[DOCS] Clarifies rare security job details (#1814) (#1815)

docs/en/stack/ml/anomaly-detection/ootb-ml-jobs-siem.asciidoc

@@ -592,8 +592,8 @@ result of compromised credentials or keys.
 
 Job details:::
 
-* Detects unusually rare `event.action` values compared to other cities (using
-the {ml-docs}/ml-rare-functions.html#ml-rare[`rare` function]).
+* For each city, detects rare `event.action` values (using the
+{ml-docs}/ml-rare-functions.html#ml-rare[`rare` function]).
 
 Required {beats} or {agent} integrations:::
 
@@ -612,8 +612,8 @@ result of compromised credentials or keys.
 
 Job details:::
 
-* Detects unusually rare `event.action` values compared to other countries
-(using the {ml-docs}/ml-rare-functions.html#ml-rare[`rare` function]).
+* For each country, detects rare `event.action` values (using the
+{ml-docs}/ml-rare-functions.html#ml-rare[`rare` function]).
 
 Required {beats} or {agent} integrations:::
 
@@ -633,8 +633,8 @@ account to persist, move laterally, or exfil data.
 
 Job details:::
 
-* Detects unusually rare `event.action` values compared to other users (using
-the {ml-docs}/ml-rare-functions.html#ml-rare[`rare` function]).
+* For each user, detects rare `event.action` values (using the
+{ml-docs}/ml-rare-functions.html#ml-rare[`rare` function]).
 
 Required {beats} or {agent} integrations:::