[Docs][Alerting] updates images in Alerts Management and adds docs for the Run When field

docs/user/alerting/defining-alerts.asciidoc

@@ -52,7 +52,12 @@ To add an action to an alert, you first select the type of action:
 [role="screenshot"]
 image::images/alert-flyout-action-type-selection.png[UI for selecting an action type]
 
-Each action  must specify a <<alerting-concepts-connectors, connector>> instance. If no connectors exist for that action type, click "Add new" to create one.
+When an alert instance is detected as matching a condition it is marked as _Active_, assigned an action group and triggers the actions in that group.
+When the condition is no longer detected for an _Active_ alert instance, it is assigned the _Recovered_ action group, triggering any actions assigned to that group.
+
+**Run When** allows you to assign an action to an _action group_, ensuring you are notified about alert instances in that group by triggering the action in accordance with your **Notify every** setting.
+
+Each action must specify a <<alerting-concepts-connectors, connector>> instance. If no connectors exist for that action type, click "Add new" to create one.
 
 Each action type exposes different properties. For example an email action allows you to set the recipients, the subject, and a message body in markdown format. See <<action-types>> for details on the types of actions provided by {kib} and their properties.