[Security Solution] Address guided onboarding feedback for the rules area

[xcrzx]

Related to: #144016

Summary

This follow-up PR addresses guided onboarding feedback mentioned here and here.

To summarize:

• We're keeping the first step (install prebuilt rules) intact, but most users wouldn't see it as the rules are installed automatically during previous stages. This step is needed to cover edge cases when rules were deleted for some reason.
• We're splitting the second step into two: 1) search the first rule and 2) activate it.
• We're adding "Next" buttons to these steps.
• For the search step, the "Next" button will automatically filter the rules table, so the first rule becomes visible.
• For the activate step, the "Next" button automatically activates the first rule.
• The "Next" button stays optional; we still automatically progress the guide once user actions satisfy certain conditions, like the user filtered the rules table manually or activated the first rule by clicking its toggle.

Find rule step

Enable rule step

Testing instructions

1. Add feature flag to kibana.dev.yml: xpack.securitySolution.enableExperimental: ['guidedOnboarding']
2. Add also cloud ID to mimic a cloud environment: xpack.cloud.id: "x"
3. Run kibana with examples: yarn start --run-examples
4. Go to /app/guidedOnboardingExample
5. Use the "Set guide state" section to set Guide to security and Step ID to rules
6. The Setup guide menu will automatically open. Hit the "Start" button
7. You will be redirected to the rules management page with tour steps active.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[maximpn]

@xcrzx The changes LGTM

There is a comment for improvement.

[maximpn]

The idea that only demoRule is needed so it's possible to check if that rule is loaded. So the functionality can be moved to a separate hook like useDemoRule() which returns demoRule and isLoading which should be enough to properly determine the tourStatus.

[xcrzx]

Yes, I like that idea 👍 We could improve that in a follow-up if you don't mind.

[maximpn]

Sounds good

[maximpn]

I'm just curious why enum keys are string literals while it can be started with capital case keys as in the TypeScript docs? So it could be

export enum GuidedOnboardingRulesStatus {
  Inactive = 'inactive',
  InstallRules = 'installRules',
  ...
}

[xcrzx]

Hmm, no intention here, to be honest. FWIW, in security solution, enum formats are not very consistent, but the most widespread one is CamelCase for names and snake_case for members:

I'd stick to it for consistency.

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 92c8273

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	9.6MB	9.6MB	+1.4KB

Unknown metric groups

ESLint disabled in files

id	before	after	diff
osquery	1	2	+1

ESLint disabled line counts

id	before	after	diff
enterpriseSearch	19	21	+2
fleet	59	65	+6
osquery	108	113	+5
securitySolution	441	447	+6
total			+19

Total ESLint disabled count

id	before	after	diff
enterpriseSearch	20	22	+2
fleet	67	73	+6
osquery	109	115	+6
securitySolution	518	524	+6
total			+20

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @xcrzx