[Security] Copy review for gap fill feature

[nastasha-solomon]

Filing this as a placeholder issue to track copy reviews for the feature that allows users to fill gaps in rule executions.

Related issues:

• [Request] Rule gaps #287
• [Detection Engine] [Alerting] [Response Ops] Rule gaps kibana#206313
• https://github.com/elastic/security-team/issues/8558

Copy changes will be added post-8.18/9.0.

[nkhristinin]

[nastasha-solomon]

Thanks for sharing the screenshots @nkhristinin. Please find my notes below:

• The table description for the Gaps table can be a bit more descriptive. For now, I think it's fine to mirror the description for the Manual runs table, for example: View and manage gaps in rule executions
• If possible, it'd be good to add brief explanations to each column, similar to what we've done for the Manual runs table. Some of the columns already have tooltip descriptions in other tables but the following ones are new and could benefit from a short explanation in the UI:
  • Manual fill tasks
  • Event time covered
  • Range
  • Total gap duration

[approksiu]

Manual fill tasks - informs user about any manual runs that are in progress for the corresponding gap interval.
Event time covered - shows the progress of the gap fill
Range - time range of the detected rule execution gap
Total gap duration - how long does the gap last, to help understand the impact

@nastasha-solomon - agree with the table description suggestion!

[nastasha-solomon]

Thanks for sharing these descriptions, @approksiu. Since these are tooltips, shorter text (when possible) is better. I made some minor tweaks to the descriptions. Let me know your thoughts:

• Manual fill tasks: Status of manual run filling the gap
• Event time covered: Progress of manual run filling the gap
• Range: Time range of gap
• Total gap duration: How long gap lasted

[nastasha-solomon]

Removing the 8.18/9.0 labels since these changes won't make it into either releases. Also slightly lowering the priority and moving it to the next sprint since this is no longer an 8.18/9.0 task.

[nastasha-solomon]

@yctercero I just checked the Gaps table in the latest BC and none of the columns have tooltip descriptions. To make the implementation easier, here's what I'd suggest for each of the columns.

• Status: Status of gap
• Detected at: Date and time gap was discovered
• Manual fill tasks: Status of manual run filling the gap
• Event time covered: Progress of manual run filling the gap
• Range: Time range of gap
• Total gap duration: How long gap lasted

[approksiu]

Thanks @nastasha-solomon , looks good to me!

[nastasha-solomon]

@approksiu I just remembered the other item we had previously discussed adding a tooltip to was the Unfilled gaps duration column on the Rule Monitoring tab.

What are your thoughts on the following for the column's tooltip description?

Total sum of unfilled or partially filled gaps

[approksiu]

@nastasha-solomon how about "Duration of unfilled or partially filled gaps".? Is it clear we'll only count unfilled part, and not the whole reported gap for partially filled gaps? cc @nkhristinin is my understanding here correct?

[nastasha-solomon]

Ah, I gotcha. I had cut out "remaining" in my initial version of the description, but that's actually the key word to communicating that we're only summing the leftover gaps. How's this:

Sum of remaining unfilled or partially filled gaps

I prefer "sum" over "duration" because sum = total combined amount and duration = how long something lasts. I'm open to other perspectives though. : )

[yctercero]

Created a ticket on our end to track work and assigned to @denar50 per our discussion during sync - elastic/kibana#218345