[SIEM] [ML] Improve UX around managing ML Rules/Jobs

[spong]

In 7.7 the ML Rule type was introduced, which now tightly couples the running of a Detection Rule to the running of a ML Job. As a byproduct of this, we now have a few user flows we can improve UX around in effort to ensure that a user isn't enabling an ML Rule without also enabling the ML Job (and thus preventing a known error state).

Some of these enhancements were captured in #62396, which helped to add additional messaging when a user was enabling an ML Rule when the ML Job was not running, as well as #62383, which marks a Rule as failed if the ML Job is not running when the rule executes (ensuring Rule Details gives a clear picture to the user as to why a ML Rule is not functioning).

This issue is for capturing any remaining enhancements we can implement to provide a better UX around managing ML Rules and ML Jobs, including:

• Providing a prompt when enabling a rule:
  • During create flow
  • Within Rule Details
  • On All Rules Table
• Adding an Empty View to the Host/Network Anomalies Tables that provides a CTA to enabling ML Jobs
• Adding a generic CTA to the Host/Network Anomalies Tables for enabling/disabling ML Job

To capture the comments from #58053

@marrasherrier:

From slack conversation:

Screen Recording 2020-04-14 at 9.31.41 AM.mov.zip

@spong:
The only thing I'm wondering about is with the anomalies table, and what logic we'll use to show the empty view. I think no jobs running + no data is probably the best bet. And of course if no permissions, whatever placeholder upsell/talk to your admin copy we want.

If there is anomaly data do show, will the button to enable jobs still be present (top right maybe?)

@marrasherrier:

@spong what do you mean by "no jobs running + no data is probably the best bet?"

I will update designs to include these 3 use cases:

• anamoly data present
• no anamoly data (because no persmissions)
• no anamoly data (because no jobs + no data)

And to respond to:

what do you mean by "no jobs running + no data is probably the best bet?"

This is just the criteria I'm thinking we want to use for when the empty view is shown. I'm thinking this'll be best for both FTUE and handling corner cases where you don't have ML jobs running anymore (either permissions downgrade or just disabled) but still have anomaly data.

cc @marrasherrier @rylnd @MikePaquette

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)