[DOCS] EQL updates (#1391) (#1394)

* Two slight changes to EQL stuff.

* Small edit.

(cherry picked from commit 709b0d5)

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

Author: mergify[bot]

docs/detections/detections-ui-exceptions.asciidoc

@@ -84,9 +84,9 @@ exception's criteria.
 
 [IMPORTANT]
 ==============
-Be careful when adding exceptions to event correlation rules. Exceptions are
-evaluated against every event in the sequence, and when the exception matches any
-event(s) in the sequence, alerts are not generated. To exclude values from a
+Be careful when adding exceptions to event correlation rules. Exceptions are evaluated against every event in the sequence, and when the exception matches _all_ event(s) in the sequence, alerts _are not_ generated. If the exception only matches _some_ of the events in the sequence, alerts _are_ generated. 
+
+To exclude values from a
 specific event in the sequence, update the rule's EQL statement. For example:
 
 [source,eql]

docs/detections/rules-ui-create.asciidoc

@@ -101,7 +101,7 @@ image::images/create-new-rule.png[]
 [IMPORTANT]
 ==============
 To create or edit {ml} rules, you must have the https://www.elastic.co/subscriptions[appropriate license] or use a
-{ess-trial}[cloud deployment]. Additionally, you must have the {ref}/built-in-roles.html[`machine_learning_admin`] user 
+{ess-trial}[cloud deployment]. Additionally, you must have the {ref}/built-in-roles.html[`machine_learning_admin`] user
 role, and the selected {ml} job must be running for the rule to function correctly.
 ==============
 
@@ -190,7 +190,7 @@ network connection:
 +
 ** *Index patterns*: `winlogbeat-*`
 +
-> Winlogbeat ships Windows events to {es-sec}.
+> Winlogbeat ships Windows events to {elastic-sec}.
 
 ** *EQL query*:
 +
@@ -305,7 +305,7 @@ values:
 [role="screenshot"]
 image::images/severity-mapping-ui.png[]
 +
-NOTE: For threshold rules, not all source event values can be used for overrides; only the fields that were aggregated over (the `Group by` fields) will contain data.
+NOTE: For threshold rules, not all source event values can be used for overrides; only the fields that were aggregated over (the `Group by` fields) will contain data. Please also note that overrides are not supported for event correlation rules.
 .. *Default risk score*: A numerical value between 0 and 100 that correlates
 with the *Severity* level. General guidelines are:
 * `0` - `21` represents low severity.