[SIEM] Fixes FTUE when APM node is present

[spong]

Summary

This PR resolves #56363 found in 7.6 BC4, where configuring a cloud instance with an APM node would circumvent our FTUE checks and would show the Overview Page when no data is present.

As detailed in the above issue, this resolves the problem by performing a similar check as to what APM performs to determine their empty data state.

As can be observed in the gifs below, this check adds additional latency to the full-app flicker, which is not ideal... Perhaps we can tweak the query further to improve this?

Deployment w/o APM node:

Deployment w/ APM node:

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

• This was checked for cross-browser compatibility, including a check against IE11
• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• This was checked for keyboard-only and screenreader accessibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately
• This includes a feature addition or change that requires a release note and was labeled appropriately

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[tsg]

About the flicker, does that mean that there's no extra delay on normal load? If yes, then I'd say that's a reasonable compromise, we want to optimize for the normal operation.

[XavierM]

Not for this PR ;) I am wondering with the new platform life cycle set up and start if we can try to put this query/hook in the set up life cycle to get all this information when we have the Kibana loader. So when we start SIEM this query is already done with all the data need it.

[spong]

@XavierM -- @andrew-goldstein and I were contemplating how we could tighten this up with some new platform magic like you mentioned. Having all this information gathered by the time SIEM starts would be ideal 🙂

For now though, another option would be to not do these checks in parallel, but rather just do the SIEM specific check first since it's so quick (just checking for shard count), and then only do the APM check if that returns 0. This would ensure the same speedy normal load throughout the app when there's SIEM data, and keep the FTUE flicker to around the same as it is in the second gif above (since that SIEM specific check is so quick).

[spong]

FYI: I've updated the flow here as as detailed in the second half of my comment above. This will keep normal app usage snappy on initial loads (or at least as it is currently), while not ballooning the FTUE flicker too much since the SIEM index check is so quick.

[XavierM]

during my review, I was wondering if we will be better later on to do a special empty prompt where we used the APM data. To differentiate it to the end-user. Instead to make it globally.

[XavierM]

Reviewed/Tested LGTM

[spong]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 8a48874

History

• 💚 Build #23902 succeeded 34dfdf0
• 💚 Build #23884 succeeded 4f5b60a

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[aisantos]

SIEM/Security dashboard appears one second or so before the "Add Data" splash page. Adding the Slack thread link here for reference on further discussion.