[Security][9.1 & Serverless] Improvements to the gap remediation feature

solutions/security/detect-and-alert/manage-detection-rules.md

@@ -188,7 +188,28 @@ Be mindful of the following:
 
 ::::
 
+## Fill gaps for multiple rules [bulk-fill-gaps-multiple-rules]
 
+```{applies_to}
+   stack: ga 9.1
+```
+
+From the Rules table, fill gaps for multiple rules by using the **Fill gaps** bulk action.
+
+1. Find **Detection rules (SIEM)** in the navigation menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
+2. In the Rules table, click the **Rule Monitoring** tab, then do one of the following:
+
+   * Fill rules with unfilled or partially filled gaps - Select the appropriate rules or all rules on the page, then click **Bulk actions → Fill gaps**.
+
+   * Only fill rules with unfilled gaps - In the panel above the table, click the **Only rules with unfilled gaps** filter to only show rules with unfilled gaps (rules with partially filled gaps are excluded). Select the appropriate rules or all of them, then click **Bulk actions → Fill gaps**. 
+
+3. Specify when to start and end the manual run that will fill the gaps. 
+4. Click **Schedule gap fills**. The rule will manually run over unfilled gaps in the selected time range. 
+
+After scheduling the manual run, you can track gap fill progress by checking the **Total rules with gaps:** field in the panel above the Rules table. The field displays two metrics separated by a forward slash. The metric on the left tells you the remaining number of rules with unfilled gaps. The metric on the right tells you the number of rules that are currently having their gaps filled. 
+
+Alternatively, you can check gap fill progress for individual rules by going to their details page, clicking the **Execution results** tab, and going to the [Gaps table](/solutions/security/detect-and-alert/monitor-rule-executions.md#gaps-table).
+
 
 ## Snooze rule actions [snooze-rule-actions]
 

solutions/security/detect-and-alert/monitor-rule-executions.md

@@ -40,9 +40,18 @@ To sort the rules list, click any column header. To sort in descending order, cl
 
 For detailed information on a rule, the alerts it generated, and associated errors, click on its name in the table. This also allows you to perform the same actions that are available on the [**Installed Rules** tab](manage-detection-rules.md), such as modifying or deleting rules, activating or deactivating rules, exporting or importing rules, and duplicating prebuilt rules.
 
-For information about rule execution gaps (which are periods of time when a rule didn't run), use the panel above the table. The time filter on the left allows you to select a time range for viewing gap data. The **Total rules with gaps:** field tells you how many rules have unfilled or partially filled gaps within the selected time range. The **Only rules with gaps** filter on the right lets you only display rules with unfilled or partially filled gaps.
+For information about rule execution gaps (which are periods of time when a rule didn't run), use the panel above the table. The panel contains the following:
 
-Within the table, the **Last Gap (if any)** column conveys how long the most recent gap for a rule lasted. The **Unfilled gaps duration** column shows whether a rule still has gaps and provides a total sum of the remaining unfilled or partially filled gaps. The total sum can change based on the time range that you select in the panel above the table. If a rule has no gaps, the columns display a dash (`––`).
+* **Time filter**: Allows you to select a time range for viewing gap data. 
+* **Total rules with gaps:** Provides metrics for rules with gaps:
+
+  * {applies_to}`stack: ga 9.0` Tells you how many rules have unfilled or partially filled gaps within the selected time range. 
+  * {applies_to}`stack: ga 9.1` Tells you the number of rules with unfilled gaps (left metric) and the number of rules with gaps being filled (right metric). 
+
+* {applies_to}`stack: ga 9.0` **Only rules with gaps**: Filters the Rules table to only display rules with unfilled or partially filled gaps.
+* {applies_to}`stack: ga 9.1` **Only rules with unfilled gaps**: Filters the Rules table to only display rules with unfilled gaps. Note that the filter excludes rules with partial gaps or gaps that are being filled. 
+
+Within the Rules table, the **Last Gap (if any)** column conveys how long the most recent gap for a rule lasted. The **Unfilled gaps duration** column shows whether a rule still has gaps and provides a total sum of the remaining unfilled or partially filled gaps. The total sum can change based on the time range that you select in the panel above the table. If a rule has no gaps, the columns display a dash (`––`). 
 
 ::::{tip}
 For a detailed view of a rule's gaps, go to the **Execution results** tab and check the [Gaps table](/solutions/security/detect-and-alert/monitor-rule-executions.md#gaps-table).
@@ -84,17 +93,21 @@ Use these controls to filter what’s included in the logs table:
 
 ### Gaps table [gaps-table]
 
-::::{warning}
-This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
-::::
+```{applies_to}
+   stack: preview 9.0, ga 9.1
+```
 
 Gaps in rule executions are periods of time where a rule didn’t run. They can be caused by various disruptions, including system updates, rule failures, or simply turning off a rule. Addressing gaps is essential for maintaining consistent coverage and avoiding missed alerts.
 
 ::::{tip}
 Refer to the [Troubleshoot gaps](../../../troubleshoot/security/detection-rules.md#troubleshoot-gaps) section for strategies for avoiding gaps.
 ::::
 
-Use the information in the Gaps table to assess the scope and severity of rule execution gaps. To control what's shown in the table, you can filter the table by gap status, select a time range for viewing gap data, and sort multiple columns.
+Use the information in the Gaps table to assess the scope and severity of rule execution gaps. To control what's shown in the table, you can filter the table by gap status, select a time range for viewing gap data, and sort multiple columns. In {{stack}} 9.1 and Serverless, fill all gaps for the current rule by clicking **Fill all gaps** in the Gaps table. 
+
+::::{note}
+{applies_to}`stack: ga 9.1` From the Rules table, fill gaps for multiple rules with the [**Fill gaps** bulk action](/solutions/security/detect-and-alert/manage-detection-rules.md#bulk-fill-gaps-multiple-rules).
+::::
 
 :::{image} /solutions/images/security-gaps-table.png
 :alt: Gaps table on the rule execution results tab