diff --git a/.buildkite/pipelines/artifacts.yml b/.buildkite/pipelines/artifacts.yml
index 647f2c317569c..ab3201472b5c2 100644
--- a/.buildkite/pipelines/artifacts.yml
+++ b/.buildkite/pipelines/artifacts.yml
@@ -31,6 +31,13 @@ steps:
       queue: n2-2
     timeout_in_minutes: 30
 
+  - command: .buildkite/scripts/steps/artifacts/cloud.sh
+    label: 'Cloud Deployment'
+    agents:
+      queue: n2-2
+    timeout_in_minutes: 30
+    if: "build.env('RELEASE_BUILD') == null || build.env('RELEASE_BUILD') == '' || build.env('RELEASE_BUILD') == 'false'"
+
   - wait
 
   - command: .buildkite/scripts/steps/artifacts/publish.sh
diff --git a/.buildkite/scripts/steps/artifacts/cloud.sh b/.buildkite/scripts/steps/artifacts/cloud.sh
new file mode 100644
index 0000000000000..8fa04a5d176b0
--- /dev/null
+++ b/.buildkite/scripts/steps/artifacts/cloud.sh
@@ -0,0 +1,81 @@
+#!/bin/bash
+
+set -euo pipefail
+
+.buildkite/scripts/bootstrap.sh
+
+source .buildkite/scripts/steps/artifacts/env.sh
+
+echo "--- Publish Cloud image"
+mkdir -p target
+cd target
+
+buildkite-agent artifact download "kibana-cloud-$FULL_VERSION-docker-image.tar.gz" . --build "${KIBANA_BUILD_ID:-$BUILDKITE_BUILD_ID}"
+docker load --input kibana-cloud-$FULL_VERSION-docker-image.tar.gz
+
+TAG="$FULL_VERSION-$GIT_COMMIT"
+KIBANA_BASE_IMAGE="docker.elastic.co/kibana-ci/kibana-cloud:$FULL_VERSION"
+KIBANA_TEST_IMAGE="docker.elastic.co/kibana-ci/kibana-cloud:$TAG"
+
+docker tag "$KIBANA_BASE_IMAGE" "$KIBANA_TEST_IMAGE"
+
+echo "$KIBANA_DOCKER_PASSWORD" | docker login -u "$KIBANA_DOCKER_USERNAME" --password-stdin docker.elastic.co
+trap 'docker logout docker.elastic.co' EXIT
+
+docker push "$KIBANA_TEST_IMAGE"
+docker logout docker.elastic.co
+
+cd -
+
+echo "--- Create deployment"
+CLOUD_DEPLOYMENT_NAME="kibana-artifacts-$TAG"
+
+LOGS=$(mktemp --suffix ".json")
+DEPLOYMENT_SPEC=$(mktemp --suffix ".json")
+
+jq '
+  .name = "'$CLOUD_DEPLOYMENT_NAME'" |
+  .resources.kibana[0].plan.kibana.docker_image = "'$KIBANA_TEST_IMAGE'" |
+  .resources.kibana[0].plan.kibana.version = "'$FULL_VERSION'" |
+  .resources.elasticsearch[0].plan.elasticsearch.version = "'$FULL_VERSION'" |
+  .resources.enterprise_search[0].plan.enterprise_search.version = "'$FULL_VERSION'" |
+  .resources.integrations_server[0].plan.integrations_server.version = "'$FULL_VERSION'"
+  ' .buildkite/scripts/steps/cloud/deploy.json > "$DEPLOYMENT_SPEC"
+
+ecctl deployment create --track --output json --file "$DEPLOYMENT_SPEC" &> "$LOGS"
+CLOUD_DEPLOYMENT_USERNAME=$(jq --slurp '.[]|select(.resources).resources[] | select(.credentials).credentials.username' "$LOGS")
+CLOUD_DEPLOYMENT_PASSWORD=$(jq --slurp '.[]|select(.resources).resources[] | select(.credentials).credentials.password' "$LOGS")
+CLOUD_DEPLOYMENT_ID=$(jq -r --slurp '.[0].id' "$LOGS")
+CLOUD_DEPLOYMENT_STATUS_MESSAGES=$(jq --slurp '[.[]|select(.resources == null)]' "$LOGS")
+
+CLOUD_DEPLOYMENT_KIBANA_URL=$(ecctl deployment show "$CLOUD_DEPLOYMENT_ID" | jq -r '.resources.kibana[0].info.metadata.aliased_url')
+CLOUD_DEPLOYMENT_ELASTICSEARCH_URL=$(ecctl deployment show "$CLOUD_DEPLOYMENT_ID" | jq -r '.resources.elasticsearch[0].info.metadata.aliased_url')
+
+# NOTE: disabled pending log sanitization
+# echo "--- Setup FTR"
+# export TEST_KIBANA_PROTOCOL=$(node -e "console.log(new URL('$CLOUD_DEPLOYMENT_KIBANA_URL').protocol)")
+# export TEST_KIBANA_HOSTNAME=$(node -e "console.log(new URL('$CLOUD_DEPLOYMENT_KIBANA_URL').hostname)")
+# export TEST_KIBANA_PORT=$(node -e "console.log(new URL('$CLOUD_DEPLOYMENT_KIBANA_URL').port)")
+# export TEST_KIBANA_USERNAME=$CLOUD_DEPLOYMENT_USERNAME"
+# export TEST_KIBANA_PASS=$CLOUD_DEPLOYMENT_PASSWORD"
+
+# export TEST_ES_PROTOCOL=$(node -e "console.log(new URL('$CLOUD_DEPLOYMENT_KIBANA_URL').protocol)")
+# export TEST_ES_HOSTNAME==$(node -e "console.log(new URL('$CLOUD_DEPLOYMENT_KIBANA_URL').hostname)")
+# export TEST_ES_PORT=$(node -e "console.log(new URL('$CLOUD_DEPLOYMENT_KIBANA_URL').port)")
+# export TEST_ES_USER="$CLOUD_DEPLOYMENT_USERNAME"
+# export TEST_ES_PASS="$CLOUD_DEPLOYMENT_PASSWORD"
+
+# export TEST_BROWSER_HEADLESS=1
+
+# Error: attempted to use the "es" service to fetch Elasticsearch version info but the request failed: ConnectionError: self signed certificate in certificate chain
+# export NODE_TLS_REJECT_UNAUTHORIZED=0
+
+# echo "--- Run default functional tests"
+# node --no-warnings scripts/functional_test_runner.js --include-tag=cloud -exclude-tag=skipCloud
+
+# echo "--- Run x-pack functional tests"
+# cd x-pack
+# node --no-warnings scripts/functional_test_runner.js --include-tag=cloud -exclude-tag=skipCloud 
+
+echo "--- Shutdown deployment"
+ecctl deployment shutdown "$CLOUD_DEPLOYMENT_ID" --force --track --output json &> "$LOGS"
diff --git a/x-pack/plugins/fleet/public/components/enrollment_instructions/standalone/index.tsx b/x-pack/plugins/fleet/public/components/enrollment_instructions/standalone/index.tsx
index db36c16934e4b..a2feb6aade466 100644
--- a/x-pack/plugins/fleet/public/components/enrollment_instructions/standalone/index.tsx
+++ b/x-pack/plugins/fleet/public/components/enrollment_instructions/standalone/index.tsx
@@ -29,10 +29,10 @@ cd elastic-agent-${kibanaVersion}-windows-x86_64
 .\\elastic-agent.exe install`;
 
   const linuxDebCommand = `curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-${kibanaVersion}-amd64.deb
-  sudo dpkg -i elastic-agent-${kibanaVersion}-amd64.deb \nsudo systemctl enable elastic-agent \nsudo systemctl start elastic-agent`;
+sudo dpkg -i elastic-agent-${kibanaVersion}-amd64.deb \nsudo systemctl enable elastic-agent \nsudo systemctl start elastic-agent`;
 
   const linuxRpmCommand = `curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-${kibanaVersion}-x86_64.rpm
-  sudo rpm -vi elastic-agent-${kibanaVersion}-x86_64.rpm \nsudo systemctl enable elastic-agent \nsudo systemctl start elastic-agent`;
+sudo rpm -vi elastic-agent-${kibanaVersion}-x86_64.rpm \nsudo systemctl enable elastic-agent \nsudo systemctl start elastic-agent`;
 
   const linuxCommand =
     isK8s === 'IS_KUBERNETES' ? KUBERNETES_RUN_INSTRUCTIONS : STANDALONE_RUN_INSTRUCTIONS_LINUX;
diff --git a/x-pack/plugins/session_view/common/constants.ts b/x-pack/plugins/session_view/common/constants.ts
index ed0c21f89a8d6..0e1a7c16172f2 100644
--- a/x-pack/plugins/session_view/common/constants.ts
+++ b/x-pack/plugins/session_view/common/constants.ts
@@ -9,7 +9,7 @@ export const PROCESS_EVENTS_ROUTE = '/internal/session_view/process_events_route
 export const ALERTS_ROUTE = '/internal/session_view/alerts_route';
 export const ALERT_STATUS_ROUTE = '/internal/session_view/alert_status_route';
 export const SESSION_ENTRY_LEADERS_ROUTE = '/internal/session_view/session_entry_leaders_route';
-export const PROCESS_EVENTS_INDEX = 'logs-endpoint.events.process-default';
+export const PROCESS_EVENTS_INDEX = 'logs-endpoint.events.process-*';
 export const PREVIEW_ALERTS_INDEX = '.preview.alerts-security.alerts-default';
 export const ENTRY_SESSION_ENTITY_ID_PROPERTY = 'process.entry_leader.entity_id';
 export const ALERT_UUID_PROPERTY = 'kibana.alert.uuid';
@@ -41,11 +41,11 @@ export const PROCESS_EVENTS_PER_PAGE = 1000;
 // causes a session to only list and highlight up to 1000 alerts, even though there could
 // be far greater than this amount. UX should be added to let the end user know this is
 // happening and to revise their rule to be more specific.
-export const ALERTS_PER_PAGE = 1000;
+export const ALERTS_PER_PAGE = 501;
 
 // when showing the count of alerts in details panel tab, if the number
-// exceeds ALERT_COUNT_THRESHOLD we put a + next to it, e.g  999+
-export const ALERT_COUNT_THRESHOLD = 999;
+// exceeds ALERT_COUNT_THRESHOLD we put a + next to it, e.g  500+
+export const ALERT_COUNT_THRESHOLD = 500;
 
 // react-query caching keys
 export const QUERY_KEY_PROCESS_EVENTS = 'sessionViewProcessEvents';
diff --git a/x-pack/plugins/session_view/public/components/detail_panel_alert_group_item/index.tsx b/x-pack/plugins/session_view/public/components/detail_panel_alert_group_item/index.tsx
index c2f1e8d5a0494..a83e41d793e23 100644
--- a/x-pack/plugins/session_view/public/components/detail_panel_alert_group_item/index.tsx
+++ b/x-pack/plugins/session_view/public/components/detail_panel_alert_group_item/index.tsx
@@ -49,14 +49,18 @@ export const DetailPanelAlertGroupItem = ({
       arrowDisplay="right"
       initialIsOpen={false}
       buttonContent={
-        <EuiText data-test-subj={ALERT_GROUP_ITEM_TITLE_TEST_ID} css={styles.alertTitle} size="s">
-          <p>
+        <EuiText
+          data-test-subj={ALERT_GROUP_ITEM_TITLE_TEST_ID}
+          css={styles.alertTitleContainer}
+          size="s"
+        >
+          <p css={styles.alertTitle}>
             <EuiIcon color="danger" type="alert" css={styles.alertIcon} />
             {dataOrDash(rule?.name)}
           </p>
         </EuiText>
       }
-      css={styles.alertItem}
+      css={styles.alertGroupItem}
       extraAction={
         <EuiNotificationBadge
           data-test-subj={ALERT_GROUP_ITEM_COUNT_TEST_ID}
diff --git a/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/index.tsx b/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/index.tsx
index b85b3e809e356..1c6dd0a57b7e7 100644
--- a/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/index.tsx
+++ b/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/index.tsx
@@ -93,8 +93,8 @@ export const DetailPanelAlertListItem = ({
       data-test-subj={ALERT_LIST_ITEM_TEST_ID}
       arrowDisplay={isInvestigated ? 'right' : 'none'}
       buttonContent={
-        <EuiText css={styles.alertTitle} size="s">
-          <p>
+        <EuiText css={styles.alertTitleContainer} size="s">
+          <p css={styles.alertTitle}>
             <EuiIcon color="danger" type="alert" css={styles.alertIcon} />
             {dataOrDash(name)}
           </p>
diff --git a/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/styles.ts b/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/styles.ts
index 7672bb942ff32..403c6d3e2cacb 100644
--- a/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/styles.ts
+++ b/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/styles.ts
@@ -50,10 +50,21 @@ export const useStyles = (minimal = false, isInvestigated = false) => {
       }
     `;
 
-    const alertTitle: CSSObject = {
+    const alertGroupItem = css`
+      ${alertItem}
+
+      & .euiAccordion__childWrapper {
+        overflow: hidden;
+      }
+    `;
+
+    const alertTitleContainer: CSSObject = {
       display: minimal ? 'none' : 'initial',
       color: alertTitleColor,
       fontWeight: font.weight.semiBold,
+    };
+
+    const alertTitle: CSSObject = {
       textOverflow: 'ellipsis',
       overflow: 'hidden',
       whiteSpace: 'nowrap',
@@ -98,6 +109,8 @@ export const useStyles = (minimal = false, isInvestigated = false) => {
 
     return {
       alertItem,
+      alertGroupItem,
+      alertTitleContainer,
       alertTitle,
       alertIcon,
       alertAccordionButton,