Document comparison of Alert Suppression, Snoozing, Exceptions, Maintenance Windows

docs/detections/alerts-reduce.asciidoc

@@ -0,0 +1,31 @@
+[[reduce-notifications-alerts]]
+== Reduce notifications and alerts
+
+{elastic-sec} offers several features to help reduce the amount of notifications and alerts produced by your detection rules. This table provides a general comparison of these features, with links for more details:
+
+[cols="2"]
+|===
+
+| <<snooze-rule-actions,Rule action snoozing>>
+a| *_Prevents a specific rule's notification actions from running_*. 
+
+Use to avoid unnecessary notifications from a noisy rule. The rule continues to run and generate alerts during the snooze period, but its <<rule-notifications,notification actions>> are suppressed.
+
+| {kibana-ref}/maintenance-windows.html[Maintenance window]
+a| *_Prevents all rules' notification actions from running_*. 
+
+Use to avoid false alarms and unnecessary notifications during planned outages. All rules continue to run and generate alerts during the maintenance window, but their <<rule-notifications,notification actions>> are suppressed.
+
+NOTE: Maintenance windows are a {kib} feature and are configured outside of the {security-app} in *Stack Management*.
+
+| <<alert-suppression,Alert suppression>>
+a| *_Reduces repeated or duplicate alerts created by a custom query rule_*. 
+
+Use to reduce the number of alerts created by a <<create-custom-rule,custom query rule>> that matches multiple source events. Matching events are grouped by their values in a specified field, and only one alert is created for each group.
+
+| <<detections-ui-exceptions,Rule exception>>
+a| *_Prevents a rule from creating alerts under specific conditions_*.
+
+Use to reduce false positive alerts, by preventing trusted processes and network activity from generating unnecessary alerts. You can configure an exception to be used by a single rule or shared among multiple rules, but they typically don't affect _all_ rules.
+
+|===

docs/detections/detections-index.asciidoc

@@ -32,6 +32,8 @@ include::alerts-add-to-cases.asciidoc[leveloffset=+1]
 
 include::alert-suppression.asciidoc[leveloffset=+1]
 
+include::alerts-reduce.asciidoc[]
+
 include::visual-event-analyzer.asciidoc[]
 
 include::query-alert-indices.asciidoc[]