Add UI for bulk fill gaps (#224585)

## Summary

This draft PR adds the UI to bulk gap filling gaps. This action can be
triggered from the "rules management" table as well as from the gaps
table in the "execution results" tab for any rule.

# How to test
Make sure your `kibana.dev.yaml` contains the following feature flags:
`storeGapsInEventLogEnabled` and `bulkFillRuleGapsEnabled`.

You can just paste this string in the file:
```
xpack.securitySolution.enableExperimental: [ 'storeGapsInEventLogEnabled', 'bulkFillRuleGapsEnabled' ]
```
## Bulk gap filling from the "rules management" table
1. Generate 100 rules, each with 1000 gaps using [this
tool](https://github.com/elastic/security-documents-generator).
`yarn start rules --rules 100 -g 1000 -c -i"5m"`
2. Navigate to the rules management table at
`/app/security/rules/management`
3. Select some rules, click on "Bulk actions" and then on "Fill gaps"

![image](https://github.com/user-attachments/assets/f5d9bcb6-9139-43cb-b023-f1f63a9b8b7a)
4. Select the time window and click on "Run"

![image](https://github.com/user-attachments/assets/0269d00a-2750-4b2d-975e-0ebfbac27e16)
5. You should see a confirmation toast showing that 3 rules were
successfully scheduled

![image](https://github.com/user-attachments/assets/9800c9e2-3c3e-4b87-96e4-17c84f1b024a)
6. Click on any of the rules for which you just executed a gaps fill and
check its gaps by going to "Execution results" and scrolling down to the
"Gaps" table. You can see that the gaps covering the time range you
selected are marked as "in progress"

![image](https://github.com/user-attachments/assets/850dea1c-12cc-46c5-8675-d11445218c24)

If you select one or more rules that are disabled, you should see this
modal:

![image](https://github.com/user-attachments/assets/4a820b92-a9f0-4529-93ee-1fbaf7552888)


## Bulk filling from a rule gaps table
1. From the "rules management" table, click on any rule that has gaps.
2. Click on the "execution results" tab
3. Scroll down to the gaps table, you should see a "Fill all gaps"
button.
4. Click on it and select the time range.

![image](https://github.com/user-attachments/assets/375b0677-9b49-43e4-8820-5186c9343891)
5. If you select a big time range, you should see a toast indicating
that the scheduling is in progress after 5 seconds (you can hit this
case by generating 10000 gaps for 1 rule)

![image](https://github.com/user-attachments/assets/6d6345d9-fbc6-4c14-9c2d-04f40941fd17)

6. You should see a success toast once it is done

![image](https://github.com/user-attachments/assets/089ec2b9-daa5-44df-bfc0-84c69e2f6eec)

---------

Co-authored-by: Khristinin Nikita <nikita.khristinin@elastic.co>
This commit is contained in:
Edgar Santos 2025-06-23 23:00:17 +02:00 committed by GitHub
parent 59f635c9c8
commit e585c2223d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
55 changed files with 1833 additions and 171 deletions

View file

@ -144,7 +144,7 @@ pageLoadAssetSize:
searchQueryRules: 19708
searchSynonyms: 20262
security: 81771
securitySolution: 98429
securitySolution: 99000
securitySolutionEss: 36000
securitySolutionServerless: 62488
serverless: 16573