update rule query clarification

[Tibo669]

The example 2 provided in the documentation has a few typos and is using an incorrect parameter.

Also the documentation on the "params" in the action schema could use an example.
https://www.elastic.co/guide/en/security/current/bulk-actions-rules-api.html#actions-object-schema-bulk

It can be difficult to apprehend that you need to define it as a list with a single item that is an array. An example would have made it a lot more clear.
Like for example:

POST api/detection_engine/rules/_bulk_action
"query": "alert.attributes.params.severity: \"critical\"",
"action": "edit",
"edit": [
{
"type": "set_rule_actions",
"value": {
"actions": [
{
"id": "id",
"group": "default",
"params": {
"subAction": "pushToService",
"subActionParams": {
"incident": {
"issueType": "10009",
"priority": "Critical",
"description": "{{#context.alerts}}\n*Host:* {{host.name}} ({{source.ip}}) *OS:* {{host.os.name}} {{host.os.version}}\n*Time:* {{event.start}} - {{event.end}}\n*Reason:* {{signal.reason}}\n\n*------------------ Optional Fields ------------------*\n*Username:* {{winlog.user.name}} - {{user.name}}\n*File name:* {{file.name}}\n*Process Name:* {{process.name}} \n*Parent Process:* {{parent.process.name}}\n*-----------------------------------------------------*\n{{/context.alerts}}\n\n*Count of events:* {{state.signals_count}}\n\n*Link:* TENANTURL{{{context.results_link}}}",
"summary": "{{context.rule.name}} - {{context.rule.severity}}"
},
"comments": [
{
"commentId": "1",
"comment": "*Description:* {{context.rule.description}}\n\n*Rule Severity:* {{context.rule.severity}}\n\n*References:* {{context.rule.references}}\n\n*Possible false positive reason:* {{context.rule.false_positives}}\n\n*MITRE ATT&CK and ID:* {{context.rule.threat}}"
}
]
}
}
},
{
"group": "default",
"id": "id",
"params": {
"message": "# **{{context.rule.name}}**\n\n**Alerts:** {{state.signals_count}}\n\n**Severity:** {{context.rule.severity}}\n\n**Kibana URL:** TENANTURL{{{context.results_link}}}"
}
}
],
"throttle": "rule"
}
}
]

[github-actions]

Documentation previews:

• ✨ HTML diff
• 📙 Elastic Security Guide

[mergify]

This pull request does not have a backport label. Could you fix it @Tibo669? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• v7.x is the label to automatically backport to the 7.x branch.
• v7./d./d is the label to automatically backport to the 7./d branch. /d is the digit

NOTE: backport-skip has been added to this pull request.

[banderror]

Appreciate the fix @Tibo669 🙏 I agree, the docs could have been better. I opened #3019 based on your feedback and we'll work with the docs team on improving it in the next release cycles.

[jmikell821]

Hey @banderror is it safe to close this PR since changes were updated in #3019?

[banderror]

Hey @jmikell821, not sure I understand the question. #3019 is a follow-up issue, it doesn't update the docs.

[jmikell821]

Hey @jmikell821, not sure I understand the question. #3019 is a follow-up issue, it doesn't update the docs.

Oops, sorry @banderror, I misread. If the changes @Tibo669 made look good to you (they look 👍 to me), I can merge this. Thanks!