diff --git a/docs/detections/rules-ui-manage.asciidoc b/docs/detections/rules-ui-manage.asciidoc index ae6bc223c4..a6d671aac1 100644 --- a/docs/detections/rules-ui-manage.asciidoc +++ b/docs/detections/rules-ui-manage.asciidoc @@ -105,13 +105,13 @@ TIP: You can hide the *integrations* badge in the Rules tables. Go to *{kib}* -> [[edit-rules-settings]] === Modify existing rules settings -You can edit an existing rule's settings, and can bulk edit index patterns, tags, and Timeline templates for multiple rules at once. +You can edit an existing rule's settings, and can bulk edit settings for multiple rules at once. [NOTE] ==== For prebuilt Elastic rules, you can't modify most settings. You can only edit <> and <>. -If you try to bulk edit with both prebuilt and custom rules selected, the action will affect only custom rules. +If you try to bulk edit with both prebuilt and custom rules selected, the action will affect only the rules that can be modified. ==== . Go to *Manage* -> *Rules*. @@ -120,6 +120,11 @@ If you try to bulk edit with both prebuilt and custom rules selected, the action * Bulk edit multiple rules: Select the rules you want to edit, then select an action from the *Bulk actions* menu: ** *Index patterns*: Add or delete the index patterns used by all selected rules. ** *Tags*: Add or delete tags on all selected rules. +** *Add rule actions*: Add <> on all selected rules. ++ +NOTE: The action frequency you select applies to all actions (both new and existing) on all selected rules. If you don't want to change the frequency of existing actions, update the rules separately. + +** *Update rule schedules*: Update the <> and look-back times on all selected rules. ** *Apply Timeline template*: Apply a specified <> to the selected rules. You can also choose *None* to remove Timeline templates from the selected rules. . On the flyout that opens, update the settings. . If available, select *Overwrite all selected _x_* to overwrite the settings on the rules. For example, if you're adding tags to multiple rules, selecting *Overwrite all selected rules tags* removes all the rules' original tags and replaces them with the tags you specify.