[DE][9.4 & Serverless] Attach Security Detection rule as AI Agent context

[nastasha-solomon]

Summary

Fixes #5364.

Documents the Add to chat feature that lets users attach a Security detection rule to the AI Agent from rule details, rule editing, rule creation, and alert flyouts.

• New section "Create and refine detection rules in Agent Builder" highlights the following:
  • Where Add to chat appears (rule details, rule editing, rule creation, alerts flyout rule summary, alerts table rule flyout).
  • What the agent can help with (detection intent, query logic, MITRE ATT&CK coverage, timing/scheduling, metadata quality, investigation guide suggestions).
  • What the agent can "see" -- only rule-defined fields. Also does not resolve exception lists.
• Added a note after the "Edit a single rule" section to highlight that Add to chat is available from the rule details page and edit rule settings view.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

Cursor + Auto

[github-actions]

Vale Linting Results

Summary: 1 suggestion found

💡 Suggestions (1)

File	Line	Rule	Message
solutions/security/ai/agent-builder/agent-builder.md	31	Elastic.Clone	Use clone only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/ai/agent-builder/agent-builder.md
• solutions/security/detect-and-alert/manage-detection-rules.md
• solutions/security/detect-and-alert/validate-and-test-rules.md

[benironside]

Your work LGTM @nastasha-solomon! I added a section to the Validate and test your detection rules page about how to validate rules using AI. Please lmk what you think!

[nastasha-solomon]

I might need to wait til next week to merge this PR. The PR that made AB the default agent in sec and obs was just merged today. Currently in serverless, users still need to opt-into AB and the TH agent is available to choose:

[leemthompo]

🚗 Drive-by review from me, chiefly nits about referring to AI agents instead of Agent Builder. Changes look good!