[SIEM][Detection Engine] Modified gap detection util to accept all dateMath formats

[yctercero]

Summary

Modify signals utils gap detection functions to make use of @elastic/datemath. Should account for more edge cases - such as value to or from being ISO strings, invalid strings, or things other than their defaults.

Prior functionality allowed to to only be now and from to only be now-x.

To test using default rule schedule values, start Kibana -> post a rule -> shut down Kibana for 6+ minutes. You should see an error like the following show up:

[warning][plugins][siem] Signal rule name: "Query with a rule id", id: [ID HERE], rule_id: "query-rule-id" has a time gap of [TIME GAP HERE] minutes, and could be missing signals within that time. Consider increasing your look behind time or adding more Kibana instances.

Note that it seems there's checks for to and from to be valid date strings in ES so if you attempt to create a rule that does not use an ISO string, now, or now-x you'll get an error of ES yelling at you. In create_rules_schema.ts we're just checking for them to be strings.

Follow up to #54547

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

• This was checked for cross-browser compatibility, including a check against IE11
• Any text added follows EUI's writing guidelines, uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• This was checked for keyboard-only and screenreader accessibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately
• This includes a feature addition or change that requires a release note and was labeled appropriately

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[yctercero]

@elasticmachine merge upstream

[yctercero]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: bf98edf

History

• 💚 Build #23647 succeeded fabcd80
• 💚 Build #23633 succeeded 9a857b5
• 💛 Build #23580 was flaky 066c53d
• 💚 Build #23498 succeeded 897e642
• 💔 Build #23412 failed 9c5f3a2

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[FrankHassanabad]

Checked it out, tested it with a query that was 30 seconds, the Gap detection looks to be operating.

Thanks for letting me know you modeled the tests after the others from Kibana core with regards to mocking the times. That was a good thing for me to learn.

LGTM! Merge away and backport

[dhurley14]

Forgot to submit review but tested locally and everything looked great!