[DOCS] Alert suppression on query type rules

[joepeeples]

Description

Alert suppression allows users to reduce the number of duplicate or repeated alerts written to the alerts index. The implementation is very similar in concept to threshold rules. We allow users to pick one or more fields to group source documents by and use a composite aggregation to collect documents bucketed by those fields. We create 1 alert for each bucket based on the first document in the bucket and add metadata to the alert that represents how to retrieve the rest of the documents in the bucket.

Related:

• https://github.com/elastic/security-team/issues/3405
• [Security Solution][Alerts] Alert suppression per rule execution kibana#142686
• Alert Suppression Demo.mov recording (internal, Google Drive)

Docs to update

• Create a detection rule | Create a custom query rule
• Manage detection alerts (??)
• View detection alert details | Insights on alerts
• Tune detection rules

Notes

• Alert suppression is licensed as a Platinum-level feature. Refer to kibana#142686 for additional nuances on licensing, what happens if user isn't licensed, changes licensing, etc.
• "Alert suppression" is the preferred nomenclature; the feature was previously called "alert throttling" but we pivoted away from that.
• Investigate in Timeline button in Alerts table now opens the events for the suppressed alerts in Timeline (confirm if this also works with other ways of pivoting from an alert to Timeline, such as "Take action" menu in alert details flyout)
• Confirm how this interacts with bulk action for sending multiple alerts to Timeline
• Alert details flyout also includes a section under "Insights" for suppressed alerts (Tech Preview label). Confirm if this always displays for all alerts now, or only once suppression has been enabled. Also check for any screenshots of alert details flyout that might need updating (recently updated in [DOCS] MITRE ATT&CK being added to alert details flyout and alert reason re-named #2686)

Screenshots

(from elastic/kibana#142686)

NOT an exhaustive list, look for other areas that might need capturing

• Rule Create/Edit With License
  

• Rule Details With License
  

• Alerts table