...
The rule is run when it is manually triggered by the user from Actions on an alert. For example, run an SSM document if the alert description contains certain keywords when the user manually triggers the rule.
Use that can rule this rule: By default, your rule can be run by all logged-in team members, but you can allow only specific users and teams to run your rule.
Filter alerts to show your rule: You can make your rule available to be run only for certain alerts by choosing alert fields to filter by.
Optionally, you can select Prompt for input when the rule is triggered if you want the user, who triggers the rule from an alert, to input any information before the rule is run.
...