Automatic backfills for rule execution gaps #3407
Description
Description
This feature introduces automatic detection and remediation of rule execution gaps in Elastic Security. When a rule fails to run during a time interval, the system automatically backfills the missing detections—reducing manual effort, maintaining detection coverage, and preventing alert duplication. Users can view and monitor the scheduler to understand when automated gap run have been scheduled.
Background & resources
Epic - https://github.com/elastic/security-team/issues/6097
PM: @approksiu
Designer: @ARWNightingale
Developer: @yctercero
Design Flows for Docs info
User flow 🏄 - 1. Enable / Disable Auto Gap Fill
User flow 🏄 2 - View Gaps and Fill Status
User flow 🏄 3 - View Scheduler
Copy Required:
AUTO FILL INFO: copy for tooltip explaining what Auto fill is, Plus the copy for the toast.
CALLOUTS: 4 call out info required, see below image for each one.
Which documentation set does this change impact?
ESS and serverless
ESS release
9.3
Serverless release
Once ready - TBC
Feature differences
Licence level- TBC
API docs impact
None
Prerequisites, privileges, feature flags
No response