[One workflow] Event tab empty state in execute modal

[yngrdyn]

Relates to https://github.com/elastic/security-team/issues/16717.

Summary

When the event tab loads and the trigger-events search returns zero hits, show a dedicated empty state instead of an empty data grid. Copy is honest about time range and KQL (not “no events ever”), and points authors to practical next steps: widen the range, edit the query, open Manual, or fire a real event.

Motivation

Authors testing event-driven workflows often open the event tab before any rows appear in the default window (now-15m → now plus workflow triggerId scope). An empty grid with no explanation reads like a broken search. We need guidance that matches what the API actually returns: zero documents for the current time range and query—not a guarantee that the trigger has never fired.

UX behavior

Empty state renders when:

• Trigger-event search has finished loading (DataLoadingState.loaded)
• Search is not in error
• total === 0
• Workflows events data view is ready

Two copy variants

Condition	Title	Guidance
Default workflow trigger scope in KQL (triggerId: …)	No events in the selected time range	Widen time range, adjust search-bar query, Manual tab, or trigger a real event and refresh
User changed KQL from default scope	No events match your search	Widen time range, adjust query, or Manual tab

Scope detection uses isDefaultTriggerEventSearchScope() (compares submitted KQL to buildDefaultTriggerEventSearchQuery()).

🎥 Demo

Screen.Recording.2026-05-29.at.23.39.21.mov

[h88]

LGTM.
For consideration: 1- higher test coverage (custom-KQL variant \etc...) 2- consider !isFetching in the empty state condition if you see a "flash"🪩 while refetching (reading the condition / haven't verified locally)

[kibanamachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 114771a
• Build duration: 52 mins

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
workflowsManagement	1893	1894	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
workflowsManagement	2.5MB	2.5MB	+2.1KB

History

• 💛 Build #450682 was flaky 02f8f0b
• 💛 Build #450578 was flaky 060eb8e

cc @yngrdyn