Add Exceptions action steps page for Workflows

[nastasha-solomon]

Summary

Documents the two exception action steps that are GA in 9.6 and serverless:

• security.createRuleException adds an item to a detection rule's own default exception list, creating that list if the rule doesn't have one. Affects only that rule.
• security.createExceptionListItem adds an item to an existing exception list identified by list_id. Affects every rule linked to that list.

Both live on a new family page, explore-analyze/workflows/steps/exceptions.md, mirroring the layout of the existing steps/detection-rules.md. The issues asked for an inline "Exceptions" group on steps/security.md, but that page is now a hub that links out to family pages, so a new family page matches the current IA. security.md gets an Exceptions section pointing to it.

The page covers the shared conventions both steps use: the flat verb-based entry operators, the value-list mixing restriction, entries as a logical AND, the lack of nested-condition support, expire_time, and idempotency via item_id / overwrite.

Closes #7819
Closes #7820

Files

File	Change
explore-analyze/workflows/steps/exceptions.md	New family page covering both steps
explore-analyze/workflows/steps/security.md	Exceptions section + Related link
explore-analyze/workflows/steps/action-steps.md	Bullet on the Security category list
explore-analyze/workflows/reference/step-types.md	Two rows in the A–Z index
explore-analyze/toc.yml	New page in the nav

Reviewer notes

⚠️ One % comment must be removed before merge. In the "Detection rules have two identifiers" convention, I left a question: is there a supported UI path for finding a rule's id (the UUID) that we should link? Readers who only know a rule by name or by its rule_id field currently have no documented way to get the UUID. I couldn't verify a path without UI access, so I flagged it rather than guessing.

Verified against kibana#277802 at HEAD, not against the issue text. Parameter names, types, defaults, required-ness, the operator enum, the overwrite-requires-item_id refinement, the cross-list item_id conflict behavior, and the output shape all come from the step schemas, server handlers, and their unit tests. One discrepancy worth noting: issue #7820 says the editor icon is list_add, but HEAD uses list_check. Icons aren't documented, so nothing in the page depends on it.

Reader-tested three times. The third pass caught a real bug in my own example: I had written a scheduled workflow with a top-level inputs: block using type: choice with items:. At HEAD, inputs belongs to the manual trigger on 9.5+, and choice takes options: and yields a single string, not an array. The complete example now uses consts, which matches authoring-techniques/anatomy.md.

Local build passes. docs-builder completes, the page renders, the schema-location-legend include expands, all section anchors emit, and all 15 outbound links resolve. Vale reports 0 errors on the new page. (The build also throws pre-existing unrelated errors on the logstash OpenAPI generator and four changelog bundles; those fire on a clean main too.)

Deliberately left out: whether a new exception suppresses already-generated alerts or only affects future rule runs. Two reader tests asked for it. I found nothing authoritative in the source or existing docs, so I'd rather a SME answer it than guess. Happy to add it if someone can confirm.

Scoped out of this PR, can add on request: the one-sentence pointer from solutions/security/detect-and-alert/rule-exceptions.md, plus entries in reference/cheat-sheet.md, authoring-techniques/choose-the-right-step.md, and use-cases/security/manage-detection-rules.md. Separately, choose-the-right-step.md is currently missing security.enableRule / security.disableRule entirely — a pre-existing gap I didn't want to half-fix here.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

Tool(s) and model(s) used: Cursor (Claude Opus 5). All technical claims were verified by the author against the implementation PR at HEAD and the local docs build.

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• explore-analyze/workflows/reference/step-types.md
• explore-analyze/workflows/steps/action-steps.md
• explore-analyze/workflows/steps/exceptions.md
• explore-analyze/workflows/steps/security.md

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 4 warnings, 1 suggestion found

⚠️ Warnings (4): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
explore-analyze/workflows/reference/step-types.md	92	Elastic.Spelling	'idempotency' is a possible misspelling.
explore-analyze/workflows/reference/step-types.md	93	Elastic.Spelling	'idempotency' is a possible misspelling.
explore-analyze/workflows/steps/exceptions.md	99	Elastic.Spelling	'idempotency' is a possible misspelling.
explore-analyze/workflows/steps/exceptions.md	171	Elastic.Spelling	'idempotency' is a possible misspelling.

💡 Suggestions (1): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
explore-analyze/workflows/steps/exceptions.md	266	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.