[Behavioral Analytics] Introduce empty state for events tab

[tutelaris]

Description

In order to proceed with the Behavioral Analytics introduction, it's required to introduce an empty state on the events tab, when there are no events, and remove this state once events start coming.

This PR is dedicated to introducing an empty state in the events tab.

Screen.Recording.2022-12-02.at.18.53.07.mov

[joemcelroy]

suggestion: as this is the purpose of the API, I wouldn't expect it to throw an error if the index doesn't exist. It should be a 2xx response with a boolean flag on whether the index exists or not.

[tutelaris]

I'm not sure. It's going to be not REST-compliant then, since we try to call exists in the scope of passed {collectionId}. If it was events/exists/{collectionId}, then it makes sense. Also, I wanted to be aligned with the Elasticsearch API, which returns 404 if the index doesn't exist and returns 200 with the payload when it exists

[joemcelroy]

Personally 4xx / 5xx errors should be reserved for genuinely unexpected responses. For example I would expect a 404 error here if the analytics collection didn't exist. I wouldn't expect a 404 for when the purpose of this endpoint is check if events index is present. My reasoning stems from APM monitoring where this 4xx/5xx would indicate an issue but its an expected response. Hope that makes sense.

[joemcelroy]

typo: incorrect test name

[joemcelroy]

typo: test name incorrect

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: ee89e5b

Failed CI Steps

• FTR Configs #48

Test Failures

• [job] [logs] FTR Configs #48 / APM API tests basic no data Service group counts with alerts "before all" hook for "returns the correct number of alerts"

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
enterpriseSearch	1881	1883	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
enterpriseSearch	2.0MB	2.0MB	+2.0KB

Unknown metric groups

ESLint disabled in files

id	before	after	diff
osquery	1	2	+1

ESLint disabled line counts

id	before	after	diff
enterpriseSearch	19	21	+2
fleet	60	66	+6
osquery	109	115	+6
securitySolution	445	451	+6
total			+20

Total ESLint disabled count

id	before	after	diff
enterpriseSearch	20	22	+2
fleet	69	75	+6
osquery	110	117	+7
securitySolution	521	527	+6
total			+21

History

• 💚 Build #94008 succeeded 0518d2a
• 💔 Build #94004 failed 8812b8e2e0d80f00d1fc1b608d1879c135bf3a14
• 💚 Build #92615 succeeded 6a731577298eaebaf404ca050fcd15d664dab5f1
• 💚 Build #92405 succeeded b74d535

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @tutelaris