Kibana: [SIEM] Missing welcome screen in 7.6 BC4

[tsg]

Kibana version: 7.6.0 BC4

Describe the bug: It used to be that if you had no data in the Elasticsearch cluster, an intermediate page was blocking the app and was linking to Docs and Add Data button. This seems to be gone in BC4.

Steps to reproduce:

1. Start a Cloud instance and don't send any data.
2. Go to the SIEM app.

Looking at the indices, I think this might actually be a change in APM, which seems to pre-create their indices:

"apm-7.6.0-transaction-000001" : { "aliases" : { "apm-7.6.0-transaction" : { "is_write_index" : true } } }

Since we match on apm-*-transaction by default, that disable the Welcome screen.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[tsg]

I chatted to Silvia, this is not a recent change in APM. I thought I tested the above, but now I'm thinking that probably I disabled apm-server before starting the cluster last time.

[tsg]

More info from the APM team: This is how they test if an installation is "empty": "We check for data, specifically whether a terms aggregation on service.nam returns any results. See see x-pack/legacy/plugins/apm/public/components/app/ServiceOverview/index.tsx and x-pack/legacy/plugins/apm/server/lib/services/get_services/index.ts.

[spong]

Fix should be as simple as updating our server-side hasIndices check to include the above APM check. I'll touch base with @XavierM and see if this can't be implemented as a low impact fix.

Thanks @tsg @simitt @dgieselaar!