[system/{cpu,memory}] Add alert rule templates

[mykola-elastic]

Proposed commit message

See title.

This PR adds alerting rule template for the identified key alerting metrics for CPU and memory datastreams:

• "[System] CPU Utilization".
• "[System] Memory Utilization".

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

ES|QL queries

CPU

// Alert when the average CPU usage exceeds a threshold.
// Groups by host.
// Adjust utilization threshold in the final WHERE clause as needed.
FROM metrics-system.cpu-*
| KEEP host.name, system.cpu.total.norm.pct
| STATS avg_cpu_util = AVG(system.cpu.total.norm.pct) BY host.name
| WHERE avg_cpu_util >= 0.85

Memory

// Alert when the average memory usage exceeds a threshold.
// Groups by host.
// Adjust utilization threshold in the final WHERE clause as needed.
FROM metrics-system.memory-*
| KEEP host.name, system.memory.actual.used.pct
| STATS avg_memory_util = AVG(system.memory.actual.used.pct) BY host.name
| WHERE avg_memory_util >= 0.9

[mykola-elastic]

Checked that the ES|QL query works:

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: bab617f

History

• 💚 Build #36366 succeeded 1636cea

cc @mykola-elastic