[Serverless] Manual rule run docs

docs/serverless/alerts/alert-schema.mdx

@@ -904,4 +904,13 @@ The non-ECS fields listed below are beta and subject to change.
 
     </DocCell>
   </DocRow>
+    <DocRow>
+    <DocCell> `kibana.alert.intended_timestamp`</DocCell>
+    <DocCell>
+      Represents the time when the alert would have been created based on the source event timestamp. This field is only populated for alerts generated by manual rule runs.
+
+      Type: date
+
+    </DocCell>
+  </DocRow>
 </DocTable>

docs/serverless/rules/alerts-ui-monitor.mdx

@@ -41,27 +41,60 @@ For detailed information on a rule, the alerts it generated, and associated erro
 
 ## Execution results
 
-Each detection rule execution is logged, including its success or failure, any warning or error messages, and how long it took to search for data, create alerts, and complete. This can help you troubleshoot a particular rule if it isn't behaving as expected (for example, if it isn't creating alerts or takes a long time to run).
+Each detection rule execution is logged, including the execution type, the execution's success or failure, any warning or error messages, how long it took to search for data, create alerts, and complete. This can help you troubleshoot a particular rule if it isn't behaving as expected (for example, if it isn't creating alerts or takes a long time to run).
 
-To access a rule's execution log, go to **Rules** → **Detection rules (SIEM)**, click the rule's name to open its details, then scroll down and select the **Execution results** tab. You can expand a long warning or error message by clicking the arrow at the end of a row.
+To access a rule's execution log, go to **Rules** → **Detection rules (SIEM)**, click the rule's name to open its details, then scroll down and select the **Execution results** tab. Within the Execution log table, you can click the arrow at the end of a row to expand a long warning or error message.
 
-![Rule execution results tab](../images/alerts-ui-monitor/-detections-rule-execution-logs.png)
+![Rule execution log on the rule execution results tab](../images/alerts-ui-monitor/-detections-rule-execution-logs.png)
 
 You can hover over each column heading to display a tooltip about that column's data. Click a column heading to sort the table by that column.
 
 Use these controls to filter what's included in the logs table:
 
+* The **Run type** drop-down filters the table by rule execution type: 
+    * **Scheduled**: Rule executions that the detection engine automatically ran according to the rule's schedule.
+    * **Manual**: Rule executions that were <DocLink slug="/serverless/security/rules-ui-management" section="manually-run-rules">started manually</DocLink>.
+
 * The **Status** drop-down filters the table by rule execution status: 
     * **Succeeded**: The rule completed its defined search. This doesn't necessarily mean it generated an alert, just that it ran without error.
     * **Failed**: The rule encountered an error that prevented it from running. For example, a ((ml)) rule whose corresponding ((ml)) job wasn't running.
     * **Warning**: Nothing prevented the rule from running, but it might have returned unexpected results. For example, a custom query rule tried to search an index pattern that couldn't be found in ((es)).
 
 * The date and time picker sets the time range of rule executions included in the table. This is separate from the global date and time picker at the top of the rule details page.
 
+* The **Source event time range** toggle includes more or less data in the table, pertaining to the time range of a manual run.
+
 * The **Show metrics columns** toggle includes more or less data in the table, pertaining to the timing of each rule execution.
 
 * The **Actions** column allows you to show alerts generated from a given rule execution. Click the filter icon (<DocIcon type="filterInCircle" title="Filter" size="s"/>) to create a global search filter based on the rule execution's ID value. This replaces any previously applied filters, changes the global date and time range to 24 hours before and after the rule execution, and displays a confirmation notification. You can revert this action by clicking **Restore previous filters** in the notification.
 
+<div id="manual-runs-table"></div>
+
+### Manual runs table
+
+<DocBadge template="technical preview" />
+
+Execution details of active manual runs are shown in the Manual runs table. Each manual run can produce multiple rule executions, depending on the time range of the run and the rule's execution schedule.
+
+To access the Manual runs table, go to **Rules** -> **Detection rules (SIEM)**, click the rule's name to open its details, then scroll down and select the **Execution results** tab. Scroll down again to find the Manual runs table. 
+
+To stop an active run, go to the appropriate row and click **Stop run** in the **Actions** column. Completed rule executions for each manual run are logged in the Execution log table.
+
+![Manual rule runs table on the rule execution results tab](../images/alerts-ui-monitor/-detections-manual-rule-run-table.png)
+
+The Manual runs table displays important details such as:
+
+* The status of each manual run:
+   * **Pending**: The rule is not yet running. 
+   *  **Running**: The rule is executing during the time range you specified. Some rules, such as indicator match rules, can take longer to run.
+   * **Error**: The rule's configuration might have an issue. For example, the rule's conditions cannot be validated. 
+
+* When a manual run started and the time in which it will run
+
+* The number of rule executions that are failing, pending, running, and completed for a manual run
+
+* The total number of rule executions that are occurring for a manual run
+
 <div id="troubleshoot-signals"></div>
 
 ## Troubleshoot missing alerts

docs/serverless/rules/rules-ui-management.mdx

@@ -19,6 +19,7 @@ On the Rules page, you can:
 * <DocLink slug="/serverless/security/rules-ui-management" section="check-the-current-status-of-rules">Check the current status of rules</DocLink>
 * <DocLink slug="/serverless/security/rules-ui-management" section="modify-existing-rules-settings">Modify existing rules settings</DocLink>
 * <DocLink slug="/serverless/security/rules-ui-management" section="manage-rules">Manage rules</DocLink>
+* <DocLink slug="/serverless/security/rules-ui-management" section="manually-run-rules">Manually run rules</DocLink>
 * <DocLink slug="/serverless/security/rules-ui-management" section="snooze-rule-actions">Snooze rule actions</DocLink>
 * <DocLink slug="/serverless/security/rules-ui-management" section="export-and-import-rules">Export and import rules</DocLink>
 * <DocLink slug="/serverless/security/rules-ui-management" section="confirm-rule-prerequisites">Confirm rule prerequisites</DocLink>
@@ -111,6 +112,37 @@ When duplicating a rule with exceptions, you can choose to duplicate the rule an
     * To enable or disable a single rule, switch on the rule's **Enabled** toggle.
     * To <DocLink slug="/serverless/security/rules-ui-management" section="snooze-rule-actions">snooze</DocLink> actions for rules, click the bell icon.
 
+<div id="manually-run-rules"></div>
+
+## Run rules manually
+
+<DocBadge template="technical preview" />
+
+Manually run enabled rules for a specfied period of time for testing purposes or additional rule coverage.
+
+<DocCallOut title="Important" color="warning">
+Before manually running rules, make sure you properly understand and plan for rule dependencies. Incorrect scheduling can lead to inconsistent rule results.
+</DocCallOut>
+
+1. Go to **Rules** -> **Detection rules (SIEM)**.
+1. Do one of the following:
+    * Select the **All actions** menu on a rule (**...** → **All actions** in the rules list), then select **Manual run**.
+    * Select all the rules you want to manually run, select the **Bulk actions** menu, then select **Manual run**.
+1. Specify when the manual run starts and ends. The default selection is the current day starting three hours in the past. The rule will search for events during the selected time range.
+1. Click **Run** to manually run the rule.
+   <DocCallOut title="Note">
+   Running the rule manually can produce multiple rule executions. This is determined by the manual run's time range and the rule's execution schedule.
+   </DocCallOut>
+
+The manual run's details are shown in the <DocLink slug="/serverless/security/alerts-ui-monitor" section="manual-runs-table">Manual runs</DocLink> table on the **Execution results** tab. Changes you make to the manual run or rule settings will display in the Manual runs table after the current run completes.
+
+<DocCallOut title="Note">
+Be mindful of the following:
+* Rules actions are not activated during manual runs. 
+* Except for threshold rules, duplicate alerts are not created if a rule is manually run during a time range that was already covered by a scheduled run.
+* Manual runs are executed with low priority and limited concurrency, meaning they might take longer to complete. This can be especially apparent for rules requiring multiple executions.
+</DocCallOut>
+
 <div id="snooze-rule-actions"></div>
 
 ## Snooze rule actions