[8.13] [DOCS] Add alert creation delay in Stack rules (#178461) (#178517

)

# Backport

This will backport the following commits from `main` to `8.13`:
- [[DOCS] Add alert creation delay in Stack rules
(#178461)](#178461)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Lisa
Cawley","email":"lcawley@elastic.co"},"sourceCommit":{"committedDate":"2024-03-12T14:57:34Z","message":"[DOCS]
Add alert creation delay in Stack rules
(#178461)","sha":"0c6701d4a78e437dd7f31c8dd72ef68d24f50bc3","branchLabelMapping":{"^v8.14.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Feature:Alerting","release_note:skip","Team:ResponseOps","docs","v8.13.0","v8.14.0"],"title":"[DOCS]
Add alert creation delay in Stack
rules","number":178461,"url":"#178461
Add alert creation delay in Stack rules
(#178461)","sha":"0c6701d4a78e437dd7f31c8dd72ef68d24f50bc3"}},"sourceBranch":"main","suggestedTargetBranches":["8.13"],"targetPullRequestStates":[{"branch":"8.13","label":"v8.13.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.14.0","branchLabelMappingKey":"^v8.14.0$","isSourceBranch":true,"state":"MERGED","url":"#178461
Add alert creation delay in Stack rules
(#178461)","sha":"0c6701d4a78e437dd7f31c8dd72ef68d24f50bc3"}}]}]
BACKPORT-->

Co-authored-by: Lisa Cawley <lcawley@elastic.co>

docs/user/alerting/create-and-manage-rules.asciidoc

@@ -55,7 +55,7 @@ Each rule type provides its own way of defining the conditions to detect, but an
 For example, in an {es} query rule, you specify an index, a query, and a threshold, which uses a metric aggregation operation (`count`, `average`, `max`, `min`, or `sum`):
 
 [role="screenshot"]
-image::images/es-query-rule-conditions.png[UI for defining rule conditions in an {es} query rule,500]
+image::images/rule-types-es-query-conditions.png[UI for defining rule conditions in an {es} query rule,500]
 // NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
 All rules must have a check interval, which defines how often to evaluate the rule conditions. Checks are queued; they run as close to the defined value as capacity allows.

docs/user/alerting/rule-types/es-query.asciidoc

@@ -81,7 +81,10 @@ This option is not available when you use a grouping field.
 Generally this value should be set to a value that is smaller than the time window, to avoid gaps in 
 detection.
 
-7. Select a scope value, which affects the <<kibana-feature-privileges,{kib} feature privileges>> that are required to access the rule.
+7. In the advanced options, you can change the number of consecutive runs that must meet the rule conditions before an alert occurs.
+  The default value is `1`.
+
+8. Select a scope value, which affects the <<kibana-feature-privileges,{kib} feature privileges>> that are required to access the rule.
 For example when it's set to `Stack Rules`, you must have the appropriate *Management > {stack-rules-feature}* feature privileges to view or edit the rule.
 
 [float]

docs/user/alerting/rule-types/geo-rule-types.asciidoc

@@ -29,7 +29,10 @@ image::user/alerting/images/alert-types-tracking-containment-conditions.png[Crea
   Boundaries data is expected to be static (not updating).
   Boundaries are collected once when the rule is created and anytime after when boundary configuration is modified.
 
-. Set the check interval, which defines how often to evaluate the rule conditions. 
+. Set the check interval, which defines how often to evaluate the rule conditions.
+
+. In the advanced options, you can change the number of consecutive runs that must meet the rule conditions before an alert occurs.
+  The default value is `1`.
 
 Entity locations are queried to determine whether they are contained within any monitored boundaries.
 Entity data should be somewhat "real time", meaning the dates of new documents aren't older than the current time minus the amount of the interval.

docs/user/alerting/rule-types/index-threshold.asciidoc

@@ -44,6 +44,9 @@ It determines how far back to search for documents and uses the time field set i
 7. Set the check interval, which defines how often to evaluate the rule conditions. 
 Generally this value should be set to a value that is smaller than the time window, to avoid gaps in detection.
 
+8. In the advanced options, you can change the number of consecutive runs that must meet the rule conditions before an alert occurs.
+The default value is `1`.
+
 If data is available and all clauses have been defined, a preview chart will render the threshold value and display a line chart showing the value for the last 30 intervals.
 This can provide an indication of recent values and their proximity to the threshold, and help you tune the clauses.