diff --git a/docs/serverless/rules/rules-ui-create.mdx b/docs/serverless/rules/rules-ui-create.mdx
index 941c52c1cb..bb3d8e84f1 100644
--- a/docs/serverless/rules/rules-ui-create.mdx
+++ b/docs/serverless/rules/rules-ui-create.mdx
@@ -52,7 +52,7 @@ To create or edit ((ml)) rules, you need an appropriate user role. Additionally,
 1. <DocBadge template="technical preview" /> (Optional) Use **Suppress alerts by** to reduce the number of repeated or duplicate alerts created by the rule. Refer to <DocLink slug="/serverless/security/alert-suppression">Suppress detection alerts</DocLink> for more information.
 
     <DocCallOut title="Note">
-    Because ((ml)) rules generate alerts from anomalies, alert documents don't contain source event fields and you can only use anomaly fields when configuring alert suppression.
+    Because ((ml)) rules generate alerts from anomalies, which don't contain source event fields, you can only use anomaly fields when configuring alert suppression.
     </DocCallOut>
 
     {/* The following steps are repeated across multiple rule types. If you change anything