[UI copy]: Manual rule runs about security-docs

[nastasha-solomon]

Hey, @nkhristinin. I dropped a few questions in Slack about the first set of screenshots that you provided in the description.

Here are my suggestions for the copy that was added for the second set of items (Backfill group and stop of the group run):

1. I'd recommend changing "Stop" to "Stop run" or "Stop rule run". Making the command more descriptive helps our users understand what they're stopping. It's also helpful for those relying on screen readers to navigate the UI.

   

2. See notes below for the copy that appears in the confirmation modal:

   Title

   Our UI copy guidelines say to avoid using "Are you sure", and to be more direct when addressing users. Here's a few options for the title in the confirmation message:

   • Option 1: Stop running this rule
   • Option 2: Stop this rule run
   • Option 3: Stop the rule from running

   Body text

   I'm not quite sure what the text in the body explains. It sort of looks like a user manually ran a rule multiple times, and the first run, plus every subsequent run after that, is being stopped. If that's the case, here's some potential revisions:
   - Option 1: The current rule run, and any other that you set up, will be stopped.
   - Option 2: This action stops the current rule run and any additional ones that you set up.

   Updated copy options for the body text:

   • Option 1: The current rule run and pending ones will be stopped.
   • Option 2: This action stops the current rule run and any pending ones.

   Question: Is it important for users to know the number of runs that are pending? If so, We should add that detail into the body text. For example: The current rule run and 4 pending ones will be stopped.

   Buttons

   Copy options for the confirmation and cancel buttons:

   • Cancel button: Looks good! No changes needed.

   • Stop runs button (i.e., the Confirmation button): Stop rule run

     

3. Just recommend being a bit more descriptive here and changing "Run stopped" to "Rule run stopped". Also, does a different message display if the rule had more than one manual rule run in queue?

   

Notes from Slack convos

• The description for the Manual runs table could be similar to what we have for the Execution log table, for example:
  A list of manual rule runs
• If the last column in the Manual runs table needs a label, I suggest Action.
  
• Asked @ARWNightingale for more context on the naming of the Source event time range column. More specifically, I was wondering why we use “source event” (which is more closely related to alerts) instead of “manual run”, and whether the column can/should be renamed.

[nkhristinin]

I'm not quite sure what the text in the body explains. It sort of looks like a user manually ran a rule multiple times, and the first run, plus every subsequent run after that, is being stopped. If that's the case, here's some potential revisions:

When user execute manual run - it create a group, which can contain several potenial rule execution

Let's say - 1 manual rule run group has 10 tasks:

• 6 completed
• 4 pending

We can stop only the whole group, so means 4 pending tasks will be canceled

[nkhristinin]

Also, does a different message display if the rule had more than one manual rule run in queue?

No, as we always just stop the whole group

[nastasha-solomon]

@nastasha-solomon do you thinks it's clear from this UI, what total,completed,error etc means?

I think all of the columns in the second table could use tooltips, similar to the Execution log table at the top of the tab. I can help with the wording, but I'll need explanations for what each column displays. @approksiu would you be able to help with that?

[nkhristinin]

I think all of the columns in the second table could use tooltips, similar to the Execution log table at the top of the tab. I can help with the wording, but I'll need explanations for what each column displays. @approksiu would you be able to help with that?

I can also try to help with that:

Status - it's status of the whole Manual run group - can be Pending, Running,
Created at - when user execute manual rule run
Source event time range - it's the date range which user select when execute manual rule run

Also each Manual run can have multiple tasks/rule execution to cover this date range:

Total - total amount of tasks (rule executions) which this manual run has.
Completed - number of completed tasks/rule executions
Running - number of tasks/rule executions which is progress
Pending - number of tasks which wait to be queued by task manager
Error - Number of failed tasks/rule executions

[approksiu]

@nastasha-solomon I have the suggestions for the following:

* **Total**: The total number of times this manual run was executed
* **Completed**: The number of completed manual run executions
* **Running**: The number of manual runs that are executing
* **Pending**: The number of manual runs that are waiting to execute
* **Error**: The number of failed manual run executions

Total: The total number of rule executions this manual run will execute
Completed: The number of completed manual run rule executions
Running: The number of manual run rule executions that are in progress
Pending: The number of manual run rule executions that are waiting to execute
Error: The number of failed manual run rule executions

[approksiu]

Suggestion for the tooltip copy for the above screenshot:
"Applies to manual run rule executions. The actual time range will also include lookback time according to the rule settings."
cc @nastasha-solomon @nkhristinin

[approksiu]

How about "View and manage active manual runs" for the info under "Manual runs" table header? cc @nastasha-solomon @nkhristinin

[approksiu]

2. See notes below for the copy that appears in the confirmation modal:
   #### Title
   Our [UI copy guidelines](https://eui.elastic.co/#/guidelines/writing/guidelines#messages) say to avoid using "Are you sure", and to be more direct when addressing users. Here's a few options for the title in the confirmation message:
   
   * **Option 1:** Stop running this rule
   * **Option 2:** Stop this rule run
   * **Option 3:** Stop the rule from running
   
   #### Body text
   ~I'm not quite sure what the text in the body explains. It sort of looks like a user manually ran a rule multiple times, and the first run, plus every subsequent run after that, is being stopped. If that's the case, here's some potential revisions:~
   ~- **Option 1:** The current rule run, and any other that you set up, will be stopped.~
   ~- **Option 2:** This action stops the current rule run and any additional ones that you set up.~
   Updated copy options for the body text:
   
   * **Option 1:** The current rule run and pending ones will be stopped.
   * **Option 2:** This action stops the current rule run and any pending ones.

For the Title, let's use Option 2: Stop this rule run
For the Body, I'd suggest to use something like: "All the pending rule executions for this manual rule run will be stopped".

@nastasha-solomon what do you think?
cc @nkhristinin

[nkhristinin]

@nastasha-solomon do you thinks it's clear from this UI, what total,completed,error etc means?

[nastasha-solomon]

Thanks for providing a starting point, @nkhristinin. Here's my crack at the descriptions for the table columns:

(Note that some of these descriptions are identical to the corresponding columns in the Execution log table.)

• Status: Overall status of execution
• Created at: When the manual run was started
• Source event time range: The date and time range selected for the manual run
• Total: The total number of times this manual run was executed
• Completed: The number of completed manual run executions
• Running: The number of manual runs that are executing
• Pending: The number of manual runs that are waiting to execute
• Error: The number of failed manual run executions

[approksiu]

1. I'd recommend changing "Stop" to "Stop run" or "Stop rule run". Making the command more descriptive helps our users understand what they're stopping. It's also helpful for those relying on screen readers to navigate the UI.

I vote for "Stop run" option. cc @nastasha-solomon @nkhristinin