[Security Solution] Threat intelligence tab displayed with no data

[gavinwye]

Describe the bug: The threat intel tab is displayed when there isn't any threat intel see screenshot

Kibana/Elasticsearch Stack version: v 7.16.1 from Edne

Original install method (e.g. download page, yum, from source, etc.): Eden

Functional Area (e.g. Endpoint management, timelines, resolver, etc.): Detect > Alerts

Current behavior: The threat intel tab is displayed when there isn't any threat intel see screenshot

Expected behavior: We shouldn't show users anything that they can't do anything about.

• we're showing a tab (or any other element) with no available data in it, users should not be able to refine the interface to nothing.
• the H5 Threat Match Detected implies that there is a match but the content below contradicts this heading We did not find threat intelligence that matches any of the indicator match rules, or any enrichment for this alert.
• the section headed Enriched with Threat Intelligence contains a date picker it's not clear from the interface what this date picker is for
• the date picker doesn't have aria labels to describe its role. Needs accessibility review, see attached report
• there is something wrong with the tab order of the date picker it's not possible to access the end date using the keyboard. Needs accessibility review, see attached report
• in the following paragraph of content We haven't found field value has additional information available from threat intelligence sources we searched in the past 30 days by default. it's not clear what the words field value means
• we don't provide users with a way to resolve this. If there isn't anything that users can do about this we should be hiding it from them.
• It's not clear from the design of the page if the take action button is related to the content of this tab or to the flyout overall

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.): Automatic accessibility audit of the date picker sec-xdr-19-reverse.prod-3.eden.elastic.dev-Alerts-Kibana-2021-12-21.csv

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[ecezalp]

this is not a bug exactly as we can't know whether there are going to be investigation time enrichments in the past unless the user uses the calendar. Tagging @monina-n @yiyangliu9286 and @paulewing for possible UX improvements

[gavinwye]

Thanks @ecezalp I'm working on Threat Intelligence now so I'm going to pick this up as part of that work.