[Docs][Alerting] updates images in Alerts Management and adds docs for the Run When field (#92225)

Updates images in Alerts Management Docs and usage of the Run When field

docs/user/alerting/defining-alerts.asciidoc

@@ -56,7 +56,12 @@ To add an action to an alert, you first select the type of action:
 [role="screenshot"]
 image::images/alert-flyout-action-type-selection.png[UI for selecting an action type]
 
-Each action  must specify a <<alerting-concepts-connectors, connector>> instance. If no connectors exist for that action type, click "Add new" to create one.
+When an alert instance matches a condition, the alert is marked as _Active_ and assigned an action group.  The actions in that group are triggered.
+When the condition is no longer detected, the alert is assigned to the _Recovered_ action group, which triggers any actions assigned to that group.
+
+**Run When** allows you to assign an action to an _action group_. This will trigger the action in accordance with your **Notify every** setting.
+
+Each action must specify a <<alerting-concepts-connectors, connector>> instance. If no connectors exist for that action type, click *Add action* to create one.
 
 Each action type exposes different properties. For example an email action allows you to set the recipients, the subject, and a message body in markdown format. See <<action-types>> for details on the types of actions provided by {kib} and their properties.