This is a current pain point for users that we are doing near-real time detection so far but we haven't gotten to doing specific interval rule runs. We are hoping to get to that feature.
But I do have some good news for you, you do have some work-arounds, abilities for you to utilize that can still get the job done.
The first one that is really nice is in "advanced settings" you can pick a different time stamp and use something such as
event.ingested and then mark all of your documents with a timestamp that is close to the current date time.
Then the signals will pick it up and run against them and write out up to the 100 signals per rule run on anything it finds.
The second option for you, would be an incredibly long look back time that you can set and then run the rule(s) once and reset the look back time. This isn't as ideal and you can obviously get a lot of timeouts doing this as it is going to comb through a large volume of data at once, but it might help you out momentarily. If you go this route to do a large "catch up" I would recommend running only 1 or 2 rules at a time manually to get them caught up and then reset it to the standard settings.