[Internal]: Rule gaps callout and gaps overview panel

[nkhristinin]

Description

What: We’re introducing a new gaps callout on the Rules pages and making updates to the gaps overview panel on the Rules Monitoring tab.
When: 8.19 / 9.1
Why: To display more detailed information about gaps and make this information more useful.

Summary

This update introduces a new callout for recent rule gaps on the Rules page and improves the gaps panel on the Rule monitoring tab. The goal is to provide better visibility into gap-filling progress and make it easier for users to take action.

1. New callout on the Rules page

• A dismissible callout appears when unfilled gaps are detected within the last 24 hours.
• The callout contains:
  • A link to Rule monitoring tab
  • A link to the gaps dashboard.
  • A link to relevant documentation.
• The callout disappears when dismissed and will not reappear for 24 hours — unless new gaps are found during that period.

2. Improved metrics in the gaps panel

-The gaps panel now shows:

• The number of rules with unfilled gaps.
• The number of rules with gaps currently being filled (in progress).

These metrics help users understand the current status of gap-filling.

Note: The “in-progress” count may be briefly out of sync, since gap status updates are asynchronous and may complete after a bulk request finishes.

3. Updated filtering logic

• The rule list now only displays rules with gaps that can still be filled. Before we show any rules with status unfilled.
• Example:
  • If 5 rules had unfilled gaps and 3 are now being filled, the list will show just the remaining 2 unfilled rules. (Before we will show all 5 rules)

Before

After

Resources

This feature implemented: elastic/kibana#224268

Issues: https://github.com/elastic/security-team/issues/12828, https://github.com/elastic/security-team/issues/12829

Which documentation set does this change impact?

Elastic On-Prem and Cloud (all)

Feature differences

The feature is identical on all deployments

What release is this request related to?

9.1

Serverless release

Next available serverless release

Collaboration model

The documentation team

Point of contact.

Main contact: @nkhristinin

Stakeholders: @approksiu @ARWNightingale

[nastasha-solomon]

8.19, 9.1, and Serverless docs merged.