[Detection engine] Some UX for rule creation

[XavierM]

Summary

• Step headers should utilize sentence casing. Please change “Define Rule” to “Define rule”, “About Rule” to “About rule” and “Schedule Rule” to “Schedule rule”.
• The “Index patterns” field validation text uses an incorrect plural. Suggest changing to “A minimum of one index pattern is required.”
• I love your addition of the “Only favorites” filter button to the “Timeline template” field dropdown. Can we just alter the layout slightly and possibly add an indicator showing which timeline is favorited versus unfavorited in the list? I’ve updated my Figma design to reflect this request. (X)
  
• Selected check icons and subsequent text are not aligned as shown in the EuiSelectable documentation examples and the Figma design updates in the “Timeline template” field dropdown. Would it be possible to update the alignment as shown in the Figma designs? (X)
• Can the “Add reference” button text for the “Reference URLs” field be changed to “Add reference URL”? (X)
• Can the “False positives” field label be renamed to “False positive examples” and the subsequent “Add false positive” button text be changed to “Add false positive example”? (X)
• For both the “Reference URLs” and “False positive examples” fields, if the user begins to type a string in the input and then goes back and deletes it, the entire input element is suddenly removed. This could be very confusing for a user who is just potentially editing their text. Can we leave the input element present, even if the user deletes text that they had in it? The field should only be removed when clicking the trash button icon. (X)
• The subordinate actions for “Add reference URL” and “Add false positive example” do not appear to work unless the preceding field is filled. This confused me at first, as I thought it was broken when I attempted to add multiple at once. Can we allow users to add reference URLs and false positive examples without requiring they have the fields filled first? (X)
• If a user has not yet selected a “MITRE ATT&CK tactic” for a given row, the related “MITRE ATT&CK technique” should be disabled without a placeholder, as indicated in the updated mockups. Only once a tactic has been selected, the technique field should be enabled with accompanying placeholder. (X)

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

• [ ] This was checked for cross-browser compatibility, including a check against IE11
• [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• [ ] Documentation was added for features that require explanation or tutorials
• [ ] Unit or functional tests were updated or added to match the most common scenarios
• [ ] This was checked for keyboard-only and screenreader accessibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately
• This includes a feature addition or change that requires a release note and was labeled appropriately

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[XavierM]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 2f95402

History

• 💔 Build #19337 failed c06017c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[MichaelMarcialis]

This looks good from my perspective. Thanks @XavierM!