Add new gap fill status for rules

oas_docs/output/kibana.serverless.yaml

@@ -14146,6 +14146,14 @@ paths:
           required: false
           schema:
             type: string
+        - description: Aggregated gap fill statuses
+          in: query
+          name: gap_fill_statuses
+          required: false
+          schema:
+            items:
+              $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+            type: array
       responses:
         '200':
           content:
@@ -79648,6 +79656,11 @@ components:
           enum:
             - delete
           type: string
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -79674,6 +79687,11 @@ components:
           enum:
             - disable
           type: string
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -79713,6 +79731,11 @@ components:
           required:
             - include_exceptions
             - include_expired_exceptions
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -79813,6 +79836,11 @@ components:
             $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayload'
           minItems: 1
           type: array
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -79844,6 +79872,11 @@ components:
           enum:
             - enable
           type: string
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -79872,6 +79905,11 @@ components:
           enum:
             - export
           type: string
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -79915,6 +79953,11 @@ components:
           required:
             - start_date
             - end_date
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -79942,6 +79985,11 @@ components:
           enum:
             - run
           type: string
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -81110,6 +81158,12 @@ components:
         - updated_at
         - updatedAt
       type: string
+    Security_Detections_API_GapFillStatus:
+      enum:
+        - unfilled
+        - in_progress
+        - filled
+      type: string
     Security_Detections_API_HistoryWindowStart:
       description: Start date to use when checking if a term has been seen before. Supports relative dates – for example, now-30d will search the last 30 days of data when checking if a term is new. We do not recommend using absolute dates, which can cause issues with rule performance due to querying increasing amounts of data over time.
       format: nonempty

oas_docs/output/kibana.yaml

@@ -16071,6 +16071,14 @@ paths:
           required: false
           schema:
             type: string
+        - description: Aggregated gap fill statuses
+          in: query
+          name: gap_fill_statuses
+          required: false
+          schema:
+            items:
+              $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+            type: array
       responses:
         '200':
           content:
@@ -90195,6 +90203,11 @@ components:
           enum:
             - delete
           type: string
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -90221,6 +90234,11 @@ components:
           enum:
             - disable
           type: string
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -90260,6 +90278,11 @@ components:
           required:
             - include_exceptions
             - include_expired_exceptions
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -90360,6 +90383,11 @@ components:
             $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayload'
           minItems: 1
           type: array
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -90391,6 +90419,11 @@ components:
           enum:
             - enable
           type: string
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -90419,6 +90452,11 @@ components:
           enum:
             - export
           type: string
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -90462,6 +90500,11 @@ components:
           required:
             - start_date
             - end_date
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -90489,6 +90532,11 @@ components:
           enum:
             - run
           type: string
+        gap_fill_statuses:
+          description: Aggregated gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
+          items:
+            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
+          type: array
         gaps_range_end:
           description: Gaps range end, valid only when query is provided
           type: string
@@ -91657,6 +91705,12 @@ components:
         - updated_at
         - updatedAt
       type: string
+    Security_Detections_API_GapFillStatus:
+      enum:
+        - unfilled
+        - in_progress
+        - filled
+      type: string
     Security_Detections_API_HistoryWindowStart:
       description: Start date to use when checking if a term has been seen before. Supports relative dates – for example, now-30d will search the last 30 days of data when checking if a term is new. We do not recommend using absolute dates, which can cause issues with rule performance due to querying increasing amounts of data over time.
       format: nonempty

x-pack/platform/plugins/private/translations/translations/de-DE.json

@@ -38468,11 +38468,6 @@
     "xpack.securitySolution.ruleExceptions.logic.closeAlerts.error": "Alerts konnten nicht geschlossen werden",
     "xpack.securitySolution.ruleFromTimeline.error.title": "Regel konnte nicht aus der Zeitleiste importiert werden",
     "xpack.securitySolution.ruleFromTimeline.error.toastMessage": "Fehler beim Erstellen einer Regel aus der Zeitachse mit der ID: {id}",
-    "xpack.securitySolution.ruleGapsOverviewPanel.label": "Gesamtanzahl der Regeln mit Lücken:",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last24HoursLabel": "Letzte 24 Stunden",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last3DaysLabel": "Letzte 3 Tage",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last7DaysLabel": "Letzte 7 Tage",
-    "xpack.securitySolution.ruleGapsOverviewPanel.showRulesWithGapsLabel": "Nur Regeln mit Lücken",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipContent": "Sehen Sie sich unser {createEsqlRuleTypeLink} an, um mit der Nutzung der ES|QL-Regeln zu beginnen.",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipLink": "Dokumentation",
     "xpack.securitySolution.ruleManagement.esqlValidation.errorMessage": "Fehler bei der Validierung von ES|QL: \"{message}\"",

x-pack/platform/plugins/private/translations/translations/fr-FR.json

@@ -38784,11 +38784,6 @@
     "xpack.securitySolution.ruleExceptions.logic.closeAlerts.success": "Mise à jour réussie de {numAlerts} {numAlerts, plural, =1 {alert} other {alertes}}",
     "xpack.securitySolution.ruleFromTimeline.error.title": "Échec de l'importation de la règle à partir de la chronologie",
     "xpack.securitySolution.ruleFromTimeline.error.toastMessage": "Impossible de créer la règle à partir de la chronologie avec l'ID : {id}",
-    "xpack.securitySolution.ruleGapsOverviewPanel.label": "Nombre total de règles avec des écarts :",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last24HoursLabel": "Dernières 24 heures",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last3DaysLabel": "3 derniers jours",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last7DaysLabel": "7 derniers jours",
-    "xpack.securitySolution.ruleGapsOverviewPanel.showRulesWithGapsLabel": "Seulement les règles avec des écarts",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipContent": "Consultez {createEsqlRuleTypeLink} pour commencer à utiliser les règles ES|QL.",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipLink": "documentation",
     "xpack.securitySolution.ruleManagement.esqlValidation.errorMessage": "Erreur lors de la validation ES|QL : \"{message}\"",

x-pack/platform/plugins/private/translations/translations/ja-JP.json

@@ -38828,11 +38828,6 @@
     "xpack.securitySolution.ruleExceptions.logic.closeAlerts.success": "{numAlerts} {numAlerts, plural, =1 {alert} other {件のアラート}}が正常に更新されました",
     "xpack.securitySolution.ruleFromTimeline.error.title": "タイムラインからルールをインポートできませんでした",
     "xpack.securitySolution.ruleFromTimeline.error.toastMessage": "次のIDでタイムラインからのルール作成に失敗しました：{id}",
-    "xpack.securitySolution.ruleGapsOverviewPanel.label": "ギャップがあるルールの合計数：",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last24HoursLabel": "過去 24 時間",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last3DaysLabel": "過去3日間",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last7DaysLabel": "過去 7 日間",
-    "xpack.securitySolution.ruleGapsOverviewPanel.showRulesWithGapsLabel": "ギャップがあるルールのみ",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipContent": "ES|QL ルールの使用を開始するには、{createEsqlRuleTypeLink}を確認してください。",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipLink": "ドキュメンテーション",
     "xpack.securitySolution.ruleManagement.esqlValidation.errorMessage": "ES|QLの検証エラー：\"{message}\"",

x-pack/platform/plugins/private/translations/translations/zh-CN.json

@@ -38808,11 +38808,6 @@
     "xpack.securitySolution.ruleExceptions.logic.closeAlerts.success": "已成功更新 {numAlerts} 个{numAlerts, plural, =1 {告警} other {告警}}",
     "xpack.securitySolution.ruleFromTimeline.error.title": "无法从时间线导入规则",
     "xpack.securitySolution.ruleFromTimeline.error.toastMessage": "无法用以下 ID 从时间线创建规则：{id}",
-    "xpack.securitySolution.ruleGapsOverviewPanel.label": "存在缺口的规则总数：",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last24HoursLabel": "过去 24 小时",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last3DaysLabel": "过去 3 天",
-    "xpack.securitySolution.ruleGapsOverviewPanel.last7DaysLabel": "过去 7 天",
-    "xpack.securitySolution.ruleGapsOverviewPanel.showRulesWithGapsLabel": "仅限存在缺口的规则",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipContent": "请访问我们的{createEsqlRuleTypeLink}以开始使用 ES|QL 规则。",
     "xpack.securitySolution.ruleManagement.esqlQuery.esqlInfoTooltipLink": "文档",
     "xpack.securitySolution.ruleManagement.esqlValidation.errorMessage": "验证 ES|QL 时出错：“{message}”",

x-pack/platform/plugins/shared/alerting/common/constants/gap_status.ts

@@ -12,3 +12,11 @@ export const gapStatus = {
 } as const;
 
 export type GapStatus = (typeof gapStatus)[keyof typeof gapStatus];
+
+export const gapFillStatus = {
+  UNFILLED: 'unfilled',
+  IN_PROGRESS: 'in_progress',
+  FILLED: 'filled',
+} as const;
+
+export type GapFillStatus = (typeof gapFillStatus)[keyof typeof gapFillStatus];

x-pack/platform/plugins/shared/alerting/common/constants/index.ts

@@ -13,8 +13,8 @@ export {
   MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_MS,
 } from './backfill';
 export { PLUGIN } from './plugin';
-export { gapStatus } from './gap_status';
-export type { GapStatus } from './gap_status';
+export { gapStatus, gapFillStatus } from './gap_status';
+export type { GapStatus, GapFillStatus } from './gap_status';
 export { alertDeleteCategoryIds } from './alert_delete';
 export type { BackfillInitiator } from './backfill';
 export { backfillInitiator } from './backfill';

x-pack/platform/plugins/shared/alerting/common/index.ts

@@ -183,7 +183,8 @@ export {
   preconfiguredConnectorActionRefPrefix,
   systemConnectorActionRefPrefix,
 } from './action_ref_prefix';
-export { gapStatus } from './constants';
+export { gapStatus, gapFillStatus } from './constants';
+export type { GapStatus, GapFillStatus } from './constants';
 
 export type {
   MaintenanceWindowModificationMetadata,

x-pack/platform/plugins/shared/alerting/common/routes/gaps/apis/get_gaps_summary_by_rule_ids/schemas/v1.ts

@@ -38,6 +38,7 @@ export const getGapsSummaryByRuleIdsResponseSchema = schema.object({
       total_unfilled_duration_ms: schema.number(),
       total_in_progress_duration_ms: schema.number(),
       total_filled_duration_ms: schema.number(),
+      gap_fill_status: schema.maybe(schema.string()),
     })
   ),
 });

x-pack/platform/plugins/shared/alerting/common/routes/gaps/apis/get_rules_with_gaps/schemas/v1.ts

@@ -5,12 +5,30 @@
  * 2.0.
  */
 import { schema } from '@kbn/config-schema';
+import { gapFillStatus, gapStatus } from '../../../../../constants';
 
 export const getRuleIdsWithGapBodySchema = schema.object(
   {
     end: schema.string(),
     start: schema.string(),
-    statuses: schema.maybe(schema.arrayOf(schema.string())),
+    statuses: schema.maybe(
+      schema.arrayOf(
+        schema.oneOf([
+          schema.literal(gapStatus.UNFILLED),
+          schema.literal(gapStatus.PARTIALLY_FILLED),
+          schema.literal(gapStatus.FILLED),
+        ])
+      )
+    ),
+    highest_priority_gap_fill_statuses: schema.maybe(
+      schema.arrayOf(
+        schema.oneOf([
+          schema.literal(gapFillStatus.UNFILLED),
+          schema.literal(gapFillStatus.IN_PROGRESS),
+          schema.literal(gapFillStatus.FILLED),
+        ])
+      )
+    ),
     has_unfilled_intervals: schema.maybe(schema.boolean()),
     has_in_progress_intervals: schema.maybe(schema.boolean()),
     has_filled_intervals: schema.maybe(schema.boolean()),