[Request] Documentation for Manual Run of Security rules about security-docs

[nkhristinin]

Known issue for Threshold rule:
If manual rule run cover the date range, which was already covered by scheduled rule executions it can produce duplicate errors.

Use case:

Let's say I have 4 events: 13:00, 14:00, 15:00, 16:00
Threshold rule - with 5 minute interval and 10 hours lookback time and threshold = 2
Normal rule execution - give me 2 alerts (14:00, 16:00)
If I run manual rule run from 12:00-16:10
I will have 2 alerts generated at 14:00 and 16:00.
Probably user should expect 0 alerts from manual rule run, as it was already covered by scheduled rule execution

[nkhristinin]

Known issue 2:
Suppression count for custom query rule can be updated wrong
https://github.com/elastic/security-team/issues/9870

[nastasha-solomon]

General notes from today's feature sync:

• @nastasha-solomon will aim to have docs done in time for the Monday, July 29, 2024 Serverless release.
• @nkhristinin will check if it's possible to only enable the feature flag for this feature in ESS.
• @nkhristinin or @e40pud to provide a test env for docs testing and screenshots either this week, or after Nastasha is back from PTO (which is the week of July 15)

[nkhristinin]

We should mention Manual rule limitations - to users in docs

[e40pud]

API docs impact

We need to update next sections:

1. Bulk action > Request body: add run as a new possible action's value
2. Bulk action > Request body: add new property

Name	Type	Description	Required
run	BulkManualRuleRun[]	Object that describes applying an manual rule run action.	No. Yes, if action is run.

3. We should add new type description similar to BulkDuplicateAction object and BulkEditAction object:

BulkManualRuleRun

• start_date field: (String, Required). Defines start date of the manual rule run.
• end_date field: (String, Optional). Defines end date of the manual rule run.

4. Response payload: add run to the actions list. Also, we should mention that we use attributes.results.updated to return rule objects that were scheduled for manual rule run during the run action execution.