[Internal][Security Solution][Detection Engine]: auto inject metadata _id in rule ES|QL query

[nastasha-solomon]

Summary

Fixes #5462 by documenting automatic METADATA _id handling for non-aggregating ES|QL detection rules.

Previews

• Alert deduplication and _id metadata: Added that in 9.4+, users don’t need METADATA _id in the editor for deduplication, the saved query stays as typed (including pastes from Discover or AI tools), and that missing _id in results surfaces a non-blocking editor warning with Save with errors and possible duplicate alerts until the query is fixed.
• Non-aggregating example - Updated so the sample rule query omits METADATA _id in FROM
• Troubleshoot detection rules | ESQL rules - Updated table description to describe the auto-injection of METADATA _id.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

Cursor + Composer

[github-actions]

🔍 Preview links for changed docs

• solutions/security/detect-and-alert/custom-query.md
• solutions/security/detect-and-alert/eql.md
• solutions/security/detect-and-alert/esql.md
• solutions/security/detect-and-alert/threshold.md
• troubleshoot/security/detection-rules.md

[github-actions]

Vale Linting Results

Summary: 1 warning, 5 suggestions found

⚠️ Warnings (1)

File	Line	Rule	Message
solutions/security/detect-and-alert/esql.md	38	Elastic.DontUse	Don't use '...'.

💡 Suggestions (5)

File	Line	Rule	Message
solutions/security/detect-and-alert/esql.md	38	Elastic.Ellipses	In general, don't use an ellipsis.
solutions/security/detect-and-alert/esql.md	159	Elastic.Semicolons	Use semicolons judiciously.
solutions/security/detect-and-alert/esql.md	185	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/esql.md	185	Elastic.Semicolons	Use semicolons judiciously.
troubleshoot/security/detection-rules.md	166	Elastic.Repetition	"to" is repeated.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[mdbirnstiehl]

LGTM!