…for day units (elastic#224083)

**Addresses:** elastic#223446

## Summary

This PR fixes an issue when time duration normalized to day(s) is shown as 0 seconds. The fix is performed by allowing using days time unit at rule schedule.

## Details

The issue happens when rule schedule's look-back gets normalized to day(s). The reason is that look-backs input doesn't support Days time unit. It leads to inability to parse the value and displaying the default value which is 0 seconds.

Rule schedule is shown to the users as rule `interval` and `look-back` while rule's SO saves the schedule by using three fields `interval`, `from` and `to`. Where `look-back` represents a logical value calculated as `lookback` = `to` - `from` - `interval`. Taking that into account it's becomes harder to maintain the original time duration unit value during prebuilt rules upgrade workflow (See elastic#204317 for more details).

The easiest way to fix this issue is to allow Days time unit in rule schedule inputs. On top of that 24 hours are always 1 day making hours the largest simply convertible time unit. The PR allows hours in rule schedule.

**Before:**

https://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605

**After:**

https://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a
(cherry picked from commit a013929)

…hedule for day units (#224083) (#224716)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Fix time duration normalization at rule schedule
for day units (#224083)](#224083)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-06-20T14:42:42Z","message":"[Security
Solution] Fix time duration normalization at rule schedule for day units
(#224083)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/223446\n\n## Summary\n\nThis PR
fixes an issue when time duration normalized to day(s) is shown as 0
seconds. The fix is performed by allowing using days time unit at rule
schedule.\n\n## Details\n\nThe issue happens when rule schedule's
look-back gets normalized to day(s). The reason is that look-backs input
doesn't support Days time unit. It leads to inability to parse the value
and displaying the default value which is 0 seconds.\n\nRule schedule is
shown to the users as rule `interval` and `look-back` while rule's SO
saves the schedule by using three fields `interval`, `from` and `to`.
Where `look-back` represents a logical value calculated as `lookback` =
`to` - `from` - `interval`. Taking that into account it's becomes harder
to maintain the original time duration unit value during prebuilt rules
upgrade workflow (See #204317 for
more details).\n\nThe easiest way to fix this issue is to allow Days
time unit in rule schedule inputs. On top of that 24 hours are always 1
day making hours the largest simply convertible time unit. The PR allows
hours in rule
schedule.\n\n**Before:**\n\nhttps://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605\n\n**After:**\n\nhttps://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a","sha":"a013929fda4dbae08b52d8258c37cb4c144a83f5","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Feature:Detection
Rules","Team:Detections and Resp","Team:
SecuritySolution","Team:Detection Rule
Management","backport:version","v9.1.0","v8.19.0"],"title":"[Security
Solution] Fix time duration normalization at rule schedule for day
units","number":224083,"url":"https://github.com/elastic/kibana/pull/224083","mergeCommit":{"message":"[Security
Solution] Fix time duration normalization at rule schedule for day units
(#224083)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/223446\n\n## Summary\n\nThis PR
fixes an issue when time duration normalized to day(s) is shown as 0
seconds. The fix is performed by allowing using days time unit at rule
schedule.\n\n## Details\n\nThe issue happens when rule schedule's
look-back gets normalized to day(s). The reason is that look-backs input
doesn't support Days time unit. It leads to inability to parse the value
and displaying the default value which is 0 seconds.\n\nRule schedule is
shown to the users as rule `interval` and `look-back` while rule's SO
saves the schedule by using three fields `interval`, `from` and `to`.
Where `look-back` represents a logical value calculated as `lookback` =
`to` - `from` - `interval`. Taking that into account it's becomes harder
to maintain the original time duration unit value during prebuilt rules
upgrade workflow (See #204317 for
more details).\n\nThe easiest way to fix this issue is to allow Days
time unit in rule schedule inputs. On top of that 24 hours are always 1
day making hours the largest simply convertible time unit. The PR allows
hours in rule
schedule.\n\n**Before:**\n\nhttps://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605\n\n**After:**\n\nhttps://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a","sha":"a013929fda4dbae08b52d8258c37cb4c144a83f5"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/224083","number":224083,"mergeCommit":{"message":"[Security
Solution] Fix time duration normalization at rule schedule for day units
(#224083)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/223446\n\n## Summary\n\nThis PR
fixes an issue when time duration normalized to day(s) is shown as 0
seconds. The fix is performed by allowing using days time unit at rule
schedule.\n\n## Details\n\nThe issue happens when rule schedule's
look-back gets normalized to day(s). The reason is that look-backs input
doesn't support Days time unit. It leads to inability to parse the value
and displaying the default value which is 0 seconds.\n\nRule schedule is
shown to the users as rule `interval` and `look-back` while rule's SO
saves the schedule by using three fields `interval`, `from` and `to`.
Where `look-back` represents a logical value calculated as `lookback` =
`to` - `from` - `interval`. Taking that into account it's becomes harder
to maintain the original time duration unit value during prebuilt rules
upgrade workflow (See #204317 for
more details).\n\nThe easiest way to fix this issue is to allow Days
time unit in rule schedule inputs. On top of that 24 hours are always 1
day making hours the largest simply convertible time unit. The PR allows
hours in rule
schedule.\n\n**Before:**\n\nhttps://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605\n\n**After:**\n\nhttps://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a","sha":"a013929fda4dbae08b52d8258c37cb4c144a83f5"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>

…for day units (elastic#224083)

**Addresses:** elastic#223446

## Summary

This PR fixes an issue when time duration normalized to day(s) is shown as 0 seconds. The fix is performed by allowing using days time unit at rule schedule.

## Details

The issue happens when rule schedule's look-back gets normalized to day(s). The reason is that look-backs input doesn't support Days time unit. It leads to inability to parse the value and displaying the default value which is 0 seconds.

Rule schedule is shown to the users as rule `interval` and `look-back` while rule's SO saves the schedule by using three fields `interval`, `from` and `to`. Where `look-back` represents a logical value calculated as `lookback` = `to` - `from` - `interval`. Taking that into account it's becomes harder to maintain the original time duration unit value during prebuilt rules upgrade workflow (See elastic#204317 for more details).

The easiest way to fix this issue is to allow Days time unit in rule schedule inputs. On top of that 24 hours are always 1 day making hours the largest simply convertible time unit. The PR allows hours in rule schedule.

**Before:**

https://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605

**After:**

https://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a

…for day units (elastic#224083)

**Addresses:** elastic#223446

## Summary

This PR fixes an issue when time duration normalized to day(s) is shown as 0 seconds. The fix is performed by allowing using days time unit at rule schedule.

## Details

The issue happens when rule schedule's look-back gets normalized to day(s). The reason is that look-backs input doesn't support Days time unit. It leads to inability to parse the value and displaying the default value which is 0 seconds.

Rule schedule is shown to the users as rule `interval` and `look-back` while rule's SO saves the schedule by using three fields `interval`, `from` and `to`. Where `look-back` represents a logical value calculated as `lookback` = `to` - `from` - `interval`. Taking that into account it's becomes harder to maintain the original time duration unit value during prebuilt rules upgrade workflow (See elastic#204317 for more details).

The easiest way to fix this issue is to allow Days time unit in rule schedule inputs. On top of that 24 hours are always 1 day making hours the largest simply convertible time unit. The PR allows hours in rule schedule.

**Before:**

https://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605

**After:**

https://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a
(cherry picked from commit a013929)

…for day units (elastic#224083)

**Addresses:** elastic#223446

## Summary

This PR fixes an issue when time duration normalized to day(s) is shown as 0 seconds. The fix is performed by allowing using days time unit at rule schedule.

## Details

The issue happens when rule schedule's look-back gets normalized to day(s). The reason is that look-backs input doesn't support Days time unit. It leads to inability to parse the value and displaying the default value which is 0 seconds.

Rule schedule is shown to the users as rule `interval` and `look-back` while rule's SO saves the schedule by using three fields `interval`, `from` and `to`. Where `look-back` represents a logical value calculated as `lookback` = `to` - `from` - `interval`. Taking that into account it's becomes harder to maintain the original time duration unit value during prebuilt rules upgrade workflow (See elastic#204317 for more details).

The easiest way to fix this issue is to allow Days time unit in rule schedule inputs. On top of that 24 hours are always 1 day making hours the largest simply convertible time unit. The PR allows hours in rule schedule.

**Before:**

https://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605

**After:**

https://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a
(cherry picked from commit a013929)

…hedule for day units (#224083) (#225424)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Fix time duration normalization at rule schedule
for day units (#224083)](#224083)

<!--- Backport version: 10.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-06-20T14:42:42Z","message":"[Security
Solution] Fix time duration normalization at rule schedule for day units
(#224083)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/223446\n\n## Summary\n\nThis PR
fixes an issue when time duration normalized to day(s) is shown as 0
seconds. The fix is performed by allowing using days time unit at rule
schedule.\n\n## Details\n\nThe issue happens when rule schedule's
look-back gets normalized to day(s). The reason is that look-backs input
doesn't support Days time unit. It leads to inability to parse the value
and displaying the default value which is 0 seconds.\n\nRule schedule is
shown to the users as rule `interval` and `look-back` while rule's SO
saves the schedule by using three fields `interval`, `from` and `to`.
Where `look-back` represents a logical value calculated as `lookback` =
`to` - `from` - `interval`. Taking that into account it's becomes harder
to maintain the original time duration unit value during prebuilt rules
upgrade workflow (See #204317 for
more details).\n\nThe easiest way to fix this issue is to allow Days
time unit in rule schedule inputs. On top of that 24 hours are always 1
day making hours the largest simply convertible time unit. The PR allows
hours in rule
schedule.\n\n**Before:**\n\nhttps://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605\n\n**After:**\n\nhttps://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a","sha":"a013929fda4dbae08b52d8258c37cb4c144a83f5","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Rule Creation","Feature:Rule
Edit","backport:version","v9.1.0","v8.19.0"],"title":"[Security
Solution] Fix time duration normalization at rule schedule for day
units","number":224083,"url":"https://github.com/elastic/kibana/pull/224083","mergeCommit":{"message":"[Security
Solution] Fix time duration normalization at rule schedule for day units
(#224083)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/223446\n\n## Summary\n\nThis PR
fixes an issue when time duration normalized to day(s) is shown as 0
seconds. The fix is performed by allowing using days time unit at rule
schedule.\n\n## Details\n\nThe issue happens when rule schedule's
look-back gets normalized to day(s). The reason is that look-backs input
doesn't support Days time unit. It leads to inability to parse the value
and displaying the default value which is 0 seconds.\n\nRule schedule is
shown to the users as rule `interval` and `look-back` while rule's SO
saves the schedule by using three fields `interval`, `from` and `to`.
Where `look-back` represents a logical value calculated as `lookback` =
`to` - `from` - `interval`. Taking that into account it's becomes harder
to maintain the original time duration unit value during prebuilt rules
upgrade workflow (See #204317 for
more details).\n\nThe easiest way to fix this issue is to allow Days
time unit in rule schedule inputs. On top of that 24 hours are always 1
day making hours the largest simply convertible time unit. The PR allows
hours in rule
schedule.\n\n**Before:**\n\nhttps://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605\n\n**After:**\n\nhttps://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a","sha":"a013929fda4dbae08b52d8258c37cb4c144a83f5"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/224083","number":224083,"mergeCommit":{"message":"[Security
Solution] Fix time duration normalization at rule schedule for day units
(#224083)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/223446\n\n## Summary\n\nThis PR
fixes an issue when time duration normalized to day(s) is shown as 0
seconds. The fix is performed by allowing using days time unit at rule
schedule.\n\n## Details\n\nThe issue happens when rule schedule's
look-back gets normalized to day(s). The reason is that look-backs input
doesn't support Days time unit. It leads to inability to parse the value
and displaying the default value which is 0 seconds.\n\nRule schedule is
shown to the users as rule `interval` and `look-back` while rule's SO
saves the schedule by using three fields `interval`, `from` and `to`.
Where `look-back` represents a logical value calculated as `lookback` =
`to` - `from` - `interval`. Taking that into account it's becomes harder
to maintain the original time duration unit value during prebuilt rules
upgrade workflow (See #204317 for
more details).\n\nThe easiest way to fix this issue is to allow Days
time unit in rule schedule inputs. On top of that 24 hours are always 1
day making hours the largest simply convertible time unit. The PR allows
hours in rule
schedule.\n\n**Before:**\n\nhttps://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605\n\n**After:**\n\nhttps://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a","sha":"a013929fda4dbae08b52d8258c37cb4c144a83f5"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/224716","number":224716,"state":"MERGED","mergeCommit":{"sha":"0163914af918d1ee0181d731224f00e14cadc4db","message":"[8.19]
[Security Solution] Fix time duration normalization at rule schedule for
day units (#224083) (#224716)\n\n# Backport\n\nThis will backport the
following commits from `main` to `8.19`:\n- [[Security Solution] Fix
time duration normalization at rule schedule\nfor day units
(#224083)](https://github.com/elastic/kibana/pull/224083)\n\n\n\n###
Questions ?\nPlease refer to the [Backport
tool\ndocumentation](https://github.com/sorenlouv/backport)\n\n\n\nCo-authored-by:
Maxim Palenov <maxim.palenov@elastic.co>"}}]}] BACKPORT-->

…edule for day units (#224083) (#226388)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Fix time duration normalization at rule schedule
for day units (#224083)](#224083)

<!--- Backport version: 10.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-06-20T14:42:42Z","message":"[Security
Solution] Fix time duration normalization at rule schedule for day units
(#224083)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/223446\n\n## Summary\n\nThis PR
fixes an issue when time duration normalized to day(s) is shown as 0
seconds. The fix is performed by allowing using days time unit at rule
schedule.\n\n## Details\n\nThe issue happens when rule schedule's
look-back gets normalized to day(s). The reason is that look-backs input
doesn't support Days time unit. It leads to inability to parse the value
and displaying the default value which is 0 seconds.\n\nRule schedule is
shown to the users as rule `interval` and `look-back` while rule's SO
saves the schedule by using three fields `interval`, `from` and `to`.
Where `look-back` represents a logical value calculated as `lookback` =
`to` - `from` - `interval`. Taking that into account it's becomes harder
to maintain the original time duration unit value during prebuilt rules
upgrade workflow (See #204317 for
more details).\n\nThe easiest way to fix this issue is to allow Days
time unit in rule schedule inputs. On top of that 24 hours are always 1
day making hours the largest simply convertible time unit. The PR allows
hours in rule
schedule.\n\n**Before:**\n\nhttps://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605\n\n**After:**\n\nhttps://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a","sha":"a013929fda4dbae08b52d8258c37cb4c144a83f5","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Rule Creation","Feature:Rule
Edit","backport:version","v9.1.0","v8.19.0"],"title":"[Security
Solution] Fix time duration normalization at rule schedule for day
units","number":224083,"url":"https://github.com/elastic/kibana/pull/224083","mergeCommit":{"message":"[Security
Solution] Fix time duration normalization at rule schedule for day units
(#224083)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/223446\n\n## Summary\n\nThis PR
fixes an issue when time duration normalized to day(s) is shown as 0
seconds. The fix is performed by allowing using days time unit at rule
schedule.\n\n## Details\n\nThe issue happens when rule schedule's
look-back gets normalized to day(s). The reason is that look-backs input
doesn't support Days time unit. It leads to inability to parse the value
and displaying the default value which is 0 seconds.\n\nRule schedule is
shown to the users as rule `interval` and `look-back` while rule's SO
saves the schedule by using three fields `interval`, `from` and `to`.
Where `look-back` represents a logical value calculated as `lookback` =
`to` - `from` - `interval`. Taking that into account it's becomes harder
to maintain the original time duration unit value during prebuilt rules
upgrade workflow (See #204317 for
more details).\n\nThe easiest way to fix this issue is to allow Days
time unit in rule schedule inputs. On top of that 24 hours are always 1
day making hours the largest simply convertible time unit. The PR allows
hours in rule
schedule.\n\n**Before:**\n\nhttps://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605\n\n**After:**\n\nhttps://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a","sha":"a013929fda4dbae08b52d8258c37cb4c144a83f5"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/224083","number":224083,"mergeCommit":{"message":"[Security
Solution] Fix time duration normalization at rule schedule for day units
(#224083)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/223446\n\n## Summary\n\nThis PR
fixes an issue when time duration normalized to day(s) is shown as 0
seconds. The fix is performed by allowing using days time unit at rule
schedule.\n\n## Details\n\nThe issue happens when rule schedule's
look-back gets normalized to day(s). The reason is that look-backs input
doesn't support Days time unit. It leads to inability to parse the value
and displaying the default value which is 0 seconds.\n\nRule schedule is
shown to the users as rule `interval` and `look-back` while rule's SO
saves the schedule by using three fields `interval`, `from` and `to`.
Where `look-back` represents a logical value calculated as `lookback` =
`to` - `from` - `interval`. Taking that into account it's becomes harder
to maintain the original time duration unit value during prebuilt rules
upgrade workflow (See #204317 for
more details).\n\nThe easiest way to fix this issue is to allow Days
time unit in rule schedule inputs. On top of that 24 hours are always 1
day making hours the largest simply convertible time unit. The PR allows
hours in rule
schedule.\n\n**Before:**\n\nhttps://github.com/user-attachments/assets/4f2038f1-4a6a-4a88-b86e-381a5b717605\n\n**After:**\n\nhttps://github.com/user-attachments/assets/74875bf2-9341-425f-a35f-c8b088c1ef6a","sha":"a013929fda4dbae08b52d8258c37cb4c144a83f5"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/224716","number":224716,"state":"MERGED","mergeCommit":{"sha":"0163914af918d1ee0181d731224f00e14cadc4db","message":"[8.19]
[Security Solution] Fix time duration normalization at rule schedule for
day units (#224083) (#224716)\n\n# Backport\n\nThis will backport the
following commits from `main` to `8.19`:\n- [[Security Solution] Fix
time duration normalization at rule schedule\nfor day units
(#224083)](https://github.com/elastic/kibana/pull/224083)\n\n\n\n###
Questions ?\nPlease refer to the [Backport
tool\ndocumentation](https://github.com/sorenlouv/backport)\n\n\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>"}},{"url":"https://github.com/elastic/kibana/pull/225424","number":225424,"branch":"8.18","state":"OPEN"}]}]
BACKPORT-->