Add documentation for detector rule creation updates

[cwillum]

Description

The detection rule creation UI was updated to be more intuitive for users. This requires update of text and screenshots.

Issues Resolved

Updated documentation based on previous description.

Fixes #4413

Checklist

• By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
  For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[cwillum]

@amsiglan These are updates to detection rule creation. Could you have a look for technical accuracy when you find a chance? Thanks.

[hdhalter]

Looks good!

[natebower]

@cwillum Please see my comments and changes and let me know if you have any questions. Thanks!

[natebower]

Suggested change

The security rules, or threat detection rules, define the conditional logic applied to ingested log data that allows the system to identify an event of interest. Security Analytics uses prepackaged, open source [Sigma rules](https://github.com/SigmaHQ/sigma) as a starting point for describing relevant log events. But with their inherently flexible format and easy portability, Sigma rules provide users of Security Analytics with options for importing and customizing the rules. You can take advantage of these options using either Dashboards or the API.

The security rules, or threat detection rules, define the conditional logic applied to ingested log data that allows the system to identify an event of interest. Security Analytics uses prepackaged, open-source [Sigma rules](https://github.com/SigmaHQ/sigma) as a starting point for describing relevant log events. But with their inherently flexible format and easy portability, Sigma rules provide Security Analytics users with options for importing and customizing the rules. You can take advantage of these options using either OpenSearch Dashboards or the API.