Add support for Exceptions in Threshold rules

[Bananenbrei]

Describe the feature:
Threshold rules currently do not seem to support Exceptions

Describe a specific use case for the feature:
I want to alert after a total of 10/20/50 unique ports have been queried but not if the IP Address belongs to a vulnerability scanner.

I want to alert after a total of 5 failed logon events happened but not for some specific users

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[pmuellr]

@lukeelmers - do we know which threshold alert this is for? Log threshold perhaps? I'd like to direct this issue to the owner of the alert. Alerting services currently only maintains the index threshold alert, but I'm assuming this is a solution-specific alert - security or o11y

woops - I thought Luke had created this issue, so directed the question at him, re-posted the question back to the creator.

[pmuellr]

@Bananenbrei - which alert was this for? We now have many alerts available, I'm guessing this was the log threshold alert, or perhaps as part of the security solution.

[Bananenbrei]

@pmuellr - this was in regards to the newly added Threshold rules in the Security Application (Security -> Detection). Exceptions (lists) are supported for the custom query rules but not for the threshold ones.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[SHolzhauer]

This would be a great addition.
The ability to except events from a total based on field=value.

[misc-heading]

This is indeed something that is missing in the current version.

[peluja1012]

This PR adds exceptions support to Threshold rules #85103.