From 9d48e8b639856779c36ff17c5fd470d49bca7f35 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Thu, 18 Jul 2024 17:40:07 -0400 Subject: [PATCH] Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Ryland Herrick --- docs/detections/rules-ui-create.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/detections/rules-ui-create.asciidoc b/docs/detections/rules-ui-create.asciidoc index 7ae83b9162..24aef2f7a6 100644 --- a/docs/detections/rules-ui-create.asciidoc +++ b/docs/detections/rules-ui-create.asciidoc @@ -48,7 +48,7 @@ NOTE: If a required job isn't currently running, it will automatically start whe + . preview:[] (Optional, https://www.elastic.co/pricing[Platinum or higher subscription] required) Use *Suppress alerts by* to reduce the number of repeated or duplicate alerts created by the rule. Refer to <> for more information. + -NOTE: Because {ml} rules generate alerts from anomalies, alert documents don't contain source event fields and you can only use anomaly fields when configuring alert suppression. +NOTE: Because {ml} rules generate alerts from anomalies, which don't contain source event fields, you can only use anomaly fields when configuring alert suppression. + ////