !isFormValidated,
       }),
     [
@@ -269,6 +272,7 @@ export const RuleActionsField: React.FC<Props> = ({
       setActionFrequency,
       setActionAlertsFilterProperty,
       ruleTypeId,
+      defaultRuleFrequency,
       isFormValidated,
     ]
   );