diff --git a/docs/user/alerting/alerting-getting-started.asciidoc b/docs/user/alerting/alerting-getting-started.asciidoc
index 8c17f8ec93b96..b699c56ebd944 100644
--- a/docs/user/alerting/alerting-getting-started.asciidoc
+++ b/docs/user/alerting/alerting-getting-started.asciidoc
@@ -136,9 +136,4 @@ Functionally, {kib} alerting differs in that:
 At a higher level, {kib} alerting allows rich integrations across use cases like <<xpack-apm,*APM*>>, <<metrics-app,*Metrics*>>, <<xpack-siem,*Security*>>, and <<uptime-app,*Uptime*>>.
 Pre-packaged *rule types* simplify setup and hide the details of complex, domain-specific detections, while providing a consistent interface across {kib}.
 
-[float]
-[[alerting-setup-prerequisites]]
-== Prerequisites
-<<alerting-prerequisites, Alerting prerequisites>> 
-
 --
\ No newline at end of file
diff --git a/docs/user/alerting/alerting-setup.asciidoc b/docs/user/alerting/alerting-setup.asciidoc
index 39f1af0030e0a..2ae5160069f0a 100644
--- a/docs/user/alerting/alerting-setup.asciidoc
+++ b/docs/user/alerting/alerting-setup.asciidoc
@@ -1,8 +1,8 @@
 [role="xpack"]
 [[alerting-setup]]
-== Alerting Setup
+== Alerting Set up
 ++++
-<titleabbrev>Setup</titleabbrev>
+<titleabbrev>Set up</titleabbrev>
 ++++
 
 The Alerting feature is automatically enabled in {kib}, but might require some additional configuration.
diff --git a/docs/user/alerting/defining-rules.asciidoc b/docs/user/alerting/defining-rules.asciidoc
deleted file mode 100644
index 686a7bbc8a37b..0000000000000
--- a/docs/user/alerting/defining-rules.asciidoc
+++ /dev/null
@@ -1,11 +0,0 @@
-[role="xpack"]
-[[defining-alerts]]
-== Defining rules
-
-This content has been moved to <<create-and-manage-rules>>.
-
-[float]
-[[defining-alerts-general-details]]
-==== General rule details
-
-This content has been moved to <<create-and-manage-rules>>.
\ No newline at end of file
diff --git a/docs/user/alerting/index.asciidoc b/docs/user/alerting/index.asciidoc
index 9ab6a2dc46ebf..957d99a54ebaa 100644
--- a/docs/user/alerting/index.asciidoc
+++ b/docs/user/alerting/index.asciidoc
@@ -1,7 +1,5 @@
 include::alerting-getting-started.asciidoc[]
 include::alerting-setup.asciidoc[]
 include::create-and-manage-rules.asciidoc[]
-include::defining-rules.asciidoc[]
-include::rule-management.asciidoc[]
 include::rule-types.asciidoc[]
 include::alerting-troubleshooting.asciidoc[]
diff --git a/docs/user/alerting/rule-management.asciidoc b/docs/user/alerting/rule-management.asciidoc
deleted file mode 100644
index d6349a60e08eb..0000000000000
--- a/docs/user/alerting/rule-management.asciidoc
+++ /dev/null
@@ -1,5 +0,0 @@
-[role="xpack"]
-[[alert-management]]
-== Managing rules
-
-This content has been moved to <<create-and-manage-rules>>.
\ No newline at end of file
diff --git a/docs/user/alerting/rule-types.asciidoc b/docs/user/alerting/rule-types.asciidoc
index bb840014fe80f..f7f57d2f845a0 100644
--- a/docs/user/alerting/rule-types.asciidoc
+++ b/docs/user/alerting/rule-types.asciidoc
@@ -15,7 +15,7 @@ see {subscriptions}[the subscription page].
 [[stack-rules]]
 === Stack rules
 
-<<alert-management, Stack rules>> are built into {kib}.  To access the *Stack Rules* feature and create and edit rules, users require the `all` privilege. See <<kibana-feature-privileges, feature privileges>> for more information.
+<<create-and-manage-rules, Stack rules>> are built into {kib}.  To access the *Stack Rules* feature and create and edit rules, users require the `all` privilege. See <<kibana-feature-privileges, feature privileges>> for more information.
 
 [cols="2*<"]
 |===
diff --git a/docs/user/security/audit-logging.asciidoc b/docs/user/security/audit-logging.asciidoc
index b9fc0c9c4ac46..5808e56d6d289 100644
--- a/docs/user/security/audit-logging.asciidoc
+++ b/docs/user/security/audit-logging.asciidoc
@@ -93,9 +93,9 @@ Refer to the corresponding {es} logs for potential write errors.
 | `unknown` | User is creating a connector.
 | `failure` | User is not authorized to create a connector.
 
-.2+| `alert_create`
-| `unknown` | User is creating an alert.
-| `failure` | User is not authorized to create an alert.
+.2+| `rule_create`
+| `unknown` | User is creating a rule.
+| `failure` | User is not authorized to create a rule.
 
 .2+| `space_create`
 | `unknown` | User is creating a space.
@@ -128,38 +128,38 @@ Refer to the corresponding {es} logs for potential write errors.
 | `unknown` | User is updating a connector.
 | `failure` | User is not authorized to update a connector.
 
-.2+| `alert_update`
-| `unknown` | User is updating an alert.
-| `failure` | User is not authorized to update an alert.
+.2+| `rule_update`
+| `unknown` | User is updating a rule.
+| `failure` | User is not authorized to update a rule.
 
-.2+| `alert_update_api_key`
-| `unknown` | User is updating the API key of an alert.
-| `failure` | User is not authorized to update the API key of an alert.
+.2+| `rule_update_api_key`
+| `unknown` | User is updating the API key of a rule.
+| `failure` | User is not authorized to update the API key of a rule.
 
-.2+| `alert_enable`
-| `unknown` | User is enabling an alert.
-| `failure` | User is not authorized to enable an alert.
+.2+| `rule_enable`
+| `unknown` | User is enabling a rule.
+| `failure` | User is not authorized to enable a rule.
 
-.2+| `alert_disable`
-| `unknown` | User is disabling an alert.
-| `failure` | User is not authorized to disable an alert.
+.2+| `rule_disable`
+| `unknown` | User is disabling a rule.
+| `failure` | User is not authorized to disable a rule.
 
-.2+| `alert_mute`
+.2+| `rule_mute`
+| `unknown` | User is muting a rule.
+| `failure` | User is not authorized to mute a rule.
+
+.2+| `rule_unmute`
+| `unknown` | User is unmuting a rule.
+| `failure` | User is not authorized to unmute a rule.
+
+.2+| `rule_alert_mute`
 | `unknown` | User is muting an alert.
 | `failure` | User is not authorized to mute an alert.
 
-.2+| `alert_unmute`
+.2+| `rule_alert_unmute`
 | `unknown` | User is unmuting an alert.
 | `failure` | User is not authorized to unmute an alert.
 
-.2+| `alert_instance_mute`
-| `unknown` | User is muting an alert instance.
-| `failure` | User is not authorized to mute an alert instance.
-
-.2+| `alert_instance_unmute`
-| `unknown` | User is unmuting an alert instance.
-| `failure` | User is not authorized to unmute an alert instance.
-
 .2+| `space_update`
 | `unknown` | User is updating a space.
 | `failure` | User is not authorized to update a space.
@@ -183,9 +183,9 @@ Refer to the corresponding {es} logs for potential write errors.
 | `unknown` | User is deleting a connector.
 | `failure` | User is not authorized to delete a connector.
 
-.2+| `alert_delete`
-| `unknown` | User is deleting an alert.
-| `failure` | User is not authorized to delete an alert.
+.2+| `rule_delete`
+| `unknown` | User is deleting a rule.
+| `failure` | User is not authorized to delete a rule.
 
 .2+| `space_delete`
 | `unknown` | User is deleting a space.
@@ -218,13 +218,13 @@ Refer to the corresponding {es} logs for potential write errors.
 | `success` | User has accessed a connector as part of a search operation.
 | `failure` | User is not authorized to search for connectors.
 
-.2+| `alert_get`
-| `success` | User has accessed an alert.
-| `failure` | User is not authorized to access an alert.
+.2+| `rule_get`
+| `success` | User has accessed a rule.
+| `failure` | User is not authorized to access a rule.
 
-.2+| `alert_find`
-| `success` | User has accessed an alert as part of a search operation.
-| `failure` | User is not authorized to search for alerts.
+.2+| `rule_find`
+| `success` | User has accessed a rule as part of a search operation.
+| `failure` | User is not authorized to search for rules.
 
 .2+| `space_get`
 | `success` | User has accessed a space.
diff --git a/packages/kbn-pm/dist/index.js b/packages/kbn-pm/dist/index.js
index 1311eb4d7c638..e455f487d1384 100644
--- a/packages/kbn-pm/dist/index.js
+++ b/packages/kbn-pm/dist/index.js
@@ -48479,7 +48479,7 @@ async function runBazelCommandWithRunner(bazelCommandRunner, bazelArgs, offline
     stdio: 'pipe'
   });
 
-  if (offline || !offline) {
+  if (offline) {
     bazelArgs = [...bazelArgs, '--config=offline'];
   }
 
diff --git a/packages/kbn-pm/src/utils/bazel/run.ts b/packages/kbn-pm/src/utils/bazel/run.ts
index 5f3743876e0e4..c030081e53daa 100644
--- a/packages/kbn-pm/src/utils/bazel/run.ts
+++ b/packages/kbn-pm/src/utils/bazel/run.ts
@@ -29,7 +29,7 @@ async function runBazelCommandWithRunner(
     stdio: 'pipe',
   };
 
-  if (offline || !offline) {
+  if (offline) {
     bazelArgs = [...bazelArgs, '--config=offline'];
   }
 
diff --git a/src/plugins/expressions/common/expression_functions/specs/math_column.ts b/src/plugins/expressions/common/expression_functions/specs/math_column.ts
index 0ff8faf3ce55a..633d912c29502 100644
--- a/src/plugins/expressions/common/expression_functions/specs/math_column.ts
+++ b/src/plugins/expressions/common/expression_functions/specs/math_column.ts
@@ -69,25 +69,40 @@ export const mathColumn: ExpressionFunctionDefinition<
       return id === args.id;
     });
     if (existingColumnIndex > -1) {
-      throw new Error('ID must be unique');
+      throw new Error(
+        i18n.translate('expressions.functions.mathColumn.uniqueIdError', {
+          defaultMessage: 'ID must be unique',
+        })
+      );
     }
 
     const newRows = input.rows.map((row) => {
-      return {
-        ...row,
-        [args.id]: math.fn(
-          {
-            type: 'datatable',
-            columns: input.columns,
-            rows: [row],
-          },
-          {
-            expression: args.expression,
-            onError: args.onError,
-          },
-          context
-        ),
-      };
+      const result = math.fn(
+        {
+          type: 'datatable',
+          columns: input.columns,
+          rows: [row],
+        },
+        {
+          expression: args.expression,
+          onError: args.onError,
+        },
+        context
+      );
+
+      if (Array.isArray(result)) {
+        if (result.length === 1) {
+          return { ...row, [args.id]: result[0] };
+        }
+        throw new Error(
+          i18n.translate('expressions.functions.mathColumn.arrayValueError', {
+            defaultMessage: 'Cannot perform math on array values at {name}',
+            values: { name: args.name },
+          })
+        );
+      }
+
+      return { ...row, [args.id]: result };
     });
     const type = newRows.length ? getType(newRows[0][args.id]) : 'null';
     const newColumn: DatatableColumn = {
diff --git a/src/plugins/expressions/common/expression_functions/specs/tests/math_column.test.ts b/src/plugins/expressions/common/expression_functions/specs/tests/math_column.test.ts
index bc6699a2b689b..e0fb0a3a9f23d 100644
--- a/src/plugins/expressions/common/expression_functions/specs/tests/math_column.test.ts
+++ b/src/plugins/expressions/common/expression_functions/specs/tests/math_column.test.ts
@@ -34,6 +34,30 @@ describe('mathColumn', () => {
     });
   });
 
+  it('extracts a single array value, but not a multi-value array', () => {
+    const arrayTable = {
+      ...testTable,
+      rows: [
+        {
+          name: 'product1',
+          time: 1517842800950, // 05 Feb 2018 15:00:00 GMT
+          price: [605, 500],
+          quantity: [100],
+          in_stock: true,
+        },
+      ],
+    };
+    const args = {
+      id: 'output',
+      name: 'output',
+      expression: 'quantity',
+    };
+    expect(fn(arrayTable, args).rows[0].output).toEqual(100);
+    expect(() => fn(arrayTable, { ...args, expression: 'price' })).toThrowError(
+      `Cannot perform math on array values`
+    );
+  });
+
   it('handles onError', () => {
     const args = {
       id: 'output',
diff --git a/src/plugins/expressions/common/expression_types/get_type.test.ts b/src/plugins/expressions/common/expression_types/get_type.test.ts
index 6eca54d2aea44..b1a9cb703182f 100644
--- a/src/plugins/expressions/common/expression_types/get_type.test.ts
+++ b/src/plugins/expressions/common/expression_types/get_type.test.ts
@@ -30,6 +30,7 @@ describe('getType()', () => {
   });
 
   test('throws if object has no .type property', () => {
+    expect(() => getType([])).toThrow();
     expect(() => getType({})).toThrow();
     expect(() => getType({ _type: 'foo' })).toThrow();
     expect(() => getType({ tipe: 'foo' })).toThrow();
diff --git a/src/plugins/expressions/common/expression_types/get_type.ts b/src/plugins/expressions/common/expression_types/get_type.ts
index e29a610b3ed90..052508df41329 100644
--- a/src/plugins/expressions/common/expression_types/get_type.ts
+++ b/src/plugins/expressions/common/expression_types/get_type.ts
@@ -8,6 +8,9 @@
 
 export function getType(node: any) {
   if (node == null) return 'null';
+  if (Array.isArray(node)) {
+    throw new Error('Unexpected array value encountered.');
+  }
   if (typeof node === 'object') {
     if (!node.type) throw new Error('Objects must have a type property');
     return node.type;
diff --git a/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts b/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts
index c81fa7927ef7d..53d888967c431 100644
--- a/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts
@@ -63,7 +63,7 @@ import { parseDuration } from '../../common/parse_duration';
 import { retryIfConflicts } from '../lib/retry_if_conflicts';
 import { partiallyUpdateAlert } from '../saved_objects';
 import { markApiKeyForInvalidation } from '../invalidate_pending_api_keys/mark_api_key_for_invalidation';
-import { alertAuditEvent, AlertAuditAction } from './audit_events';
+import { ruleAuditEvent, RuleAuditAction } from './audit_events';
 import { KueryNode, nodeBuilder } from '../../../../../src/plugins/data/common';
 import { mapSortField } from './lib';
 import { getAlertExecutionStatusPending } from '../lib/alert_execution_status';
@@ -253,8 +253,8 @@ export class AlertsClient {
       });
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.CREATE,
+        ruleAuditEvent({
+          action: RuleAuditAction.CREATE,
           savedObject: { type: 'alert', id },
           error,
         })
@@ -305,8 +305,8 @@ export class AlertsClient {
     };
 
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.CREATE,
+      ruleAuditEvent({
+        action: RuleAuditAction.CREATE,
         outcome: 'unknown',
         savedObject: { type: 'alert', id },
       })
@@ -375,8 +375,8 @@ export class AlertsClient {
       });
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.GET,
+        ruleAuditEvent({
+          action: RuleAuditAction.GET,
           savedObject: { type: 'alert', id },
           error,
         })
@@ -384,8 +384,8 @@ export class AlertsClient {
       throw error;
     }
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.GET,
+      ruleAuditEvent({
+        action: RuleAuditAction.GET,
         savedObject: { type: 'alert', id },
       })
     );
@@ -467,8 +467,8 @@ export class AlertsClient {
       );
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.FIND,
+        ruleAuditEvent({
+          action: RuleAuditAction.FIND,
           error,
         })
       );
@@ -508,8 +508,8 @@ export class AlertsClient {
         );
       } catch (error) {
         this.auditLogger?.log(
-          alertAuditEvent({
-            action: AlertAuditAction.FIND,
+          ruleAuditEvent({
+            action: RuleAuditAction.FIND,
             savedObject: { type: 'alert', id },
             error,
           })
@@ -525,8 +525,8 @@ export class AlertsClient {
 
     authorizedData.forEach(({ id }) =>
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.FIND,
+        ruleAuditEvent({
+          action: RuleAuditAction.FIND,
           savedObject: { type: 'alert', id },
         })
       )
@@ -620,8 +620,8 @@ export class AlertsClient {
       });
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.DELETE,
+        ruleAuditEvent({
+          action: RuleAuditAction.DELETE,
           savedObject: { type: 'alert', id },
           error,
         })
@@ -630,8 +630,8 @@ export class AlertsClient {
     }
 
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.DELETE,
+      ruleAuditEvent({
+        action: RuleAuditAction.DELETE,
         outcome: 'unknown',
         savedObject: { type: 'alert', id },
       })
@@ -694,8 +694,8 @@ export class AlertsClient {
       });
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.UPDATE,
+        ruleAuditEvent({
+          action: RuleAuditAction.UPDATE,
           savedObject: { type: 'alert', id },
           error,
         })
@@ -704,8 +704,8 @@ export class AlertsClient {
     }
 
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.UPDATE,
+      ruleAuditEvent({
+        action: RuleAuditAction.UPDATE,
         outcome: 'unknown',
         savedObject: { type: 'alert', id },
       })
@@ -870,8 +870,8 @@ export class AlertsClient {
       }
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.UPDATE_API_KEY,
+        ruleAuditEvent({
+          action: RuleAuditAction.UPDATE_API_KEY,
           savedObject: { type: 'alert', id },
           error,
         })
@@ -900,8 +900,8 @@ export class AlertsClient {
     });
 
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.UPDATE_API_KEY,
+      ruleAuditEvent({
+        action: RuleAuditAction.UPDATE_API_KEY,
         outcome: 'unknown',
         savedObject: { type: 'alert', id },
       })
@@ -976,8 +976,8 @@ export class AlertsClient {
       }
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.ENABLE,
+        ruleAuditEvent({
+          action: RuleAuditAction.ENABLE,
           savedObject: { type: 'alert', id },
           error,
         })
@@ -986,8 +986,8 @@ export class AlertsClient {
     }
 
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.ENABLE,
+      ruleAuditEvent({
+        action: RuleAuditAction.ENABLE,
         outcome: 'unknown',
         savedObject: { type: 'alert', id },
       })
@@ -1090,8 +1090,8 @@ export class AlertsClient {
       });
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.DISABLE,
+        ruleAuditEvent({
+          action: RuleAuditAction.DISABLE,
           savedObject: { type: 'alert', id },
           error,
         })
@@ -1100,8 +1100,8 @@ export class AlertsClient {
     }
 
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.DISABLE,
+      ruleAuditEvent({
+        action: RuleAuditAction.DISABLE,
         outcome: 'unknown',
         savedObject: { type: 'alert', id },
       })
@@ -1167,8 +1167,8 @@ export class AlertsClient {
       }
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.MUTE,
+        ruleAuditEvent({
+          action: RuleAuditAction.MUTE,
           savedObject: { type: 'alert', id },
           error,
         })
@@ -1177,8 +1177,8 @@ export class AlertsClient {
     }
 
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.MUTE,
+      ruleAuditEvent({
+        action: RuleAuditAction.MUTE,
         outcome: 'unknown',
         savedObject: { type: 'alert', id },
       })
@@ -1229,8 +1229,8 @@ export class AlertsClient {
       }
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.UNMUTE,
+        ruleAuditEvent({
+          action: RuleAuditAction.UNMUTE,
           savedObject: { type: 'alert', id },
           error,
         })
@@ -1239,8 +1239,8 @@ export class AlertsClient {
     }
 
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.UNMUTE,
+      ruleAuditEvent({
+        action: RuleAuditAction.UNMUTE,
         outcome: 'unknown',
         savedObject: { type: 'alert', id },
       })
@@ -1291,8 +1291,8 @@ export class AlertsClient {
       }
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.MUTE_INSTANCE,
+        ruleAuditEvent({
+          action: RuleAuditAction.MUTE_ALERT,
           savedObject: { type: 'alert', id: alertId },
           error,
         })
@@ -1301,8 +1301,8 @@ export class AlertsClient {
     }
 
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.MUTE_INSTANCE,
+      ruleAuditEvent({
+        action: RuleAuditAction.MUTE_ALERT,
         outcome: 'unknown',
         savedObject: { type: 'alert', id: alertId },
       })
@@ -1358,8 +1358,8 @@ export class AlertsClient {
       }
     } catch (error) {
       this.auditLogger?.log(
-        alertAuditEvent({
-          action: AlertAuditAction.UNMUTE_INSTANCE,
+        ruleAuditEvent({
+          action: RuleAuditAction.UNMUTE_ALERT,
           savedObject: { type: 'alert', id: alertId },
           error,
         })
@@ -1368,8 +1368,8 @@ export class AlertsClient {
     }
 
     this.auditLogger?.log(
-      alertAuditEvent({
-        action: AlertAuditAction.UNMUTE_INSTANCE,
+      ruleAuditEvent({
+        action: RuleAuditAction.UNMUTE_ALERT,
         outcome: 'unknown',
         savedObject: { type: 'alert', id: alertId },
       })
diff --git a/x-pack/plugins/alerting/server/alerts_client/audit_events.test.ts b/x-pack/plugins/alerting/server/alerts_client/audit_events.test.ts
index 4ccb69832cd26..781b8fe1f4715 100644
--- a/x-pack/plugins/alerting/server/alerts_client/audit_events.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/audit_events.test.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
-import { AlertAuditAction, alertAuditEvent } from './audit_events';
+import { RuleAuditAction, ruleAuditEvent } from './audit_events';
 
-describe('#alertAuditEvent', () => {
+describe('#ruleAuditEvent', () => {
   test('creates event with `unknown` outcome', () => {
     expect(
-      alertAuditEvent({
-        action: AlertAuditAction.CREATE,
+      ruleAuditEvent({
+        action: RuleAuditAction.CREATE,
         outcome: 'unknown',
         savedObject: { type: 'alert', id: 'ALERT_ID' },
       })
@@ -19,7 +19,7 @@ describe('#alertAuditEvent', () => {
       Object {
         "error": undefined,
         "event": Object {
-          "action": "alert_create",
+          "action": "rule_create",
           "category": Array [
             "database",
           ],
@@ -34,22 +34,22 @@ describe('#alertAuditEvent', () => {
             "type": "alert",
           },
         },
-        "message": "User is creating alert [id=ALERT_ID]",
+        "message": "User is creating rule [id=ALERT_ID]",
       }
     `);
   });
 
   test('creates event with `success` outcome', () => {
     expect(
-      alertAuditEvent({
-        action: AlertAuditAction.CREATE,
+      ruleAuditEvent({
+        action: RuleAuditAction.CREATE,
         savedObject: { type: 'alert', id: 'ALERT_ID' },
       })
     ).toMatchInlineSnapshot(`
       Object {
         "error": undefined,
         "event": Object {
-          "action": "alert_create",
+          "action": "rule_create",
           "category": Array [
             "database",
           ],
@@ -64,15 +64,15 @@ describe('#alertAuditEvent', () => {
             "type": "alert",
           },
         },
-        "message": "User has created alert [id=ALERT_ID]",
+        "message": "User has created rule [id=ALERT_ID]",
       }
     `);
   });
 
   test('creates event with `failure` outcome', () => {
     expect(
-      alertAuditEvent({
-        action: AlertAuditAction.CREATE,
+      ruleAuditEvent({
+        action: RuleAuditAction.CREATE,
         savedObject: { type: 'alert', id: 'ALERT_ID' },
         error: new Error('ERROR_MESSAGE'),
       })
@@ -83,7 +83,7 @@ describe('#alertAuditEvent', () => {
           "message": "ERROR_MESSAGE",
         },
         "event": Object {
-          "action": "alert_create",
+          "action": "rule_create",
           "category": Array [
             "database",
           ],
@@ -98,7 +98,7 @@ describe('#alertAuditEvent', () => {
             "type": "alert",
           },
         },
-        "message": "Failed attempt to create alert [id=ALERT_ID]",
+        "message": "Failed attempt to create rule [id=ALERT_ID]",
       }
     `);
   });
diff --git a/x-pack/plugins/alerting/server/alerts_client/audit_events.ts b/x-pack/plugins/alerting/server/alerts_client/audit_events.ts
index 93cca255d6ebc..f04b7c3701974 100644
--- a/x-pack/plugins/alerting/server/alerts_client/audit_events.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/audit_events.ts
@@ -8,67 +8,67 @@
 import { EcsEventOutcome, EcsEventType } from 'src/core/server';
 import { AuditEvent } from '../../../security/server';
 
-export enum AlertAuditAction {
-  CREATE = 'alert_create',
-  GET = 'alert_get',
-  UPDATE = 'alert_update',
-  UPDATE_API_KEY = 'alert_update_api_key',
-  ENABLE = 'alert_enable',
-  DISABLE = 'alert_disable',
-  DELETE = 'alert_delete',
-  FIND = 'alert_find',
-  MUTE = 'alert_mute',
-  UNMUTE = 'alert_unmute',
-  MUTE_INSTANCE = 'alert_instance_mute',
-  UNMUTE_INSTANCE = 'alert_instance_unmute',
+export enum RuleAuditAction {
+  CREATE = 'rule_create',
+  GET = 'rule_get',
+  UPDATE = 'rule_update',
+  UPDATE_API_KEY = 'rule_update_api_key',
+  ENABLE = 'rule_enable',
+  DISABLE = 'rule_disable',
+  DELETE = 'rule_delete',
+  FIND = 'rule_find',
+  MUTE = 'rule_mute',
+  UNMUTE = 'rule_unmute',
+  MUTE_ALERT = 'rule_alert_mute',
+  UNMUTE_ALERT = 'rule_alert_unmute',
 }
 
 type VerbsTuple = [string, string, string];
 
-const eventVerbs: Record<AlertAuditAction, VerbsTuple> = {
-  alert_create: ['create', 'creating', 'created'],
-  alert_get: ['access', 'accessing', 'accessed'],
-  alert_update: ['update', 'updating', 'updated'],
-  alert_update_api_key: ['update API key of', 'updating API key of', 'updated API key of'],
-  alert_enable: ['enable', 'enabling', 'enabled'],
-  alert_disable: ['disable', 'disabling', 'disabled'],
-  alert_delete: ['delete', 'deleting', 'deleted'],
-  alert_find: ['access', 'accessing', 'accessed'],
-  alert_mute: ['mute', 'muting', 'muted'],
-  alert_unmute: ['unmute', 'unmuting', 'unmuted'],
-  alert_instance_mute: ['mute instance of', 'muting instance of', 'muted instance of'],
-  alert_instance_unmute: ['unmute instance of', 'unmuting instance of', 'unmuted instance of'],
+const eventVerbs: Record<RuleAuditAction, VerbsTuple> = {
+  rule_create: ['create', 'creating', 'created'],
+  rule_get: ['access', 'accessing', 'accessed'],
+  rule_update: ['update', 'updating', 'updated'],
+  rule_update_api_key: ['update API key of', 'updating API key of', 'updated API key of'],
+  rule_enable: ['enable', 'enabling', 'enabled'],
+  rule_disable: ['disable', 'disabling', 'disabled'],
+  rule_delete: ['delete', 'deleting', 'deleted'],
+  rule_find: ['access', 'accessing', 'accessed'],
+  rule_mute: ['mute', 'muting', 'muted'],
+  rule_unmute: ['unmute', 'unmuting', 'unmuted'],
+  rule_alert_mute: ['mute alert of', 'muting alert of', 'muted alert of'],
+  rule_alert_unmute: ['unmute alert of', 'unmuting alert of', 'unmuted alert of'],
 };
 
-const eventTypes: Record<AlertAuditAction, EcsEventType> = {
-  alert_create: 'creation',
-  alert_get: 'access',
-  alert_update: 'change',
-  alert_update_api_key: 'change',
-  alert_enable: 'change',
-  alert_disable: 'change',
-  alert_delete: 'deletion',
-  alert_find: 'access',
-  alert_mute: 'change',
-  alert_unmute: 'change',
-  alert_instance_mute: 'change',
-  alert_instance_unmute: 'change',
+const eventTypes: Record<RuleAuditAction, EcsEventType> = {
+  rule_create: 'creation',
+  rule_get: 'access',
+  rule_update: 'change',
+  rule_update_api_key: 'change',
+  rule_enable: 'change',
+  rule_disable: 'change',
+  rule_delete: 'deletion',
+  rule_find: 'access',
+  rule_mute: 'change',
+  rule_unmute: 'change',
+  rule_alert_mute: 'change',
+  rule_alert_unmute: 'change',
 };
 
-export interface AlertAuditEventParams {
-  action: AlertAuditAction;
+export interface RuleAuditEventParams {
+  action: RuleAuditAction;
   outcome?: EcsEventOutcome;
   savedObject?: NonNullable<AuditEvent['kibana']>['saved_object'];
   error?: Error;
 }
 
-export function alertAuditEvent({
+export function ruleAuditEvent({
   action,
   savedObject,
   outcome,
   error,
-}: AlertAuditEventParams): AuditEvent {
-  const doc = savedObject ? `alert [id=${savedObject.id}]` : 'an alert';
+}: RuleAuditEventParams): AuditEvent {
+  const doc = savedObject ? `rule [id=${savedObject.id}]` : 'a rule';
   const [present, progressive, past] = eventVerbs[action];
   const message = error
     ? `Failed attempt to ${present} ${doc}`
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/create.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/create.test.ts
index a2d5a5e0386c4..793357215d382 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/create.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/create.test.ts
@@ -226,7 +226,7 @@ describe('create()', () => {
   });
 
   describe('auditLogger', () => {
-    test('logs audit event when creating an alert', async () => {
+    test('logs audit event when creating a rule', async () => {
       const data = getMockData({
         enabled: false,
         actions: [],
@@ -241,7 +241,7 @@ describe('create()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_create',
+            action: 'rule_create',
             outcome: 'unknown',
           }),
           kibana: { saved_object: { id: 'mock-saved-object-id', type: 'alert' } },
@@ -249,7 +249,7 @@ describe('create()', () => {
       );
     });
 
-    test('logs audit event when not authorised to create an alert', async () => {
+    test('logs audit event when not authorised to create a rule', async () => {
       authorization.ensureAuthorized.mockRejectedValue(new Error('Unauthorized'));
 
       await expect(
@@ -263,7 +263,7 @@ describe('create()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_create',
+            action: 'rule_create',
             outcome: 'failure',
           }),
           kibana: {
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/delete.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/delete.test.ts
index 0f9d91d829854..ca0f0cf0fb5a6 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/delete.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/delete.test.ts
@@ -258,12 +258,12 @@ describe('delete()', () => {
   });
 
   describe('auditLogger', () => {
-    test('logs audit event when deleting an alert', async () => {
+    test('logs audit event when deleting a rule', async () => {
       await alertsClient.delete({ id: '1' });
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_delete',
+            action: 'rule_delete',
             outcome: 'unknown',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -271,14 +271,14 @@ describe('delete()', () => {
       );
     });
 
-    test('logs audit event when not authorised to delete an alert', async () => {
+    test('logs audit event when not authorised to delete a rule', async () => {
       authorization.ensureAuthorized.mockRejectedValue(new Error('Unauthorized'));
 
       await expect(alertsClient.delete({ id: '1' })).rejects.toThrow();
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_delete',
+            action: 'rule_delete',
             outcome: 'failure',
           }),
           kibana: {
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/disable.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/disable.test.ts
index 7eb107c2f4dec..da1c5ea8bfe8d 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/disable.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/disable.test.ts
@@ -126,12 +126,12 @@ describe('disable()', () => {
   });
 
   describe('auditLogger', () => {
-    test('logs audit event when disabling an alert', async () => {
+    test('logs audit event when disabling a rule', async () => {
       await alertsClient.disable({ id: '1' });
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_disable',
+            action: 'rule_disable',
             outcome: 'unknown',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -139,14 +139,14 @@ describe('disable()', () => {
       );
     });
 
-    test('logs audit event when not authorised to disable an alert', async () => {
+    test('logs audit event when not authorised to disable a rule', async () => {
       authorization.ensureAuthorized.mockRejectedValue(new Error('Unauthorized'));
 
       await expect(alertsClient.disable({ id: '1' })).rejects.toThrow();
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_disable',
+            action: 'rule_disable',
             outcome: 'failure',
           }),
           kibana: {
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/enable.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/enable.test.ts
index 8329e52d7444a..b3c8d3bd83980 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/enable.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/enable.test.ts
@@ -165,12 +165,12 @@ describe('enable()', () => {
   });
 
   describe('auditLogger', () => {
-    test('logs audit event when enabling an alert', async () => {
+    test('logs audit event when enabling a rule', async () => {
       await alertsClient.enable({ id: '1' });
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_enable',
+            action: 'rule_enable',
             outcome: 'unknown',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -178,14 +178,14 @@ describe('enable()', () => {
       );
     });
 
-    test('logs audit event when not authorised to enable an alert', async () => {
+    test('logs audit event when not authorised to enable a rule', async () => {
       authorization.ensureAuthorized.mockRejectedValue(new Error('Unauthorized'));
 
       await expect(alertsClient.enable({ id: '1' })).rejects.toThrow();
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_enable',
+            action: 'rule_enable',
             outcome: 'failure',
           }),
           kibana: {
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/find.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/find.test.ts
index 8fa8ae7ae38b0..fe788cd43bc2b 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/find.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/find.test.ts
@@ -277,13 +277,13 @@ describe('find()', () => {
   });
 
   describe('auditLogger', () => {
-    test('logs audit event when searching alerts', async () => {
+    test('logs audit event when searching rules', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       await alertsClient.find();
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_find',
+            action: 'rule_find',
             outcome: 'success',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -291,7 +291,7 @@ describe('find()', () => {
       );
     });
 
-    test('logs audit event when not authorised to search alerts', async () => {
+    test('logs audit event when not authorised to search rules', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       authorization.getFindAuthorizationFilter.mockRejectedValue(new Error('Unauthorized'));
 
@@ -299,7 +299,7 @@ describe('find()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_find',
+            action: 'rule_find',
             outcome: 'failure',
           }),
           error: {
@@ -310,7 +310,7 @@ describe('find()', () => {
       );
     });
 
-    test('logs audit event when not authorised to search alert type', async () => {
+    test('logs audit event when not authorised to search rule type', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       authorization.getFindAuthorizationFilter.mockResolvedValue({
         ensureRuleTypeIsAuthorized: jest.fn(() => {
@@ -323,7 +323,7 @@ describe('find()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_find',
+            action: 'rule_find',
             outcome: 'failure',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/get.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/get.test.ts
index a958ea4061ae5..1be9d3e3ba2c9 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/get.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/get.test.ts
@@ -226,13 +226,13 @@ describe('get()', () => {
       });
     });
 
-    test('logs audit event when getting an alert', async () => {
+    test('logs audit event when getting a rule', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       await alertsClient.get({ id: '1' });
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_get',
+            action: 'rule_get',
             outcome: 'success',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -240,7 +240,7 @@ describe('get()', () => {
       );
     });
 
-    test('logs audit event when not authorised to get an alert', async () => {
+    test('logs audit event when not authorised to get a rule', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       authorization.ensureAuthorized.mockRejectedValue(new Error('Unauthorized'));
 
@@ -248,7 +248,7 @@ describe('get()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_get',
+            action: 'rule_get',
             outcome: 'failure',
           }),
           kibana: {
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/mute_all.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/mute_all.test.ts
index 6734ec9b99600..43f43b539ebf2 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/mute_all.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/mute_all.test.ts
@@ -155,7 +155,7 @@ describe('muteAll()', () => {
   });
 
   describe('auditLogger', () => {
-    test('logs audit event when muting an alert', async () => {
+    test('logs audit event when muting a rule', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
         id: '1',
@@ -181,7 +181,7 @@ describe('muteAll()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_mute',
+            action: 'rule_mute',
             outcome: 'unknown',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -189,7 +189,7 @@ describe('muteAll()', () => {
       );
     });
 
-    test('logs audit event when not authorised to mute an alert', async () => {
+    test('logs audit event when not authorised to mute a rule', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
         id: '1',
@@ -217,7 +217,7 @@ describe('muteAll()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_mute',
+            action: 'rule_mute',
             outcome: 'failure',
           }),
           kibana: {
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/mute_instance.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/mute_instance.test.ts
index bc0b7288e952f..e2e4aff61866b 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/mute_instance.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/mute_instance.test.ts
@@ -189,7 +189,7 @@ describe('muteInstance()', () => {
   });
 
   describe('auditLogger', () => {
-    test('logs audit event when muting an alert instance', async () => {
+    test('logs audit event when muting an alert', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
         id: '1',
@@ -209,7 +209,7 @@ describe('muteInstance()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_instance_mute',
+            action: 'rule_alert_mute',
             outcome: 'unknown',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -217,7 +217,7 @@ describe('muteInstance()', () => {
       );
     });
 
-    test('logs audit event when not authorised to mute an alert instance', async () => {
+    test('logs audit event when not authorised to mute an alert', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
         id: '1',
@@ -241,7 +241,7 @@ describe('muteInstance()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_instance_mute',
+            action: 'rule_alert_mute',
             outcome: 'failure',
           }),
           kibana: {
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/unmute_all.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/unmute_all.test.ts
index c061bc7840fb6..02439d3cd6bad 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/unmute_all.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/unmute_all.test.ts
@@ -155,7 +155,7 @@ describe('unmuteAll()', () => {
   });
 
   describe('auditLogger', () => {
-    test('logs audit event when unmuting an alert', async () => {
+    test('logs audit event when unmuting a rule', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
         id: '1',
@@ -181,7 +181,7 @@ describe('unmuteAll()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_unmute',
+            action: 'rule_unmute',
             outcome: 'unknown',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -189,7 +189,7 @@ describe('unmuteAll()', () => {
       );
     });
 
-    test('logs audit event when not authorised to unmute an alert', async () => {
+    test('logs audit event when not authorised to unmute a rule', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
         id: '1',
@@ -217,7 +217,7 @@ describe('unmuteAll()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_unmute',
+            action: 'rule_unmute',
             outcome: 'failure',
           }),
           kibana: {
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/unmute_instance.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/unmute_instance.test.ts
index 4da83b6441a8d..3f3ec697a9478 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/unmute_instance.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/unmute_instance.test.ts
@@ -187,7 +187,7 @@ describe('unmuteInstance()', () => {
   });
 
   describe('auditLogger', () => {
-    test('logs audit event when unmuting an alert instance', async () => {
+    test('logs audit event when unmuting an alert', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
         id: '1',
@@ -207,7 +207,7 @@ describe('unmuteInstance()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_instance_unmute',
+            action: 'rule_alert_unmute',
             outcome: 'unknown',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -215,7 +215,7 @@ describe('unmuteInstance()', () => {
       );
     });
 
-    test('logs audit event when not authorised to unmute an alert instance', async () => {
+    test('logs audit event when not authorised to unmute an alert', async () => {
       const alertsClient = new AlertsClient({ ...alertsClientParams, auditLogger });
       unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
         id: '1',
@@ -239,7 +239,7 @@ describe('unmuteInstance()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_instance_unmute',
+            action: 'rule_alert_unmute',
             outcome: 'failure',
           }),
           kibana: {
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/update.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/update.test.ts
index c743312ef2c4b..350c9ed31298f 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/update.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/update.test.ts
@@ -1476,7 +1476,7 @@ describe('update()', () => {
       });
     });
 
-    test('logs audit event when updating an alert', async () => {
+    test('logs audit event when updating a rule', async () => {
       await alertsClient.update({
         id: '1',
         data: {
@@ -1495,7 +1495,7 @@ describe('update()', () => {
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_update',
+            action: 'rule_update',
             outcome: 'unknown',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -1503,7 +1503,7 @@ describe('update()', () => {
       );
     });
 
-    test('logs audit event when not authorised to update an alert', async () => {
+    test('logs audit event when not authorised to update a rule', async () => {
       authorization.ensureAuthorized.mockRejectedValue(new Error('Unauthorized'));
 
       await expect(
@@ -1526,7 +1526,7 @@ describe('update()', () => {
         expect.objectContaining({
           event: expect.objectContaining({
             outcome: 'failure',
-            action: 'alert_update',
+            action: 'rule_update',
           }),
           kibana: {
             saved_object: {
diff --git a/x-pack/plugins/alerting/server/alerts_client/tests/update_api_key.test.ts b/x-pack/plugins/alerting/server/alerts_client/tests/update_api_key.test.ts
index 4215f14b4a560..15aa0dbc64eb8 100644
--- a/x-pack/plugins/alerting/server/alerts_client/tests/update_api_key.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/tests/update_api_key.test.ts
@@ -295,13 +295,13 @@ describe('updateApiKey()', () => {
   });
 
   describe('auditLogger', () => {
-    test('logs audit event when updating the API key of an alert', async () => {
+    test('logs audit event when updating the API key of a rule', async () => {
       await alertsClient.updateApiKey({ id: '1' });
 
       expect(auditLogger.log).toHaveBeenCalledWith(
         expect.objectContaining({
           event: expect.objectContaining({
-            action: 'alert_update_api_key',
+            action: 'rule_update_api_key',
             outcome: 'unknown',
           }),
           kibana: { saved_object: { id: '1', type: 'alert' } },
@@ -309,7 +309,7 @@ describe('updateApiKey()', () => {
       );
     });
 
-    test('logs audit event when not authorised to update the API key of an alert', async () => {
+    test('logs audit event when not authorised to update the API key of a rule', async () => {
       authorization.ensureAuthorized.mockRejectedValue(new Error('Unauthorized'));
 
       await expect(alertsClient.updateApiKey({ id: '1' })).rejects.toThrow();
@@ -317,7 +317,7 @@ describe('updateApiKey()', () => {
         expect.objectContaining({
           event: expect.objectContaining({
             outcome: 'failure',
-            action: 'alert_update_api_key',
+            action: 'rule_update_api_key',
           }),
           kibana: {
             saved_object: {
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/__mocks__/engine_logic.mock.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/__mocks__/engine_logic.mock.ts
index 23d638d5f25f3..b38659b7a9a79 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/__mocks__/engine_logic.mock.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/__mocks__/engine_logic.mock.ts
@@ -6,7 +6,7 @@
  */
 
 import { EngineDetails } from '../components/engine/types';
-import { ENGINES_TITLE } from '../components/engines';
+import { ENGINES_TITLE } from '../components/engines/constants';
 import { generateEncodedPath } from '../utils/encode_path_params';
 
 export const mockEngineValues = {
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/document_creation/document_creation_buttons.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/document_creation/document_creation_buttons.tsx
index 6d3caca87dcc3..7ed9b9ea65025 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/document_creation/document_creation_buttons.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/document_creation/document_creation_buttons.tsx
@@ -60,6 +60,7 @@ export const DocumentCreationButtons: React.FC<Props> = ({ disabled = false }) =
       <EuiFlexGrid columns={2}>
         <EuiFlexItem>
           <EuiCard
+            display="subdued"
             title={i18n.translate(
               'xpack.enterpriseSearch.appSearch.documentCreation.buttons.text',
               { defaultMessage: 'Paste JSON' }
@@ -73,6 +74,7 @@ export const DocumentCreationButtons: React.FC<Props> = ({ disabled = false }) =
         </EuiFlexItem>
         <EuiFlexItem>
           <EuiCard
+            display="subdued"
             title={i18n.translate(
               'xpack.enterpriseSearch.appSearch.documentCreation.buttons.file',
               { defaultMessage: 'Upload a JSON file' }
@@ -85,6 +87,7 @@ export const DocumentCreationButtons: React.FC<Props> = ({ disabled = false }) =
         </EuiFlexItem>
         <EuiFlexItem>
           <EuiCard
+            display="subdued"
             title={i18n.translate('xpack.enterpriseSearch.appSearch.documentCreation.buttons.api', {
               defaultMessage: 'Index from API',
             })}
@@ -96,6 +99,7 @@ export const DocumentCreationButtons: React.FC<Props> = ({ disabled = false }) =
         </EuiFlexItem>
         <EuiFlexItem>
           <EuiCardTo
+            display="subdued"
             title={i18n.translate(
               'xpack.enterpriseSearch.appSearch.documentCreation.buttons.crawl',
               { defaultMessage: 'Use the Crawler' }
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_creation/engine_creation.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_creation/engine_creation.tsx
index 250c941009ecb..913aa4f0ec845 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_creation/engine_creation.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_creation/engine_creation.tsx
@@ -16,15 +16,13 @@ import {
   EuiFlexItem,
   EuiFieldText,
   EuiSelect,
-  EuiPageHeader,
-  EuiPageContent,
+  EuiPanel,
   EuiSpacer,
   EuiTitle,
   EuiButton,
 } from '@elastic/eui';
 
-import { FlashMessages } from '../../../shared/flash_messages';
-import { SetAppSearchChrome as SetPageChrome } from '../../../shared/kibana_chrome';
+import { AppSearchPageTemplate } from '../layout';
 
 import {
   ALLOWED_CHARS_NOTE,
@@ -44,77 +42,77 @@ export const EngineCreation: React.FC = () => {
   const { setLanguage, setRawName, submitEngine } = useActions(EngineCreationLogic);
 
   return (
-    <div data-test-subj="EngineCreation">
-      <SetPageChrome trail={[ENGINE_CREATION_TITLE]} />
-      <EuiPageHeader pageTitle={ENGINE_CREATION_TITLE} />
-      <FlashMessages />
-      <EuiPageContent hasBorder>
-        <EuiForm>
-          <form
-            data-test-subj="EngineCreationForm"
-            onSubmit={(e) => {
-              e.preventDefault();
-              submitEngine();
-            }}
-          >
-            <EuiTitle>
-              <h2>{ENGINE_CREATION_FORM_TITLE}</h2>
-            </EuiTitle>
-            <EuiSpacer />
-            <EuiFlexGroup>
-              <EuiFlexItem>
-                <EuiFormRow
-                  data-test-subj="EngineCreationNameFormRow"
-                  label={ENGINE_CREATION_FORM_ENGINE_NAME_LABEL}
-                  helpText={
-                    name.length > 0 && rawName !== name ? (
-                      <>
-                        {SANITIZED_NAME_NOTE} <strong>{name}</strong>
-                      </>
-                    ) : (
-                      ALLOWED_CHARS_NOTE
-                    )
-                  }
+    <AppSearchPageTemplate
+      pageChrome={[ENGINE_CREATION_TITLE]}
+      pageHeader={{ pageTitle: ENGINE_CREATION_TITLE }}
+      data-test-subj="EngineCreation"
+    >
+      <EuiPanel hasBorder>
+        <EuiForm
+          component="form"
+          data-test-subj="EngineCreationForm"
+          onSubmit={(e) => {
+            e.preventDefault();
+            submitEngine();
+          }}
+        >
+          <EuiTitle>
+            <h2>{ENGINE_CREATION_FORM_TITLE}</h2>
+          </EuiTitle>
+          <EuiSpacer />
+          <EuiFlexGroup>
+            <EuiFlexItem>
+              <EuiFormRow
+                data-test-subj="EngineCreationNameFormRow"
+                label={ENGINE_CREATION_FORM_ENGINE_NAME_LABEL}
+                helpText={
+                  name.length > 0 && rawName !== name ? (
+                    <>
+                      {SANITIZED_NAME_NOTE} <strong>{name}</strong>
+                    </>
+                  ) : (
+                    ALLOWED_CHARS_NOTE
+                  )
+                }
+                fullWidth
+              >
+                <EuiFieldText
+                  name="engine-name"
+                  value={rawName}
+                  onChange={(event) => setRawName(event.currentTarget.value)}
+                  autoComplete="off"
                   fullWidth
-                >
-                  <EuiFieldText
-                    name="engine-name"
-                    value={rawName}
-                    onChange={(event) => setRawName(event.currentTarget.value)}
-                    autoComplete="off"
-                    fullWidth
-                    data-test-subj="EngineCreationNameInput"
-                    placeholder={ENGINE_CREATION_FORM_ENGINE_NAME_PLACEHOLDER}
-                    autoFocus
-                  />
-                </EuiFormRow>
-              </EuiFlexItem>
-              <EuiFlexItem grow={false}>
-                <EuiFormRow label={ENGINE_CREATION_FORM_ENGINE_LANGUAGE_LABEL}>
-                  <EuiSelect
-                    name="engine-language"
-                    value={language}
-                    options={SUPPORTED_LANGUAGES}
-                    data-test-subj="EngineCreationLanguageInput"
-                    onChange={(event) => setLanguage(event.currentTarget.value)}
-                  />
-                </EuiFormRow>
-              </EuiFlexItem>
-            </EuiFlexGroup>
-            <EuiSpacer />
-            <EuiButton
-              disabled={name.length === 0}
-              isLoading={isLoading}
-              type="submit"
-              data-test-subj="NewEngineSubmitButton"
-              color="secondary"
-              fill
-            >
-              {ENGINE_CREATION_FORM_SUBMIT_BUTTON_LABEL}
-            </EuiButton>
-          </form>
+                  data-test-subj="EngineCreationNameInput"
+                  placeholder={ENGINE_CREATION_FORM_ENGINE_NAME_PLACEHOLDER}
+                  autoFocus
+                />
+              </EuiFormRow>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiFormRow label={ENGINE_CREATION_FORM_ENGINE_LANGUAGE_LABEL}>
+                <EuiSelect
+                  name="engine-language"
+                  value={language}
+                  options={SUPPORTED_LANGUAGES}
+                  data-test-subj="EngineCreationLanguageInput"
+                  onChange={(event) => setLanguage(event.currentTarget.value)}
+                />
+              </EuiFormRow>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+          <EuiSpacer />
+          <EuiButton
+            disabled={name.length === 0}
+            isLoading={isLoading}
+            type="submit"
+            data-test-subj="NewEngineSubmitButton"
+            color="secondary"
+            fill
+          >
+            {ENGINE_CREATION_FORM_SUBMIT_BUTTON_LABEL}
+          </EuiButton>
         </EuiForm>
-      </EuiPageContent>
-    </div>
+      </EuiPanel>
+    </AppSearchPageTemplate>
   );
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/empty_state.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/empty_state.tsx
index e6a7c03d2aab4..df17d22d387d9 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/empty_state.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/empty_state.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 
 import { useValues, useActions } from 'kea';
 
-import { EuiPageContent, EuiEmptyPrompt, EuiSpacer } from '@elastic/eui';
+import { EuiEmptyPrompt, EuiSpacer } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
 import { EuiButtonTo } from '../../../../shared/react_router_helpers';
@@ -20,86 +20,72 @@ import { ENGINE_CREATION_PATH } from '../../../routes';
 
 import { SampleEngineCreationCta } from '../../sample_engine_creation_cta/sample_engine_creation_cta';
 
-import { EnginesOverviewHeader } from './header';
-
 export const EmptyState: React.FC = () => {
   const {
     myRole: { canManageEngines },
   } = useValues(AppLogic);
   const { sendAppSearchTelemetry } = useActions(TelemetryLogic);
 
-  return (
-    <>
-      <EnginesOverviewHeader />
-      <EuiPageContent color="subdued">
-        {canManageEngines ? (
-          <EuiEmptyPrompt
-            data-test-subj="AdminEmptyEnginesPrompt"
-            iconType={EngineIcon}
-            title={
-              <h2>
-                {i18n.translate('xpack.enterpriseSearch.appSearch.emptyState.title', {
-                  defaultMessage: 'Create your first engine',
-                })}
-              </h2>
-            }
-            titleSize="l"
-            body={
-              <p>
-                {i18n.translate('xpack.enterpriseSearch.appSearch.emptyState.description1', {
-                  defaultMessage:
-                    'An App Search engine stores the documents for your search experience.',
-                })}
-              </p>
-            }
-            actions={
-              <>
-                <EuiButtonTo
-                  data-test-subj="EmptyStateCreateFirstEngineCta"
-                  fill
-                  to={ENGINE_CREATION_PATH}
-                  onClick={() =>
-                    sendAppSearchTelemetry({
-                      action: 'clicked',
-                      metric: 'create_first_engine_button',
-                    })
-                  }
-                >
-                  {i18n.translate(
-                    'xpack.enterpriseSearch.appSearch.emptyState.createFirstEngineCta',
-                    { defaultMessage: 'Create an engine' }
-                  )}
-                </EuiButtonTo>
-                <EuiSpacer size="xxl" />
-                <SampleEngineCreationCta />
-              </>
-            }
-          />
-        ) : (
-          <EuiEmptyPrompt
-            data-test-subj="NonAdminEmptyEnginesPrompt"
-            iconType={EngineIcon}
-            title={
-              <h2>
-                {i18n.translate('xpack.enterpriseSearch.appSearch.emptyState.nonAdmin.title', {
-                  defaultMessage: 'No engines available',
-                })}
-              </h2>
-            }
-            body={
-              <p>
-                {i18n.translate(
-                  'xpack.enterpriseSearch.appSearch.emptyState.nonAdmin.description',
-                  {
-                    defaultMessage:
-                      'Contact your App Search administrator to either create or grant you access to an engine.',
-                  }
-                )}
-              </p>
+  return canManageEngines ? (
+    <EuiEmptyPrompt
+      data-test-subj="AdminEmptyEnginesPrompt"
+      iconType={EngineIcon}
+      title={
+        <h2>
+          {i18n.translate('xpack.enterpriseSearch.appSearch.emptyState.title', {
+            defaultMessage: 'Create your first engine',
+          })}
+        </h2>
+      }
+      titleSize="l"
+      body={
+        <p>
+          {i18n.translate('xpack.enterpriseSearch.appSearch.emptyState.description1', {
+            defaultMessage: 'An App Search engine stores the documents for your search experience.',
+          })}
+        </p>
+      }
+      actions={
+        <>
+          <EuiButtonTo
+            data-test-subj="EmptyStateCreateFirstEngineCta"
+            fill
+            to={ENGINE_CREATION_PATH}
+            onClick={() =>
+              sendAppSearchTelemetry({
+                action: 'clicked',
+                metric: 'create_first_engine_button',
+              })
             }
-          />
-        )}
-      </EuiPageContent>
-    </>
+          >
+            {i18n.translate('xpack.enterpriseSearch.appSearch.emptyState.createFirstEngineCta', {
+              defaultMessage: 'Create an engine',
+            })}
+          </EuiButtonTo>
+          <EuiSpacer size="xxl" />
+          <SampleEngineCreationCta />
+        </>
+      }
+    />
+  ) : (
+    <EuiEmptyPrompt
+      data-test-subj="NonAdminEmptyEnginesPrompt"
+      iconType={EngineIcon}
+      title={
+        <h2>
+          {i18n.translate('xpack.enterpriseSearch.appSearch.emptyState.nonAdmin.title', {
+            defaultMessage: 'No engines available',
+          })}
+        </h2>
+      }
+      body={
+        <p>
+          {i18n.translate('xpack.enterpriseSearch.appSearch.emptyState.nonAdmin.description', {
+            defaultMessage:
+              'Contact your App Search administrator to either create or grant you access to an engine.',
+          })}
+        </p>
+      }
+    />
   );
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/header.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/header.tsx
deleted file mode 100644
index bab67fd0e4bb5..0000000000000
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/header.tsx
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-
-import { useActions } from 'kea';
-
-import { EuiPageHeader, EuiButton } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-
-import { getAppSearchUrl } from '../../../../shared/enterprise_search_url';
-import { SetAppSearchChrome as SetPageChrome } from '../../../../shared/kibana_chrome';
-import { TelemetryLogic } from '../../../../shared/telemetry';
-
-import { ENGINES_TITLE } from '../constants';
-
-export const EnginesOverviewHeader: React.FC = () => {
-  const { sendAppSearchTelemetry } = useActions(TelemetryLogic);
-
-  return (
-    <>
-      <SetPageChrome trail={[ENGINES_TITLE]} />
-      <EuiPageHeader
-        pageTitle={i18n.translate('xpack.enterpriseSearch.appSearch.enginesOverview.title', {
-          defaultMessage: 'Engines overview',
-        })}
-        rightSideItems={[
-          // eslint-disable-next-line @elastic/eui/href-or-on-click
-          <EuiButton
-            size="s"
-            iconType="popout"
-            href={getAppSearchUrl()}
-            target="_blank"
-            onClick={() =>
-              sendAppSearchTelemetry({
-                action: 'clicked',
-                metric: 'header_launch_button',
-              })
-            }
-            data-test-subj="launchButton"
-          >
-            {i18n.translate('xpack.enterpriseSearch.appSearch.productCta', {
-              defaultMessage: 'Launch App Search',
-            })}
-          </EuiButton>,
-        ]}
-      />
-    </>
-  );
-};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/index.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/index.ts
index 234d3ba31f44b..1d8e578e0edf2 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/index.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/index.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-export { EnginesOverviewHeader } from './header';
-export { LoadingState } from './loading_state';
+export { LaunchAppSearchButton } from './launch_as_button';
 export { EmptyState } from './empty_state';
 export { EmptyMetaEnginesState } from './empty_meta_engines_state';
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/header.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/launch_as_button.test.tsx
similarity index 64%
rename from x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/header.test.tsx
rename to x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/launch_as_button.test.tsx
index 9b245a468b083..93c91cc3830f4 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/header.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/launch_as_button.test.tsx
@@ -12,23 +12,11 @@ import React from 'react';
 
 import { shallow } from 'enzyme';
 
-import { EuiPageHeader } from '@elastic/eui';
-
-import { EnginesOverviewHeader } from './';
-
-describe('EnginesOverviewHeader', () => {
-  const wrapper = shallow(<EnginesOverviewHeader />)
-    .find(EuiPageHeader)
-    .dive()
-    .children()
-    .dive();
-
-  it('renders', () => {
-    expect(wrapper.find('h1').text()).toEqual('Engines overview');
-  });
+import { LaunchAppSearchButton } from './';
 
+describe('LaunchAppSearchButton', () => {
   it('renders a launch app search button that sends telemetry on click', () => {
-    const button = wrapper.find('[data-test-subj="launchButton"]');
+    const button = shallow(<LaunchAppSearchButton />);
 
     expect(button.prop('href')).toBe('http://localhost:3002/as');
     expect(button.prop('isDisabled')).toBeFalsy();
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/launch_as_button.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/launch_as_button.tsx
new file mode 100644
index 0000000000000..41102cb4fba2e
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/launch_as_button.tsx
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { useActions } from 'kea';
+
+import { EuiButton } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+import { getAppSearchUrl } from '../../../../shared/enterprise_search_url';
+import { TelemetryLogic } from '../../../../shared/telemetry';
+
+export const LaunchAppSearchButton: React.FC = () => {
+  const { sendAppSearchTelemetry } = useActions(TelemetryLogic);
+
+  return (
+    // eslint-disable-next-line @elastic/eui/href-or-on-click
+    <EuiButton
+      size="s"
+      iconType="popout"
+      href={getAppSearchUrl()}
+      target="_blank"
+      onClick={() =>
+        sendAppSearchTelemetry({
+          action: 'clicked',
+          metric: 'header_launch_button',
+        })
+      }
+      data-test-subj="launchButton"
+    >
+      {i18n.translate('xpack.enterpriseSearch.appSearch.productCta', {
+        defaultMessage: 'Launch App Search',
+      })}
+    </EuiButton>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/loading_state.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/loading_state.test.tsx
deleted file mode 100644
index f7ccfea4bb4d4..0000000000000
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/loading_state.test.tsx
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-
-import { shallow } from 'enzyme';
-
-import { EuiLoadingContent } from '@elastic/eui';
-
-import { LoadingState } from './';
-
-describe('LoadingState', () => {
-  it('renders', () => {
-    const wrapper = shallow(<LoadingState />);
-
-    expect(wrapper.find(EuiLoadingContent)).toHaveLength(2);
-  });
-});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/loading_state.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/loading_state.tsx
deleted file mode 100644
index 875c47378d1fb..0000000000000
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/components/loading_state.tsx
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-
-import { EuiPageContent, EuiSpacer, EuiLoadingContent } from '@elastic/eui';
-
-import { EnginesOverviewHeader } from './header';
-
-export const LoadingState: React.FC = () => {
-  return (
-    <>
-      <EnginesOverviewHeader />
-      <EuiPageContent hasBorder paddingSize="l">
-        <EuiLoadingContent lines={5} />
-        <EuiSpacer size="xxl" />
-        <EuiLoadingContent lines={4} />
-      </EuiPageContent>
-    </>
-  );
-};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/constants.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/constants.ts
index 8d03e3d23ae23..d01e89e004d28 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/constants.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/constants.ts
@@ -11,6 +11,11 @@ export const ENGINES_TITLE = i18n.translate('xpack.enterpriseSearch.appSearch.en
   defaultMessage: 'Engines',
 });
 
+export const ENGINES_OVERVIEW_TITLE = i18n.translate(
+  'xpack.enterpriseSearch.appSearch.enginesOverview.title',
+  { defaultMessage: 'Engines overview' }
+);
+
 export const META_ENGINES_TITLE = i18n.translate(
   'xpack.enterpriseSearch.appSearch.metaEngines.title',
   { defaultMessage: 'Meta Engines' }
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/engines_overview.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/engines_overview.test.tsx
index 27fe65fe518eb..8825c322fb8d5 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/engines_overview.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/engines_overview.test.tsx
@@ -14,7 +14,6 @@ import { shallow, ShallowWrapper } from 'enzyme';
 
 import { rerender } from '../../../test_helpers';
 
-import { LoadingState, EmptyState } from './components';
 import { EnginesTable } from './components/tables/engines_table';
 import { MetaEnginesTable } from './components/tables/meta_engines_table';
 
@@ -61,135 +60,117 @@ describe('EnginesOverview', () => {
     setMockActions(actions);
   });
 
-  describe('non-happy-path states', () => {
-    it('isLoading', () => {
-      setMockValues({ ...values, dataLoading: true });
-      const wrapper = shallow(<EnginesOverview />);
+  const valuesWithEngines = {
+    ...values,
+    dataLoading: false,
+    engines: ['test-engine'],
+    enginesMeta: {
+      page: {
+        current: 1,
+        size: 10,
+        total_results: 100,
+      },
+    },
+  };
 
-      expect(wrapper.find(LoadingState)).toHaveLength(1);
-    });
+  beforeEach(() => {
+    jest.clearAllMocks();
+    setMockValues(valuesWithEngines);
+  });
 
-    it('isEmpty', () => {
-      setMockValues({ ...values, engines: [] });
-      const wrapper = shallow(<EnginesOverview />);
+  it('renders and calls the engines API', () => {
+    const wrapper = shallow(<EnginesOverview />);
 
-      expect(wrapper.find(EmptyState)).toHaveLength(1);
-    });
+    expect(wrapper.find(EnginesTable)).toHaveLength(1);
+    expect(actions.loadEngines).toHaveBeenCalled();
   });
 
-  describe('happy-path states', () => {
-    const valuesWithEngines = {
-      ...values,
-      dataLoading: false,
-      engines: ['test-engine'],
-      enginesMeta: {
-        page: {
-          current: 1,
-          size: 10,
-          total_results: 100,
-        },
-      },
-    };
+  describe('when the user can manage/create engines', () => {
+    it('renders a create engine button which takes users to the create engine page', () => {
+      setMockValues({
+        ...valuesWithEngines,
+        myRole: { canManageEngines: true },
+      });
+      const wrapper = shallow(<EnginesOverview />);
 
-    beforeEach(() => {
-      jest.clearAllMocks();
-      setMockValues(valuesWithEngines);
+      expect(
+        wrapper.find('[data-test-subj="appSearchEnginesEngineCreationButton"]').prop('to')
+      ).toEqual('/engine_creation');
     });
+  });
 
-    it('renders and calls the engines API', () => {
+  describe('when the account has a platinum license', () => {
+    it('renders a 2nd meta engines table & makes a 2nd meta engines call', () => {
+      setMockValues({
+        ...valuesWithEngines,
+        hasPlatinumLicense: true,
+      });
       const wrapper = shallow(<EnginesOverview />);
 
-      expect(wrapper.find(EnginesTable)).toHaveLength(1);
-      expect(actions.loadEngines).toHaveBeenCalled();
+      expect(wrapper.find(MetaEnginesTable)).toHaveLength(1);
+      expect(actions.loadMetaEngines).toHaveBeenCalled();
     });
 
     describe('when the user can manage/create engines', () => {
-      it('renders a create engine button which takes users to the create engine page', () => {
+      it('renders a create engine button which takes users to the create meta engine page', () => {
         setMockValues({
           ...valuesWithEngines,
+          hasPlatinumLicense: true,
           myRole: { canManageEngines: true },
         });
         const wrapper = shallow(<EnginesOverview />);
 
         expect(
-          wrapper.find('[data-test-subj="appSearchEnginesEngineCreationButton"]').prop('to')
-        ).toEqual('/engine_creation');
+          wrapper.find('[data-test-subj="appSearchEnginesMetaEngineCreationButton"]').prop('to')
+        ).toEqual('/meta_engine_creation');
       });
     });
+  });
 
-    describe('when the account has a platinum license', () => {
-      it('renders a 2nd meta engines table & makes a 2nd meta engines call', () => {
-        setMockValues({
-          ...valuesWithEngines,
-          hasPlatinumLicense: true,
-        });
-        const wrapper = shallow(<EnginesOverview />);
+  describe('pagination', () => {
+    const getTablePagination = (wrapper: ShallowWrapper) =>
+      wrapper.find(EnginesTable).prop('pagination');
 
-        expect(wrapper.find(MetaEnginesTable)).toHaveLength(1);
-        expect(actions.loadMetaEngines).toHaveBeenCalled();
-      });
+    it('passes down page data from the API', () => {
+      const wrapper = shallow(<EnginesOverview />);
+      const pagination = getTablePagination(wrapper);
 
-      describe('when the user can manage/create engines', () => {
-        it('renders a create engine button which takes users to the create meta engine page', () => {
-          setMockValues({
-            ...valuesWithEngines,
-            hasPlatinumLicense: true,
-            myRole: { canManageEngines: true },
-          });
-          const wrapper = shallow(<EnginesOverview />);
-
-          expect(
-            wrapper.find('[data-test-subj="appSearchEnginesMetaEngineCreationButton"]').prop('to')
-          ).toEqual('/meta_engine_creation');
-        });
-      });
+      expect(pagination.totalItemCount).toEqual(100);
+      expect(pagination.pageIndex).toEqual(0);
     });
 
-    describe('pagination', () => {
-      const getTablePagination = (wrapper: ShallowWrapper) =>
-        wrapper.find(EnginesTable).prop('pagination');
-
-      it('passes down page data from the API', () => {
-        const wrapper = shallow(<EnginesOverview />);
-        const pagination = getTablePagination(wrapper);
+    it('re-polls the API on page change', () => {
+      const wrapper = shallow(<EnginesOverview />);
 
-        expect(pagination.totalItemCount).toEqual(100);
-        expect(pagination.pageIndex).toEqual(0);
+      setMockValues({
+        ...valuesWithEngines,
+        enginesMeta: {
+          page: {
+            ...valuesWithEngines.enginesMeta.page,
+            current: 51,
+          },
+        },
       });
+      rerender(wrapper);
 
-      it('re-polls the API on page change', () => {
-        const wrapper = shallow(<EnginesOverview />);
-
-        setMockValues({
-          ...valuesWithEngines,
-          enginesMeta: {
-            page: {
-              ...valuesWithEngines.enginesMeta.page,
-              current: 51,
-            },
-          },
-        });
-        rerender(wrapper);
+      expect(actions.loadEngines).toHaveBeenCalledTimes(2);
+      expect(getTablePagination(wrapper).pageIndex).toEqual(50);
+    });
 
-        expect(actions.loadEngines).toHaveBeenCalledTimes(2);
-        expect(getTablePagination(wrapper).pageIndex).toEqual(50);
+    it('calls onPagination handlers', () => {
+      setMockValues({
+        ...valuesWithEngines,
+        hasPlatinumLicense: true,
+        metaEngines: ['test-meta-engine'],
       });
+      const wrapper = shallow(<EnginesOverview />);
+      const pageEvent = { page: { index: 0 } };
 
-      it('calls onPagination handlers', () => {
-        setMockValues({
-          ...valuesWithEngines,
-          hasPlatinumLicense: true,
-          metaEngines: ['test-meta-engine'],
-        });
-        const wrapper = shallow(<EnginesOverview />);
-        const pageEvent = { page: { index: 0 } };
-
-        wrapper.find(EnginesTable).simulate('change', pageEvent);
-        expect(actions.onEnginesPagination).toHaveBeenCalledWith(1);
+      wrapper.find(EnginesTable).simulate('change', pageEvent);
+      expect(actions.onEnginesPagination).toHaveBeenCalledWith(1);
 
-        wrapper.find(MetaEnginesTable).simulate('change', pageEvent);
-        expect(actions.onMetaEnginesPagination).toHaveBeenCalledWith(1);
-      });
+      wrapper.find(MetaEnginesTable).simulate('change', pageEvent);
+      expect(actions.onMetaEnginesPagination).toHaveBeenCalledWith(1);
     });
   });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/engines_overview.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/engines_overview.tsx
index 7001ecada999a..44111a5ecbe66 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/engines_overview.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engines/engines_overview.tsx
@@ -12,7 +12,7 @@ import { useValues, useActions } from 'kea';
 import {
   EuiFlexGroup,
   EuiFlexItem,
-  EuiPageContent,
+  EuiPanel,
   EuiPageContentHeader,
   EuiPageContentHeaderSection,
   EuiPageContentBody,
@@ -20,24 +20,19 @@ import {
   EuiSpacer,
 } from '@elastic/eui';
 
-import { FlashMessages } from '../../../shared/flash_messages';
 import { LicensingLogic } from '../../../shared/licensing';
 import { EuiButtonTo } from '../../../shared/react_router_helpers';
 import { convertMetaToPagination, handlePageChange } from '../../../shared/table_pagination';
-import { SendAppSearchTelemetry as SendTelemetry } from '../../../shared/telemetry';
 import { AppLogic } from '../../app_logic';
 import { EngineIcon, MetaEngineIcon } from '../../icons';
 import { ENGINE_CREATION_PATH, META_ENGINE_CREATION_PATH } from '../../routes';
+import { AppSearchPageTemplate } from '../layout';
 
-import {
-  EnginesOverviewHeader,
-  LoadingState,
-  EmptyState,
-  EmptyMetaEnginesState,
-} from './components';
+import { LaunchAppSearchButton, EmptyState, EmptyMetaEnginesState } from './components';
 import { EnginesTable } from './components/tables/engines_table';
 import { MetaEnginesTable } from './components/tables/meta_engines_table';
 import {
+  ENGINES_OVERVIEW_TITLE,
   CREATE_AN_ENGINE_BUTTON_LABEL,
   CREATE_A_META_ENGINE_BUTTON_LABEL,
   ENGINES_TITLE,
@@ -73,16 +68,19 @@ export const EnginesOverview: React.FC = () => {
     if (hasPlatinumLicense) loadMetaEngines();
   }, [hasPlatinumLicense, metaEnginesMeta.page.current]);
 
-  if (dataLoading) return <LoadingState />;
-  if (!engines.length) return <EmptyState />;
-
   return (
-    <>
-      <SendTelemetry action="viewed" metric="engines_overview" />
-
-      <EnginesOverviewHeader />
-      <EuiPageContent hasBorder>
-        <FlashMessages />
+    <AppSearchPageTemplate
+      pageViewTelemetry="engines_overview"
+      pageChrome={[ENGINES_TITLE]}
+      pageHeader={{
+        pageTitle: ENGINES_OVERVIEW_TITLE,
+        rightSideItems: [<LaunchAppSearchButton />],
+      }}
+      isLoading={dataLoading}
+      isEmptyState={!engines.length}
+      emptyState={<EmptyState />}
+    >
+      <EuiPanel hasBorder>
         <EuiPageContentHeader>
           <EuiPageContentHeaderSection>
             <EuiFlexGroup gutterSize="xs" alignItems="center" responsive={false}>
@@ -168,7 +166,7 @@ export const EnginesOverview: React.FC = () => {
             </EuiPageContentBody>
           </>
         )}
-      </EuiPageContent>
-    </>
+      </EuiPanel>
+    </AppSearchPageTemplate>
   );
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/meta_engine_creation/meta_engine_creation.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/meta_engine_creation/meta_engine_creation.tsx
index 02a1768a7528e..325e557acec0c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/meta_engine_creation/meta_engine_creation.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/meta_engine_creation/meta_engine_creation.tsx
@@ -18,16 +18,14 @@ import {
   EuiFormRow,
   EuiFlexItem,
   EuiFieldText,
-  EuiPageContent,
-  EuiPageHeader,
+  EuiPanel,
   EuiSpacer,
   EuiTitle,
   EuiButton,
 } from '@elastic/eui';
 
-import { FlashMessages } from '../../../shared/flash_messages';
-import { SetAppSearchChrome as SetPageChrome } from '../../../shared/kibana_chrome';
 import { AppLogic } from '../../app_logic';
+import { AppSearchPageTemplate } from '../layout';
 
 import {
   ALLOWED_CHARS_NOTE,
@@ -74,20 +72,21 @@ export const MetaEngineCreation: React.FC = () => {
   }, []);
 
   return (
-    <div data-test-subj="MetaEngineCreation">
-      <SetPageChrome trail={[META_ENGINE_CREATION_TITLE]} />
-      <EuiPageHeader
-        pageTitle={META_ENGINE_CREATION_TITLE}
-        description={
+    <AppSearchPageTemplate
+      pageChrome={[META_ENGINE_CREATION_TITLE]}
+      pageHeader={{
+        pageTitle: META_ENGINE_CREATION_TITLE,
+        description: (
           <>
             {META_ENGINE_CREATION_FORM_META_ENGINE_DESCRIPTION}
             <br />
             {META_ENGINE_CREATION_FORM_DOCUMENTATION_DESCRIPTION}
           </>
-        }
-      />
-      <FlashMessages />
-      <EuiPageContent hasBorder>
+        ),
+      }}
+      data-test-subj="MetaEngineCreation"
+    >
+      <EuiPanel hasBorder>
         <EuiForm
           component="form"
           data-test-subj="MetaEngineCreationForm"
@@ -166,7 +165,7 @@ export const MetaEngineCreation: React.FC = () => {
             {META_ENGINE_CREATION_FORM_SUBMIT_BUTTON_LABEL}
           </EuiButton>
         </EuiForm>
-      </EuiPageContent>
-    </div>
+      </EuiPanel>
+    </AppSearchPageTemplate>
   );
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx
index caf0f805e8ca7..b2cd3d7b54a1a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx
@@ -92,6 +92,22 @@ export const AppSearchConfigured: React.FC<Required<InitialAppData>> = (props) =
           <Library />
         </Route>
       )}
+      <Route exact path={ROOT_PATH}>
+        <Redirect to={ENGINES_PATH} />
+      </Route>
+      <Route exact path={ENGINES_PATH}>
+        <EnginesOverview />
+      </Route>
+      {canManageEngines && (
+        <Route exact path={ENGINE_CREATION_PATH}>
+          <EngineCreation />
+        </Route>
+      )}
+      {canManageMetaEngines && (
+        <Route exact path={META_ENGINE_CREATION_PATH}>
+          <MetaEngineCreation />
+        </Route>
+      )}
       {canViewRoleMappings && (
         <Route path={ROLE_MAPPINGS_PATH}>
           <RoleMappings />
@@ -100,12 +116,6 @@ export const AppSearchConfigured: React.FC<Required<InitialAppData>> = (props) =
       <Route>
         <Layout navigation={<AppSearchNav />} readOnlyMode={readOnlyMode}>
           <Switch>
-            <Route exact path={ROOT_PATH}>
-              <Redirect to={ENGINES_PATH} />
-            </Route>
-            <Route exact path={ENGINES_PATH}>
-              <EnginesOverview />
-            </Route>
             <Route path={ENGINE_PATH}>
               <EngineRouter />
             </Route>
@@ -115,16 +125,6 @@ export const AppSearchConfigured: React.FC<Required<InitialAppData>> = (props) =
             <Route exact path={CREDENTIALS_PATH}>
               <Credentials />
             </Route>
-            {canManageEngines && (
-              <Route exact path={ENGINE_CREATION_PATH}>
-                <EngineCreation />
-              </Route>
-            )}
-            {canManageMetaEngines && (
-              <Route exact path={META_ENGINE_CREATION_PATH}>
-                <MetaEngineCreation />
-              </Route>
-            )}
             <Route>
               <NotFound product={APP_SEARCH_PLUGIN} />
             </Route>
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/display_settings_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/display_settings_logic.ts
index e8b419a31abb2..38424df724bd4 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/display_settings_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/display_settings_logic.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
-import { DropResult } from 'react-beautiful-dnd';
-
 import { kea, MakeLogicType } from 'kea';
 import { cloneDeep, isEqual, differenceBy } from 'lodash';
 
+import { DropResult } from '@elastic/eui';
+
 import {
   setSuccessMessage,
   clearFlashMessages,
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/math.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/math.tsx
index 52522a18604aa..7aae35f496923 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/math.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/math.tsx
@@ -48,7 +48,7 @@ export const mathOperation: OperationDefinition<MathIndexPatternColumn, 'managed
         function: 'mathColumn',
         arguments: {
           id: [columnId],
-          name: [columnId],
+          name: [column.label],
           expression: [astToString(column.params.tinymathAst)],
           onError: ['null'],
         },
diff --git a/x-pack/plugins/observability/public/components/app/cases/all_cases/index.tsx b/x-pack/plugins/observability/public/components/app/cases/all_cases/index.tsx
index 1636d08aa56e4..29a16590f3eb3 100644
--- a/x-pack/plugins/observability/public/components/app/cases/all_cases/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/cases/all_cases/index.tsx
@@ -28,19 +28,18 @@ interface AllCasesProps {
 export const AllCases = React.memo<AllCasesProps>(({ userCanCrud }) => {
   const {
     cases: casesUi,
-    application: { navigateToApp },
+    application: { getUrlForApp, navigateToUrl },
   } = useKibana().services;
   const { formatUrl } = useFormatUrl(CASES_APP_ID);
 
+  const casesUrl = getUrlForApp(CASES_APP_ID);
   return casesUi.getAllCases({
     caseDetailsNavigation: {
       href: ({ detailName, subCaseId }: AllCasesNavProps) => {
         return formatUrl(getCaseDetailsUrl({ id: detailName, subCaseId }));
       },
       onClick: async ({ detailName, subCaseId, search }: AllCasesNavProps) =>
-        navigateToApp(`${CASES_APP_ID}`, {
-          path: getCaseDetailsUrl({ id: detailName, subCaseId }),
-        }),
+        navigateToUrl(`${casesUrl}${getCaseDetailsUrl({ id: detailName, subCaseId })}`),
     },
     configureCasesNavigation: {
       href: formatUrl(getConfigureCasesUrl()),
@@ -48,9 +47,7 @@ export const AllCases = React.memo<AllCasesProps>(({ userCanCrud }) => {
         if (ev != null) {
           ev.preventDefault();
         }
-        return navigateToApp(`${CASES_APP_ID}`, {
-          path: getConfigureCasesUrl(),
-        });
+        return navigateToUrl(`${casesUrl}${getConfigureCasesUrl()}`);
       },
     },
     createCaseNavigation: {
@@ -59,9 +56,7 @@ export const AllCases = React.memo<AllCasesProps>(({ userCanCrud }) => {
         if (ev != null) {
           ev.preventDefault();
         }
-        return navigateToApp(`${CASES_APP_ID}`, {
-          path: getCreateCaseUrl(),
-        });
+        return navigateToUrl(`${casesUrl}${getCreateCaseUrl()}`);
       },
     },
     disableAlerts: true,
diff --git a/x-pack/plugins/observability/public/components/app/cases/case_view/index.tsx b/x-pack/plugins/observability/public/components/app/cases/case_view/index.tsx
index 728333ac8c544..07d8019153a06 100644
--- a/x-pack/plugins/observability/public/components/app/cases/case_view/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/cases/case_view/index.tsx
@@ -42,8 +42,10 @@ export interface CaseProps extends Props {
 export const CaseView = React.memo(({ caseId, subCaseId, userCanCrud }: Props) => {
   const [caseTitle, setCaseTitle] = useState<string | null>(null);
 
-  const { cases: casesUi, application } = useKibana().services;
-  const { navigateToApp } = application;
+  const {
+    cases: casesUi,
+    application: { getUrlForApp, navigateToUrl },
+  } = useKibana().services;
   const allCasesLink = getCaseUrl();
   const { formatUrl } = useFormatUrl(CASES_APP_ID);
   const href = formatUrl(allCasesLink);
@@ -79,6 +81,7 @@ export const CaseView = React.memo(({ caseId, subCaseId, userCanCrud }: Props) =
     [caseId, formatUrl, subCaseId]
   );
 
+  const casesUrl = getUrlForApp(CASES_APP_ID);
   return casesUi.getCaseView({
     allCasesNavigation: {
       href: allCasesHref,
@@ -86,9 +89,7 @@ export const CaseView = React.memo(({ caseId, subCaseId, userCanCrud }: Props) =
         if (ev != null) {
           ev.preventDefault();
         }
-        return navigateToApp(`${CASES_APP_ID}`, {
-          path: allCasesLink,
-        });
+        return navigateToUrl(casesUrl);
       },
     },
     caseDetailsNavigation: {
@@ -97,9 +98,7 @@ export const CaseView = React.memo(({ caseId, subCaseId, userCanCrud }: Props) =
         if (ev != null) {
           ev.preventDefault();
         }
-        return navigateToApp(`${CASES_APP_ID}`, {
-          path: getCaseDetailsUrl({ id: caseId }),
-        });
+        return navigateToUrl(`${casesUrl}${getCaseDetailsUrl({ id: caseId })}`);
       },
     },
     caseId,
@@ -109,9 +108,7 @@ export const CaseView = React.memo(({ caseId, subCaseId, userCanCrud }: Props) =
         if (ev != null) {
           ev.preventDefault();
         }
-        return navigateToApp(`${CASES_APP_ID}`, {
-          path: configureCasesLink,
-        });
+        return navigateToUrl(`${casesUrl}${configureCasesLink}`);
       },
     },
     getCaseDetailHrefWithCommentId,
diff --git a/x-pack/plugins/observability/public/components/app/cases/create/index.test.tsx b/x-pack/plugins/observability/public/components/app/cases/create/index.test.tsx
index ec7511836328b..6dae88733fd49 100644
--- a/x-pack/plugins/observability/public/components/app/cases/create/index.test.tsx
+++ b/x-pack/plugins/observability/public/components/app/cases/create/index.test.tsx
@@ -12,7 +12,7 @@ import { EuiThemeProvider } from '../../../../../../../../src/plugins/kibana_rea
 import { Create } from '.';
 import { useKibana } from '../../../../utils/kibana_react';
 import { basicCase } from '../../../../../../cases/public/containers/mock';
-import { CASES_APP_ID, CASES_OWNER } from '../constants';
+import { CASES_OWNER } from '../constants';
 import { Case } from '../../../../../../cases/common';
 import { getCaseDetailsUrl } from '../../../../pages/cases/links';
 
@@ -20,7 +20,8 @@ jest.mock('../../../../utils/kibana_react');
 
 describe('Create case', () => {
   const mockCreateCase = jest.fn();
-  const mockNavigateToApp = jest.fn();
+  const mockNavigateToUrl = jest.fn();
+  const mockCasesUrl = 'https://elastic.co/app/observability/cases';
   beforeEach(() => {
     jest.resetAllMocks();
     (useKibana as jest.Mock).mockReturnValue({
@@ -28,7 +29,7 @@ describe('Create case', () => {
         cases: {
           getCreateCase: mockCreateCase,
         },
-        application: { navigateToApp: mockNavigateToApp },
+        application: { navigateToUrl: mockNavigateToUrl, getUrlForApp: () => mockCasesUrl },
       },
     });
   });
@@ -52,7 +53,7 @@ describe('Create case', () => {
             onCancel();
           },
         },
-        application: { navigateToApp: mockNavigateToApp },
+        application: { navigateToUrl: mockNavigateToUrl, getUrlForApp: () => mockCasesUrl },
       },
     });
     mount(
@@ -61,7 +62,7 @@ describe('Create case', () => {
       </EuiThemeProvider>
     );
 
-    await waitFor(() => expect(mockNavigateToApp).toHaveBeenCalledWith(`${CASES_APP_ID}`));
+    await waitFor(() => expect(mockNavigateToUrl).toHaveBeenCalledWith(`${mockCasesUrl}`));
   });
 
   it('should redirect to new case when posting the case', async () => {
@@ -72,7 +73,7 @@ describe('Create case', () => {
             onSuccess(basicCase);
           },
         },
-        application: { navigateToApp: mockNavigateToApp },
+        application: { navigateToUrl: mockNavigateToUrl, getUrlForApp: () => mockCasesUrl },
       },
     });
     mount(
@@ -82,9 +83,10 @@ describe('Create case', () => {
     );
 
     await waitFor(() =>
-      expect(mockNavigateToApp).toHaveBeenNthCalledWith(1, `${CASES_APP_ID}`, {
-        path: getCaseDetailsUrl({ id: basicCase.id }),
-      })
+      expect(mockNavigateToUrl).toHaveBeenNthCalledWith(
+        1,
+        `${mockCasesUrl}${getCaseDetailsUrl({ id: basicCase.id })}`
+      )
     );
   });
 });
diff --git a/x-pack/plugins/observability/public/components/app/cases/create/index.tsx b/x-pack/plugins/observability/public/components/app/cases/create/index.tsx
index d7e2daea2490b..a3ed234147314 100644
--- a/x-pack/plugins/observability/public/components/app/cases/create/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/cases/create/index.tsx
@@ -15,17 +15,18 @@ import { CASES_APP_ID, CASES_OWNER } from '../constants';
 export const Create = React.memo(() => {
   const {
     cases,
-    application: { navigateToApp },
+    application: { getUrlForApp, navigateToUrl },
   } = useKibana().services;
+  const casesUrl = getUrlForApp(CASES_APP_ID);
   const onSuccess = useCallback(
-    async ({ id }) =>
-      navigateToApp(`${CASES_APP_ID}`, {
-        path: getCaseDetailsUrl({ id }),
-      }),
-    [navigateToApp]
+    async ({ id }) => navigateToUrl(`${casesUrl}${getCaseDetailsUrl({ id })}`),
+    [casesUrl, navigateToUrl]
   );
 
-  const handleSetIsCancel = useCallback(() => navigateToApp(`${CASES_APP_ID}`), [navigateToApp]);
+  const handleSetIsCancel = useCallback(() => navigateToUrl(`${casesUrl}`), [
+    casesUrl,
+    navigateToUrl,
+  ]);
 
   return (
     <EuiPanel>
diff --git a/x-pack/plugins/observability/public/pages/cases/case_details.tsx b/x-pack/plugins/observability/public/pages/cases/case_details.tsx
index 78f1cb313ea9b..6adf5ad286808 100644
--- a/x-pack/plugins/observability/public/pages/cases/case_details.tsx
+++ b/x-pack/plugins/observability/public/pages/cases/case_details.tsx
@@ -16,7 +16,7 @@ import { CaseCallOut, permissionsReadOnlyErrorMessage } from '../../components/a
 
 export const CaseDetailsPage = React.memo(() => {
   const {
-    application: { navigateToApp },
+    application: { getUrlForApp, navigateToUrl },
   } = useKibana().services;
   const userPermissions = useGetUserCasesPermissions();
   const { detailName: caseId, subCaseId } = useParams<{
@@ -24,8 +24,9 @@ export const CaseDetailsPage = React.memo(() => {
     subCaseId?: string;
   }>();
 
+  const casesUrl = getUrlForApp(CASES_APP_ID);
   if (userPermissions != null && !userPermissions.read) {
-    navigateToApp(`${CASES_APP_ID}`);
+    navigateToUrl(casesUrl);
     return null;
   }
 
diff --git a/x-pack/plugins/observability/public/pages/cases/configure_cases.tsx b/x-pack/plugins/observability/public/pages/cases/configure_cases.tsx
index 2986c1ff34e11..a4df4855b0204 100644
--- a/x-pack/plugins/observability/public/pages/cases/configure_cases.tsx
+++ b/x-pack/plugins/observability/public/pages/cases/configure_cases.tsx
@@ -23,22 +23,23 @@ const ButtonEmpty = styled(EuiButtonEmpty)`
 function ConfigureCasesPageComponent() {
   const {
     cases,
-    application: { navigateToApp },
+    application: { getUrlForApp, navigateToUrl },
   } = useKibana().services;
+  const casesUrl = getUrlForApp(CASES_APP_ID);
   const userPermissions = useGetUserCasesPermissions();
   const { ObservabilityPageTemplate } = usePluginContext();
   const onClickGoToCases = useCallback(
     async (ev) => {
       ev.preventDefault();
-      return navigateToApp(`${CASES_APP_ID}`);
+      return navigateToUrl(casesUrl);
     },
-    [navigateToApp]
+    [casesUrl, navigateToUrl]
   );
   const { formatUrl } = useFormatUrl(CASES_APP_ID);
   const href = formatUrl(getCaseUrl());
   useBreadcrumbs([{ ...casesBreadcrumbs.cases, href }, casesBreadcrumbs.configure]);
   if (userPermissions != null && !userPermissions.read) {
-    navigateToApp(`${CASES_APP_ID}`);
+    navigateToUrl(casesUrl);
     return null;
   }
 
diff --git a/x-pack/plugins/observability/public/pages/cases/create_case.tsx b/x-pack/plugins/observability/public/pages/cases/create_case.tsx
index 11f6d62da6103..96ed59734edda 100644
--- a/x-pack/plugins/observability/public/pages/cases/create_case.tsx
+++ b/x-pack/plugins/observability/public/pages/cases/create_case.tsx
@@ -25,22 +25,23 @@ export const CreateCasePage = React.memo(() => {
   const userPermissions = useGetUserCasesPermissions();
   const { ObservabilityPageTemplate } = usePluginContext();
   const {
-    application: { navigateToApp },
+    application: { getUrlForApp, navigateToUrl },
   } = useKibana().services;
 
+  const casesUrl = getUrlForApp(CASES_APP_ID);
   const goTo = useCallback(
     async (ev) => {
       ev.preventDefault();
-      return navigateToApp(CASES_APP_ID);
+      return navigateToUrl(casesUrl);
     },
-    [navigateToApp]
+    [casesUrl, navigateToUrl]
   );
 
   const { formatUrl } = useFormatUrl(CASES_APP_ID);
   const href = formatUrl(getCaseUrl());
   useBreadcrumbs([{ ...casesBreadcrumbs.cases, href }, casesBreadcrumbs.create]);
   if (userPermissions != null && !userPermissions.crud) {
-    navigateToApp(`${CASES_APP_ID}`);
+    navigateToUrl(casesUrl);
     return null;
   }
 
diff --git a/x-pack/plugins/osquery/server/usage/fetchers.test.ts b/x-pack/plugins/osquery/server/usage/fetchers.test.ts
new file mode 100644
index 0000000000000..13da639e2c72d
--- /dev/null
+++ b/x-pack/plugins/osquery/server/usage/fetchers.test.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { extractBeatUsageMetrics } from './fetchers';
+
+describe('extractBeatUsageMetrics', () => {
+  it('should not blow when no values are supplied for the aggregations', () => {
+    expect(extractBeatUsageMetrics({})).toEqual({
+      memory: {
+        rss: {},
+      },
+      cpu: {},
+    });
+  });
+
+  it('should not blow when some values are missing from the aggregations', () => {
+    expect(
+      extractBeatUsageMetrics({
+        aggregations: {
+          lastDay: {
+            max_rss: {
+              value: 1,
+            },
+          },
+        },
+      })
+    ).toEqual({
+      memory: {
+        rss: {
+          max: 1,
+        },
+      },
+      cpu: {},
+    });
+  });
+
+  it('should pick out all the max/avg/latest for memory/cpu', () => {
+    expect(
+      extractBeatUsageMetrics({
+        aggregations: {
+          lastDay: {
+            max_rss: {
+              value: 1,
+            },
+            avg_rss: {
+              value: 1,
+            },
+            max_cpu: {
+              value: 2,
+            },
+            avg_cpu: {
+              value: 2,
+            },
+            latest: {
+              hits: {
+                total: 1,
+                hits: [
+                  {
+                    _index: '',
+                    _id: '',
+                    _source: {
+                      monitoring: {
+                        metrics: {
+                          beat: {
+                            cpu: {
+                              total: {
+                                time: {
+                                  ms: 2,
+                                },
+                              },
+                            },
+                            memstats: {
+                              rss: 1,
+                            },
+                          },
+                        },
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+          },
+        },
+      })
+    ).toEqual({
+      memory: {
+        rss: {
+          max: 1,
+          avg: 1,
+          latest: 1,
+        },
+      },
+      cpu: {
+        max: 2,
+        avg: 2,
+        latest: 2,
+      },
+    });
+  });
+});
diff --git a/x-pack/plugins/osquery/server/usage/fetchers.ts b/x-pack/plugins/osquery/server/usage/fetchers.ts
index 5f5b282331bec..6a4236b5adccd 100644
--- a/x-pack/plugins/osquery/server/usage/fetchers.ts
+++ b/x-pack/plugins/osquery/server/usage/fetchers.ts
@@ -9,6 +9,7 @@ import {
   AggregationsSingleBucketAggregate,
   AggregationsTopHitsAggregate,
   AggregationsValueAggregate,
+  SearchResponse,
 } from '@elastic/elasticsearch/api/types';
 import { PackagePolicyServiceInterface } from '../../../fleet/server';
 import { getRouteMetric } from '../routes/usage';
@@ -133,6 +134,46 @@ export async function getLiveQueryUsage(
   return result;
 }
 
+export function extractBeatUsageMetrics(
+  metricResponse: Pick<SearchResponse<unknown>, 'aggregations'>
+) {
+  const lastDayAggs = metricResponse.aggregations?.lastDay as AggregationsSingleBucketAggregate;
+  const result: BeatMetricsUsage = {
+    memory: {
+      rss: {},
+    },
+    cpu: {},
+  };
+
+  if (lastDayAggs) {
+    if ('max_rss' in lastDayAggs) {
+      result.memory.rss.max = (lastDayAggs.max_rss as AggregationsValueAggregate).value;
+    }
+
+    if ('avg_rss' in lastDayAggs) {
+      result.memory.rss.avg = (lastDayAggs.max_rss as AggregationsValueAggregate).value;
+    }
+
+    if ('max_cpu' in lastDayAggs) {
+      result.cpu.max = (lastDayAggs.max_cpu as AggregationsValueAggregate).value;
+    }
+
+    if ('avg_cpu' in lastDayAggs) {
+      result.cpu.avg = (lastDayAggs.max_cpu as AggregationsValueAggregate).value;
+    }
+
+    if ('latest' in lastDayAggs) {
+      const latest = (lastDayAggs.latest as AggregationsTopHitsAggregate).hits.hits[0]?._source
+        ?.monitoring.metrics.beat;
+      if (latest) {
+        result.cpu.latest = latest.cpu.total.time.ms;
+        result.memory.rss.latest = latest.memstats.rss;
+      }
+    }
+  }
+  return result;
+}
+
 export async function getBeatUsage(esClient: ElasticsearchClient) {
   const { body: metricResponse } = await esClient.search({
     body: {
@@ -186,38 +227,6 @@ export async function getBeatUsage(esClient: ElasticsearchClient) {
     },
     index: METRICS_INDICES,
   });
-  const lastDayAggs = metricResponse.aggregations?.lastDay as AggregationsSingleBucketAggregate;
-  const result: BeatMetricsUsage = {
-    memory: {
-      rss: {},
-    },
-    cpu: {},
-  };
-
-  if ('max_rss' in lastDayAggs) {
-    result.memory.rss.max = (lastDayAggs.max_rss as AggregationsValueAggregate).value;
-  }
 
-  if ('avg_rss' in lastDayAggs) {
-    result.memory.rss.avg = (lastDayAggs.max_rss as AggregationsValueAggregate).value;
-  }
-
-  if ('max_cpu' in lastDayAggs) {
-    result.cpu.max = (lastDayAggs.max_cpu as AggregationsValueAggregate).value;
-  }
-
-  if ('avg_cpu' in lastDayAggs) {
-    result.cpu.avg = (lastDayAggs.max_cpu as AggregationsValueAggregate).value;
-  }
-
-  if ('latest' in lastDayAggs) {
-    const latest = (lastDayAggs.latest as AggregationsTopHitsAggregate).hits.hits[0]?._source
-      ?.monitoring.metrics.beat;
-    if (latest) {
-      result.cpu.latest = latest.cpu.total.time.ms;
-      result.memory.rss.latest = latest.memstats.rss;
-    }
-  }
-
-  return result;
+  return extractBeatUsageMetrics(metricResponse);
 }
diff --git a/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts b/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
index e30e276c7b717..f22ce54de193a 100644
--- a/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
+++ b/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
@@ -386,6 +386,8 @@ export default ({ getService }: FtrProviderContext): void => {
           },
         });
 
+        await es.indices.refresh({ index: alert._index });
+
         const { body: updatedAlert } = await supertest
           .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
           .set('kbn-xsrf', 'true')
@@ -439,6 +441,8 @@ export default ({ getService }: FtrProviderContext): void => {
           },
         });
 
+        await es.indices.refresh({ index: alert._index });
+
         const { body: updatedAlert } = await supertest
           .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
           .set('kbn-xsrf', 'true')
diff --git a/x-pack/test/functional/apps/lens/formula.ts b/x-pack/test/functional/apps/lens/formula.ts
index d1376731886eb..e9e5051c006f0 100644
--- a/x-pack/test/functional/apps/lens/formula.ts
+++ b/x-pack/test/functional/apps/lens/formula.ts
@@ -15,8 +15,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const browser = getService('browser');
   const testSubjects = getService('testSubjects');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/102183
-  describe.skip('lens formula', () => {
+  describe('lens formula', () => {
     it('should transition from count to formula', async () => {
       await PageObjects.visualize.gotoVisualizationLandingPage();
       await listingTable.searchForItemWithName('lnsXYvis');
@@ -81,7 +80,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       let element = await find.byCssSelector('.monaco-editor');
       expect(await element.getVisibleText()).to.equal(`count(kql='Men\\'s Clothing ')`);
 
-      await PageObjects.common.sleep(100);
       await PageObjects.lens.typeFormula('count(kql=');
       input = await find.activeElement();
       await input.type(`Men\'s Clothing`);
diff --git a/x-pack/test/functional/page_objects/lens_page.ts b/x-pack/test/functional/page_objects/lens_page.ts
index 332a40795bee9..d416d26baaf0d 100644
--- a/x-pack/test/functional/page_objects/lens_page.ts
+++ b/x-pack/test/functional/page_objects/lens_page.ts
@@ -1066,7 +1066,7 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
       await find.byCssSelector('.monaco-editor');
       await find.clickByCssSelectorWhenNotDisabled('.monaco-editor');
       const input = await find.activeElement();
-      await input.clearValueWithKeyboard();
+      await input.clearValueWithKeyboard({ charByChar: true });
       await input.type(formula);
     },
   });
diff --git a/x-pack/test/stack_functional_integration/apps/maps/_maps.ts b/x-pack/test/stack_functional_integration/apps/maps/_maps.ts
index 890d467f0311a..4b7b12dc5bef2 100644
--- a/x-pack/test/stack_functional_integration/apps/maps/_maps.ts
+++ b/x-pack/test/stack_functional_integration/apps/maps/_maps.ts
@@ -15,13 +15,12 @@ export default function ({
 }: FtrProviderContext & { updateBaselines: boolean }) {
   const screenshot = getService('screenshots');
   const browser = getService('browser');
-  const find = getService('find');
-  const PageObjects = getPageObjects(['maps']);
+  const PageObjects = getPageObjects(['common', 'maps']);
 
   describe('check Elastic Maps Server', function () {
     before(async function () {
       await PageObjects.maps.loadSavedMap('EMS Test');
-      await find.clickByButtonText('Dismiss');
+      await PageObjects.common.dismissBanner();
       await browser.setScreenshotSize(1000, 1000);
     });
 
diff --git a/x-pack/test/stack_functional_integration/apps/metricbeat/_metricbeat_dashboard.js b/x-pack/test/stack_functional_integration/apps/metricbeat/_metricbeat_dashboard.js
index 2a04d40d0b727..ac911a941c146 100644
--- a/x-pack/test/stack_functional_integration/apps/metricbeat/_metricbeat_dashboard.js
+++ b/x-pack/test/stack_functional_integration/apps/metricbeat/_metricbeat_dashboard.js
@@ -15,7 +15,6 @@ const ARCHIVE = resolve(INTEGRATION_TEST_ROOT, 'test/es_archives/metricbeat');
 export default function ({ getService, getPageObjects, updateBaselines }) {
   const screenshot = getService('screenshots');
   const browser = getService('browser');
-  const find = getService('find');
   const log = getService('log');
   const esArchiver = getService('esArchiver');
   const PageObjects = getPageObjects(['common', 'dashboard', 'timePicker']);
@@ -47,7 +46,7 @@ export default function ({ getService, getPageObjects, updateBaselines }) {
       // await PageObjects.dashboard.clickFullScreenMode();
 
       await PageObjects.common.sleep(2000);
-      await find.clickByButtonText('Dismiss');
+      await PageObjects.common.dismissBanner();
       await PageObjects.dashboard.waitForRenderComplete();
       await PageObjects.common.sleep(2000);
       await browser.setScreenshotSize(1000, 1337);
@@ -64,7 +63,7 @@ export default function ({ getService, getPageObjects, updateBaselines }) {
           'metricbeat_dashboard',
           updateBaselines
         );
-        expect(percentDifference).to.be.lessThan(0.01);
+        expect(percentDifference).to.be.lessThan(0.017);
       } finally {
         log.debug('### Screenshot taken');
       }
diff --git a/x-pack/test/stack_functional_integration/apps/telemetry/_telemetry.js b/x-pack/test/stack_functional_integration/apps/telemetry/_telemetry.js
index 71133cf011cfc..d35102cae1b7f 100644
--- a/x-pack/test/stack_functional_integration/apps/telemetry/_telemetry.js
+++ b/x-pack/test/stack_functional_integration/apps/telemetry/_telemetry.js
@@ -18,6 +18,9 @@ export default ({ getService, getPageObjects }) => {
       await browser.setWindowSize(1200, 800);
       await PageObjects.common.navigateToApp('home');
     });
+    after(async function () {
+      await PageObjects.common.dismissBanner();
+    });
 
     it('should show banner Help us improve the Elastic Stack', async () => {
       const actualMessage = await PageObjects.common.getWelcomeText();