Add new gap fill status for rules

oas_docs/output/kibana.serverless.yaml

@@ -14306,6 +14306,14 @@ paths:
           required: false
           schema:
             type: string
+        - description: Gap fill statuses
+          in: query
+          name: gap_fill_statuses
+          required: false
+          schema:
+            items:
+              $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+            type: array
       responses:
         '200':
           content:
@@ -84145,6 +84153,11 @@ components:
           enum:
             - delete
           type: string
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -84171,6 +84184,11 @@ components:
           enum:
             - disable
           type: string
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -84210,6 +84228,11 @@ components:
           required:
             - include_exceptions
             - include_expired_exceptions
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -84310,6 +84333,11 @@ components:
             $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayload'
           minItems: 1
           type: array
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -84341,6 +84369,11 @@ components:
           enum:
             - enable
           type: string
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -84369,6 +84402,11 @@ components:
           enum:
             - export
           type: string
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -84412,6 +84450,11 @@ components:
           required:
             - start_date
             - end_date
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -84439,6 +84482,11 @@ components:
           enum:
             - run
           type: string
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -85607,6 +85655,12 @@ components:
         - updated_at
         - updatedAt
       type: string
+    Security_Detections_API_GapFillStatus:
+      enum:
+        - unfilled
+        - in_progress
+        - filled
+      type: string
     Security_Detections_API_HistoryWindowStart:
       description: Start date to use when checking if a term has been seen before. Supports relative dates – for example, now-30d will search the last 30 days of data when checking if a term is new. We do not recommend using absolute dates, which can cause issues with rule performance due to querying increasing amounts of data over time.
       format: nonempty

oas_docs/output/kibana.yaml

@@ -16237,6 +16237,14 @@ paths:
           required: false
           schema:
             type: string
+        - description: Gap fill statuses
+          in: query
+          name: gap_fill_statuses
+          required: false
+          schema:
+            items:
+              $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+            type: array
       responses:
         '200':
           content:
@@ -94719,6 +94727,11 @@ components:
           enum:
             - delete
           type: string
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -94745,6 +94758,11 @@ components:
           enum:
             - disable
           type: string
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -94784,6 +94802,11 @@ components:
           required:
             - include_exceptions
             - include_expired_exceptions
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -94884,6 +94907,11 @@ components:
             $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayload'
           minItems: 1
           type: array
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -94915,6 +94943,11 @@ components:
           enum:
             - enable
           type: string
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -94943,6 +94976,11 @@ components:
           enum:
             - export
           type: string
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -94986,6 +95024,11 @@ components:
           required:
             - start_date
             - end_date
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -95013,6 +95056,11 @@ components:
           enum:
             - run
           type: string
+        gap_fill_statuses:
+          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -96181,6 +96229,12 @@ components:
         - updated_at
         - updatedAt
       type: string
+    Security_Detections_API_GapFillStatus:
+      enum:
+        - unfilled
+        - in_progress
+        - filled
+      type: string
     Security_Detections_API_HistoryWindowStart:
       description: Start date to use when checking if a term has been seen before. Supports relative dates – for example, now-30d will search the last 30 days of data when checking if a term is new. We do not recommend using absolute dates, which can cause issues with rule performance due to querying increasing amounts of data over time.
       format: nonempty

x-pack/platform/plugins/private/translations/translations/de-DE.json

@@ -38313,11 +38313,6 @@
     "xpack.securitySolution.ruleExceptions.logic.closeAlerts.error": "Alerts konnten nicht geschlossen werden",
     "xpack.securitySolution.ruleFromTimeline.error.title": "Regel konnte nicht aus der Zeitleiste importiert werden",
     "xpack.securitySolution.ruleFromTimeline.error.toastMessage": "Fehler beim Erstellen einer Regel aus der Zeitachse mit der ID: {id}",
-    "xpack.securitySolution.ruleGapsOverviewPanel.label": "Gesamtanzahl der Regeln mit Lücken:",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last24HoursLabel": "Letzte 24 Stunden",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last3DaysLabel": "Letzte 3 Tage",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last7DaysLabel": "Letzte 7 Tage",
-    "xpack.securitySolution.ruleGapsOverviewPanel.showRulesWithGapsLabel": "Nur Regeln mit Lücken",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipContent": "Sehen Sie sich unser {createEsqlRuleTypeLink} an, um mit der Nutzung der ES|QL-Regeln zu beginnen.",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipLink": "Dokumentation",
     "xpack.securitySolution.ruleManagement.esqlValidation.errorMessage": "Fehler bei der Validierung von ES|QL: \"{message}\"",

x-pack/platform/plugins/private/translations/translations/fr-FR.json

@@ -38682,11 +38682,6 @@
     "xpack.securitySolution.ruleExceptions.logic.closeAlerts.success": "Mise à jour réussie de {numAlerts} {numAlerts, plural, =1 {alert} other {alertes}}",
     "xpack.securitySolution.ruleFromTimeline.error.title": "Échec de l'importation de la règle à partir de la chronologie",
     "xpack.securitySolution.ruleFromTimeline.error.toastMessage": "Impossible de créer la règle à partir de la chronologie avec l'ID : {id}",
-    "xpack.securitySolution.ruleGapsOverviewPanel.label": "Nombre total de règles avec des écarts :",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last24HoursLabel": "Dernières 24 heures",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last3DaysLabel": "3 derniers jours",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last7DaysLabel": "7 derniers jours",
-    "xpack.securitySolution.ruleGapsOverviewPanel.showRulesWithGapsLabel": "Seulement les règles avec des écarts",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipContent": "Consultez {createEsqlRuleTypeLink} pour commencer à utiliser les règles ES|QL.",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipLink": "documentation",
     "xpack.securitySolution.ruleManagement.esqlValidation.errorMessage": "Erreur lors de la validation ES|QL : \"{message}\"",

x-pack/platform/plugins/private/translations/translations/ja-JP.json

@@ -38721,11 +38721,6 @@
     "xpack.securitySolution.ruleExceptions.logic.closeAlerts.success": "{numAlerts} {numAlerts, plural, =1 {alert} other {件のアラート}}が正常に更新されました",
     "xpack.securitySolution.ruleFromTimeline.error.title": "タイムラインからルールをインポートできませんでした",
     "xpack.securitySolution.ruleFromTimeline.error.toastMessage": "次のIDでタイムラインからのルール作成に失敗しました：{id}",
-    "xpack.securitySolution.ruleGapsOverviewPanel.label": "ギャップがあるルールの合計数：",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last24HoursLabel": "過去 24 時間",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last3DaysLabel": "過去3日間",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last7DaysLabel": "過去 7 日間",
-    "xpack.securitySolution.ruleGapsOverviewPanel.showRulesWithGapsLabel": "ギャップがあるルールのみ",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipContent": "ES|QL ルールの使用を開始するには、{createEsqlRuleTypeLink}を確認してください。",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipLink": "ドキュメンテーション",
     "xpack.securitySolution.ruleManagement.esqlValidation.errorMessage": "ES|QLの検証エラー：\"{message}\"",

x-pack/platform/plugins/private/translations/translations/zh-CN.json

@@ -38701,11 +38701,6 @@
     "xpack.securitySolution.ruleExceptions.logic.closeAlerts.success": "已成功更新 {numAlerts} 个{numAlerts, plural, =1 {告警} other {告警}}",
     "xpack.securitySolution.ruleFromTimeline.error.title": "无法从时间线导入规则",
     "xpack.securitySolution.ruleFromTimeline.error.toastMessage": "无法用以下 ID 从时间线创建规则：{id}",
-    "xpack.securitySolution.ruleGapsOverviewPanel.label": "存在缺口的规则总数：",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last24HoursLabel": "过去 24 小时",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last3DaysLabel": "过去 3 天",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last7DaysLabel": "过去 7 天",
-    "xpack.securitySolution.ruleGapsOverviewPanel.showRulesWithGapsLabel": "仅限存在缺口的规则",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipContent": "请访问我们的{createEsqlRuleTypeLink}以开始使用 ES|QL 规则。",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipLink": "文档",
     "xpack.securitySolution.ruleManagement.esqlValidation.errorMessage": "验证 ES|QL 时出错：“{message}”",

x-pack/platform/plugins/shared/alerting/common/constants/gap_status.ts

@@ -5,10 +5,27 @@
  * 2.0.
  */
 
+/**
+ * Describes the raw status of individual gap documents regarding to the gap fill process.
+ */
 export const gapStatus = {
   UNFILLED: 'unfilled',
   FILLED: 'filled',
   PARTIALLY_FILLED: 'partially_filled',
 } as const;
 
 export type GapStatus = (typeof gapStatus)[keyof typeof gapStatus];
+
+/**
+ * Represents the status of a gap fill process for a rule.
+ * This is a derived, per-rule aggregation that summarizes how well
+ * the set of gaps for a rule has been filled. It is calculated from the gap
+ * duration sums with precedence: unfilled > in_progress > filled.
+ */
+export const gapFillStatus = {
+  UNFILLED: 'unfilled',
+  IN_PROGRESS: 'in_progress',
+  FILLED: 'filled',
+} as const;
+
+export type GapFillStatus = (typeof gapFillStatus)[keyof typeof gapFillStatus];

x-pack/platform/plugins/shared/alerting/common/constants/index.ts

@@ -13,8 +13,8 @@ export {
   MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_MS,
 } from './backfill';
 export { PLUGIN } from './plugin';
-export { gapStatus } from './gap_status';
-export type { GapStatus } from './gap_status';
+export { gapStatus, gapFillStatus } from './gap_status';
+export type { GapStatus, GapFillStatus } from './gap_status';
 export { alertDeleteCategoryIds } from './alert_delete';
 export type { BackfillInitiator } from './backfill';
 export { backfillInitiator } from './backfill';

x-pack/platform/plugins/shared/alerting/common/index.ts

@@ -179,7 +179,8 @@ export {
   preconfiguredConnectorActionRefPrefix,
   systemConnectorActionRefPrefix,
 } from './action_ref_prefix';
-export { gapStatus } from './constants';
+export { gapStatus, gapFillStatus } from './constants';
+export type { GapStatus, GapFillStatus } from './constants';
 
 export {
   mappingFromFieldMap,

x-pack/platform/plugins/shared/alerting/common/routes/gaps/apis/get_gaps_summary_by_rule_ids/schemas/v1.ts

@@ -38,6 +38,7 @@ export const getGapsSummaryByRuleIdsResponseSchema = schema.object({
       total_unfilled_duration_ms: schema.number(),
       total_in_progress_duration_ms: schema.number(),
       total_filled_duration_ms: schema.number(),
+      gap_fill_status: schema.maybe(schema.string()),
     })
   ),
 });

x-pack/platform/plugins/shared/alerting/common/routes/gaps/apis/get_rules_with_gaps/schemas/v1.ts

@@ -5,12 +5,34 @@
  * 2.0.
  */
 import { schema } from '@kbn/config-schema';
+import { gapFillStatus, gapStatus } from '../../../../../constants';
 
 export const getRuleIdsWithGapBodySchema = schema.object(
   {
     end: schema.string(),
     start: schema.string(),
-    statuses: schema.maybe(schema.arrayOf(schema.string())),
+    // Filters the underlying gap documents before aggregation. Matches the raw
+    // per-gap statuses.
+    statuses: schema.maybe(
+      schema.arrayOf(
+        schema.oneOf([
+          schema.literal(gapStatus.UNFILLED),
+          schema.literal(gapStatus.PARTIALLY_FILLED),
+          schema.literal(gapStatus.FILLED),
+        ])
+      )
+    ),
+    // Filters by the derived, per-rule status that is calculated from gap
+    // duration sums (unfilled > in_progress > filled precedence).
+    highest_priority_gap_fill_statuses: schema.maybe(
+      schema.arrayOf(
+        schema.oneOf([
+          schema.literal(gapFillStatus.UNFILLED),
+          schema.literal(gapFillStatus.IN_PROGRESS),
+          schema.literal(gapFillStatus.FILLED),
+        ])
+      )
+    ),
     has_unfilled_intervals: schema.maybe(schema.boolean()),
     has_in_progress_intervals: schema.maybe(schema.boolean()),
     has_filled_intervals: schema.maybe(schema.boolean()),