[Suggestion] Add example of excluding cold/frozen data from Indicator Match rule queries#5895

nastasha-solomon wants to merge 3 commits intomainelastic/security-docs:mainfrom

issue-47-im-rule-doc-improvementselastic/security-docs:issue-47-im-rule-doc-improvementsCopy head branch name to clipboard