[Security Solution] fixes rule preview works for form's invalid state

[denar50]

Summary

Enhance the function getIsRulePreviewDisabled so that it takes into account whether the threshold fields in the define step form are valid or not.
Additionally, this PR fixes the check for machine_learning inside getIsRulePreviewDisabled to return true when the learning job id list is empty.

Why not using the isValid property from the define step form to check whether the preview button is enabled or not?

That property is not populated until the validate function of the form is invoked. That function is asynchronous and therefore it is hard to call it on every render to determine if the preview button is disabled or not.
Alternatively we can change the preview button to act as a submit button. In this case it will always be enabled, and when the user clicks, the validation is triggered and the user will see the validation errors on the left hand side of the screen. The problem with this approach is that since the rule type selection buttons might be so big that it might be hard for the user to notice there are errors without scrolling the page.

This solves issue #173930

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: d0c7839

Failed CI Steps

• Osquery Cypress Tests #8
• Osquery Cypress Tests on Serverless #7

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	8.9MB	8.9MB	+349.0B

History

cc @denar50

[nkhristinin]

For me, it looks like we should have just one place that determines whether a rule is valid or not.

I like the idea of performing async validation when we click the Preview button.

Maybe, if the form is not valid, we can show a general message in the preview layout indicating that the rule is invalid.

Otherwise, we might face a similar situation in the future when adding new fields or validations, requiring us to duplicate the logic.

[denar50]

For me, it looks like we should have just one place that determines whether a rule is valid or not.

I like the idea of performing async validation when we click the Preview button.

Maybe, if the form is not valid, we can show a general message in the preview layout indicating that the rule is invalid.

Otherwise, we might face a similar situation in the future when adding new fields or validations, requiring us to duplicate the logic.

Totally agree with you. I opened a new PR with the implementation of the new approach #213801