Clarify delayed-rule catch-up behavior before gaps are recorded in Security rule monitoring docs

[Copilot]

The docs for rule monitoring and gap filling did not explain why a rule can show scheduling delay while gap duration remains empty/zero. This update documents the catch-up window behavior so users can distinguish expected delay recovery from true coverage gaps.

• What was missing

  • Added explicit guidance that delayed executions can backfill missed time before a gap is recorded.
  • Clarified that only delay beyond the catch-up ceiling becomes a recorded gap.

• monitor-rule-executions.md updates (Scheduling and gaps)

  • Added a note under Scheduling and gaps explaining:
    • late runs may still have 0 Gap duration
    • catch-up extends the source window by up to four additional interval-sized windows
    • gap recording starts only after that capacity is exceeded
  • Added a concrete sizing example with derivation:

  (4 × 5m) + 6m = 26m
  

• fill-rule-gaps.md updates (Gap information)

  • Added a companion note in Gap information explaining:
    • Scheduling delay can be present while Unfilled gaps duration is empty/0
    • this is expected when catch-up covers the missed period
    • only remaining delay beyond catch-up is recorded as a gap

• Fixes Docs: explain catch-up search window before gaps are recorded (monitor-rule-executions / fill-rule-gaps) #7708

[bmorelli25]

@nastasha-solomon this one felt well scoped enough for me to throw copilot at. If we're too far off, close this and we can reassess.

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/detect-and-alert/fill-rule-gaps.md
• solutions/security/detect-and-alert/monitor-rule-executions.md

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[nastasha-solomon]

@bmorelli25 I'm not the biggest fan of the updates that copilot made. I read the doc issue as: users want to know if rules running on a late schedule (e.g., they were queued or took a long time to execute) extend their search window to cover the "missed" time window. The updates don't explicitly confirm this, and instead jump to explaining how the rule's catch-up window works and what the UI displays. I'd like to take a whack at this PR when I'm back from PTO and/or consider how to better direct copilot with these types of updates.

[bmorelli25]

Works for me! Thanks!