diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 5fcb619af6570..c91d1a702b7ec 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -315,7 +315,6 @@
 /src/plugins/es_ui_shared/  @elastic/kibana-stack-management
 /x-pack/plugins/cross_cluster_replication/  @elastic/kibana-stack-management
 /x-pack/plugins/index_lifecycle_management/  @elastic/kibana-stack-management
-/x-pack/plugins/console_extensions/  @elastic/kibana-stack-management
 /x-pack/plugins/grokdebugger/  @elastic/kibana-stack-management
 /x-pack/plugins/index_management/  @elastic/kibana-stack-management
 /x-pack/plugins/license_api_guard/  @elastic/kibana-stack-management
@@ -330,7 +329,6 @@
 /x-pack/plugins/ingest_pipelines/  @elastic/kibana-stack-management
 /packages/kbn-ace/ @elastic/kibana-stack-management
 /packages/kbn-monaco/ @elastic/kibana-stack-management
-#CC# /x-pack/plugins/console_extensions/ @elastic/kibana-stack-management
 #CC# /x-pack/plugins/cross_cluster_replication/ @elastic/kibana-stack-management
 
 # Security Solution
diff --git a/.github/workflows/project-assigner.yml b/.github/workflows/project-assigner.yml
index 4966a0b506317..f2359846504bf 100644
--- a/.github/workflows/project-assigner.yml
+++ b/.github/workflows/project-assigner.yml
@@ -8,8 +8,17 @@ jobs:
     name: Assign issue or PR to project based on label
     steps:
       - name: Assign to project
-        uses: elastic/github-actions/project-assigner@v2.0.0
+        uses: elastic/github-actions/project-assigner@v2.1.0
         id: project_assigner
         with:
-          issue-mappings: '[{"label": "Feature:Lens", "projectNumber": 32, "columnName": "Long-term goals"}, {"label": "Feature:Canvas", "projectNumber": 38, "columnName": "Inbox"}, {"label": "Feature:Dashboard", "projectNumber": 68, "columnName": "Inbox"}, {"label": "Feature:Drilldowns", "projectNumber": 68, "columnName": "Inbox"}, {"label": "Feature:Input Controls", "projectNumber": 72, "columnName": "Inbox"}]'
+          issue-mappings: |
+            [
+              {"label": "Feature:Lens", "projectNumber": 32, "columnName": "Long-term goals"},
+              {"label": "Feature:Discover", "projectNumber": 44, "columnName": "Inbox"},
+              {"label": "Feature:Canvas", "projectNumber": 38, "columnName": "Inbox"},
+              {"label": "Feature:Dashboard", "projectNumber": 68, "columnName": "Inbox"},
+              {"label": "Feature:Drilldowns", "projectNumber": 68, "columnName": "Inbox"},
+              {"label": "Feature:Input Controls", "projectNumber": 72, "columnName": "Inbox"},
+              {"label": "Team:Security", "projectNumber": 320, "columnName": "Awaiting triage", "projectScope": "org"}
+            ]
           ghToken: ${{ secrets.PROJECT_ASSIGNER_TOKEN }}
diff --git a/config/kibana.yml b/config/kibana.yml
index eefb6bb8bacda..dea9849f17b28 100644
--- a/config/kibana.yml
+++ b/config/kibana.yml
@@ -42,6 +42,10 @@
 #elasticsearch.username: "kibana_system"
 #elasticsearch.password: "pass"
 
+# Kibana can also authenticate to Elasticsearch via "service account tokens".
+# If may use this token instead of a username/password.
+# elasticsearch.serviceAccountToken: "my_token"
+
 # Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
 # These settings enable SSL for outgoing requests from the Kibana server to the browser.
 #server.ssl.enabled: false
diff --git a/docs/apm/agent-configuration.asciidoc b/docs/apm/agent-configuration.asciidoc
index 2574d254ac14c..f2e07412c4a38 100644
--- a/docs/apm/agent-configuration.asciidoc
+++ b/docs/apm/agent-configuration.asciidoc
@@ -43,6 +43,7 @@ Supported configurations are also tagged with the image:./images/dynamic-config.
 
 [horizontal]
 Go Agent:: {apm-go-ref}/configuration.html[Configuration reference]
+iOS agent:: _Not yet supported_
 Java Agent:: {apm-java-ref}/configuration.html[Configuration reference]
 .NET Agent:: {apm-dotnet-ref}/configuration.html[Configuration reference]
 Node.js Agent:: {apm-node-ref}/configuration.html[Configuration reference]
diff --git a/docs/apm/apm-alerts.asciidoc b/docs/apm/apm-alerts.asciidoc
index 3e3e2b178ff10..42016ac08bfc7 100644
--- a/docs/apm/apm-alerts.asciidoc
+++ b/docs/apm/apm-alerts.asciidoc
@@ -1,69 +1,57 @@
 [role="xpack"]
 [[apm-alerts]]
-=== Alerts
+=== Alerts and rules
 
 ++++
 <titleabbrev>Create an alert</titleabbrev>
 ++++
 
+The APM app allows you to define **rules** to detect complex conditions within your APM data
+and trigger built-in **actions** when those conditions are met.
 
-The APM app integrates with Kibana's {kibana-ref}/alerting-getting-started.html[alerting and actions] feature.
-It provides a set of built-in **actions** and APM specific threshold **alerts** for you to use
-and enables central management of all alerts from <<management,Kibana Management>>.
+The following **rules** are supported:
+
+* Latency anomaly rule:
+Alert when latency of a service is abnormal
+* Transaction error rate threshold rule:
+Alert when the service's transaction error rate is above the defined threshold
+* Error count threshold rule:
+Alert when the number of errors in a service exceeds a defined threshold
 
 [role="screenshot"]
 image::apm/images/apm-alert.png[Create an alert in the APM app]
 
-For a walkthrough of the alert flyout panel, including detailed information on each configurable property,
-see Kibana's <<create-edit-rules,defining alerts>>.
-
-The APM app supports four different types of alerts:
-
-* Transaction duration anomaly:
-alerts when the service's transaction duration reaches a certain anomaly score
-* Transaction duration threshold:
-alerts when the service's transaction duration exceeds a given time limit over a given time frame
-* Transaction error rate threshold:
-alerts when the service's transaction error rate is above the selected rate over a given time frame
-* Error count threshold:
-alerts when service exceeds a selected number of errors over a given time frame
+For a complete walkthrough of the **Create rule** flyout panel, including detailed information on each configurable property,
+see Kibana's <<create-edit-rules,create and edit rules>>.
 
-Below, we'll walk through the creation of two of these alerts.
+Below, we'll walk through the creation of two APM rules.
 
 [float]
 [[apm-create-transaction-alert]]
-=== Example: create a transaction duration alert
+=== Example: create a latency anomaly rule
 
-Transaction duration alerts trigger when the duration of a specific transaction type in a service exceeds a defined threshold.
-This guide will create an alert for the `opbeans-java` service based on the following criteria:
+Latency anomaly rules trigger when the latency of a service is abnormal.
+This guide will create an alert for all services based on the following criteria:
 
-* Environment: Production
-* Transaction type: `transaction.type:request`
-* Average request is above `1500ms` for the last 5 minutes
-* Check every 10 minutes, and repeat the alert every 30 minutes
-* Send the alert via Slack
+* Environment: production
+* Severity level: critical
+* Run every five minutes
+* Send an alert to a Slack channel only when the rule status changes
 
-From the APM app, navigate to the `opbeans-java` service and select
-**Alerts** > **Create threshold alert** > **Transaction duration**.
+From any page in the APM app, select **Alerts and rules** > **Latency** > **Create anomaly rule**.
+Change the name of the alert, but do not edit the tags.
 
-`Transaction duration | opbeans-java` is automatically set as the name of the alert,
-and `apm` and `service.name:opbeans-java` are added as tags.
-It's fine to change the name of the alert, but do not edit the tags.
+Based on the criteria above, define the following rule details:
 
-Based on the alert criteria, define the following alert details:
+* **Check every** - `5 minutes`
+* **Notify** - "Only on status change"
+* **Environment** - `all`
+* **Has anomaly with severity** - `critical`
 
-* **Check every** - `10 minutes`
-* **Notify every** - `30 minutes`
-* **TYPE** - `request`
-* **WHEN** - `avg`
-* **IS ABOVE** - `1500ms`
-* **FOR THE LAST** - `5 minutes`
-
-Select an action type.
-Multiple action types can be selected, but in this example, we want to post to a Slack channel.
+Next, add a connector. Multiple connectors can be selected, but in this example we're interested in Slack.
 Select **Slack** > **Create a connector**.
 Enter a name for the connector,
-and paste the webhook URL.
+and paste your Slack webhook URL.
 See Slack's webhook documentation if you need to create one.
 
 A default message is provided as a starting point for your alert.
@@ -72,35 +60,32 @@ to pass additional alert values at the time a condition is detected to an action
 A list of available variables can be accessed by selecting the
 **add variable** button image:apm/images/add-variable.png[add variable button].
 
-Select **Save**. The alert has been created and is now active!
+Click **Save**. The rule has been created and is now active!
 
 [float]
 [[apm-create-error-alert]]
-=== Example: create an error rate alert
+=== Example: create an error count threshold alert
 
-Error rate alerts trigger when the number of errors in a service exceeds a defined threshold.
-This guide creates an alert for the `opbeans-python` service based on the following criteria:
+The error count threshold alert triggers when the number of errors in a service exceeds a defined threshold.
+This guide will create an alert for all services based on the following criteria:
 
-* Environment: Production
+* All environments
 * Error rate is above 25 for the last minute
-* Check every 1 minute, and repeat the alert every 10 minutes
-* Send the alert via email to the `opbeans-python` team
-
-From the APM app, navigate to the `opbeans-python` service and select
-**Alerts** > **Create threshold alert** > **Error rate**.
+* Check every 1 minute, and alert every time the rule is active
+* Send the alert via email to the site reliability team
 
-`Error rate | opbeans-python` is automatically set as the name of the alert,
-and `apm` and `service.name:opbeans-python` are added as tags.
-It's fine to change the name of the alert, but do not edit the tags.
+From any page in the APM app, select **Alerts and rules** > **Error count** > **Create threshold rule**.
+Change the name of the alert, but do not edit the tags.
 
-Based on the alert criteria, define the following alert details:
+Based on the criteria above, define the following rule details:
 
 * **Check every** - `1 minute`
-* **Notify every** - `10 minutes`
-* **IS ABOVE** - `25 errors`
-* **FOR THE LAST** - `1 minute`
+* **Notify** - "Every time alert is active"
+* **Environment** - `all`
+* **Is above** - `25 errors`
+* **For the last** - `1 minute`
 
-Select the **Email** action type and click **Create a connector**.
+Select the **Email** connector and click **Create a connector**.
 Fill out the required details: sender, host, port, etc., and click **save**.
 
 A default message is provided as a starting point for your alert.
@@ -109,14 +94,14 @@ to pass additional alert values at the time a condition is detected to an action
 A list of available variables can be accessed by selecting the
 **add variable** button image:apm/images/add-variable.png[add variable button].
 
-Select **Save**. The alert has been created and is now active!
+Click **Save**. The alert has been created and is now active!
 
 [float]
 [[apm-alert-manage]]
-=== Manage alerts and actions
+=== Manage alerts and rules
 
-From the APM app, select **Alerts** > **View active alerts** to be taken to the Kibana alerts and actions management page.
-From this page, you can create, edit, disable, mute, and delete alerts, and create, edit, and disable connectors.
+From the APM app, select **Alerts and rules** > **Manage rules** to be taken to the Kibana **Rules and Connectors** page.
+From this page, you can disable, mute, and delete APM alerts.
 
 [float]
 [[apm-alert-more-info]]
@@ -126,4 +111,4 @@ See {kibana-ref}/alerting-getting-started.html[alerting and actions] for more in
 
 NOTE: If you are using an **on-premise** Elastic Stack deployment with security,
 communication between Elasticsearch and Kibana must have TLS configured.
-More information is in the alerting {kibana-ref}/alerting-setup.html#alerting-prerequisites[prerequisites].
\ No newline at end of file
+More information is in the alerting {kibana-ref}/alerting-setup.html#alerting-prerequisites[prerequisites].
diff --git a/docs/apm/filters.asciidoc b/docs/apm/filters.asciidoc
index 56602ab7c05c9..c0ea81c87378b 100644
--- a/docs/apm/filters.asciidoc
+++ b/docs/apm/filters.asciidoc
@@ -36,6 +36,7 @@ It's vital to be consistent when naming environments in your agents.
 To learn how to configure service environments, see the specific agent documentation:
 
 * *Go:* {apm-go-ref}/configuration.html#config-environment[`ELASTIC_APM_ENVIRONMENT`]
+* *iOS agent:* _Not yet supported_
 * *Java:* {apm-java-ref}/config-core.html#config-environment[`environment`]
 * *.NET:* {apm-dotnet-ref}/config-core.html#config-environment[`Environment`]
 * *Node.js:* {apm-node-ref}/configuration.html#environment[`environment`]
diff --git a/docs/apm/images/apm-agent-configuration.png b/docs/apm/images/apm-agent-configuration.png
index 07398f0609187..22fd9d75c3d73 100644
Binary files a/docs/apm/images/apm-agent-configuration.png and b/docs/apm/images/apm-agent-configuration.png differ
diff --git a/docs/apm/images/apm-alert.png b/docs/apm/images/apm-alert.png
index 2ac91b6b19219..a845d65dd24a5 100644
Binary files a/docs/apm/images/apm-alert.png and b/docs/apm/images/apm-alert.png differ
diff --git a/docs/apm/images/apm-error-group.png b/docs/apm/images/apm-error-group.png
index 359bdc6b704e9..1326e97f757d6 100644
Binary files a/docs/apm/images/apm-error-group.png and b/docs/apm/images/apm-error-group.png differ
diff --git a/docs/apm/images/apm-logs-tab.png b/docs/apm/images/apm-logs-tab.png
index 77aecf744bc7f..891d2b7a1dd69 100644
Binary files a/docs/apm/images/apm-logs-tab.png and b/docs/apm/images/apm-logs-tab.png differ
diff --git a/docs/apm/images/apm-services-overview.png b/docs/apm/images/apm-services-overview.png
index 1c16ac5b572c3..7aeb5f1ac379f 100644
Binary files a/docs/apm/images/apm-services-overview.png and b/docs/apm/images/apm-services-overview.png differ
diff --git a/docs/apm/images/apm-settings.png b/docs/apm/images/apm-settings.png
index c821b7fb76e79..2201ed5fcaa72 100644
Binary files a/docs/apm/images/apm-settings.png and b/docs/apm/images/apm-settings.png differ
diff --git a/docs/apm/images/apm-span-detail.png b/docs/apm/images/apm-span-detail.png
index bacb2d372c166..c9f55575b2232 100644
Binary files a/docs/apm/images/apm-span-detail.png and b/docs/apm/images/apm-span-detail.png differ
diff --git a/docs/apm/images/apm-traces.png b/docs/apm/images/apm-traces.png
index 0e9062ee448b4..ee16f9ed16a18 100644
Binary files a/docs/apm/images/apm-traces.png and b/docs/apm/images/apm-traces.png differ
diff --git a/docs/apm/images/apm-transaction-duration-dist.png b/docs/apm/images/apm-transaction-duration-dist.png
index 863f493f20db4..91ae6c3a59ad2 100644
Binary files a/docs/apm/images/apm-transaction-duration-dist.png and b/docs/apm/images/apm-transaction-duration-dist.png differ
diff --git a/docs/apm/images/apm-transaction-response-dist.png b/docs/apm/images/apm-transaction-response-dist.png
index 2f3e69f263a28..70e5ad7041287 100644
Binary files a/docs/apm/images/apm-transaction-response-dist.png and b/docs/apm/images/apm-transaction-response-dist.png differ
diff --git a/docs/apm/images/apm-transaction-sample.png b/docs/apm/images/apm-transaction-sample.png
index 0e4bc5f3f878a..54eea902f0311 100644
Binary files a/docs/apm/images/apm-transaction-sample.png and b/docs/apm/images/apm-transaction-sample.png differ
diff --git a/docs/apm/images/apm-transactions-overview.png b/docs/apm/images/apm-transactions-overview.png
index be292c37e24e0..66cf739a861b7 100644
Binary files a/docs/apm/images/apm-transactions-overview.png and b/docs/apm/images/apm-transactions-overview.png differ
diff --git a/docs/apm/images/service-maps-java.png b/docs/apm/images/service-maps-java.png
index d7c0786e406d9..25600b690a5bd 100644
Binary files a/docs/apm/images/service-maps-java.png and b/docs/apm/images/service-maps-java.png differ
diff --git a/docs/apm/images/service-maps.png b/docs/apm/images/service-maps.png
index 190b7af3c560e..511d8401b22f3 100644
Binary files a/docs/apm/images/service-maps.png and b/docs/apm/images/service-maps.png differ
diff --git a/docs/apm/service-maps.asciidoc b/docs/apm/service-maps.asciidoc
index 99a6205ae010e..f43253d819429 100644
--- a/docs/apm/service-maps.asciidoc
+++ b/docs/apm/service-maps.asciidoc
@@ -108,6 +108,7 @@ Service maps are supported for the following Agent versions:
 
 [horizontal]
 Go agent:: ≥ v1.7.0
+iOS agent:: _Not yet supported_
 Java agent:: ≥ v1.13.0
 .NET agent:: ≥ v1.3.0
 Node.js agent:: ≥ v3.6.0
diff --git a/docs/apm/transactions.asciidoc b/docs/apm/transactions.asciidoc
index c2a3e0bc2502d..76006d375d075 100644
--- a/docs/apm/transactions.asciidoc
+++ b/docs/apm/transactions.asciidoc
@@ -100,22 +100,22 @@ the selected transaction group.
 image::apm/images/apm-transaction-response-dist.png[Example view of response time distribution]
 
 [[transaction-duration-distribution]]
-==== Transactions duration distribution
+==== Latency distribution
 
-This chart plots all transaction durations for the given time period.
+A plot of all transaction durations for the given time period.
 The screenshot below shows a typical distribution,
 and indicates most of our requests were served quickly -- awesome!
-It's the requests on the right, the ones taking longer than average, that we probably want to focus on.
+It's the requests on the right, the ones taking longer than average, that we probably need to focus on.
 
 [role="screenshot"]
-image::apm/images/apm-transaction-duration-dist.png[Example view of transactions duration distribution graph]
+image::apm/images/apm-transaction-duration-dist.png[Example view of latency distribution graph]
 
-Select a transaction duration _bucket_ to display up to ten trace samples.
+Select a latency duration _bucket_ to display up to ten trace samples.
 
 [[transaction-trace-sample]]
 ==== Trace sample
 
-Trace samples are based on the _bucket_ selection in the *Transactions duration distribution* chart;
+Trace samples are based on the _bucket_ selection in the *Latency distribution* chart;
 update the samples by selecting a new _bucket_.
 The number of requests per bucket is displayed when hovering over the graph,
 and the selected bucket is highlighted to stand out.
diff --git a/docs/apm/troubleshooting.asciidoc b/docs/apm/troubleshooting.asciidoc
index 8cab7bb03da75..4a62f71528676 100644
--- a/docs/apm/troubleshooting.asciidoc
+++ b/docs/apm/troubleshooting.asciidoc
@@ -15,6 +15,7 @@ don't forget to check our other troubleshooting guides or discussion forum:
 * {apm-server-ref}/troubleshooting.html[APM Server troubleshooting]
 * {apm-dotnet-ref}/troubleshooting.html[.NET agent troubleshooting]
 * {apm-go-ref}/troubleshooting.html[Go agent troubleshooting]
+* {apm-ios-ref}/troubleshooting.html[iOS agent troubleshooting]
 * {apm-java-ref}/trouble-shooting.html[Java agent troubleshooting]
 * {apm-node-ref}/troubleshooting.html[Node.js agent troubleshooting]
 * {apm-php-ref}/troubleshooting.html[PHP agent troubleshooting]
diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc
index eee92ba433721..5f49360c926bf 100644
--- a/docs/developer/plugin-list.asciidoc
+++ b/docs/developer/plugin-list.asciidoc
@@ -354,10 +354,6 @@ The plugin exposes the static DefaultEditorController class to consume.
 The client-side plugin configures following values:
 
 
-|{kib-repo}blob/{branch}/x-pack/plugins/console_extensions/README.md[consoleExtensions]
-|This plugin provides autocomplete definitions of licensed APIs to the OSS Console plugin.
-
-
 |{kib-repo}blob/{branch}/x-pack/plugins/cross_cluster_replication/README.md[crossClusterReplication]
 |You can run a local cluster and simulate a remote cluster within a single Kibana directory.
 
@@ -393,7 +389,7 @@ security and spaces filtering as well as performing audit logging.
 
 
 |{kib-repo}blob/{branch}/x-pack/plugins/enterprise_search/README.md[enterpriseSearch]
-|This plugin's goal is to provide a Kibana user interface to the Enterprise Search solution's products (App Search and Workplace Search). In it's current MVP state, the plugin provides the following with the goal of gathering user feedback and raising product awareness:
+|This plugin provides beta Kibana user interfaces for managing the Enterprise Search solution and its products, App Search and Workplace Search.
 
 
 |{kib-repo}blob/{branch}/x-pack/plugins/event_log/README.md[eventLog]
diff --git a/docs/development/core/server/kibana-plugin-core-server.elasticsearchclientconfig.md b/docs/development/core/server/kibana-plugin-core-server.elasticsearchclientconfig.md
index a854e5ddad19a..208e0e0175d71 100644
--- a/docs/development/core/server/kibana-plugin-core-server.elasticsearchclientconfig.md
+++ b/docs/development/core/server/kibana-plugin-core-server.elasticsearchclientconfig.md
@@ -9,7 +9,7 @@ Configuration options to be used to create a [cluster client](./kibana-plugin-co
 <b>Signature:</b>
 
 ```typescript
-export declare type ElasticsearchClientConfig = Pick<ElasticsearchConfig, 'customHeaders' | 'sniffOnStart' | 'sniffOnConnectionFault' | 'requestHeadersWhitelist' | 'sniffInterval' | 'hosts' | 'username' | 'password'> & {
+export declare type ElasticsearchClientConfig = Pick<ElasticsearchConfig, 'customHeaders' | 'sniffOnStart' | 'sniffOnConnectionFault' | 'requestHeadersWhitelist' | 'sniffInterval' | 'hosts' | 'username' | 'password' | 'serviceAccountToken'> & {
     pingTimeout?: ElasticsearchConfig['pingTimeout'] | ClientOptions['pingTimeout'];
     requestTimeout?: ElasticsearchConfig['requestTimeout'] | ClientOptions['requestTimeout'];
     ssl?: Partial<ElasticsearchConfig['ssl']>;
diff --git a/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.md b/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.md
index d87ea63d59b8d..a9ed614ba7552 100644
--- a/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.md
+++ b/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.md
@@ -31,10 +31,11 @@ export declare class ElasticsearchConfig
 |  [pingTimeout](./kibana-plugin-core-server.elasticsearchconfig.pingtimeout.md) |  | <code>Duration</code> | Timeout after which PING HTTP request will be aborted and retried. |
 |  [requestHeadersWhitelist](./kibana-plugin-core-server.elasticsearchconfig.requestheaderswhitelist.md) |  | <code>string[]</code> | List of Kibana client-side headers to send to Elasticsearch when request scoped cluster client is used. If this is an empty array then \*no\* client-side will be sent. |
 |  [requestTimeout](./kibana-plugin-core-server.elasticsearchconfig.requesttimeout.md) |  | <code>Duration</code> | Timeout after which HTTP request will be aborted and retried. |
+|  [serviceAccountToken](./kibana-plugin-core-server.elasticsearchconfig.serviceaccounttoken.md) |  | <code>string</code> | If Elasticsearch security features are enabled, this setting provides the service account token that the Kibana server users to perform its administrative functions.<!-- -->This is an alternative to specifying a username and password. |
 |  [shardTimeout](./kibana-plugin-core-server.elasticsearchconfig.shardtimeout.md) |  | <code>Duration</code> | Timeout for Elasticsearch to wait for responses from shards. Set to 0 to disable. |
 |  [sniffInterval](./kibana-plugin-core-server.elasticsearchconfig.sniffinterval.md) |  | <code>false &#124; Duration</code> | Interval to perform a sniff operation and make sure the list of nodes is complete. If <code>false</code> then sniffing is disabled. |
 |  [sniffOnConnectionFault](./kibana-plugin-core-server.elasticsearchconfig.sniffonconnectionfault.md) |  | <code>boolean</code> | Specifies whether the client should immediately sniff for a more current list of nodes when a connection dies. |
 |  [sniffOnStart](./kibana-plugin-core-server.elasticsearchconfig.sniffonstart.md) |  | <code>boolean</code> | Specifies whether the client should attempt to detect the rest of the cluster when it is first instantiated. |
 |  [ssl](./kibana-plugin-core-server.elasticsearchconfig.ssl.md) |  | <code>Pick&lt;SslConfigSchema, Exclude&lt;keyof SslConfigSchema, 'certificateAuthorities' &#124; 'keystore' &#124; 'truststore'&gt;&gt; &amp; {</code><br/><code>        certificateAuthorities?: string[];</code><br/><code>    }</code> | Set of settings configure SSL connection between Kibana and Elasticsearch that are required when <code>xpack.ssl.verification_mode</code> in Elasticsearch is set to either <code>certificate</code> or <code>full</code>. |
-|  [username](./kibana-plugin-core-server.elasticsearchconfig.username.md) |  | <code>string</code> | If Elasticsearch is protected with basic authentication, this setting provides the username that the Kibana server uses to perform its administrative functions. |
+|  [username](./kibana-plugin-core-server.elasticsearchconfig.username.md) |  | <code>string</code> | If Elasticsearch is protected with basic authentication, this setting provides the username that the Kibana server uses to perform its administrative functions. Cannot be used in conjunction with serviceAccountToken. |
 
diff --git a/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.serviceaccounttoken.md b/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.serviceaccounttoken.md
new file mode 100644
index 0000000000000..5934e83de17a4
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.serviceaccounttoken.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [ElasticsearchConfig](./kibana-plugin-core-server.elasticsearchconfig.md) &gt; [serviceAccountToken](./kibana-plugin-core-server.elasticsearchconfig.serviceaccounttoken.md)
+
+## ElasticsearchConfig.serviceAccountToken property
+
+If Elasticsearch security features are enabled, this setting provides the service account token that the Kibana server users to perform its administrative functions.
+
+This is an alternative to specifying a username and password.
+
+<b>Signature:</b>
+
+```typescript
+readonly serviceAccountToken?: string;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.username.md b/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.username.md
index 14db9f2e36ccf..959870ff43a0f 100644
--- a/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.username.md
+++ b/docs/development/core/server/kibana-plugin-core-server.elasticsearchconfig.username.md
@@ -4,7 +4,7 @@
 
 ## ElasticsearchConfig.username property
 
-If Elasticsearch is protected with basic authentication, this setting provides the username that the Kibana server uses to perform its administrative functions.
+If Elasticsearch is protected with basic authentication, this setting provides the username that the Kibana server uses to perform its administrative functions. Cannot be used in conjunction with serviceAccountToken.
 
 <b>Signature:</b>
 
diff --git a/docs/development/core/server/kibana-plugin-core-server.legacyelasticsearchclientconfig.md b/docs/development/core/server/kibana-plugin-core-server.legacyelasticsearchclientconfig.md
index b028a09bee453..a80ebe2fee493 100644
--- a/docs/development/core/server/kibana-plugin-core-server.legacyelasticsearchclientconfig.md
+++ b/docs/development/core/server/kibana-plugin-core-server.legacyelasticsearchclientconfig.md
@@ -11,7 +11,7 @@
 <b>Signature:</b>
 
 ```typescript
-export declare type LegacyElasticsearchClientConfig = Pick<ConfigOptions, 'keepAlive' | 'log' | 'plugins'> & Pick<ElasticsearchConfig, 'apiVersion' | 'customHeaders' | 'requestHeadersWhitelist' | 'sniffOnStart' | 'sniffOnConnectionFault' | 'hosts' | 'username' | 'password'> & {
+export declare type LegacyElasticsearchClientConfig = Pick<ConfigOptions, 'keepAlive' | 'log' | 'plugins'> & Pick<ElasticsearchConfig, 'apiVersion' | 'customHeaders' | 'requestHeadersWhitelist' | 'sniffOnStart' | 'sniffOnConnectionFault' | 'hosts' | 'username' | 'password' | 'serviceAccountToken'> & {
     pingTimeout?: ElasticsearchConfig['pingTimeout'] | ConfigOptions['pingTimeout'];
     requestTimeout?: ElasticsearchConfig['requestTimeout'] | ConfigOptions['requestTimeout'];
     sniffInterval?: ElasticsearchConfig['sniffInterval'] | ConfigOptions['sniffInterval'];
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntype.md
new file mode 100644
index 0000000000000..46fd3a0725e40
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntype.md
@@ -0,0 +1,19 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPatternType](./kibana-plugin-plugins-data-public.indexpatterntype.md)
+
+## IndexPatternType enum
+
+<b>Signature:</b>
+
+```typescript
+export declare enum IndexPatternType 
+```
+
+## Enumeration Members
+
+|  Member | Value | Description |
+|  --- | --- | --- |
+|  DEFAULT | <code>&quot;default&quot;</code> |  |
+|  ROLLUP | <code>&quot;rollup&quot;</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.md
index e6690b244c9ea..19a884862d460 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.md
@@ -15,4 +15,5 @@ export interface TypeMeta
 |  Property | Type | Description |
 |  --- | --- | --- |
 |  [aggs](./kibana-plugin-plugins-data-public.indexpatterntypemeta.aggs.md) | <code>Record&lt;string, AggregationRestrictions&gt;</code> |  |
+|  [params](./kibana-plugin-plugins-data-public.indexpatterntypemeta.params.md) | <code>{</code><br/><code>        rollup_index: string;</code><br/><code>    }</code> |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.params.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.params.md
new file mode 100644
index 0000000000000..12646a39188a0
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.params.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPatternTypeMeta](./kibana-plugin-plugins-data-public.indexpatterntypemeta.md) &gt; [params](./kibana-plugin-plugins-data-public.indexpatterntypemeta.params.md)
+
+## IndexPatternTypeMeta.params property
+
+<b>Signature:</b>
+
+```typescript
+params?: {
+        rollup_index: string;
+    };
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
index 65c4601d5faec..7c2911875ee05 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
@@ -31,6 +31,7 @@
 |  --- | --- |
 |  [BUCKET\_TYPES](./kibana-plugin-plugins-data-public.bucket_types.md) |  |
 |  [ES\_FIELD\_TYPES](./kibana-plugin-plugins-data-public.es_field_types.md) | \* |
+|  [IndexPatternType](./kibana-plugin-plugins-data-public.indexpatterntype.md) |  |
 |  [KBN\_FIELD\_TYPES](./kibana-plugin-plugins-data-public.kbn_field_types.md) | \* |
 |  [METRIC\_TYPES](./kibana-plugin-plugins-data-public.metric_types.md) |  |
 |  [QuerySuggestionTypes](./kibana-plugin-plugins-data-public.querysuggestiontypes.md) |  |
diff --git a/docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.md b/docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.md
index edaf1c9a9ce9e..040bed5a8ce53 100644
--- a/docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.md
+++ b/docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.md
@@ -39,5 +39,5 @@ export declare class Execution<Input = unknown, Output = unknown, InspectorAdapt
 |  [invokeChain(chainArr, input)](./kibana-plugin-plugins-expressions-public.execution.invokechain.md) |  |  |
 |  [invokeFunction(fn, input, args)](./kibana-plugin-plugins-expressions-public.execution.invokefunction.md) |  |  |
 |  [resolveArgs(fnDef, input, argAsts)](./kibana-plugin-plugins-expressions-public.execution.resolveargs.md) |  |  |
-|  [start(input)](./kibana-plugin-plugins-expressions-public.execution.start.md) |  | Call this method to start execution.<!-- -->N.B. <code>input</code> is initialized to <code>null</code> rather than <code>undefined</code> for legacy reasons, because in legacy interpreter it was set to <code>null</code> by default. |
+|  [start(input, isSubExpression)](./kibana-plugin-plugins-expressions-public.execution.start.md) |  | Call this method to start execution.<!-- -->N.B. <code>input</code> is initialized to <code>null</code> rather than <code>undefined</code> for legacy reasons, because in legacy interpreter it was set to <code>null</code> by default. |
 
diff --git a/docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.start.md b/docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.start.md
index 352226da6d72a..b1fa6d7d518b9 100644
--- a/docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.start.md
+++ b/docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.start.md
@@ -11,7 +11,7 @@ N.B. `input` is initialized to `null` rather than `undefined` for legacy reasons
 <b>Signature:</b>
 
 ```typescript
-start(input?: Input): Observable<ExecutionResult<Output | ExpressionValueError>>;
+start(input?: Input, isSubExpression?: boolean): Observable<ExecutionResult<Output | ExpressionValueError>>;
 ```
 
 ## Parameters
@@ -19,6 +19,7 @@ start(input?: Input): Observable<ExecutionResult<Output | ExpressionValueError>>
 |  Parameter | Type | Description |
 |  --- | --- | --- |
 |  input | <code>Input</code> |  |
+|  isSubExpression | <code>boolean</code> |  |
 
 <b>Returns:</b>
 
diff --git a/docs/development/plugins/expressions/server/kibana-plugin-plugins-expressions-server.execution.md b/docs/development/plugins/expressions/server/kibana-plugin-plugins-expressions-server.execution.md
index 47963e5e5ef46..44d16ea02e270 100644
--- a/docs/development/plugins/expressions/server/kibana-plugin-plugins-expressions-server.execution.md
+++ b/docs/development/plugins/expressions/server/kibana-plugin-plugins-expressions-server.execution.md
@@ -39,5 +39,5 @@ export declare class Execution<Input = unknown, Output = unknown, InspectorAdapt
 |  [invokeChain(chainArr, input)](./kibana-plugin-plugins-expressions-server.execution.invokechain.md) |  |  |
 |  [invokeFunction(fn, input, args)](./kibana-plugin-plugins-expressions-server.execution.invokefunction.md) |  |  |
 |  [resolveArgs(fnDef, input, argAsts)](./kibana-plugin-plugins-expressions-server.execution.resolveargs.md) |  |  |
-|  [start(input)](./kibana-plugin-plugins-expressions-server.execution.start.md) |  | Call this method to start execution.<!-- -->N.B. <code>input</code> is initialized to <code>null</code> rather than <code>undefined</code> for legacy reasons, because in legacy interpreter it was set to <code>null</code> by default. |
+|  [start(input, isSubExpression)](./kibana-plugin-plugins-expressions-server.execution.start.md) |  | Call this method to start execution.<!-- -->N.B. <code>input</code> is initialized to <code>null</code> rather than <code>undefined</code> for legacy reasons, because in legacy interpreter it was set to <code>null</code> by default. |
 
diff --git a/docs/development/plugins/expressions/server/kibana-plugin-plugins-expressions-server.execution.start.md b/docs/development/plugins/expressions/server/kibana-plugin-plugins-expressions-server.execution.start.md
index 0eef7013cb3c6..23b4d414d09d1 100644
--- a/docs/development/plugins/expressions/server/kibana-plugin-plugins-expressions-server.execution.start.md
+++ b/docs/development/plugins/expressions/server/kibana-plugin-plugins-expressions-server.execution.start.md
@@ -11,7 +11,7 @@ N.B. `input` is initialized to `null` rather than `undefined` for legacy reasons
 <b>Signature:</b>
 
 ```typescript
-start(input?: Input): Observable<ExecutionResult<Output | ExpressionValueError>>;
+start(input?: Input, isSubExpression?: boolean): Observable<ExecutionResult<Output | ExpressionValueError>>;
 ```
 
 ## Parameters
@@ -19,6 +19,7 @@ start(input?: Input): Observable<ExecutionResult<Output | ExpressionValueError>>
 |  Parameter | Type | Description |
 |  --- | --- | --- |
 |  input | <code>Input</code> |  |
+|  isSubExpression | <code>boolean</code> |  |
 
 <b>Returns:</b>
 
diff --git a/docs/getting-started/images/add-sample-data.png b/docs/getting-started/images/add-sample-data.png
index 9dee27dcde71b..07a536b19d7d0 100644
Binary files a/docs/getting-started/images/add-sample-data.png and b/docs/getting-started/images/add-sample-data.png differ
diff --git a/docs/getting-started/images/tutorial-discover-3.png b/docs/getting-started/images/tutorial-discover-3.png
index b024ad6dc39fe..79cf94058bb76 100644
Binary files a/docs/getting-started/images/tutorial-discover-3.png and b/docs/getting-started/images/tutorial-discover-3.png differ
diff --git a/docs/getting-started/images/tutorial-discover-4.png b/docs/getting-started/images/tutorial-discover-4.png
index 945a6155c02cd..584221e8cfd04 100644
Binary files a/docs/getting-started/images/tutorial-discover-4.png and b/docs/getting-started/images/tutorial-discover-4.png differ
diff --git a/docs/getting-started/images/tutorial-final-dashboard.gif b/docs/getting-started/images/tutorial-final-dashboard.gif
index 53b7bc04c5f65..6c82c4e53ca10 100644
Binary files a/docs/getting-started/images/tutorial-final-dashboard.gif and b/docs/getting-started/images/tutorial-final-dashboard.gif differ
diff --git a/docs/getting-started/images/tutorial-sample-dashboard.png b/docs/getting-started/images/tutorial-sample-dashboard.png
index 4c95c04c5e43e..5e06009d0824e 100644
Binary files a/docs/getting-started/images/tutorial-sample-dashboard.png and b/docs/getting-started/images/tutorial-sample-dashboard.png differ
diff --git a/docs/getting-started/images/tutorial-sample-filter.png b/docs/getting-started/images/tutorial-sample-filter.png
index 56ebacadbef45..8823da311ebb5 100644
Binary files a/docs/getting-started/images/tutorial-sample-filter.png and b/docs/getting-started/images/tutorial-sample-filter.png differ
diff --git a/docs/getting-started/images/tutorial-sample-filter2.png b/docs/getting-started/images/tutorial-sample-filter2.png
index 21402feacdecd..4215b63d89fa1 100644
Binary files a/docs/getting-started/images/tutorial-sample-filter2.png and b/docs/getting-started/images/tutorial-sample-filter2.png differ
diff --git a/docs/getting-started/images/tutorial-sample-query.png b/docs/getting-started/images/tutorial-sample-query.png
deleted file mode 100644
index 4f1ca24924b28..0000000000000
Binary files a/docs/getting-started/images/tutorial-sample-query.png and /dev/null differ
diff --git a/docs/getting-started/images/tutorial-sample-query2.png b/docs/getting-started/images/tutorial-sample-query2.png
deleted file mode 100644
index 0e91e1069a201..0000000000000
Binary files a/docs/getting-started/images/tutorial-sample-query2.png and /dev/null differ
diff --git a/docs/getting-started/images/tutorial-treemap.png b/docs/getting-started/images/tutorial-treemap.png
deleted file mode 100644
index 32e14fd2308e3..0000000000000
Binary files a/docs/getting-started/images/tutorial-treemap.png and /dev/null differ
diff --git a/docs/getting-started/images/tutorial-visualization-dropdown.png b/docs/getting-started/images/tutorial-visualization-dropdown.png
index 29d1b99700964..a069af95ed14a 100644
Binary files a/docs/getting-started/images/tutorial-visualization-dropdown.png and b/docs/getting-started/images/tutorial-visualization-dropdown.png differ
diff --git a/docs/getting-started/images/tutorial-visualization-treemap.png b/docs/getting-started/images/tutorial-visualization-treemap.png
new file mode 100644
index 0000000000000..c6e8db133cb44
Binary files /dev/null and b/docs/getting-started/images/tutorial-visualization-treemap.png differ
diff --git a/docs/getting-started/quick-start-guide.asciidoc b/docs/getting-started/quick-start-guide.asciidoc
index d9835b312f3ee..ed249008ac8de 100644
--- a/docs/getting-started/quick-start-guide.asciidoc
+++ b/docs/getting-started/quick-start-guide.asciidoc
@@ -7,7 +7,7 @@ When you've finished, you'll know how to:
 
 * <<explore-the-data,Explore the data with *Discover*.>>
 
-* <<view-and-analyze-the-data,Gain insight into the data with *Dashboard*.>>
+* <<view-and-analyze-the-data,Analyze the data with *Dashboard*.>>
 
 [float]
 === Required privileges
@@ -24,125 +24,125 @@ include::{docs-root}/shared/cloud/ess-getting-started.asciidoc[]
 [[gs-get-data-into-kibana]]
 == Add the sample data
 
-Sample data sets come with sample visualizations, dashboards, and more to help you explore {kib} without adding your own data.
+Sample data sets come with sample visualizations, dashboards, and more to help you explore {kib} before you ingest or add your own data.
 
-. From the home page, click *Try our sample data*.
+. On the home page, click *Try our sample data*.
 
 . On the *Sample eCommerce orders* card, click *Add data*.
 +
 [role="screenshot"]
-image::getting-started/images/add-sample-data.png[Add data UI]
+image::images/add-sample-data.png[Add data UI for the sample data sets]
 
 [float]
 [[explore-the-data]]
 == Explore the data
 
-*Discover* displays an interactive histogram that shows the distribution of of data, or documents, over time, and a table that lists the fields for each document that matches the index. By default, all fields are shown for each matching document.
+*Discover* displays the data in an interactive histogram that shows the distribution of data, or documents, over time, and a table that lists the fields for each document that matches the index pattern. To view a subset of the documents, you can apply filters to the data, and customize the table to display only the fields you want to explore.
 
 . Open the main menu, then click *Discover*.
 
 . Change the <<set-time-filter, time filter>> to *Last 7 days*.
 +
 [role="screenshot"]
-image::images/tutorial-discover-2.png[]
+image::images/tutorial-discover-2.png[Time filter menu with Last 7 days filter configured]
 
-. To focus in on the documents you want to view, use the <<kuery-query,{kib} Query Language>>. In the *KQL* search field, enter:
+. To view the sales orders for women's clothing that are $60 or more, use the <<kuery-query,*KQL*>> search field:
 +
 [source,text]
-products.taxless_price >= 60 AND category : Women's Clothing
-+
-The query returns the women's clothing orders for $60 and more.
+products.taxless_price >= 60 and category : Women's Clothing
 +
 [role="screenshot"]
-image::images/tutorial-discover-4.png[]
+image::images/tutorial-discover-4.png[Discover tables that displays only the orders for women's clothing that are $60 or more]
 
-. Hover over the list of *Available fields*, then click *+* next to the fields you want to view in the table.
-+
-For example, when you add the *category* field, the table displays the product categories for the orders.
+. To view only the product categories that contain sales orders, hover over the *category* field, then click *+*.
 +
 [role="screenshot"]
-image::images/tutorial-discover-3.png[]
-+
-For more information, refer to <<discover, *Discover*>>.
+image::images/tutorial-discover-3.png[Discover table that displays only the product categories that contain orders]
 
 [float]
 [[view-and-analyze-the-data]]
 == View and analyze the data
 
-A dashboard is a collection of panels that you can use to view and analyze the data. Panels contain visualizations, interactive controls, Markdown, and more.
+A dashboard is a collection of panels that you can use to view and analyze the data. Panels contain visualizations, interactive controls, text, and more.
 
 . Open the main menu, then click *Dashboard*. 
 
 . Click *[eCommerce] Revenue Dashboard*.
 +
 [role="screenshot"]
-image::getting-started/images/tutorial-sample-dashboard.png[]
+image::getting-started/images/tutorial-sample-dashboard.png[The [eCommerce] Revenue Dashboard that comes with the Sample eCommerce order data set]
 
 [float]
-[[filter-and-query-the-data]]
-=== Filter the data
+[[create-a-visualization]]
+=== Create a visualization panel
+
+Create a treemap panel that shows the top sales regions and manufacturers, then add the panel to the dashboard.
 
-To focus in on the data you want to view on the dashboard, use filters. 
+. From the toolbar, click *Edit*, then click *Create visualzation*.
 
-. From the *[eCommerce] Controls* panel, make a selection from the *Manufacturer* and *Category* dropdowns, then click *Apply changes*.
+. Open the *Chart type* menu, then select *Treemap*.
 +
-For example, the following dashboard shows the data for women's clothing from Gnomehouse. 
+[role="screenshot"]
+image::getting-started/images/tutorial-visualization-dropdown.png[Chart type menu with Treemap selected]
+
+. From the *Available fields* list, drag and drop the following fields onto the workspace:
+
+* *geoip.city_name*
+
+* *manufacturer.keyword*
 +
 [role="screenshot"]
-image::getting-started/images/tutorial-sample-filter.png[]
+image::getting-started/images/tutorial-visualization-treemap.png[Treemap that displays Top values of geoip.city_name and Top values or manufacturer.keyword fields]
 
-. To manually add a filter, click *Add filter*, then specify the options.
+. Click *Save and return*.
 +
-For example, to view the orders for Wednesday, select *day_of_week* from the *Field* dropdown, select *is* from the *Operator* dropdown, then select *Wednesday* from the *Value* dropdown.
+The treemap appears as the last visualization panel on the dashboard.
 +
 [role="screenshot"]
-image::getting-started/images/tutorial-sample-filter2.png[]
+image::getting-started/images/tutorial-final-dashboard.gif[Final dashboard with new treemap visualization]
+
+[float]
+[[interact-with-the-data]]
+=== Interact with the data
+
+You can interact with the dashboard data using controls that allow you to apply dashboard-level filters. Interact with the *[eCommerce] Controls* panel to view the women's clothing data from the Gnomehouse manufacturer. 
 
-. When you are done, remove the filters.
+. From the *Manufacturer* dropdown, select *Gnomehouse*.
+
+. From the *Category* dropdown, select *Women's Clothing*.
+
+. Click *Apply changes*.
 +
-For more information, refer to <<dashboard,*Dashboard*>>.
+[role="screenshot"]
+image::getting-started/images/tutorial-sample-filter.png[The [eCommerce] Revenue Dashboard that shows only the women's clothing data from the Gnomehouse manufacturer]
 
 [float]
-[[create-a-visualization]]
-=== Create a visualization panel
-
-Create a treemap panel that shows the top regions and manufacturers, then add the panel to the dashboard.
+[[filter-and-query-the-data]]
+=== Filter the data
 
-. From the toolbar, click *Edit*, then click *Create new*.
+To view a subset of the data, you can apply filters to the dashboard panels. Apply a filter to view the women's clothing data generated on Wednesday from the Gnomehouse manufacturer.
 
-. On the *New Visualization* window, click *Lens*.
+. Click *Add filter*.
 
-. From the *Available fields* list, drag and drop the following fields to the visualization builder:
+. From the *Field* dropdown, select *day_of_week*.
 
-* *geoip.city_name*
+. From the *Operator* dropdown, select *is*.
 
-* *manufacturer.keyword*
-+
-. From the visualization dropdown, select *Treemap*.
-+
-[role="screenshot"]
-image::getting-started/images/tutorial-visualization-dropdown.png[Visualization dropdown with Treemap selected]
+. From the *Value* dropdown, select *Wednesday*.
 
 . Click *Save*.
-
-. On the *Save Lens visualization*, enter a title and make sure *Add to Dashboard after saving* is selected, then click *Save and return*.
-+
-The treemap appears as the last visualization panel on the dashboard.
 +
 [role="screenshot"]
-image::getting-started/images/tutorial-final-dashboard.gif[Final dashboard with new treemap visualization]
-+
-For more information, refer to <<dashboard,Dashboard>>.
+image::getting-started/images/tutorial-sample-filter2.png[The [eCommerce] Revenue Dashboard that shows only the women's clothing data generated on Wednesday from the Gnomehouse manufacturer]
 
 [float]
 [[quick-start-whats-next]]
 == What's next?
 
-If you are you ready to add your own data, refer to <<connect-to-elasticsearch,Add data to {kib}>>.
+*Add your own data.* Ready to add your own data? Go to {fleet-guide}/fleet-quick-start.html[Quick start: Get logs and metrics into the Elastic Stack] to learn how to ingest your data, or go to <<connect-to-elasticsearch,Add data to {kib}>> and learn about all the other ways you can add data.
 
-If you want to ingest your data, refer to {fleet-guide}/fleet-quick-start.html[Quick start: Get logs and metrics into the Elastic Stack].
+*Explore your own data in Discover.* Ready to learn more about exploring your data in *Discover*? Go to <<discover, Discover>>.
 
-If you want to secure access to your data, refer to our guide on <<tutorial-secure-access-to-kibana, securing {kib}>>
+*Create a dashboard with your own data.* Ready to learn more about analyzing your data in *Dashboard*? Go to <<dashboard, Dashboard>>.
 
-If you want to try out {ml-features} with the sample data sets, refer to
-{ml-docs}/ml-getting-started.html[Getting started with {ml}].
\ No newline at end of file
+*Try out the {ml-features}.* Ready to analyze the sample data sets and generate models for its patterns of behavior? Go to {ml-docs}/ml-getting-started.html[Getting started with {ml}].
\ No newline at end of file
diff --git a/docs/management/images/management-create-rollup-bar-chart.png b/docs/management/images/management-create-rollup-bar-chart.png
index 324cfcb9ee5fb..68ba4344c0ecf 100644
Binary files a/docs/management/images/management-create-rollup-bar-chart.png and b/docs/management/images/management-create-rollup-bar-chart.png differ
diff --git a/docs/management/images/management-rollup-index-pattern.png b/docs/management/images/management-rollup-index-pattern.png
index 57ac00be7977c..de7976e63f050 100644
Binary files a/docs/management/images/management-rollup-index-pattern.png and b/docs/management/images/management-rollup-index-pattern.png differ
diff --git a/docs/management/images/management_create_rollup_job.png b/docs/management/images/management_create_rollup_job.png
index c3139c9f8df1a..f1dd1580c3a86 100644
Binary files a/docs/management/images/management_create_rollup_job.png and b/docs/management/images/management_create_rollup_job.png differ
diff --git a/docs/management/images/management_rollup_job_dashboard.png b/docs/management/images/management_rollup_job_dashboard.png
index d3c394183cad8..9573ab7a863e8 100644
Binary files a/docs/management/images/management_rollup_job_dashboard.png and b/docs/management/images/management_rollup_job_dashboard.png differ
diff --git a/docs/management/images/management_rollup_job_details.png b/docs/management/images/management_rollup_job_details.png
index e6e93a6dae130..5372ba4ad7d13 100644
Binary files a/docs/management/images/management_rollup_job_details.png and b/docs/management/images/management_rollup_job_details.png differ
diff --git a/docs/management/images/management_rollup_job_vis.png b/docs/management/images/management_rollup_job_vis.png
deleted file mode 100644
index e1f46e4db5c0a..0000000000000
Binary files a/docs/management/images/management_rollup_job_vis.png and /dev/null differ
diff --git a/docs/management/images/management_rollup_list.png b/docs/management/images/management_rollup_list.png
index 60e9a35071003..505930bcb9a38 100644
Binary files a/docs/management/images/management_rollup_list.png and b/docs/management/images/management_rollup_list.png differ
diff --git a/docs/management/rollups/create_and_manage_rollups.asciidoc b/docs/management/rollups/create_and_manage_rollups.asciidoc
index bde2ca472b258..51821a935d3f5 100644
--- a/docs/management/rollups/create_and_manage_rollups.asciidoc
+++ b/docs/management/rollups/create_and_manage_rollups.asciidoc
@@ -64,13 +64,16 @@ You can read more at {ref}/rollup-job-config.html[rollup job configuration].
 === Try it: Create and visualize rolled up data
 
 This example creates a rollup job to capture log data from sample web logs.
-To follow along, add the sample web logs data set.
+Before you start, <<add-sample-data, add the web logs sample data set>>.
 
 In this example, you want data that is older than 7 days in the target index pattern `kibana_sample_data_logs`
-to roll up once a day into the index `rollup_logstash`. You’ll bucket the
+to roll up into the `rollup_logstash` index. You’ll bucket the
 rolled up data on an hourly basis, using 60m for the time bucket configuration.
 This allows for more granular queries, such as 2h and 12h.
 
+For this example, the job will perform the rollup every minute. However, you'd
+typically roll up less frequently in production.
+
 [float]
 ==== Create the rollup job
 
@@ -80,7 +83,7 @@ As you walk through the *Create rollup job* UI, enter the data:
 |*Field* |*Value*
 
 |Name
-|logs_job
+|`logs_job`
 
 |Index pattern
 |`kibana_sample_data_logs`
@@ -89,12 +92,13 @@ As you walk through the *Create rollup job* UI, enter the data:
 |`rollup_logstash`
 
 |Frequency
-|Every day at midnight
+|Every minute
 
 |Page size
 |1000
 
-|Delay (latency buffer)|7d
+|Latency buffer
+|7d
 
 |Date field
 |@timestamp
@@ -118,6 +122,8 @@ As you walk through the *Create rollup job* UI, enter the data:
 |bytes (average)
 |===
 
+On the **Review and save** page, click **Start job now** and **Save**.
+
 The terms, histogram, and metrics fields reflect
 the key information to retain in the rolled up data: where visitors are from (geo.src),
 what operating system they are using (machine.os.keyword),
@@ -133,7 +139,6 @@ rollup index, or you can remove or archive it using <<creating-index-lifecycle-p
 Your next step is to visualize your rolled up data in a vertical bar chart.
 Most visualizations support rolled up data, with the exception of Timelion and Vega visualizations.
 
-
 . Open the main menu, then click *Stack Management > Index Patterns*.
 
 . Click *Create index pattern*, and select *Rollup index pattern* from the dropdown.
@@ -149,7 +154,11 @@ is `rollup_logstash,kibana_sample_data_logs`. In this index pattern, `rollup_log
 matches the rolled up index pattern and `kibana_sample_data_logs` matches the index
 pattern for raw data.
 
-. Open the main menu, click *Dashboard*, then create and add a vertical bar chart.
+. Open the main menu, click *Dashboard*, then *Create dashboard*.
+
+. Set the <<set-time-filter,time filter>> to *Last 90 days*.
+
+. On the dashboard, click *Create visualization*.
  
 . Choose `rollup_logstash,kibana_sample_data_logs`
 as your source to see both the raw and rolled up data.
@@ -157,13 +166,15 @@ as your source to see both the raw and rolled up data.
 [role="screenshot"]
 image::images/management-create-rollup-bar-chart.png[][Create visualization of rolled up data]
 
-. Look at the data in your visualization.
-+
-[role="screenshot"]
-image::images/management_rollup_job_vis.png[][Visualization of rolled up data]
+. Select *Bar vertical stacked* in the chart type dropdown.
 
-. Optionally, create a dashboard that contains visualizations of the rolled up
-data, raw data, or both.
+. Add the `@timestamp` field to the *Horizontal axis*.
+
+. Add the `bytes` field to the *Vertical axis*, defaulting to an `Average of
+bytes`.
++
+{kib} creates a vertical bar chart of your data. Select a section of the chart
+to zoom in.
 +
 [role="screenshot"]
 image::images/management_rollup_job_dashboard.png[][Dashboard with rolled up data]
diff --git a/docs/management/snapshot-restore/images/create-policy-example.png b/docs/management/snapshot-restore/images/create-policy-example.png
old mode 100755
new mode 100644
index e871c925f5fd5..4ab5e438b306b
Binary files a/docs/management/snapshot-restore/images/create-policy-example.png and b/docs/management/snapshot-restore/images/create-policy-example.png differ
diff --git a/docs/management/snapshot-restore/images/create-policy.png b/docs/management/snapshot-restore/images/create-policy.png
old mode 100755
new mode 100644
index d9a0dce0f4190..3ba33e2522bd5
Binary files a/docs/management/snapshot-restore/images/create-policy.png and b/docs/management/snapshot-restore/images/create-policy.png differ
diff --git a/docs/management/snapshot-restore/images/create_snapshot.png b/docs/management/snapshot-restore/images/create_snapshot.png
deleted file mode 100644
index 14c1229a23ce1..0000000000000
Binary files a/docs/management/snapshot-restore/images/create_snapshot.png and /dev/null differ
diff --git a/docs/management/snapshot-restore/images/register_repo.png b/docs/management/snapshot-restore/images/register_repo.png
old mode 100755
new mode 100644
index 9e7ee9db4ce91..c742028ce108c
Binary files a/docs/management/snapshot-restore/images/register_repo.png and b/docs/management/snapshot-restore/images/register_repo.png differ
diff --git a/docs/management/snapshot-restore/images/repository_list.png b/docs/management/snapshot-restore/images/repository_list.png
old mode 100755
new mode 100644
index a4678e87bfb2c..c4eb4fc1a3d1a
Binary files a/docs/management/snapshot-restore/images/repository_list.png and b/docs/management/snapshot-restore/images/repository_list.png differ
diff --git a/docs/management/snapshot-restore/images/restore-status.png b/docs/management/snapshot-restore/images/restore-status.png
deleted file mode 100755
index fa48e32d2fef3..0000000000000
Binary files a/docs/management/snapshot-restore/images/restore-status.png and /dev/null differ
diff --git a/docs/management/snapshot-restore/images/snapshot-restore.png b/docs/management/snapshot-restore/images/snapshot-restore.png
old mode 100755
new mode 100644
index 41a292f97c853..8ca5dc95e5892
Binary files a/docs/management/snapshot-restore/images/snapshot-restore.png and b/docs/management/snapshot-restore/images/snapshot-restore.png differ
diff --git a/docs/management/snapshot-restore/images/snapshot-retention.png b/docs/management/snapshot-restore/images/snapshot-retention.png
old mode 100755
new mode 100644
index 7b390357a21b6..44dfecc1a3321
Binary files a/docs/management/snapshot-restore/images/snapshot-retention.png and b/docs/management/snapshot-restore/images/snapshot-retention.png differ
diff --git a/docs/management/snapshot-restore/images/snapshot_details.png b/docs/management/snapshot-restore/images/snapshot_details.png
old mode 100755
new mode 100644
index 2bd226eecd84e..e6c463d7acb7f
Binary files a/docs/management/snapshot-restore/images/snapshot_details.png and b/docs/management/snapshot-restore/images/snapshot_details.png differ
diff --git a/docs/management/snapshot-restore/images/snapshot_list.png b/docs/management/snapshot-restore/images/snapshot_list.png
old mode 100755
new mode 100644
index dcbb43ec2ab84..f844bfddac4be
Binary files a/docs/management/snapshot-restore/images/snapshot_list.png and b/docs/management/snapshot-restore/images/snapshot_list.png differ
diff --git a/docs/management/snapshot-restore/images/snapshot_permissions.png b/docs/management/snapshot-restore/images/snapshot_permissions.png
deleted file mode 100644
index 463d4d6e389c6..0000000000000
Binary files a/docs/management/snapshot-restore/images/snapshot_permissions.png and /dev/null differ
diff --git a/docs/management/snapshot-restore/index.asciidoc b/docs/management/snapshot-restore/index.asciidoc
index 62633441ef161..b041bd0873a05 100644
--- a/docs/management/snapshot-restore/index.asciidoc
+++ b/docs/management/snapshot-restore/index.asciidoc
@@ -2,8 +2,8 @@
 [[snapshot-repositories]]
 == Snapshot and Restore
 
-*Snapshot and Restore* enables you to backup your {es}
-indices and clusters using data and state snapshots.
+*Snapshot and Restore* lets you back up a running {es}
+cluster using data and state snapshots.
 Snapshots are important because they provide a copy of your data in case
 something goes wrong. If you need to roll back to an older version of your data,
 you can restore a snapshot from the repository.
@@ -34,17 +34,12 @@ The minimum required permissions to access *Snapshot and Restore* include:
 
 To add privileges, open the main menu, then click *Stack Management > Roles*.
 
-[role="screenshot"]
-image:management/snapshot-restore/images/snapshot_permissions.png["Edit Role"]
-
 [float]
 [[kib-snapshot-register-repository]]
 === Register a repository
 A repository is where your snapshots live. You must register a snapshot
 repository before you can perform snapshot and restore operations.
 
-If you don't have a repository, Kibana walks you through the process of
-registering one.
 {kib} supports three repository types
 out of the box: shared file system, read-only URL, and source-only.
 For more information on these repositories and their settings,
@@ -52,11 +47,9 @@ see {ref}/snapshots-register-repository.html[Repositories].
 To use other repositories, such as S3, see
 {ref}/snapshots-register-repository.html#snapshots-repository-plugins[Repository plugins].
 
-
-Once you create a repository, it is listed in the *Repositories*
-view.
-Click a repository name to view its type, number of snapshots, and settings,
-and to verify status.
+The *Repositories* view displays a list of registered repositories. Click a
+repository name to view information about the repository, verify its status, or
+clean it up.
 
 [role="screenshot"]
 image:management/snapshot-restore/images/repository_list.png["Repository list"]
@@ -73,15 +66,8 @@ into each snapshot for further investigation.
 [role="screenshot"]
 image:management/snapshot-restore/images/snapshot_details.png["Snapshot details"]
 
-If you don’t have any snapshots, you can create them from the {kib} <<console-kibana, Console>>. The
-{ref}/snapshots-take-snapshot.html[snapshot API]
-takes the current state and data in your index or cluster, and then saves it to a
-shared repository.
-
-The snapshot process is "smart." Your first snapshot is a complete copy of
-the data in your index or cluster.
-All subsequent snapshots save the changes between the existing snapshots and
-the new data.
+If you don’t have any snapshots, you can create them using the
+{ref}/create-snapshot-api.html[create snapshot API].
 
 [float]
 [[kib-restore-snapshot]]
@@ -93,14 +79,14 @@ restore a snapshot made from one cluster to another cluster. You might
 use the restore operation to:
 
 * Recover data lost due to a failure
-* Migrate a current Elasticsearch cluster to a new version
+* Migrate an {es} cluster to a new version
 * Move data from one cluster to another cluster
 
 To get started, go to the *Snapshots* view, find the
 snapshot, and click the restore icon in the *Actions* column.
 The Restore wizard presents
 options for the restore operation, including which
-indices to restore and whether to modify the index settings.
+data streams and indices to restore and whether to change index settings.
 You can restore an existing index only if it’s closed and has the same
 number of shards as the index in the snapshot.
 
@@ -119,7 +105,7 @@ Use a {ref}/snapshot-lifecycle-management-api.html[snapshot lifecycle policy]
 to automate the creation and deletion
 of cluster snapshots. Taking automatic snapshots:
 
-* Ensures your {es} indices and clusters are backed up on a regular basis
+* Ensures your {es} data is backed up on a regular basis
 * Ensures a recent and relevant snapshot is available if a situation
 arises where a cluster needs to be recovered
 * Allows you to manage your snapshots in {kib}, instead of using a
@@ -138,8 +124,8 @@ You can drill down into each policy to examine its settings and last successful
 
 You can perform the following actions on a snapshot policy:
 
-* *Run* a policy immediately without waiting for the scheduled time.
-This action is useful before an upgrade or before performing maintenance on indices.
+* *Run* a policy immediately without waiting for the scheduled time. This action
+is useful before an upgrade or before performing maintenance.
 * *Edit* a policy and immediately apply changes to the schedule.
 * *Delete* a policy to prevent any future snapshots from being taken.
 This action does not cancel any currently ongoing snapshots or remove any previously taken snapshots.
@@ -160,7 +146,7 @@ and then click *Delete snapshots*.
 
 [role="xpack"]
 [[snapshot-restore-tutorial]]
-=== Tutorial:  Snapshot and Restore
+=== Tutorial: Snapshot and Restore
 
 
 Ready to try *Snapshot and Restore*? In this tutorial, you'll learn to:
@@ -174,15 +160,12 @@ Ready to try *Snapshot and Restore*? In this tutorial, you'll learn to:
 
 This example shows you how to register a shared file system repository
 and store snapshots.
-Before you begin, you must register the location of the repository in the
-{ref}/snapshots-register-repository.html#snapshots-filesystem-repository[path.repo] setting on
-your master and data nodes.  You can do this in one of two ways:
 
-* Edit  your `elasticsearch.yml` to include the `path.repo` setting.
-
-* Pass the `path.repo` setting when you start Elasticsearch.
-+
-`bin/elasticsearch -E path.repo=/tmp/es-backups`
+Before you begin, you must first mount the file system to the same location on
+all master and data nodes. Then add the file system’s path or parent directory
+to the
+{ref}/snapshots-register-repository.html#snapshots-filesystem-repository[`path.repo`]
+setting in `elasticsearch.yml` for each master and data node.
 
 [float]
 [[register-repo-example]]
@@ -216,13 +199,10 @@ Use the {ref}/snapshots-take-snapshot.html[snapshot API] to create a snapshot.
 . Create the snapshot:
 +
 [source,js]
-PUT /_snapshot/my_backup/2019-04-25_snapshot?wait_for_completion=true
+PUT /_snapshot/my_backup/2099-04-25_snapshot?wait_for_completion=true
 +
-In this example, the snapshot name is `2019-04-25_snapshot`. You can also
+In this example, the snapshot name is `2099-04-25_snapshot`. You can also
 use {ref}/date-math-index-names.html[date math expression] for the snapshot name.
-+
-[role="screenshot"]
-image:management/snapshot-restore/images/create_snapshot.png["Create snapshot"]
 
 . Return to *Snapshot and Restore*.
 +
@@ -251,16 +231,17 @@ image:management/snapshot-restore/images/create-policy-example.png["Create polic
 |Snapshot name
 |`<daily-snap-{now/d}>`
 
-|Schedule
-|Every day at 1:30 a.m.
-
 |Repository
 |`my_backup`
 
+|Schedule
+|Every day at 1:30 a.m.
+
 |*Snapshot&nbsp;settings* |
 
-|Indices
-|Select the indices to back up. By default, all indices, including system indices, are backed up.
+|Data streams and indices
+|Select the data streams and indices to back up. By default, all data streams
+and indices, including system indices, are backed up.
 
 |All&nbsp;other&nbsp;settings
 |Use the defaults.
@@ -280,20 +261,22 @@ Your new policy is listed in the *Policies* view, and you see a summary of its d
 
 [[restore-snapshot-example]]
 ==== Restore a snapshot
-Finally, you'll restore indices from an existing snapshot.
+Finally, you'll restore data streams and indices from an existing snapshot.
 
-. In the *Snapshots* view, find the snapshot you want to restore, for example `2019-04-25_snapshot`.
+. In the *Snapshots* view, find the snapshot you want to restore, for example `2099-04-25_snapshot`.
 . Click the restore icon in the *Actions* column.
 . As you walk through the wizard, enter the following values:
 +
 |===
 |*Logistics* |
 
-|Indices
-|Toggle to choose specific indices to restore, or leave in place to restore all indices.
+|Data streams and indices
+|Toggle to choose specific data streams and indices to restore. Use the default
+to restore all data streams and indices in the snapshot.
 
-|Rename indices
-|Toggle to give your restored indices new names, or leave in place to restore under original index names.
+|Rename data streams and indices
+|Toggle to give your restored data streams and indices new names. Use the
+default to restore the original data stream and index names.
 
 |All other fields
 |Use the defaults.
@@ -313,4 +296,4 @@ or leave in place to keep existing settings.
 +
 The operation loads for a few seconds,
 and then you’re navigated to *Restore Status*,
-where you can monitor the status of your restored indices.
+where you can monitor the status of your restored data streams and indices.
diff --git a/docs/maps/images/gs_dashboard_with_map.png b/docs/maps/images/gs_dashboard_with_map.png
index 49b71c16c12b2..a4bf95948edf0 100644
Binary files a/docs/maps/images/gs_dashboard_with_map.png and b/docs/maps/images/gs_dashboard_with_map.png differ
diff --git a/docs/maps/images/gs_dashboard_with_terms_filter.png b/docs/maps/images/gs_dashboard_with_terms_filter.png
index 21b5c044cb35d..bf84b2ee371af 100644
Binary files a/docs/maps/images/gs_dashboard_with_terms_filter.png and b/docs/maps/images/gs_dashboard_with_terms_filter.png differ
diff --git a/docs/maps/images/layer_search.png b/docs/maps/images/layer_search.png
index 8e0e8ff628953..d3828ed5f4551 100644
Binary files a/docs/maps/images/layer_search.png and b/docs/maps/images/layer_search.png differ
diff --git a/docs/maps/images/quantitative_data_driven_styling.png b/docs/maps/images/quantitative_data_driven_styling.png
index a7852ed202016..03dc22f433eee 100644
Binary files a/docs/maps/images/quantitative_data_driven_styling.png and b/docs/maps/images/quantitative_data_driven_styling.png differ
diff --git a/docs/maps/images/sample_data_ecommerce.png b/docs/maps/images/sample_data_ecommerce.png
index 5b261bb535022..7fba3da608d15 100644
Binary files a/docs/maps/images/sample_data_ecommerce.png and b/docs/maps/images/sample_data_ecommerce.png differ
diff --git a/docs/maps/images/sample_data_web_logs.png b/docs/maps/images/sample_data_web_logs.png
index f4f4de88f1992..e4902c3e89610 100644
Binary files a/docs/maps/images/sample_data_web_logs.png and b/docs/maps/images/sample_data_web_logs.png differ
diff --git a/docs/maps/images/vector_style_class.png b/docs/maps/images/vector_style_class.png
index 8c685dfcf0ab6..69549b9f5f2d8 100644
Binary files a/docs/maps/images/vector_style_class.png and b/docs/maps/images/vector_style_class.png differ
diff --git a/docs/maps/images/vector_style_dynamic.png b/docs/maps/images/vector_style_dynamic.png
index aeaef412b5220..3032e74180afa 100644
Binary files a/docs/maps/images/vector_style_dynamic.png and b/docs/maps/images/vector_style_dynamic.png differ
diff --git a/docs/maps/images/vector_style_static.png b/docs/maps/images/vector_style_static.png
index 47d9c3b21fcb6..34908aa02fac7 100644
Binary files a/docs/maps/images/vector_style_static.png and b/docs/maps/images/vector_style_static.png differ
diff --git a/docs/maps/vector-layer.asciidoc b/docs/maps/vector-layer.asciidoc
index 2115c16a889c6..5017ecf91dffd 100644
--- a/docs/maps/vector-layer.asciidoc
+++ b/docs/maps/vector-layer.asciidoc
@@ -20,10 +20,10 @@ The index must contain at least one field mapped as {ref}/geo-point.html[geo_poi
 Results are limited to the `index.max_result_window` index setting, which defaults to 10000.
 Select the appropriate *Scaling* option for your use case.
 +
-* *Limit results to 10000.* The layer displays features from the first `index.max_result_window` documents.
+* *Limit results to 10,000* The layer displays features from the first `index.max_result_window` documents.
 Results exceeding `index.max_result_window` are not displayed.
 
-* *Show clusters when results exceed 10000.* When results exceed `index.max_result_window`, the layer uses {ref}/search-aggregations-bucket-geotilegrid-aggregation.html[GeoTile grid aggregation] to group your documents into clusters and displays metrics for each cluster. When results are less then `index.max_result_window`, the layer displays features from individual documents.
+* *Show clusters when results exceed 10,000* When results exceed `index.max_result_window`, the layer uses {ref}/search-aggregations-bucket-geotilegrid-aggregation.html[GeoTile grid aggregation] to group your documents into clusters and displays metrics for each cluster. When results are less then `index.max_result_window`, the layer displays features from individual documents.
 
 * *Use vector tiles.* Vector tiles partition your map into 6 to 8 tiles.
 Each tile request is limited to the `index.max_result_window` index setting.
diff --git a/docs/settings/apm-settings.asciidoc b/docs/settings/apm-settings.asciidoc
index 79fa9a642428a..dfb239f0e26c0 100644
--- a/docs/settings/apm-settings.asciidoc
+++ b/docs/settings/apm-settings.asciidoc
@@ -18,7 +18,7 @@ It is enabled by default.
 // Any changes made in this file will be seen there as well.
 // tag::apm-indices-settings[]
 
-Index defaults can be changed in Kibana. Open the main menu, then click *APM > Settings > Indices*.
+Index defaults can be changed in the APM app. Select **Settings** > **Indices**.
 Index settings in the APM app take precedence over those set in `kibana.yml`.
 
 [role="screenshot"]
diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc
index ba333deeb1609..15abd0fa4ad96 100644
--- a/docs/setup/settings.asciidoc
+++ b/docs/setup/settings.asciidoc
@@ -284,6 +284,11 @@ the username and password that the {kib} server uses to perform maintenance
 on the {kib} index at startup. {kib} users still need to authenticate with
 {es}, which is proxied through the {kib} server.
 
+|[[elasticsearch-service-account-token]] `elasticsearch.serviceAccountToken:`
+ | beta[]. If your {es} is protected with basic authentication, this token provides the credentials
+that the {kib} server uses to perform maintenance on the {kib} index at startup. This setting
+is an alternative to `elasticsearch.username` and `elasticsearch.password`.
+
 | `enterpriseSearch.host`
   | The URL of your Enterprise Search instance
 
diff --git a/docs/user/dashboard/tsvb.asciidoc b/docs/user/dashboard/tsvb.asciidoc
index 89da3f7285924..11fe71b7639bb 100644
--- a/docs/user/dashboard/tsvb.asciidoc
+++ b/docs/user/dashboard/tsvb.asciidoc
@@ -148,6 +148,27 @@ The *Markdown* visualization supports Markdown with Handlebar (mustache) syntax
 
 For answers to frequently asked *TSVB* question, review the following. 
 
+[float]
+===== How do I create dashboard drilldowns for Top N and Table visualizations?
+
+You can create dashboard drilldowns that include the specified time range for *Top N* and *Table* visualizations.
+
+. Open the dashboard that you want to link to, then copy the URL.
+
+. Open the dashboard with the *Top N* and *Table* visualization panel, then click *Edit* in the toolbar. 
+
+. Open the *Top N* or *Table* panel menu, then select *Edit visualization*.
+
+. Click *Panel options*. 
+
+. In the *Item URL* field, enter the URL. 
++
+For example `dashboards#/view/f193ca90-c9f4-11eb-b038-dd3270053a27`.
+
+. Click *Save and return*.
+
+. In the toolbar, cick *Save as*, then make sure *Store time with dashboard* is deselected. 
+
 [float]
 ===== Why is my TSVB visualization missing data?
 
diff --git a/docs/user/management.asciidoc b/docs/user/management.asciidoc
index b86fa82c30381..2f9f1fe371dc3 100644
--- a/docs/user/management.asciidoc
+++ b/docs/user/management.asciidoc
@@ -82,9 +82,10 @@ connectors>> for triggering actions.
 | Monitor the generation of reports&mdash;PDF, PNG, and CSV&mdash;and download reports that you previously generated.
 A report can contain a dashboard, visualization, saved search, or Canvas workpad.
 
-| {ml-docs}/ml-jobs.html[Machine Learning Jobs]
-| View your {anomaly-jobs} and {dfanalytics-jobs}. Open the Single Metric
-Viewer or Anomaly Explorer to see your {ml} results.
+| Machine Learning Jobs
+| View your <<xpack-ml-anomalies,{anomaly-detect}>> and
+<<xpack-ml-dfanalytics,{dfanalytics}>> jobs. Open the Single Metric
+Viewer or Anomaly Explorer to see your {anomaly-detect} results.
 
 | <<watcher-ui, Watcher>>
 | Detect changes in your data by creating, managing, and monitoring alerts.
diff --git a/docs/user/ml/index.asciidoc b/docs/user/ml/index.asciidoc
index b3606b122d750..a05ff1eeec4a6 100644
--- a/docs/user/ml/index.asciidoc
+++ b/docs/user/ml/index.asciidoc
@@ -48,8 +48,9 @@ pane:
 image::user/ml/images/ml-job-management.png[Job Management]
 
 You can use the *Settings* pane to create and edit
-{ml-docs}/ml-calendars.html[calendars] and the filters that are used in
-{ml-docs}/ml-rules.html[custom rules]:
+{ml-docs}/ml-ad-finding-anomalies.html#ml-ad-calendars[calendars] and the
+filters that are used in
+{ml-docs}/ml-ad-finding-anomalies.html#ml-ad-rules[custom rules]:
 
 [role="screenshot"]
 image::user/ml/images/ml-settings.png[Calendar Management]
diff --git a/docs/user/production-considerations/task-manager-health-monitoring.asciidoc b/docs/user/production-considerations/task-manager-health-monitoring.asciidoc
index 8f2c8d106c77c..3321a9d0c02a1 100644
--- a/docs/user/production-considerations/task-manager-health-monitoring.asciidoc
+++ b/docs/user/production-considerations/task-manager-health-monitoring.asciidoc
@@ -57,8 +57,12 @@ xpack.task_manager.monitored_task_execution_thresholds:
 
 The health API is best consumed by via the `/api/task_manager/_health` endpoint.
 
-Additionally, the metrics are logged in the {kib} `DEBUG` logger at a regular cadence.
-To enable Task Manager DEBUG logging in your {kib} instance, add the following to your `kibana.yml`:
+Additionally, there are two ways to consume these metrics:
+
+*Debug logging*
+
+The metrics are logged in the {kib} `DEBUG` logger at a regular cadence.
+To enable Task Manager debug logging in your {kib} instance, add the following to your `kibana.yml`:
 
 [source,yml]
 ----
@@ -69,7 +73,22 @@ logging:
         level: debug
 ----
 
-These stats are logged based the number of milliseconds set in your <<task-manager-settings,`xpack.task_manager.poll_interval`>> setting, which means it could add substantial noise to your logs. Only enable this level of logging temporarily.
+These stats are logged based on the number of milliseconds set in your <<task-manager-settings,`xpack.task_manager.poll_interval`>> setting, which could add substantial noise to your logs. Only enable this level of logging temporarily.
+
+*Automatic logging*
+
+By default, the health API runs at a regular cadence, and each time it runs, it attempts to self evaluate its performance. If this self evaluation yields a potential problem,
+a message will log to the {kib} server log. In addition, the health API will look at how long tasks have waited to start (from when they were scheduled to start). If this number exceeds a configurable threshold (<<task-manager-settings,`xpack.task_manager.monitored_stats_health_verbose_log.warn_delayed_task_start_in_seconds`>>), the same message as above will log to the {kib} server log.
+
+This message looks like:
+
+[source,log]
+----
+Detected potential performance issue with Task Manager. Set 'xpack.task_manager.monitored_stats_health_verbose_log.enabled: true' in your Kibana.yml to enable debug logging`
+----
+
+
+If this message appears, set <<task-manager-settings,`xpack.task_manager.monitored_stats_health_verbose_log.enabled`>> to `true` in your `kibana.yml`. This will start logging the health metrics at either a `warn` or `error` log level, depending on the detected severity of the potential problem.
 
 [float]
 [[making-sense-of-task-manager-health-stats]]
diff --git a/package.json b/package.json
index 22eedde59c5e7..5cf72e2110982 100644
--- a/package.json
+++ b/package.json
@@ -99,7 +99,7 @@
   "dependencies": {
     "@elastic/apm-rum": "^5.8.0",
     "@elastic/apm-rum-react": "^1.2.11",
-    "@elastic/charts": "31.1.0",
+    "@elastic/charts": "32.0.0",
     "@elastic/datemath": "link:bazel-bin/packages/elastic-datemath",
     "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@^8.0.0-canary.13",
     "@elastic/ems-client": "7.14.0",
diff --git a/packages/kbn-securitysolution-list-utils/src/autocomplete_operators/types.ts b/packages/kbn-optimizer/src/__fixtures__/mock_repo/packages/kbn-ui-shared-deps/src/public_path_module_creator.ts
similarity index 56%
rename from packages/kbn-securitysolution-list-utils/src/autocomplete_operators/types.ts
rename to packages/kbn-optimizer/src/__fixtures__/mock_repo/packages/kbn-ui-shared-deps/src/public_path_module_creator.ts
index 1be21bb62a7fe..b03ee16d2f746 100644
--- a/packages/kbn-securitysolution-list-utils/src/autocomplete_operators/types.ts
+++ b/packages/kbn-optimizer/src/__fixtures__/mock_repo/packages/kbn-ui-shared-deps/src/public_path_module_creator.ts
@@ -6,14 +6,4 @@
  * Side Public License, v 1.
  */
 
-import type {
-  ListOperatorEnum as OperatorEnum,
-  ListOperatorTypeEnum as OperatorTypeEnum,
-} from '@kbn/securitysolution-io-ts-list-types';
-
-export interface OperatorOption {
-  message: string;
-  value: string;
-  operator: OperatorEnum;
-  type: OperatorTypeEnum;
-}
+// stub
diff --git a/packages/kbn-optimizer/src/common/__snapshots__/parse_path.test.ts.snap b/packages/kbn-optimizer/src/common/__snapshots__/parse_path.test.ts.snap
index f537674c3fff7..2a30694afb826 100644
--- a/packages/kbn-optimizer/src/common/__snapshots__/parse_path.test.ts.snap
+++ b/packages/kbn-optimizer/src/common/__snapshots__/parse_path.test.ts.snap
@@ -1,7 +1,7 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`parseDirPath() parses / 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [],
   "filename": undefined,
   "query": undefined,
@@ -10,7 +10,7 @@ Object {
 `;
 
 exports[`parseDirPath() parses /foo 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
   ],
@@ -21,7 +21,7 @@ Object {
 `;
 
 exports[`parseDirPath() parses /foo/bar/baz 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -34,7 +34,7 @@ Object {
 `;
 
 exports[`parseDirPath() parses /foo/bar/baz/ 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -47,7 +47,7 @@ Object {
 `;
 
 exports[`parseDirPath() parses c:\\ 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [],
   "filename": undefined,
   "query": undefined,
@@ -56,7 +56,7 @@ Object {
 `;
 
 exports[`parseDirPath() parses c:\\foo 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
   ],
@@ -67,7 +67,7 @@ Object {
 `;
 
 exports[`parseDirPath() parses c:\\foo\\bar\\baz 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -80,7 +80,7 @@ Object {
 `;
 
 exports[`parseDirPath() parses c:\\foo\\bar\\baz\\ 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -93,7 +93,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses /foo 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [],
   "filename": "foo",
   "query": undefined,
@@ -102,7 +102,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses /foo/bar/baz 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -114,7 +114,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses /foo/bar/baz.json 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -126,7 +126,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses /foo/bar/baz.json?light 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -140,7 +140,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses /foo/bar/baz.json?light=true&dark=false 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -155,7 +155,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses c:/foo/bar/baz.json 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -167,7 +167,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses c:\\foo 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [],
   "filename": "foo",
   "query": undefined,
@@ -176,7 +176,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses c:\\foo\\bar\\baz 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -188,7 +188,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses c:\\foo\\bar\\baz.json 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -200,7 +200,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses c:\\foo\\bar\\baz.json?dark 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
@@ -214,7 +214,7 @@ Object {
 `;
 
 exports[`parseFilePath() parses c:\\foo\\bar\\baz.json?dark=true&light=false 1`] = `
-Object {
+ParsedPath {
   "dirs": Array [
     "foo",
     "bar",
diff --git a/packages/kbn-optimizer/src/common/parse_path.ts b/packages/kbn-optimizer/src/common/parse_path.ts
index 7ea0042db25c9..da3744ba477bd 100644
--- a/packages/kbn-optimizer/src/common/parse_path.ts
+++ b/packages/kbn-optimizer/src/common/parse_path.ts
@@ -9,17 +9,61 @@
 import normalizePath from 'normalize-path';
 import Qs from 'querystring';
 
+class ParsedPath {
+  constructor(
+    public readonly root: string,
+    public readonly dirs: string[],
+    public readonly query?: Record<string, unknown>,
+    public readonly filename?: string
+  ) {}
+
+  private indexOfDir(match: string | RegExp, fromIndex: number = 0) {
+    for (let i = fromIndex; i < this.dirs.length; i++) {
+      if (this.matchDir(i, match)) {
+        return i;
+      }
+    }
+
+    return -1;
+  }
+
+  private matchDir(i: number, match: string | RegExp) {
+    return typeof match === 'string' ? this.dirs[i] === match : match.test(this.dirs[i]);
+  }
+
+  matchDirs(...segments: Array<string | RegExp>) {
+    const [first, ...rest] = segments;
+    let fromIndex = 0;
+    while (true) {
+      // do the dirs include the first segment to match?
+      const startIndex = this.indexOfDir(first, fromIndex);
+      if (startIndex === -1) {
+        return;
+      }
+
+      // are all of the ...rest segments also matched at this point?
+      if (!rest.length || rest.every((seg, i) => this.matchDir(startIndex + 1 + i, seg))) {
+        return { startIndex, endIndex: startIndex + rest.length };
+      }
+
+      // no match, search again, this time looking at instances after the matched instance
+      fromIndex = startIndex + 1;
+    }
+  }
+}
+
 /**
  * Parse an absolute path, supporting normalized paths from webpack,
  * into a list of directories and root
  */
 export function parseDirPath(path: string) {
   const filePath = parseFilePath(path);
-  return {
-    ...filePath,
-    dirs: [...filePath.dirs, ...(filePath.filename ? [filePath.filename] : [])],
-    filename: undefined,
-  };
+  return new ParsedPath(
+    filePath.root,
+    [...filePath.dirs, ...(filePath.filename ? [filePath.filename] : [])],
+    filePath.query,
+    undefined
+  );
 }
 
 export function parseFilePath(path: string) {
@@ -32,10 +76,10 @@ export function parseFilePath(path: string) {
   }
 
   const [root, ...others] = normalized.split('/');
-  return {
-    root: root === '' ? '/' : root,
-    dirs: others.slice(0, -1),
+  return new ParsedPath(
+    root === '' ? '/' : root,
+    others.slice(0, -1),
     query,
-    filename: others[others.length - 1] || undefined,
-  };
+    others[others.length - 1] || undefined
+  );
 }
diff --git a/packages/kbn-optimizer/src/integration_tests/basic_optimization.test.ts b/packages/kbn-optimizer/src/integration_tests/basic_optimization.test.ts
index 97a7f33be673d..48d36b706b831 100644
--- a/packages/kbn-optimizer/src/integration_tests/basic_optimization.test.ts
+++ b/packages/kbn-optimizer/src/integration_tests/basic_optimization.test.ts
@@ -15,7 +15,7 @@ import cpy from 'cpy';
 import del from 'del';
 import { tap, filter } from 'rxjs/operators';
 import { REPO_ROOT } from '@kbn/utils';
-import { ToolingLog, createReplaceSerializer } from '@kbn/dev-utils';
+import { ToolingLog } from '@kbn/dev-utils';
 import { runOptimizer, OptimizerConfig, OptimizerUpdate, logOptimizerState } from '../index';
 
 import { allValuesFrom } from '../common';
@@ -29,8 +29,6 @@ expect.addSnapshotSerializer({
   test: (value: any) => typeof value === 'string' && value.includes(REPO_ROOT),
 });
 
-expect.addSnapshotSerializer(createReplaceSerializer(/\w+-fastbuild/, '<platform>-fastbuild'));
-
 const log = new ToolingLog({
   level: 'error',
   writeTo: {
@@ -132,7 +130,7 @@ it('builds expected bundles, saves bundle counts to metadata', async () => {
   expect(foo.cache.getModuleCount()).toBe(6);
   expect(foo.cache.getReferencedFiles()).toMatchInlineSnapshot(`
     Array [
-      <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/bazel-out/<platform>-fastbuild/bin/packages/kbn-ui-shared-deps/target/public_path_module_creator.js,
+      <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/packages/kbn-ui-shared-deps/src/public_path_module_creator.ts,
       <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/plugins/foo/kibana.json,
       <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/plugins/foo/public/async_import.ts,
       <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/plugins/foo/public/ext.ts,
@@ -155,7 +153,7 @@ it('builds expected bundles, saves bundle counts to metadata', async () => {
       <absolute path>/node_modules/@kbn/optimizer/postcss.config.js,
       <absolute path>/node_modules/css-loader/package.json,
       <absolute path>/node_modules/style-loader/package.json,
-      <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/bazel-out/<platform>-fastbuild/bin/packages/kbn-ui-shared-deps/target/public_path_module_creator.js,
+      <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/packages/kbn-ui-shared-deps/src/public_path_module_creator.ts,
       <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/plugins/bar/kibana.json,
       <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/plugins/bar/public/index.scss,
       <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/plugins/bar/public/index.ts,
@@ -175,7 +173,7 @@ it('builds expected bundles, saves bundle counts to metadata', async () => {
 
   expect(baz.cache.getReferencedFiles()).toMatchInlineSnapshot(`
     Array [
-      <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/bazel-out/<platform>-fastbuild/bin/packages/kbn-ui-shared-deps/target/public_path_module_creator.js,
+      <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/packages/kbn-ui-shared-deps/src/public_path_module_creator.ts,
       <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/x-pack/baz/kibana.json,
       <absolute path>/packages/kbn-optimizer/src/__fixtures__/__tmp__/mock_repo/x-pack/baz/public/index.ts,
       <absolute path>/packages/kbn-optimizer/src/worker/entry_point_creator.ts,
diff --git a/packages/kbn-optimizer/src/worker/populate_bundle_cache_plugin.ts b/packages/kbn-optimizer/src/worker/populate_bundle_cache_plugin.ts
index 8d890b31b639d..a3455d7ddf2b9 100644
--- a/packages/kbn-optimizer/src/worker/populate_bundle_cache_plugin.ts
+++ b/packages/kbn-optimizer/src/worker/populate_bundle_cache_plugin.ts
@@ -6,11 +6,11 @@
  * Side Public License, v 1.
  */
 
-import webpack from 'webpack';
-
 import Path from 'path';
 import { inspect } from 'util';
 
+import webpack from 'webpack';
+
 import { Bundle, WorkerConfig, ascending, parseFilePath } from '../common';
 import { BundleRefModule } from './bundle_ref_module';
 import {
@@ -21,6 +21,20 @@ import {
   getModulePath,
 } from './webpack_helpers';
 
+function tryToResolveRewrittenPath(from: string, toResolve: string) {
+  try {
+    return require.resolve(toResolve);
+  } catch (error) {
+    if (error.code === 'MODULE_NOT_FOUND') {
+      throw new Error(
+        `attempted to rewrite bazel-out path [${from}] to [${toResolve}] but couldn't find the rewrite target`
+      );
+    }
+
+    throw error;
+  }
+}
+
 /**
  * sass-loader creates about a 40% overhead on the overall optimizer runtime, and
  * so this constant is used to indicate to assignBundlesToWorkers() that there is
@@ -57,17 +71,44 @@ export class PopulateBundleCachePlugin {
             let path = getModulePath(module);
             let parsedPath = parseFilePath(path);
 
-            if (parsedPath.dirs.includes('bazel-out')) {
-              const index = parsedPath.dirs.indexOf('bazel-out');
-              path = Path.join(
-                workerConfig.repoRoot,
-                'bazel-out',
-                ...parsedPath.dirs.slice(index + 1),
-                parsedPath.filename ?? ''
+            const bazelOut = parsedPath.matchDirs(
+              'bazel-out',
+              /-fastbuild$/,
+              'bin',
+              'packages',
+              /.*/,
+              'target'
+            );
+
+            // if the module is referenced from one of our packages and resolved to the `bazel-out` dir
+            // we should rewrite our reference to point to the source file so that we can track the
+            // modified time of that file rather than the built output which is rebuilt all the time
+            // without actually changing
+            if (bazelOut) {
+              const packageDir = parsedPath.dirs[bazelOut.endIndex - 1];
+              const subDirs = parsedPath.dirs.slice(bazelOut.endIndex + 1);
+              path = tryToResolveRewrittenPath(
+                path,
+                Path.join(
+                  workerConfig.repoRoot,
+                  'packages',
+                  packageDir,
+                  'src',
+                  ...subDirs,
+                  parsedPath.filename
+                    ? Path.basename(parsedPath.filename, Path.extname(parsedPath.filename))
+                    : ''
+                )
               );
               parsedPath = parseFilePath(path);
             }
 
+            if (parsedPath.matchDirs('bazel-out')) {
+              throw new Error(
+                `a bazel-out dir is being referenced by module [${path}] and not getting rewritten to its source location`
+              );
+            }
+
             if (!parsedPath.dirs.includes('node_modules')) {
               referencedFiles.add(path);
 
diff --git a/packages/kbn-securitysolution-list-utils/src/autocomplete_operators/index.ts b/packages/kbn-securitysolution-list-utils/src/autocomplete_operators/index.ts
index 967cebc360f61..051c359dc4612 100644
--- a/packages/kbn-securitysolution-list-utils/src/autocomplete_operators/index.ts
+++ b/packages/kbn-securitysolution-list-utils/src/autocomplete_operators/index.ts
@@ -11,8 +11,7 @@ import {
   ListOperatorEnum as OperatorEnum,
   ListOperatorTypeEnum as OperatorTypeEnum,
 } from '@kbn/securitysolution-io-ts-list-types';
-
-import { OperatorOption } from './types';
+import { OperatorOption } from '../types';
 
 export const isOperator: OperatorOption = {
   message: i18n.translate('lists.exceptions.isOperatorLabel', {
diff --git a/packages/kbn-securitysolution-list-utils/src/helpers/index.ts b/packages/kbn-securitysolution-list-utils/src/helpers/index.ts
index d208624b69fc5..38446b2a08ec0 100644
--- a/packages/kbn-securitysolution-list-utils/src/helpers/index.ts
+++ b/packages/kbn-securitysolution-list-utils/src/helpers/index.ts
@@ -43,7 +43,6 @@ import {
   isOneOfOperator,
   isOperator,
 } from '../autocomplete_operators';
-import { OperatorOption } from '../autocomplete_operators/types';
 
 import {
   BuilderEntry,
@@ -52,6 +51,7 @@ import {
   EmptyNestedEntry,
   ExceptionsBuilderExceptionItem,
   FormattedBuilderEntry,
+  OperatorOption,
 } from '../types';
 
 export const isEntryNested = (item: BuilderEntry): item is EntryNested => {
diff --git a/packages/kbn-securitysolution-list-utils/src/types/index.ts b/packages/kbn-securitysolution-list-utils/src/types/index.ts
index faf68ca157981..537ac06a49f34 100644
--- a/packages/kbn-securitysolution-list-utils/src/types/index.ts
+++ b/packages/kbn-securitysolution-list-utils/src/types/index.ts
@@ -23,7 +23,12 @@ import {
   EXCEPTION_LIST_NAMESPACE_AGNOSTIC,
 } from '@kbn/securitysolution-list-constants';
 
-import type { OperatorOption } from '../autocomplete_operators/types';
+export interface OperatorOption {
+  message: string;
+  value: string;
+  operator: OperatorEnum;
+  type: OperatorTypeEnum;
+}
 
 /**
  * @deprecated Use the one from core once it is in its own package which will be from:
diff --git a/packages/kbn-spec-to-console/README.md b/packages/kbn-spec-to-console/README.md
index 0328dec791320..a0e654713f61b 100644
--- a/packages/kbn-spec-to-console/README.md
+++ b/packages/kbn-spec-to-console/README.md
@@ -18,15 +18,10 @@ git pull --depth=1 origin master
 
 ### Usage
 
-You need to run the command twice: once for the **OSS** specs and once for the **X-Pack** specs  
 At the root of the Kibana repository, run the following commands:
 
 ```sh
-# OSS
 yarn spec_to_console -g "<ELASTICSEARCH-REPO-FOLDER>/rest-api-spec/src/main/resources/rest-api-spec/api/*" -d "src/plugins/console/server/lib/spec_definitions/json/generated"
-
-# X-pack
-yarn spec_to_console -g "<ELASTICSEARCH-REPO-FOLDER>/x-pack/plugin/src/test/resources/rest-api-spec/api/*" -d "x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated"
 ```
 
 ### Information used in Console that is not available in the REST spec
diff --git a/packages/kbn-spec-to-console/lib/convert/params.js b/packages/kbn-spec-to-console/lib/convert/params.js
index e5365b4d7311e..1aa89be11c76d 100644
--- a/packages/kbn-spec-to-console/lib/convert/params.js
+++ b/packages/kbn-spec-to-console/lib/convert/params.js
@@ -37,6 +37,7 @@ module.exports = (params) => {
       case 'string':
       case 'number':
       case 'number|string':
+      case 'boolean|long':
         result[param] = defaultValue || '';
         break;
       case 'list':
diff --git a/src/cli/serve/serve.js b/src/cli/serve/serve.js
index ad83965efde33..be949350f7229 100644
--- a/src/cli/serve/serve.js
+++ b/src/cli/serve/serve.js
@@ -68,12 +68,14 @@ function applyConfigOverrides(rawConfig, opts, extraCliOptions) {
   delete extraCliOptions.env;
 
   if (opts.dev) {
-    if (!has('elasticsearch.username')) {
-      set('elasticsearch.username', 'kibana_system');
-    }
+    if (!has('elasticsearch.serviceAccountToken')) {
+      if (!has('elasticsearch.username')) {
+        set('elasticsearch.username', 'kibana_system');
+      }
 
-    if (!has('elasticsearch.password')) {
-      set('elasticsearch.password', 'changeme');
+      if (!has('elasticsearch.password')) {
+        set('elasticsearch.password', 'changeme');
+      }
     }
 
     if (opts.ssl) {
diff --git a/src/core/public/chrome/ui/header/header_help_menu.tsx b/src/core/public/chrome/ui/header/header_help_menu.tsx
index c6a09c1177a5e..cbf89bba2ca44 100644
--- a/src/core/public/chrome/ui/header/header_help_menu.tsx
+++ b/src/core/public/chrome/ui/header/header_help_menu.tsx
@@ -211,7 +211,7 @@ export class HeaderHelpMenu extends Component<Props, State> {
 
     return (
       <Fragment>
-        <EuiButtonEmpty href={kibanaDocLink} target="_blank" size="xs" flush="left">
+        <EuiButtonEmpty href={kibanaDocLink} target="_blank" size="s" flush="left">
           <FormattedMessage
             id="core.ui.chrome.headerGlobalNav.helpMenuKibanaDocumentationTitle"
             defaultMessage="Kibana documentation"
@@ -220,7 +220,7 @@ export class HeaderHelpMenu extends Component<Props, State> {
 
         <EuiSpacer size="xs" />
 
-        <EuiButtonEmpty href={helpSupportUrl} target="_blank" size="xs" flush="left">
+        <EuiButtonEmpty href={helpSupportUrl} target="_blank" size="s" flush="left">
           <FormattedMessage
             id="core.ui.chrome.headerGlobalNav.helpMenuAskElasticTitle"
             defaultMessage="Ask Elastic"
@@ -229,7 +229,7 @@ export class HeaderHelpMenu extends Component<Props, State> {
 
         <EuiSpacer size="xs" />
 
-        <EuiButtonEmpty href={KIBANA_FEEDBACK_LINK} target="_blank" size="xs" flush="left">
+        <EuiButtonEmpty href={KIBANA_FEEDBACK_LINK} target="_blank" size="s" flush="left">
           <FormattedMessage
             id="core.ui.chrome.headerGlobalNav.helpMenuGiveFeedbackTitle"
             defaultMessage="Give feedback"
@@ -241,7 +241,7 @@ export class HeaderHelpMenu extends Component<Props, State> {
         <EuiButtonEmpty
           href={GITHUB_CREATE_ISSUE_LINK}
           target="_blank"
-          size="xs"
+          size="s"
           iconType="logoGithub"
           flush="left"
         >
@@ -330,7 +330,7 @@ export class HeaderHelpMenu extends Component<Props, State> {
         {customLinks}
         {content && (
           <>
-            {customLinks && <EuiSpacer size="s" />}
+            {customLinks && <EuiSpacer size="xs" />}
             <HeaderExtension extension={content} />
           </>
         )}
@@ -383,7 +383,7 @@ const createCustomLink = (
 ) => {
   return (
     <Fragment key={`helpButton${index}`}>
-      <EuiButtonEmpty {...buttonProps} size="xs" flush="left">
+      <EuiButtonEmpty {...buttonProps} size="s" flush="left">
         {text}
       </EuiButtonEmpty>
       {addSpacer && <EuiSpacer size="xs" />}
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index 7a843a41cc4ca..e8453d009e720 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -232,20 +232,20 @@ export class DocLinksService {
           guide: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/index.html`,
           aggregations: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-configuring-aggregation.html`,
           anomalyDetection: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-overview.html`,
-          anomalyDetectionJobs: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-jobs.html`,
+          anomalyDetectionJobs: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html`,
           anomalyDetectionConfiguringCategories: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-configuring-categories.html`,
-          anomalyDetectionBucketSpan: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#bucket-span`,
-          anomalyDetectionCardinality: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#cardinality`,
-          anomalyDetectionCreateJobs: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html`,
-          anomalyDetectionDetectors: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#detectors`,
-          anomalyDetectionInfluencers: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-influencers.html`,
+          anomalyDetectionBucketSpan: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-bucket-span`,
+          anomalyDetectionCardinality: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-cardinality`,
+          anomalyDetectionCreateJobs: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-create-job`,
+          anomalyDetectionDetectors: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-detectors`,
+          anomalyDetectionInfluencers: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-influencers`,
           anomalyDetectionJobResource: `${ELASTICSEARCH_DOCS}ml-put-job.html#ml-put-job-path-parms`,
           anomalyDetectionJobResourceAnalysisConfig: `${ELASTICSEARCH_DOCS}ml-put-job.html#put-analysisconfig`,
-          anomalyDetectionJobTips: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#job-tips`,
-          anomalyDetectionModelMemoryLimits: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#model-memory-limits`,
-          calendars: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-calendars.html`,
+          anomalyDetectionJobTips: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-job-tips`,
+          anomalyDetectionModelMemoryLimits: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-model-memory-limits`,
+          calendars: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-calendars`,
           classificationEvaluation: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfa-classification.html#ml-dfanalytics-classification-evaluation`,
-          customRules: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-rules.html`,
+          customRules: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-rules`,
           customUrls: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-configuring-url.html`,
           dataFrameAnalytics: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfanalytics.html`,
           featureImportance: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-feature-importance.html`,
diff --git a/src/core/server/core_app/bundle_routes/file_hash.test.ts b/src/core/server/core_app/bundle_routes/file_hash.test.ts
index 918f435156344..0de63d7409ed9 100644
--- a/src/core/server/core_app/bundle_routes/file_hash.test.ts
+++ b/src/core/server/core_app/bundle_routes/file_hash.test.ts
@@ -67,6 +67,8 @@ describe('getFileHash', () => {
     await getFileHash(cache, sampleFilePath, stats, fd);
 
     expect(cache.set).toHaveBeenCalledTimes(1);
-    expect(cache.set).toHaveBeenCalledWith(`${sampleFilePath}-${stats.ino}`, computedHashPromise);
+    expect(cache.set).toHaveBeenCalledWith(`${sampleFilePath}-${stats.ino}`, expect.any(Promise));
+    const promiseValue = await cache.set.mock.calls[0][1];
+    expect(promiseValue).toEqual('computed-hash');
   });
 });
diff --git a/src/core/server/elasticsearch/client/client_config.test.ts b/src/core/server/elasticsearch/client/client_config.test.ts
index faca79b3aa6fa..7e16339b40235 100644
--- a/src/core/server/elasticsearch/client/client_config.test.ts
+++ b/src/core/server/elasticsearch/client/client_config.test.ts
@@ -204,11 +204,27 @@ describe('parseClientOptions', () => {
         );
       });
 
+      it('adds an authorization header if `serviceAccountToken` is set', () => {
+        expect(
+          parseClientOptions(
+            createConfig({
+              serviceAccountToken: 'ABC123',
+            }),
+            false
+          )
+        ).toEqual(
+          expect.objectContaining({
+            headers: expect.objectContaining({
+              authorization: `Bearer ABC123`,
+            }),
+          })
+        );
+      });
+
       it('does not add auth to the nodes', () => {
         const options = parseClientOptions(
           createConfig({
-            username: 'user',
-            password: 'pass',
+            serviceAccountToken: 'ABC123',
             hosts: ['http://node-A:9200'],
           }),
           true
@@ -252,6 +268,34 @@ describe('parseClientOptions', () => {
                   ]
               `);
       });
+
+      it('does not add the authorization header even if `serviceAccountToken` is set', () => {
+        expect(
+          parseClientOptions(
+            createConfig({
+              serviceAccountToken: 'ABC123',
+            }),
+            true
+          ).headers
+        ).not.toHaveProperty('authorization');
+      });
+
+      it('does not add auth to the nodes even if `serviceAccountToken` is set', () => {
+        const options = parseClientOptions(
+          createConfig({
+            serviceAccountToken: 'ABC123',
+            hosts: ['http://node-A:9200'],
+          }),
+          true
+        );
+        expect(options.nodes).toMatchInlineSnapshot(`
+                  Array [
+                    Object {
+                      "url": "http://node-a:9200/",
+                    },
+                  ]
+              `);
+      });
     });
   });
 
diff --git a/src/core/server/elasticsearch/client/client_config.ts b/src/core/server/elasticsearch/client/client_config.ts
index 3044b277db902..bbbb1ac247b3b 100644
--- a/src/core/server/elasticsearch/client/client_config.ts
+++ b/src/core/server/elasticsearch/client/client_config.ts
@@ -29,6 +29,7 @@ export type ElasticsearchClientConfig = Pick<
   | 'hosts'
   | 'username'
   | 'password'
+  | 'serviceAccountToken'
 > & {
   pingTimeout?: ElasticsearchConfig['pingTimeout'] | ClientOptions['pingTimeout'];
   requestTimeout?: ElasticsearchConfig['requestTimeout'] | ClientOptions['requestTimeout'];
@@ -74,11 +75,16 @@ export function parseClientOptions(
     };
   }
 
-  if (config.username && config.password && !scoped) {
-    clientOptions.auth = {
-      username: config.username,
-      password: config.password,
-    };
+  if (!scoped) {
+    if (config.username && config.password) {
+      clientOptions.auth = {
+        username: config.username,
+        password: config.password,
+      };
+    } else if (config.serviceAccountToken) {
+      // TODO: change once ES client has native support for service account tokens: https://github.com/elastic/elasticsearch-js/issues/1477
+      clientOptions.headers!.authorization = `Bearer ${config.serviceAccountToken}`;
+    }
   }
 
   clientOptions.nodes = config.hosts.map((host) => convertHost(host));
diff --git a/src/core/server/elasticsearch/elasticsearch_config.test.ts b/src/core/server/elasticsearch/elasticsearch_config.test.ts
index f8ef1a7a20a83..6e05baac88e34 100644
--- a/src/core/server/elasticsearch/elasticsearch_config.test.ts
+++ b/src/core/server/elasticsearch/elasticsearch_config.test.ts
@@ -41,6 +41,7 @@ test('set correct defaults', () => {
         "authorization",
       ],
       "requestTimeout": "PT30S",
+      "serviceAccountToken": undefined,
       "shardTimeout": "PT30S",
       "sniffInterval": false,
       "sniffOnConnectionFault": false,
@@ -377,3 +378,22 @@ test('#username throws if equal to "elastic", only while running from source', (
   );
   expect(() => config.schema.validate(obj, { dist: true })).not.toThrow();
 });
+
+test('serviceAccountToken throws if username is also set', () => {
+  const obj = {
+    username: 'elastic',
+    serviceAccountToken: 'abc123',
+  };
+
+  expect(() => config.schema.validate(obj)).toThrowErrorMatchingInlineSnapshot(
+    `"[serviceAccountToken]: serviceAccountToken cannot be specified when \\"username\\" is also set."`
+  );
+});
+
+test('serviceAccountToken does not throw if username is not set', () => {
+  const obj = {
+    serviceAccountToken: 'abc123',
+  };
+
+  expect(() => config.schema.validate(obj)).not.toThrow();
+});
diff --git a/src/core/server/elasticsearch/elasticsearch_config.ts b/src/core/server/elasticsearch/elasticsearch_config.ts
index b2b25cda3ac2a..e756d9da867b3 100644
--- a/src/core/server/elasticsearch/elasticsearch_config.ts
+++ b/src/core/server/elasticsearch/elasticsearch_config.ts
@@ -53,6 +53,18 @@ export const configSchema = schema.object({
     )
   ),
   password: schema.maybe(schema.string()),
+  serviceAccountToken: schema.maybe(
+    schema.conditional(
+      schema.siblingRef('username'),
+      schema.never(),
+      schema.string(),
+      schema.string({
+        validate: () => {
+          return `serviceAccountToken cannot be specified when "username" is also set.`;
+        },
+      })
+    )
+  ),
   requestHeadersWhitelist: schema.oneOf(
     [
       schema.string({
@@ -272,6 +284,7 @@ export class ElasticsearchConfig {
   /**
    * If Elasticsearch is protected with basic authentication, this setting provides
    * the username that the Kibana server uses to perform its administrative functions.
+   * Cannot be used in conjunction with serviceAccountToken.
    */
   public readonly username?: string;
 
@@ -281,6 +294,14 @@ export class ElasticsearchConfig {
    */
   public readonly password?: string;
 
+  /**
+   * If Elasticsearch security features are enabled, this setting provides the service account
+   * token that the Kibana server users to perform its administrative functions.
+   *
+   * This is an alternative to specifying a username and password.
+   */
+  public readonly serviceAccountToken?: string;
+
   /**
    * Set of settings configure SSL connection between Kibana and Elasticsearch that
    * are required when `xpack.ssl.verification_mode` in Elasticsearch is set to
@@ -314,6 +335,7 @@ export class ElasticsearchConfig {
     this.healthCheckDelay = rawConfig.healthCheck.delay;
     this.username = rawConfig.username;
     this.password = rawConfig.password;
+    this.serviceAccountToken = rawConfig.serviceAccountToken;
     this.customHeaders = rawConfig.customHeaders;
 
     const { alwaysPresentCertificate, verificationMode } = rawConfig.ssl;
diff --git a/src/core/server/elasticsearch/legacy/cluster_client.test.ts b/src/core/server/elasticsearch/legacy/cluster_client.test.ts
index 2ce19570677c5..52bc4bd45660e 100644
--- a/src/core/server/elasticsearch/legacy/cluster_client.test.ts
+++ b/src/core/server/elasticsearch/legacy/cluster_client.test.ts
@@ -101,6 +101,30 @@ describe('#callAsInternalUser', () => {
     expect(mockEsClientInstance.ping).toHaveBeenLastCalledWith(mockParams);
   });
 
+  test('sets the authorization header when a service account token is configured', async () => {
+    clusterClient = new LegacyClusterClient(
+      { apiVersion: 'es-version', serviceAccountToken: 'ABC123' } as any,
+      logger.get(),
+      'custom-type'
+    );
+
+    const mockResponse = { data: 'ping' };
+    const mockParams = { param: 'ping' };
+    mockEsClientInstance.ping.mockImplementation(function mockCall(this: any) {
+      return Promise.resolve({
+        context: this,
+        response: mockResponse,
+      });
+    });
+
+    await clusterClient.callAsInternalUser('ping', mockParams);
+
+    expect(mockEsClientInstance.ping).toHaveBeenCalledWith({
+      headers: { authorization: 'Bearer ABC123' },
+      param: 'ping',
+    });
+  });
+
   test('correctly deals with nested endpoint', async () => {
     const mockResponse = { data: 'authenticate' };
     const mockParams = { param: 'authenticate' };
@@ -355,6 +379,31 @@ describe('#asScoped', () => {
     );
   });
 
+  test('does not set the authorization header when a service account token is configured', async () => {
+    clusterClient = new LegacyClusterClient(
+      {
+        apiVersion: 'es-version',
+        requestHeadersWhitelist: ['zero'],
+        serviceAccountToken: 'ABC123',
+      } as any,
+      logger.get(),
+      'custom-type'
+    );
+
+    clusterClient.asScoped(
+      httpServerMock.createRawRequest({ headers: { zero: '0', one: '1', two: '2', three: '3' } })
+    );
+
+    const expectedHeaders = { zero: '0' };
+
+    expect(MockScopedClusterClient).toHaveBeenCalledTimes(1);
+    expect(MockScopedClusterClient).toHaveBeenCalledWith(
+      expect.any(Function),
+      expect.any(Function),
+      expectedHeaders
+    );
+  });
+
   test('both scoped and internal API caller fail if cluster client is closed', async () => {
     clusterClient.asScoped(
       httpServerMock.createRawRequest({ headers: { zero: '0', one: '1', two: '2', three: '3' } })
diff --git a/src/core/server/elasticsearch/legacy/cluster_client.ts b/src/core/server/elasticsearch/legacy/cluster_client.ts
index bdb2ca4d01b3c..6a6765b67da9f 100644
--- a/src/core/server/elasticsearch/legacy/cluster_client.ts
+++ b/src/core/server/elasticsearch/legacy/cluster_client.ts
@@ -147,6 +147,13 @@ export class LegacyClusterClient implements ILegacyClusterClient {
   ) => {
     this.assertIsNotClosed();
 
+    if (this.config.serviceAccountToken) {
+      clientParams.headers = {
+        ...clientParams.headers,
+        authorization: `Bearer ${this.config.serviceAccountToken}`,
+      };
+    }
+
     return await (callAPI.bind(null, this.client) as LegacyAPICaller)(
       endpoint,
       clientParams,
diff --git a/src/core/server/elasticsearch/legacy/elasticsearch_client_config.test.ts b/src/core/server/elasticsearch/legacy/elasticsearch_client_config.test.ts
index 6239ad270d5b5..a343c0d5d2ad1 100644
--- a/src/core/server/elasticsearch/legacy/elasticsearch_client_config.test.ts
+++ b/src/core/server/elasticsearch/legacy/elasticsearch_client_config.test.ts
@@ -333,6 +333,128 @@ describe('#auth', () => {
   });
 });
 
+describe('#serviceAccountToken', () => {
+  it('is set when #auth is true, and a token is provided', () => {
+    expect(
+      parseElasticsearchClientConfig(
+        {
+          apiVersion: 'v7.0.0',
+          customHeaders: { xsrf: 'something' },
+          sniffOnStart: true,
+          sniffOnConnectionFault: true,
+          hosts: ['https://es.local'],
+          requestHeadersWhitelist: [],
+          serviceAccountToken: 'ABC123',
+        },
+        logger.get(),
+        'custom-type',
+        { auth: true }
+      )
+    ).toMatchInlineSnapshot(`
+      Object {
+        "apiVersion": "v7.0.0",
+        "hosts": Array [
+          Object {
+            "headers": Object {
+              "x-elastic-product-origin": "kibana",
+              "xsrf": "something",
+            },
+            "host": "es.local",
+            "path": "/",
+            "port": "443",
+            "protocol": "https:",
+            "query": null,
+          },
+        ],
+        "keepAlive": true,
+        "log": [Function],
+        "serviceAccountToken": "ABC123",
+        "sniffOnConnectionFault": true,
+        "sniffOnStart": true,
+      }
+    `);
+  });
+
+  it('is not set when #auth is true, and a token is not provided', () => {
+    expect(
+      parseElasticsearchClientConfig(
+        {
+          apiVersion: 'v7.0.0',
+          customHeaders: { xsrf: 'something' },
+          sniffOnStart: true,
+          sniffOnConnectionFault: true,
+          hosts: ['https://es.local'],
+          requestHeadersWhitelist: [],
+        },
+        logger.get(),
+        'custom-type',
+        { auth: true }
+      )
+    ).toMatchInlineSnapshot(`
+      Object {
+        "apiVersion": "v7.0.0",
+        "hosts": Array [
+          Object {
+            "headers": Object {
+              "x-elastic-product-origin": "kibana",
+              "xsrf": "something",
+            },
+            "host": "es.local",
+            "path": "/",
+            "port": "443",
+            "protocol": "https:",
+            "query": null,
+          },
+        ],
+        "keepAlive": true,
+        "log": [Function],
+        "sniffOnConnectionFault": true,
+        "sniffOnStart": true,
+      }
+    `);
+  });
+
+  it('is not set when #auth is false, and a token is provided', () => {
+    expect(
+      parseElasticsearchClientConfig(
+        {
+          apiVersion: 'v7.0.0',
+          customHeaders: { xsrf: 'something' },
+          sniffOnStart: true,
+          sniffOnConnectionFault: true,
+          hosts: ['https://es.local'],
+          requestHeadersWhitelist: [],
+          serviceAccountToken: 'ABC123',
+        },
+        logger.get(),
+        'custom-type',
+        { auth: false }
+      )
+    ).toMatchInlineSnapshot(`
+      Object {
+        "apiVersion": "v7.0.0",
+        "hosts": Array [
+          Object {
+            "headers": Object {
+              "x-elastic-product-origin": "kibana",
+              "xsrf": "something",
+            },
+            "host": "es.local",
+            "path": "/",
+            "port": "443",
+            "protocol": "https:",
+            "query": null,
+          },
+        ],
+        "keepAlive": true,
+        "log": [Function],
+        "sniffOnConnectionFault": true,
+        "sniffOnStart": true,
+      }
+    `);
+  });
+});
+
 describe('#customHeaders', () => {
   test('override the default headers', () => {
     const headerKey = Object.keys(DEFAULT_HEADERS)[0];
diff --git a/src/core/server/elasticsearch/legacy/elasticsearch_client_config.ts b/src/core/server/elasticsearch/legacy/elasticsearch_client_config.ts
index d68e7635c57cb..3d81caefad457 100644
--- a/src/core/server/elasticsearch/legacy/elasticsearch_client_config.ts
+++ b/src/core/server/elasticsearch/legacy/elasticsearch_client_config.ts
@@ -35,6 +35,7 @@ export type LegacyElasticsearchClientConfig = Pick<ConfigOptions, 'keepAlive' |
     | 'hosts'
     | 'username'
     | 'password'
+    | 'serviceAccountToken'
   > & {
     pingTimeout?: ElasticsearchConfig['pingTimeout'] | ConfigOptions['pingTimeout'];
     requestTimeout?: ElasticsearchConfig['requestTimeout'] | ConfigOptions['requestTimeout'];
@@ -61,6 +62,7 @@ interface LegacyElasticsearchClientConfigOverrides {
 /** @internal */
 type ExtendedConfigOptions = ConfigOptions &
   Partial<{
+    serviceAccountToken?: string;
     ssl: Partial<{
       rejectUnauthorized: boolean;
       checkServerIdentity: typeof checkServerIdentity;
@@ -106,9 +108,14 @@ export function parseElasticsearchClientConfig(
     esClientConfig.sniffInterval = getDurationAsMs(config.sniffInterval);
   }
 
-  const needsAuth = auth !== false && config.username && config.password;
+  const needsAuth =
+    auth !== false && ((config.username && config.password) || config.serviceAccountToken);
   if (needsAuth) {
-    esClientConfig.httpAuth = `${config.username}:${config.password}`;
+    if (config.username) {
+      esClientConfig.httpAuth = `${config.username}:${config.password}`;
+    } else if (config.serviceAccountToken) {
+      esClientConfig.serviceAccountToken = config.serviceAccountToken;
+    }
   }
 
   if (Array.isArray(config.hosts)) {
diff --git a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts
index 0481e6118acb0..c8ff79351aadb 100644
--- a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts
+++ b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts
@@ -137,14 +137,15 @@ describe('migrateRawDocsSafely', () => {
     const transform = jest.fn<any, any>((doc: any) => [
       set(_.cloneDeep(doc), 'attributes.name', 'HOI!'),
     ]);
-    const task = migrateRawDocsSafely(
-      new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
-      transform,
-      [
+    const task = migrateRawDocsSafely({
+      serializer: new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
+      knownTypes: new Set(['a', 'c']),
+      migrateDoc: transform,
+      rawDocs: [
         { _id: 'a:b', _source: { type: 'a', a: { name: 'AAA' } } },
         { _id: 'c:d', _source: { type: 'c', c: { name: 'DDD' } } },
-      ]
-    );
+      ],
+    });
     const result = (await task()) as Either.Right<DocumentsTransformSuccess>;
     expect(result._tag).toEqual('Right');
     expect(result.right.processedDocs).toEqual([
@@ -181,14 +182,15 @@ describe('migrateRawDocsSafely', () => {
     const transform = jest.fn<any, any>((doc: any) => [
       set(_.cloneDeep(doc), 'attributes.name', 'TADA'),
     ]);
-    const task = migrateRawDocsSafely(
-      new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
-      transform,
-      [
+    const task = migrateRawDocsSafely({
+      serializer: new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
+      knownTypes: new Set(['a', 'c']),
+      migrateDoc: transform,
+      rawDocs: [
         { _id: 'foo:b', _source: { type: 'a', a: { name: 'AAA' } } },
         { _id: 'c:d', _source: { type: 'c', c: { name: 'DDD' } } },
-      ]
-    );
+      ],
+    });
     const result = (await task()) as Either.Left<DocumentsTransformFailed>;
     expect(transform).toHaveBeenCalledTimes(1);
     expect(result._tag).toEqual('Left');
@@ -202,11 +204,12 @@ describe('migrateRawDocsSafely', () => {
       set(_.cloneDeep(doc), 'attributes.name', 'HOI!'),
       { id: 'bar', type: 'foo', attributes: { name: 'baz' } },
     ]);
-    const task = migrateRawDocsSafely(
-      new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
-      transform,
-      [{ _id: 'a:b', _source: { type: 'a', a: { name: 'AAA' } } }]
-    );
+    const task = migrateRawDocsSafely({
+      serializer: new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
+      knownTypes: new Set(['a', 'c']),
+      migrateDoc: transform,
+      rawDocs: [{ _id: 'a:b', _source: { type: 'a', a: { name: 'AAA' } } }],
+    });
     const result = (await task()) as Either.Right<DocumentsTransformSuccess>;
     expect(result._tag).toEqual('Right');
     expect(result.right.processedDocs).toEqual([
@@ -235,11 +238,12 @@ describe('migrateRawDocsSafely', () => {
     const transform = jest.fn<any, any>((doc: any) => {
       throw new TransformSavedObjectDocumentError(new Error('error during transform'), '8.0.0');
     });
-    const task = migrateRawDocsSafely(
-      new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
-      transform,
-      [{ _id: 'a:b', _source: { type: 'a', a: { name: 'AAA' } } }] // this is the raw doc
-    );
+    const task = migrateRawDocsSafely({
+      serializer: new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
+      knownTypes: new Set(['a', 'c']),
+      migrateDoc: transform,
+      rawDocs: [{ _id: 'a:b', _source: { type: 'a', a: { name: 'AAA' } } }], // this is the raw doc
+    });
     const result = (await task()) as Either.Left<DocumentsTransformFailed>;
     expect(transform).toHaveBeenCalledTimes(1);
     expect(result._tag).toEqual('Left');
@@ -252,4 +256,43 @@ describe('migrateRawDocsSafely', () => {
       }
     `);
   });
+
+  test('skips documents of unknown types', async () => {
+    const transform = jest.fn<any, any>((doc: any) => [
+      set(_.cloneDeep(doc), 'attributes.name', 'HOI!'),
+    ]);
+    const task = migrateRawDocsSafely({
+      serializer: new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
+      knownTypes: new Set(['a']),
+      migrateDoc: transform,
+      rawDocs: [
+        { _id: 'a:b', _source: { type: 'a', a: { name: 'AAA' } } },
+        { _id: 'c:d', _source: { type: 'c', c: { name: 'DDD' } } },
+      ],
+    });
+
+    const result = (await task()) as Either.Right<DocumentsTransformSuccess>;
+    expect(result._tag).toEqual('Right');
+    expect(result.right.processedDocs).toEqual([
+      {
+        _id: 'a:b',
+        _source: { type: 'a', a: { name: 'HOI!' }, migrationVersion: {}, references: [] },
+      },
+      {
+        _id: 'c:d',
+        // name field is not migrated on unknown type
+        _source: { type: 'c', c: { name: 'DDD' } },
+      },
+    ]);
+
+    const obj1 = {
+      id: 'b',
+      type: 'a',
+      attributes: { name: 'AAA' },
+      migrationVersion: {},
+      references: [],
+    };
+    expect(transform).toHaveBeenCalledTimes(1);
+    expect(transform).toHaveBeenNthCalledWith(1, obj1);
+  });
 });
diff --git a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts
index 461ae1df6bc3d..65ea21a6778d5 100644
--- a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts
+++ b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts
@@ -81,6 +81,13 @@ export async function migrateRawDocs(
   return processedDocs;
 }
 
+interface MigrateRawDocsSafelyDeps {
+  serializer: SavedObjectsSerializer;
+  knownTypes: ReadonlySet<string>;
+  migrateDoc: MigrateAndConvertFn;
+  rawDocs: SavedObjectsRawDoc[];
+}
+
 /**
  * Applies the specified migration function to every saved object document provided
  * and converts the saved object to a raw document.
@@ -88,11 +95,15 @@ export async function migrateRawDocs(
  * for which the transformation function failed.
  * @returns {TaskEither.TaskEither<DocumentsTransformFailed, DocumentsTransformSuccess>}
  */
-export function migrateRawDocsSafely(
-  serializer: SavedObjectsSerializer,
-  migrateDoc: MigrateAndConvertFn,
-  rawDocs: SavedObjectsRawDoc[]
-): TaskEither.TaskEither<DocumentsTransformFailed, DocumentsTransformSuccess> {
+export function migrateRawDocsSafely({
+  serializer,
+  knownTypes,
+  migrateDoc,
+  rawDocs,
+}: MigrateRawDocsSafelyDeps): TaskEither.TaskEither<
+  DocumentsTransformFailed,
+  DocumentsTransformSuccess
+> {
   return async () => {
     const migrateDocNonBlocking = transformNonBlocking(migrateDoc);
     const processedDocs: SavedObjectsRawDoc[] = [];
@@ -100,7 +111,10 @@ export function migrateRawDocsSafely(
     const corruptSavedObjectIds: string[] = [];
     const options = { namespaceTreatment: 'lax' as const };
     for (const raw of rawDocs) {
-      if (serializer.isRawSavedObject(raw, options)) {
+      // Do not transform documents of unknown types
+      if (raw?._source?.type && !knownTypes.has(raw._source.type)) {
+        processedDocs.push(raw);
+      } else if (serializer.isRawSavedObject(raw, options)) {
         try {
           const savedObject = convertToRawAddMigrationVersion(raw, options, serializer);
           processedDocs.push(
diff --git a/src/core/server/saved_objects/migrations/kibana/kibana_migrator.ts b/src/core/server/saved_objects/migrations/kibana/kibana_migrator.ts
index 2d0282e6d2632..572b2934e49b8 100644
--- a/src/core/server/saved_objects/migrations/kibana/kibana_migrator.ts
+++ b/src/core/server/saved_objects/migrations/kibana/kibana_migrator.ts
@@ -184,11 +184,12 @@ export class KibanaMigrator {
               logger: this.log,
               preMigrationScript: indexMap[index].script,
               transformRawDocs: (rawDocs: SavedObjectsRawDoc[]) =>
-                migrateRawDocsSafely(
-                  this.serializer,
-                  this.documentMigrator.migrateAndConvert,
-                  rawDocs
-                ),
+                migrateRawDocsSafely({
+                  serializer: this.serializer,
+                  knownTypes: new Set(this.typeRegistry.getAllTypes().map((t) => t.name)),
+                  migrateDoc: this.documentMigrator.migrateAndConvert,
+                  rawDocs,
+                }),
               migrationVersionPerType: this.documentMigrator.migrationVersion,
               indexPrefix: index,
               migrationsConfig: this.soMigrationsConfig,
diff --git a/src/core/server/saved_objects/migrationsv2/actions/check_for_unknown_docs.test.ts b/src/core/server/saved_objects/migrationsv2/actions/check_for_unknown_docs.test.ts
index 62a619ef447fa..a52cb2a922968 100644
--- a/src/core/server/saved_objects/migrationsv2/actions/check_for_unknown_docs.test.ts
+++ b/src/core/server/saved_objects/migrationsv2/actions/check_for_unknown_docs.test.ts
@@ -97,9 +97,12 @@ describe('checkForUnknownDocs', () => {
     const result = await task();
 
     expect(Either.isRight(result)).toBe(true);
+    expect((result as Either.Right<any>).right).toEqual({
+      unknownDocs: [],
+    });
   });
 
-  it('resolves with `Either.left` when unknown docs are found', async () => {
+  it('resolves with `Either.right` when unknown docs are found', async () => {
     const client = elasticsearchClientMock.createInternalClient(
       elasticsearchClientMock.createSuccessTransportRequestPromise({
         hits: {
@@ -120,9 +123,8 @@ describe('checkForUnknownDocs', () => {
 
     const result = await task();
 
-    expect(Either.isLeft(result)).toBe(true);
-    expect((result as Either.Left<any>).left).toEqual({
-      type: 'unknown_docs_found',
+    expect(Either.isRight(result)).toBe(true);
+    expect((result as Either.Right<any>).right).toEqual({
       unknownDocs: [
         { id: '12', type: 'foo' },
         { id: '14', type: 'bar' },
@@ -148,9 +150,8 @@ describe('checkForUnknownDocs', () => {
 
     const result = await task();
 
-    expect(Either.isLeft(result)).toBe(true);
-    expect((result as Either.Left<any>).left).toEqual({
-      type: 'unknown_docs_found',
+    expect(Either.isRight(result)).toBe(true);
+    expect((result as Either.Right<any>).right).toEqual({
       unknownDocs: [{ id: '12', type: 'unknown' }],
     });
   });
diff --git a/src/core/server/saved_objects/migrationsv2/actions/check_for_unknown_docs.ts b/src/core/server/saved_objects/migrationsv2/actions/check_for_unknown_docs.ts
index 7cc1c26a2ea8b..e3d72fbdf866f 100644
--- a/src/core/server/saved_objects/migrationsv2/actions/check_for_unknown_docs.ts
+++ b/src/core/server/saved_objects/migrationsv2/actions/check_for_unknown_docs.ts
@@ -32,7 +32,6 @@ export interface CheckForUnknownDocsFoundDoc {
 
 /** @internal */
 export interface UnknownDocsFound {
-  type: 'unknown_docs_found';
   unknownDocs: CheckForUnknownDocsFoundDoc[];
 }
 
@@ -42,8 +41,8 @@ export const checkForUnknownDocs = ({
   unusedTypesQuery,
   knownTypes,
 }: CheckForUnknownDocsParams): TaskEither.TaskEither<
-  RetryableEsClientError | UnknownDocsFound,
-  {}
+  RetryableEsClientError,
+  UnknownDocsFound
 > => () => {
   const query = createUnknownDocQuery(unusedTypesQuery, knownTypes);
 
@@ -56,14 +55,9 @@ export const checkForUnknownDocs = ({
     })
     .then((response) => {
       const { hits } = response.body.hits;
-      if (hits.length) {
-        return Either.left({
-          type: 'unknown_docs_found' as const,
-          unknownDocs: hits.map((hit) => ({ id: hit._id, type: hit._source?.type ?? 'unknown' })),
-        });
-      } else {
-        return Either.right({});
-      }
+      return Either.right({
+        unknownDocs: hits.map((hit) => ({ id: hit._id, type: hit._source?.type ?? 'unknown' })),
+      });
     })
     .catch(catchRetryableEsClientErrors);
 };
diff --git a/src/core/server/saved_objects/migrationsv2/actions/index.ts b/src/core/server/saved_objects/migrationsv2/actions/index.ts
index 8e4584970f138..6bfcddfe1f6de 100644
--- a/src/core/server/saved_objects/migrationsv2/actions/index.ts
+++ b/src/core/server/saved_objects/migrationsv2/actions/index.ts
@@ -80,7 +80,6 @@ export type {
 } from './update_and_pickup_mappings';
 export { updateAndPickupMappings } from './update_and_pickup_mappings';
 
-import type { UnknownDocsFound } from './check_for_unknown_docs';
 export type {
   CheckForUnknownDocsParams,
   UnknownDocsFound,
@@ -131,7 +130,6 @@ export interface ActionErrorTypeMap {
   alias_not_found_exception: AliasNotFound;
   remove_index_not_a_concrete_index: RemoveIndexNotAConcreteIndex;
   documents_transform_failed: DocumentsTransformFailed;
-  unknown_docs_found: UnknownDocsFound;
 }
 
 /**
diff --git a/src/core/server/saved_objects/migrationsv2/integration_tests/migration_7_13_0_unknown_types.test.ts b/src/core/server/saved_objects/migrationsv2/integration_tests/migration_7_13_0_unknown_types.test.ts
index c5e302adbe903..a30b3d291e7ec 100644
--- a/src/core/server/saved_objects/migrationsv2/integration_tests/migration_7_13_0_unknown_types.test.ts
+++ b/src/core/server/saved_objects/migrationsv2/integration_tests/migration_7_13_0_unknown_types.test.ts
@@ -7,42 +7,31 @@
  */
 
 import Path from 'path';
-import Fs from 'fs';
-import Util from 'util';
+import fs from 'fs/promises';
 import { estypes } from '@elastic/elasticsearch';
 import * as kbnTestServer from '../../../../test_helpers/kbn_server';
 import { Root } from '../../../root';
+import JSON5 from 'json5';
+import { ElasticsearchClient } from '../../../elasticsearch';
 
 const logFilePath = Path.join(__dirname, '7_13_unknown_types_test.log');
 
-const asyncUnlink = Util.promisify(Fs.unlink);
-
 async function removeLogFile() {
   // ignore errors if it doesn't exist
-  await asyncUnlink(logFilePath).catch(() => void 0);
+  await fs.unlink(logFilePath).catch(() => void 0);
 }
 
 describe('migration v2', () => {
   let esServer: kbnTestServer.TestElasticsearchUtils;
   let root: Root;
+  let startES: () => Promise<kbnTestServer.TestElasticsearchUtils>;
 
   beforeAll(async () => {
     await removeLogFile();
   });
 
-  afterAll(async () => {
-    if (root) {
-      await root.shutdown();
-    }
-    if (esServer) {
-      await esServer.stop();
-    }
-
-    await new Promise((resolve) => setTimeout(resolve, 10000));
-  });
-
-  it('migrates the documents to the highest version', async () => {
-    const { startES } = kbnTestServer.createTestServers({
+  beforeEach(() => {
+    ({ startES } = kbnTestServer.createTestServers({
       adjustTimeout: (t: number) => jest.setTimeout(t),
       settings: {
         es: {
@@ -53,50 +42,155 @@ describe('migration v2', () => {
           dataArchive: Path.join(__dirname, 'archives', '7.13.0_with_unknown_so.zip'),
         },
       },
-    });
+    }));
+  });
+
+  afterEach(async () => {
+    if (root) {
+      await root.shutdown();
+    }
+    if (esServer) {
+      await esServer.stop();
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, 10000));
+  });
 
+  it('logs a warning and completes the migration with unknown docs retained', async () => {
     root = createRoot();
+    esServer = await startES();
+    await root.setup();
+    await root.start();
+
+    const logFileContent = await fs.readFile(logFilePath, 'utf-8');
+    const records = logFileContent
+      .split('\n')
+      .filter(Boolean)
+      .map((str) => JSON5.parse(str));
+
+    const unknownDocsWarningLog = records.find((rec) =>
+      rec.message.startsWith(`[.kibana] CHECK_UNKNOWN_DOCUMENTS`)
+    );
+
+    expect(
+      unknownDocsWarningLog.message.startsWith(
+        '[.kibana] CHECK_UNKNOWN_DOCUMENTS Upgrades will fail for 8.0+ because documents were found for unknown saved ' +
+          'object types. To ensure that upgrades will succeed in the future, either re-enable plugins or delete ' +
+          'these documents from the ".kibana_8.0.0_001" index after the current upgrade completes.'
+      )
+    ).toBeTruthy();
+
+    const unknownDocs = [
+      { type: 'space', id: 'space:default' },
+      { type: 'space', id: 'space:first' },
+      { type: 'space', id: 'space:second' },
+      { type: 'space', id: 'space:third' },
+      { type: 'space', id: 'space:forth' },
+      { type: 'space', id: 'space:fifth' },
+      { type: 'space', id: 'space:sixth' },
+      { type: 'foo', id: 'P2SQfHkBs3dBRGh--No5' },
+      { type: 'foo', id: 'QGSZfHkBs3dBRGh-ANoD' },
+      { type: 'foo', id: 'QWSZfHkBs3dBRGh-hNob' },
+    ];
+
+    unknownDocs.forEach(({ id, type }) => {
+      expect(unknownDocsWarningLog.message).toEqual(
+        expect.stringContaining(`- "${id}" (type: "${type}")`)
+      );
+    });
+
+    const client: ElasticsearchClient = esServer.es.getClient();
+    const { body: response } = await client.indices.getSettings({ index: '.kibana_8.0.0_001' });
+    const settings = response['.kibana_8.0.0_001']
+      .settings as estypes.IndicesIndexStatePrefixedSettings;
+    expect(settings.index).not.toBeUndefined();
+    expect(settings.index!.blocks?.write).not.toEqual('true');
+
+    // Ensure that documents for unknown types were preserved in target index in an unmigrated state
+    const spaceDocs = await fetchDocs(client, '.kibana_8.0.0_001', 'space');
+    expect(spaceDocs.map((s) => s.id)).toEqual(
+      expect.arrayContaining([
+        'space:default',
+        'space:first',
+        'space:second',
+        'space:third',
+        'space:forth',
+        'space:fifth',
+        'space:sixth',
+      ])
+    );
+    spaceDocs.forEach((d) => {
+      expect(d.migrationVersion.space).toEqual('6.6.0');
+      expect(d.coreMigrationVersion).toEqual('7.13.0');
+    });
+    const fooDocs = await fetchDocs(client, '.kibana_8.0.0_001', 'foo');
+    expect(fooDocs.map((f) => f.id)).toEqual(
+      expect.arrayContaining([
+        'P2SQfHkBs3dBRGh--No5',
+        'QGSZfHkBs3dBRGh-ANoD',
+        'QWSZfHkBs3dBRGh-hNob',
+      ])
+    );
+    fooDocs.forEach((d) => {
+      expect(d.migrationVersion.foo).toEqual('7.13.0');
+      expect(d.coreMigrationVersion).toEqual('7.13.0');
+    });
+  });
 
+  it('migrates outdated documents when types are re-enabled', async () => {
+    // Start kibana with foo and space types disabled
+    root = createRoot();
     esServer = await startES();
     await root.setup();
+    await root.start();
 
-    try {
-      await root.start();
-    } catch (err) {
-      const errorMessage = err.message;
-
-      expect(
-        errorMessage.startsWith(
-          'Unable to complete saved object migrations for the [.kibana] index: Migration failed because documents ' +
-            'were found for unknown saved object types. To proceed with the migration, please delete these documents from the ' +
-            '".kibana_7.13.0_001" index.'
-        )
-      ).toBeTruthy();
-
-      const unknownDocs = [
-        { type: 'space', id: 'space:default' },
-        { type: 'space', id: 'space:first' },
-        { type: 'space', id: 'space:second' },
-        { type: 'space', id: 'space:third' },
-        { type: 'space', id: 'space:forth' },
-        { type: 'space', id: 'space:fifth' },
-        { type: 'space', id: 'space:sixth' },
-        { type: 'foo', id: 'P2SQfHkBs3dBRGh--No5' },
-        { type: 'foo', id: 'QGSZfHkBs3dBRGh-ANoD' },
-        { type: 'foo', id: 'QWSZfHkBs3dBRGh-hNob' },
-      ];
-
-      unknownDocs.forEach(({ id, type }) => {
-        expect(errorMessage).toEqual(expect.stringContaining(`- "${id}" (type: "${type}")`));
-      });
-
-      const client = esServer.es.getClient();
-      const { body: response } = await client.indices.getSettings({ index: '.kibana_7.13.0_001' });
-      const settings = response['.kibana_7.13.0_001']
-        .settings as estypes.IndicesIndexStatePrefixedSettings;
-      expect(settings.index).not.toBeUndefined();
-      expect(settings.index!.blocks?.write).not.toEqual('true');
-    }
+    // Shutdown and start Kibana again with space type registered to ensure space docs get migrated
+    await root.shutdown();
+    root = createRoot();
+    const coreSetup = await root.setup();
+    coreSetup.savedObjects.registerType({
+      name: 'space',
+      hidden: false,
+      mappings: { properties: {} },
+      namespaceType: 'agnostic',
+      migrations: {
+        '6.6.0': (d) => d,
+        '8.0.0': (d) => d,
+      },
+    });
+    await root.start();
+
+    const client: ElasticsearchClient = esServer.es.getClient();
+    const spacesDocsMigrated = await fetchDocs(client, '.kibana_8.0.0_001', 'space');
+    expect(spacesDocsMigrated.map((s) => s.id)).toEqual(
+      expect.arrayContaining([
+        'space:default',
+        'space:first',
+        'space:second',
+        'space:third',
+        'space:forth',
+        'space:fifth',
+        'space:sixth',
+      ])
+    );
+    spacesDocsMigrated.forEach((d) => {
+      expect(d.migrationVersion.space).toEqual('8.0.0'); // should be migrated
+      expect(d.coreMigrationVersion).toEqual('8.0.0');
+    });
+
+    // Make sure unmigrated foo docs are also still there in an unmigrated state
+    const fooDocsUnmigrated = await fetchDocs(client, '.kibana_8.0.0_001', 'foo');
+    expect(fooDocsUnmigrated.map((f) => f.id)).toEqual(
+      expect.arrayContaining([
+        'P2SQfHkBs3dBRGh--No5',
+        'QGSZfHkBs3dBRGh-ANoD',
+        'QWSZfHkBs3dBRGh-hNob',
+      ])
+    );
+    fooDocsUnmigrated.forEach((d) => {
+      expect(d.migrationVersion.foo).toEqual('7.13.0'); // should still not be migrated
+      expect(d.coreMigrationVersion).toEqual('7.13.0');
+    });
   });
 });
 
@@ -131,3 +225,26 @@ function createRoot() {
     }
   );
 }
+
+async function fetchDocs(esClient: ElasticsearchClient, index: string, type: string) {
+  const { body } = await esClient.search<any>({
+    index,
+    size: 10000,
+    body: {
+      query: {
+        bool: {
+          should: [
+            {
+              term: { type },
+            },
+          ],
+        },
+      },
+    },
+  });
+
+  return body.hits.hits.map((h) => ({
+    ...h._source,
+    id: h._id,
+  }));
+}
diff --git a/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.ts b/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.ts
index 8443f837a7f1d..cd42d4077695e 100644
--- a/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.ts
+++ b/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.ts
@@ -52,6 +52,8 @@ const logStateTransition = (
       switch (level) {
         case 'error':
           return logger.error(logMessagePrefix + message);
+        case 'warning':
+          return logger.warn(logMessagePrefix + message);
         case 'info':
           return logger.info(logMessagePrefix + message);
         default:
diff --git a/src/core/server/saved_objects/migrationsv2/model/extract_errors.test.ts b/src/core/server/saved_objects/migrationsv2/model/extract_errors.test.ts
index a028c40ca6597..c2daadcd342ac 100644
--- a/src/core/server/saved_objects/migrationsv2/model/extract_errors.test.ts
+++ b/src/core/server/saved_objects/migrationsv2/model/extract_errors.test.ts
@@ -25,7 +25,7 @@ describe('extractUnknownDocFailureReason', () => {
         '.kibana_15'
       )
     ).toMatchInlineSnapshot(`
-      "Migration failed because documents were found for unknown saved object types. To proceed with the migration, please delete these documents from the \\".kibana_15\\" index.
+      "Upgrades will fail for 8.0+ because documents were found for unknown saved object types. To ensure that upgrades will succeed in the future, either re-enable plugins or delete these documents from the \\".kibana_15\\" index after the current upgrade completes.
       The documents with unknown types are:
       - \\"unknownType:12\\" (type: \\"unknownType\\")
       - \\"anotherUnknownType:42\\" (type: \\"anotherUnknownType\\")
diff --git a/src/core/server/saved_objects/migrationsv2/model/extract_errors.ts b/src/core/server/saved_objects/migrationsv2/model/extract_errors.ts
index cc6fe7bad3ca7..082e6344afffc 100644
--- a/src/core/server/saved_objects/migrationsv2/model/extract_errors.ts
+++ b/src/core/server/saved_objects/migrationsv2/model/extract_errors.ts
@@ -38,15 +38,16 @@ export function extractTransformFailuresReason(
 
 export function extractUnknownDocFailureReason(
   unknownDocs: CheckForUnknownDocsFoundDoc[],
-  sourceIndex: string
+  targetIndex: string
 ): string {
   return (
-    `Migration failed because documents were found for unknown saved object types. ` +
-    `To proceed with the migration, please delete these documents from the "${sourceIndex}" index.\n` +
+    `Upgrades will fail for 8.0+ because documents were found for unknown saved object types. ` +
+    `To ensure that upgrades will succeed in the future, either re-enable plugins or delete these documents from the ` +
+    `"${targetIndex}" index after the current upgrade completes.\n` +
     `The documents with unknown types are:\n` +
     unknownDocs.map((doc) => `- "${doc.id}" (type: "${doc.type}")\n`).join('') +
     `You can delete them using the following command:\n` +
-    `curl -X POST "{elasticsearch}/${sourceIndex}/_bulk?pretty" -H 'Content-Type: application/json' -d'\n` +
+    `curl -X POST "{elasticsearch}/${targetIndex}/_bulk?pretty" -H 'Content-Type: application/json' -d'\n` +
     unknownDocs.map((doc) => `{ "delete" : { "_id" : "${doc.id}" } }\n`).join('') +
     `'`
   );
diff --git a/src/core/server/saved_objects/migrationsv2/model/model.test.ts b/src/core/server/saved_objects/migrationsv2/model/model.test.ts
index 136709d1b874f..3058f586efb0c 100644
--- a/src/core/server/saved_objects/migrationsv2/model/model.test.ts
+++ b/src/core/server/saved_objects/migrationsv2/model/model.test.ts
@@ -715,7 +715,7 @@ describe('migrations v2 model', () => {
         },
       } as const;
 
-      test('CHECK_UNKNOWN_DOCUMENTS -> SET_SOURCE_WRITE_BLOCK if action succeeds', () => {
+      test('CHECK_UNKNOWN_DOCUMENTS -> SET_SOURCE_WRITE_BLOCK if action succeeds and no unknown docs are found', () => {
         const checkUnknownDocumentsSourceState: CheckUnknownDocumentsState = {
           ...baseState,
           controlState: 'CHECK_UNKNOWN_DOCUMENTS',
@@ -723,7 +723,7 @@ describe('migrations v2 model', () => {
           sourceIndexMappings: mappingsWithUnknownType,
         };
 
-        const res: ResponseType<'CHECK_UNKNOWN_DOCUMENTS'> = Either.right({});
+        const res: ResponseType<'CHECK_UNKNOWN_DOCUMENTS'> = Either.right({ unknownDocs: [] });
         const newState = model(checkUnknownDocumentsSourceState, res);
         expect(newState.controlState).toEqual('SET_SOURCE_WRITE_BLOCK');
 
@@ -758,9 +758,12 @@ describe('migrations v2 model', () => {
             },
           }
         `);
+
+        // No log message gets appended
+        expect(newState.logs).toEqual([]);
       });
 
-      test('CHECK_UNKNOWN_DOCUMENTS -> FATAL if action fails and unknown docs were found', () => {
+      test('CHECK_UNKNOWN_DOCUMENTS -> SET_SOURCE_WRITE_BLOCK and adds log if action succeeds and unknown docs were found', () => {
         const checkUnknownDocumentsSourceState: CheckUnknownDocumentsState = {
           ...baseState,
           controlState: 'CHECK_UNKNOWN_DOCUMENTS',
@@ -768,20 +771,51 @@ describe('migrations v2 model', () => {
           sourceIndexMappings: mappingsWithUnknownType,
         };
 
-        const res: ResponseType<'CHECK_UNKNOWN_DOCUMENTS'> = Either.left({
-          type: 'unknown_docs_found',
+        const res: ResponseType<'CHECK_UNKNOWN_DOCUMENTS'> = Either.right({
           unknownDocs: [
             { id: 'dashboard:12', type: 'dashboard' },
             { id: 'foo:17', type: 'foo' },
           ],
         });
         const newState = model(checkUnknownDocumentsSourceState, res);
-        expect(newState.controlState).toEqual('FATAL');
+        expect(newState.controlState).toEqual('SET_SOURCE_WRITE_BLOCK');
 
         expect(newState).toMatchObject({
-          controlState: 'FATAL',
-          reason: expect.stringContaining(
-            'Migration failed because documents were found for unknown saved object types'
+          controlState: 'SET_SOURCE_WRITE_BLOCK',
+          sourceIndex: Option.some('.kibana_3'),
+          targetIndex: '.kibana_7.11.0_001',
+        });
+
+        // This snapshot asserts that we disable the unknown saved object
+        // type. Because it's mappings are disabled, we also don't copy the
+        // `_meta.migrationMappingPropertyHashes` for the disabled type.
+        expect(newState.targetIndexMappings).toMatchInlineSnapshot(`
+          Object {
+            "_meta": Object {
+              "migrationMappingPropertyHashes": Object {
+                "new_saved_object_type": "4a11183eee21e6fbad864f7a30b39ad0",
+              },
+            },
+            "properties": Object {
+              "disabled_saved_object_type": Object {
+                "dynamic": false,
+                "properties": Object {},
+              },
+              "new_saved_object_type": Object {
+                "properties": Object {
+                  "value": Object {
+                    "type": "text",
+                  },
+                },
+              },
+            },
+          }
+        `);
+
+        expect(newState.logs[0]).toMatchObject({
+          level: 'warning',
+          message: expect.stringContaining(
+            'Upgrades will fail for 8.0+ because documents were found for unknown saved object types'
           ),
         });
       });
diff --git a/src/core/server/saved_objects/migrationsv2/model/model.ts b/src/core/server/saved_objects/migrationsv2/model/model.ts
index b28e4e3024380..a78457fa891f7 100644
--- a/src/core/server/saved_objects/migrationsv2/model/model.ts
+++ b/src/core/server/saved_objects/migrationsv2/model/model.ts
@@ -10,7 +10,7 @@ import * as Either from 'fp-ts/lib/Either';
 import * as Option from 'fp-ts/lib/Option';
 
 import { AliasAction, isLeftTypeof } from '../actions';
-import { AllActionStates, State } from '../types';
+import { AllActionStates, MigrationLog, State } from '../types';
 import type { ResponseType } from '../next';
 import { disableUnknownTypeMappingFields } from '../../migrations/core/migration_context';
 import {
@@ -318,6 +318,7 @@ export const model = (currentState: State, resW: ResponseType<AllActionStates>):
     }
   } else if (stateP.controlState === 'CHECK_UNKNOWN_DOCUMENTS') {
     const res = resW as ExcludeRetryableEsError<ResponseType<typeof stateP.controlState>>;
+
     if (Either.isRight(res)) {
       const source = stateP.sourceIndex;
       const target = stateP.versionIndex;
@@ -336,17 +337,24 @@ export const model = (currentState: State, resW: ResponseType<AllActionStates>):
           { add: { index: target, alias: stateP.versionAlias } },
           { remove_index: { index: stateP.tempIndex } },
         ]),
+
+        logs: [
+          ...stateP.logs,
+          ...(res.right.unknownDocs.length > 0
+            ? ([
+                {
+                  level: 'warning',
+                  message: `CHECK_UNKNOWN_DOCUMENTS ${extractUnknownDocFailureReason(
+                    res.right.unknownDocs,
+                    target
+                  )}`,
+                },
+              ] as MigrationLog[])
+            : []),
+        ],
       };
     } else {
-      if (isLeftTypeof(res.left, 'unknown_docs_found')) {
-        return {
-          ...stateP,
-          controlState: 'FATAL',
-          reason: extractUnknownDocFailureReason(res.left.unknownDocs, stateP.sourceIndex.value),
-        };
-      } else {
-        return throwBadResponse(stateP, res.left);
-      }
+      return throwBadResponse(stateP, res);
     }
   } else if (stateP.controlState === 'SET_SOURCE_WRITE_BLOCK') {
     const res = resW as ExcludeRetryableEsError<ResponseType<typeof stateP.controlState>>;
diff --git a/src/core/server/saved_objects/migrationsv2/types.ts b/src/core/server/saved_objects/migrationsv2/types.ts
index ed361a710ac99..576e3a4412184 100644
--- a/src/core/server/saved_objects/migrationsv2/types.ts
+++ b/src/core/server/saved_objects/migrationsv2/types.ts
@@ -19,7 +19,7 @@ import {
   DocumentsTransformSuccess,
 } from '../migrations/core/migrate_raw_docs';
 
-export type MigrationLogLevel = 'error' | 'info';
+export type MigrationLogLevel = 'error' | 'info' | 'warning';
 
 export interface MigrationLog {
   level: MigrationLogLevel;
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index ed55c6e3d09cb..65ea082c9d8a8 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -345,6 +345,7 @@ export const config: {
             hosts: Type<string | string[]>;
             username: Type<string | undefined>;
             password: Type<string | undefined>;
+            serviceAccountToken: Type<string | undefined>;
             requestHeadersWhitelist: Type<string | string[]>;
             customHeaders: Type<Record<string, string>>;
             shardTimeout: Type<import("moment").Duration>;
@@ -948,7 +949,7 @@ export type ElasticsearchClient = Omit<KibanaClient, 'connectionPool' | 'transpo
 };
 
 // @public
-export type ElasticsearchClientConfig = Pick<ElasticsearchConfig, 'customHeaders' | 'sniffOnStart' | 'sniffOnConnectionFault' | 'requestHeadersWhitelist' | 'sniffInterval' | 'hosts' | 'username' | 'password'> & {
+export type ElasticsearchClientConfig = Pick<ElasticsearchConfig, 'customHeaders' | 'sniffOnStart' | 'sniffOnConnectionFault' | 'requestHeadersWhitelist' | 'sniffInterval' | 'hosts' | 'username' | 'password' | 'serviceAccountToken'> & {
     pingTimeout?: ElasticsearchConfig['pingTimeout'] | ClientOptions['pingTimeout'];
     requestTimeout?: ElasticsearchConfig['requestTimeout'] | ClientOptions['requestTimeout'];
     ssl?: Partial<ElasticsearchConfig['ssl']>;
@@ -968,6 +969,7 @@ export class ElasticsearchConfig {
     readonly pingTimeout: Duration;
     readonly requestHeadersWhitelist: string[];
     readonly requestTimeout: Duration;
+    readonly serviceAccountToken?: string;
     readonly shardTimeout: Duration;
     readonly sniffInterval: false | Duration;
     readonly sniffOnConnectionFault: boolean;
@@ -1675,7 +1677,7 @@ export class LegacyClusterClient implements ILegacyClusterClient {
     }
 
 // @public @deprecated (undocumented)
-export type LegacyElasticsearchClientConfig = Pick<ConfigOptions, 'keepAlive' | 'log' | 'plugins'> & Pick<ElasticsearchConfig, 'apiVersion' | 'customHeaders' | 'requestHeadersWhitelist' | 'sniffOnStart' | 'sniffOnConnectionFault' | 'hosts' | 'username' | 'password'> & {
+export type LegacyElasticsearchClientConfig = Pick<ConfigOptions, 'keepAlive' | 'log' | 'plugins'> & Pick<ElasticsearchConfig, 'apiVersion' | 'customHeaders' | 'requestHeadersWhitelist' | 'sniffOnStart' | 'sniffOnConnectionFault' | 'hosts' | 'username' | 'password' | 'serviceAccountToken'> & {
     pingTimeout?: ElasticsearchConfig['pingTimeout'] | ConfigOptions['pingTimeout'];
     requestTimeout?: ElasticsearchConfig['requestTimeout'] | ConfigOptions['requestTimeout'];
     sniffInterval?: ElasticsearchConfig['sniffInterval'] | ConfigOptions['sniffInterval'];
diff --git a/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker b/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
index 39a7665f1ce5e..c7a129418765b 100755
--- a/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
+++ b/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
@@ -51,6 +51,7 @@ kibana_vars=(
     elasticsearch.pingTimeout
     elasticsearch.requestHeadersWhitelist
     elasticsearch.requestTimeout
+    elasticsearch.serviceAccountToken
     elasticsearch.shardTimeout
     elasticsearch.sniffInterval
     elasticsearch.sniffOnConnectionFault
diff --git a/src/dev/precommit_hook/casing_check_config.js b/src/dev/precommit_hook/casing_check_config.js
index ba18c085b649d..57ae640da3c84 100644
--- a/src/dev/precommit_hook/casing_check_config.js
+++ b/src/dev/precommit_hook/casing_check_config.js
@@ -77,7 +77,11 @@ export const IGNORE_FILE_GLOBS = [
  *
  * @type {Array}
  */
-export const KEBAB_CASE_DIRECTORY_GLOBS = ['packages/*', 'x-pack'];
+export const KEBAB_CASE_DIRECTORY_GLOBS = [
+  'packages/*',
+  'x-pack',
+  'packages/kbn-optimizer/src/__fixtures__/mock_repo/packages/kbn-ui-shared-deps',
+];
 
 /**
  * These patterns are matched against directories and indicate
diff --git a/src/plugins/console/server/lib/spec_definitions/js/ingest.ts b/src/plugins/console/server/lib/spec_definitions/js/ingest.ts
index 2ac8d2cb87ccc..5ffae9d7be23e 100644
--- a/src/plugins/console/server/lib/spec_definitions/js/ingest.ts
+++ b/src/plugins/console/server/lib/spec_definitions/js/ingest.ts
@@ -179,6 +179,29 @@ const dropProcessorDefinition = {
   },
 };
 
+// Based on https://www.elastic.co/guide/en/elasticsearch/reference/master/enrich-processor.html
+const enrichProcessorDefinition = {
+  enrich: {
+    __template: {
+      policy_name: '',
+      field: '',
+      target_field: '',
+    },
+    policy_name: '',
+    field: '',
+    target_field: '',
+    ignore_missing: {
+      __one_of: [false, true],
+    },
+    override: {
+      __one_of: [true, false],
+    },
+    max_matches: 1,
+    shape_relation: 'INTERSECTS',
+    ...commonPipelineParams,
+  },
+};
+
 // Based on https://www.elastic.co/guide/en/elasticsearch/reference/master/fail-processor.html
 const failProcessorDefinition = {
   fail: {
@@ -279,13 +302,26 @@ const inferenceProcessorDefinition = {
   inference: {
     __template: {
       model_id: '',
-      field_map: {},
       inference_config: {},
+      field_mappings: {},
     },
-    model_id: '',
-    field_map: {},
-    inference_config: {},
     target_field: '',
+    model_id: '',
+    field_mappings: {
+      __template: {},
+    },
+    inference_config: {
+      regression: {
+        __template: {},
+        results_field: '',
+      },
+      classification: {
+        __template: {},
+        results_field: '',
+        num_top_classes: 2,
+        top_classes_results_field: '',
+      },
+    },
     ...commonPipelineParams,
   },
 };
@@ -530,6 +566,7 @@ const processorDefinition = {
     dissectProcessorDefinition,
     dotExpanderProcessorDefinition,
     dropProcessorDefinition,
+    enrichProcessorDefinition,
     failProcessorDefinition,
     foreachProcessorDefinition,
     geoipProcessorDefinition,
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/async_search.delete.json b/src/plugins/console/server/lib/spec_definitions/json/generated/async_search.delete.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/async_search.delete.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/async_search.delete.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/async_search.get.json b/src/plugins/console/server/lib/spec_definitions/json/generated/async_search.get.json
similarity index 88%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/async_search.get.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/async_search.get.json
index 09f4520d580e3..3fb1f3da6fdf7 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/async_search.get.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/async_search.get.json
@@ -1,7 +1,7 @@
 {
   "async_search.get": {
     "url_params": {
-      "wait_for_completion": "",
+      "wait_for_completion_timeout": "",
       "keep_alive": "",
       "typed_keys": "__flag__"
     },
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/async_search.status.json b/src/plugins/console/server/lib/spec_definitions/json/generated/async_search.status.json
new file mode 100644
index 0000000000000..f2aef917ea23d
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/async_search.status.json
@@ -0,0 +1,11 @@
+{
+  "async_search.status": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_async_search/status/{id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/async-search.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/async_search.submit.json b/src/plugins/console/server/lib/spec_definitions/json/generated/async_search.submit.json
similarity index 92%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/async_search.submit.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/async_search.submit.json
index 83fb7c0fe75ad..635436bdb167f 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/async_search.submit.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/async_search.submit.json
@@ -1,8 +1,8 @@
 {
   "async_search.submit": {
     "url_params": {
-      "wait_for_completion": "",
-      "clean_on_completion": "__flag__",
+      "wait_for_completion_timeout": "",
+      "keep_on_completion": "__flag__",
       "keep_alive": "",
       "batched_reduce_size": "",
       "request_cache": "__flag__",
@@ -23,6 +23,7 @@
       "expand_wildcards": [
         "open",
         "closed",
+        "hidden",
         "none",
         "all"
       ],
@@ -51,7 +52,7 @@
       "suggest_text": "",
       "timeout": "",
       "track_scores": "__flag__",
-      "track_total_hits": "__flag__",
+      "track_total_hits": "",
       "allow_partial_search_results": "__flag__",
       "typed_keys": "__flag__",
       "version": "__flag__",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.delete_autoscaling_policy.json b/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.delete_autoscaling_policy.json
new file mode 100644
index 0000000000000..2d65c9744987c
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.delete_autoscaling_policy.json
@@ -0,0 +1,11 @@
+{
+  "autoscaling.delete_autoscaling_policy": {
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_autoscaling/policy/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/autoscaling-delete-autoscaling-policy.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.get_autoscaling_capacity.json b/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.get_autoscaling_capacity.json
new file mode 100644
index 0000000000000..24aea8cfba86b
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.get_autoscaling_capacity.json
@@ -0,0 +1,11 @@
+{
+  "autoscaling.get_autoscaling_capacity": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_autoscaling/capacity"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/autoscaling-get-autoscaling-capacity.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/autoscaling.get_autoscaling_decision.json b/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.get_autoscaling_decision.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/autoscaling.get_autoscaling_decision.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.get_autoscaling_decision.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.get_autoscaling_policy.json b/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.get_autoscaling_policy.json
new file mode 100644
index 0000000000000..4d5ab1d00266b
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.get_autoscaling_policy.json
@@ -0,0 +1,11 @@
+{
+  "autoscaling.get_autoscaling_policy": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_autoscaling/policy/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/autoscaling-get-autoscaling-policy.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.put_autoscaling_policy.json b/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.put_autoscaling_policy.json
new file mode 100644
index 0000000000000..3ed40851c94d9
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/autoscaling.put_autoscaling_policy.json
@@ -0,0 +1,11 @@
+{
+  "autoscaling.put_autoscaling_policy": {
+    "methods": [
+      "PUT"
+    ],
+    "patterns": [
+      "_autoscaling/policy/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/autoscaling-put-autoscaling-policy.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/bulk.json b/src/plugins/console/server/lib/spec_definitions/json/generated/bulk.json
index 2d3bd260372ba..144a3ad359c40 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/bulk.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/bulk.json
@@ -13,7 +13,8 @@
       "_source": [],
       "_source_excludes": [],
       "_source_includes": [],
-      "pipeline": ""
+      "pipeline": "",
+      "require_alias": "__flag__"
     },
     "methods": [
       "POST",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.indices.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.indices.json
index 410350df13721..a0d405f60904d 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.indices.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.indices.json
@@ -15,7 +15,6 @@
         "p",
         "pb"
       ],
-      "local": "__flag__",
       "master_timeout": "",
       "h": [],
       "health": [
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/cat.ml_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.ml_data_frame_analytics.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/cat.ml_data_frame_analytics.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/cat.ml_data_frame_analytics.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/cat.ml_datafeeds.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.ml_datafeeds.json
similarity index 93%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/cat.ml_datafeeds.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/cat.ml_datafeeds.json
index 04f4e45782e1f..e58735a037153 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/cat.ml_datafeeds.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.ml_datafeeds.json
@@ -1,6 +1,7 @@
 {
   "cat.ml_datafeeds": {
     "url_params": {
+      "allow_no_match": "__flag__",
       "allow_no_datafeeds": "__flag__",
       "format": "",
       "h": [],
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/cat.ml_jobs.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.ml_jobs.json
similarity index 95%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/cat.ml_jobs.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/cat.ml_jobs.json
index 2f7e03e564b5d..a7a068fa3691e 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/cat.ml_jobs.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.ml_jobs.json
@@ -1,6 +1,7 @@
 {
   "cat.ml_jobs": {
     "url_params": {
+      "allow_no_match": "__flag__",
       "allow_no_jobs": "__flag__",
       "bytes": [
         "b",
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/cat.ml_trained_models.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.ml_trained_models.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/cat.ml_trained_models.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/cat.ml_trained_models.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.nodes.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.nodes.json
index 2e89a66ef1f35..b695bb1df9625 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.nodes.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.nodes.json
@@ -16,7 +16,6 @@
       ],
       "format": "",
       "full_id": "__flag__",
-      "local": "__flag__",
       "master_timeout": "",
       "h": [],
       "help": "__flag__",
@@ -30,7 +29,8 @@
         "micros",
         "nanos"
       ],
-      "v": "__flag__"
+      "v": "__flag__",
+      "include_unloaded_segments": "__flag__"
     },
     "methods": [
       "GET"
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.plugins.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.plugins.json
index 958992be81216..752313bf6f975 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.plugins.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.plugins.json
@@ -6,6 +6,7 @@
       "master_timeout": "",
       "h": [],
       "help": "__flag__",
+      "include_bootstrap": "__flag__",
       "s": [],
       "v": "__flag__"
     },
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.shards.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.shards.json
index 2b66562e3d6df..64a235eae67d5 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.shards.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.shards.json
@@ -15,7 +15,6 @@
         "p",
         "pb"
       ],
-      "local": "__flag__",
       "master_timeout": "",
       "h": [],
       "help": "__flag__",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.tasks.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.tasks.json
index 31c987a5893cf..f981d189a17b2 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.tasks.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.tasks.json
@@ -2,10 +2,10 @@
   "cat.tasks": {
     "url_params": {
       "format": "",
-      "node_id": [],
+      "nodes": [],
       "actions": [],
       "detailed": "__flag__",
-      "parent_task": "",
+      "parent_task_id": "",
       "h": [],
       "help": "__flag__",
       "s": [],
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.thread_pool.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.thread_pool.json
index 5017a0390a2e4..d237f8d54ab2a 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.thread_pool.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.thread_pool.json
@@ -2,13 +2,14 @@
   "cat.thread_pool": {
     "url_params": {
       "format": "",
-      "size": [
-        "",
-        "k",
+      "time": [
+        "d",
+        "h",
         "m",
-        "g",
-        "t",
-        "p"
+        "s",
+        "ms",
+        "micros",
+        "nanos"
       ],
       "local": "__flag__",
       "master_timeout": "",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cat.transforms.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.transforms.json
new file mode 100644
index 0000000000000..048d7af411635
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cat.transforms.json
@@ -0,0 +1,31 @@
+{
+  "cat.transforms": {
+    "url_params": {
+      "from": 0,
+      "size": 0,
+      "allow_no_match": "__flag__",
+      "format": "",
+      "h": [],
+      "help": "__flag__",
+      "s": [],
+      "time": [
+        "d",
+        "h",
+        "m",
+        "s",
+        "ms",
+        "micros",
+        "nanos"
+      ],
+      "v": "__flag__"
+    },
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_cat/transforms",
+      "_cat/transforms/{transform_id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-transforms.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.delete_auto_follow_pattern.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.delete_auto_follow_pattern.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.delete_auto_follow_pattern.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.delete_auto_follow_pattern.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.follow.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.follow.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.follow.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.follow.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.follow_info.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.follow_info.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.follow_info.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.follow_info.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.follow_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.follow_stats.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.follow_stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.follow_stats.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.forget_follower.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.forget_follower.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.forget_follower.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.forget_follower.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.get_auto_follow_pattern.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.get_auto_follow_pattern.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.get_auto_follow_pattern.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.get_auto_follow_pattern.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.pause_auto_follow_pattern.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.pause_auto_follow_pattern.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.pause_auto_follow_pattern.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.pause_auto_follow_pattern.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.pause_follow.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.pause_follow.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.pause_follow.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.pause_follow.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.put_auto_follow_pattern.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.put_auto_follow_pattern.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.put_auto_follow_pattern.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.put_auto_follow_pattern.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.resume_auto_follow_pattern.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.resume_auto_follow_pattern.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.resume_auto_follow_pattern.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.resume_auto_follow_pattern.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.resume_follow.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.resume_follow.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.resume_follow.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.resume_follow.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.stats.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.stats.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.unfollow.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ccr.unfollow.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ccr.unfollow.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ccr.unfollow.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/clear_scroll.json b/src/plugins/console/server/lib/spec_definitions/json/generated/clear_scroll.json
index 7e6e6692f931b..5273574357ddd 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/clear_scroll.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/clear_scroll.json
@@ -6,6 +6,6 @@
     "patterns": [
       "_search/scroll"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/search-request-body.html#_clear_scroll_api"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/clear-scroll-api.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/close_point_in_time.json b/src/plugins/console/server/lib/spec_definitions/json/generated/close_point_in_time.json
new file mode 100644
index 0000000000000..e1997bc2e20ea
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/close_point_in_time.json
@@ -0,0 +1,11 @@
+{
+  "close_point_in_time": {
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_pit"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/point-in-time-api.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.delete_component_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.delete_component_template.json
index e935b8999e6d3..24255f7231892 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.delete_component_template.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.delete_component_template.json
@@ -10,6 +10,6 @@
     "patterns": [
       "_component_template/{name}"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-component-templates.html"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-component-template.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.delete_voting_config_exclusions.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.delete_voting_config_exclusions.json
new file mode 100644
index 0000000000000..6b4b48113f2a8
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.delete_voting_config_exclusions.json
@@ -0,0 +1,14 @@
+{
+  "cluster.delete_voting_config_exclusions": {
+    "url_params": {
+      "wait_for_removal": "__flag__"
+    },
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_cluster/voting_config_exclusions"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/voting-config-exclusions.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.exists_component_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.exists_component_template.json
new file mode 100644
index 0000000000000..24dcbeb006e6f
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.exists_component_template.json
@@ -0,0 +1,15 @@
+{
+  "cluster.exists_component_template": {
+    "url_params": {
+      "master_timeout": "",
+      "local": "__flag__"
+    },
+    "methods": [
+      "HEAD"
+    ],
+    "patterns": [
+      "_component_template/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-component-template.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.get_component_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.get_component_template.json
index 784053d69ad5a..cbfed6741f8a4 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.get_component_template.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.get_component_template.json
@@ -12,5 +12,6 @@
       "_component_template",
       "_component_template/{name}"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/getting-component-templates.html"  }
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/getting-component-templates.html"
+  }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.get_settings.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.get_settings.json
index 249f582c33682..6c97254b5201c 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.get_settings.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.get_settings.json
@@ -12,6 +12,6 @@
     "patterns": [
       "_cluster/settings"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/cluster-update-settings.html"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/cluster-get-settings.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.post_voting_config_exclusions.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.post_voting_config_exclusions.json
new file mode 100644
index 0000000000000..74cc74a8c05a4
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.post_voting_config_exclusions.json
@@ -0,0 +1,16 @@
+{
+  "cluster.post_voting_config_exclusions": {
+    "url_params": {
+      "node_ids": "",
+      "node_names": "",
+      "timeout": ""
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_cluster/voting_config_exclusions"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/voting-config-exclusions.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.put_component_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.put_component_template.json
index 8a0bfc278cbf3..999ff0c149fe8 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.put_component_template.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/cluster.put_component_template.json
@@ -5,10 +5,12 @@
       "master_timeout": ""
     },
     "methods": [
-      "PUT"
+      "PUT",
+      "POST"
     ],
     "patterns": [
       "_component_template/{name}"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-component-template.html"  }
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-component-template.html"
+  }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/dangling_indices.delete_dangling_index.json b/src/plugins/console/server/lib/spec_definitions/json/generated/dangling_indices.delete_dangling_index.json
new file mode 100644
index 0000000000000..03d7c914baab5
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/dangling_indices.delete_dangling_index.json
@@ -0,0 +1,16 @@
+{
+  "dangling_indices.delete_dangling_index": {
+    "url_params": {
+      "accept_data_loss": "__flag__",
+      "timeout": "",
+      "master_timeout": ""
+    },
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_dangling/{index_uuid}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-gateway-dangling-indices.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/dangling_indices.import_dangling_index.json b/src/plugins/console/server/lib/spec_definitions/json/generated/dangling_indices.import_dangling_index.json
new file mode 100644
index 0000000000000..c55cdd2901699
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/dangling_indices.import_dangling_index.json
@@ -0,0 +1,16 @@
+{
+  "dangling_indices.import_dangling_index": {
+    "url_params": {
+      "accept_data_loss": "__flag__",
+      "timeout": "",
+      "master_timeout": ""
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_dangling/{index_uuid}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-gateway-dangling-indices.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/dangling_indices.list_dangling_indices.json b/src/plugins/console/server/lib/spec_definitions/json/generated/dangling_indices.list_dangling_indices.json
new file mode 100644
index 0000000000000..63dd560947876
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/dangling_indices.list_dangling_indices.json
@@ -0,0 +1,11 @@
+{
+  "dangling_indices.list_dangling_indices": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_dangling"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-gateway-dangling-indices.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.delete_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.delete_transform.json
new file mode 100644
index 0000000000000..6dfd81ded7bc5
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.delete_transform.json
@@ -0,0 +1,10 @@
+{
+  "data_frame_transform_deprecated.delete_transform": {
+    "url_params": {
+      "force": "__flag__"
+    },
+    "methods": [],
+    "patterns": [],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/delete-transform.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.get_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.get_transform.json
new file mode 100644
index 0000000000000..be3716ba3da6e
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.get_transform.json
@@ -0,0 +1,13 @@
+{
+  "data_frame_transform_deprecated.get_transform": {
+    "url_params": {
+      "from": 0,
+      "size": 0,
+      "allow_no_match": "__flag__",
+      "exclude_generated": "__flag__"
+    },
+    "methods": [],
+    "patterns": [],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/get-transform.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.get_transform_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.get_transform_stats.json
new file mode 100644
index 0000000000000..440eed6a1f2a4
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.get_transform_stats.json
@@ -0,0 +1,12 @@
+{
+  "data_frame_transform_deprecated.get_transform_stats": {
+    "url_params": {
+      "from": "",
+      "size": "",
+      "allow_no_match": "__flag__"
+    },
+    "methods": [],
+    "patterns": [],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/get-transform-stats.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.preview_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.preview_transform.json
new file mode 100644
index 0000000000000..f095847ed0d9a
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.preview_transform.json
@@ -0,0 +1,7 @@
+{
+  "data_frame_transform_deprecated.preview_transform": {
+    "methods": [],
+    "patterns": [],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/preview-transform.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.put_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.put_transform.json
new file mode 100644
index 0000000000000..e7555ce4bad29
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.put_transform.json
@@ -0,0 +1,10 @@
+{
+  "data_frame_transform_deprecated.put_transform": {
+    "url_params": {
+      "defer_validation": "__flag__"
+    },
+    "methods": [],
+    "patterns": [],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/put-transform.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.start_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.start_transform.json
new file mode 100644
index 0000000000000..d50346ff328c6
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.start_transform.json
@@ -0,0 +1,10 @@
+{
+  "data_frame_transform_deprecated.start_transform": {
+    "url_params": {
+      "timeout": ""
+    },
+    "methods": [],
+    "patterns": [],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/start-transform.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.stop_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.stop_transform.json
new file mode 100644
index 0000000000000..2618446916c76
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.stop_transform.json
@@ -0,0 +1,12 @@
+{
+  "data_frame_transform_deprecated.stop_transform": {
+    "url_params": {
+      "wait_for_completion": "__flag__",
+      "timeout": "",
+      "allow_no_match": "__flag__"
+    },
+    "methods": [],
+    "patterns": [],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/stop-transform.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.update_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.update_transform.json
new file mode 100644
index 0000000000000..60f71474e865a
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/data_frame_transform_deprecated.update_transform.json
@@ -0,0 +1,10 @@
+{
+  "data_frame_transform_deprecated.update_transform": {
+    "url_params": {
+      "defer_validation": "__flag__"
+    },
+    "methods": [],
+    "patterns": [],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/update-transform.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/delete.json b/src/plugins/console/server/lib/spec_definitions/json/generated/delete.json
index 0852d8d184831..a71a659618eb1 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/delete.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/delete.json
@@ -15,8 +15,7 @@
       "version_type": [
         "internal",
         "external",
-        "external_gte",
-        "force"
+        "external_gte"
       ]
     },
     "methods": [
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/delete_by_query.json b/src/plugins/console/server/lib/spec_definitions/json/generated/delete_by_query.json
index e01ea8b2dec6d..4e2b3a180fbba 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/delete_by_query.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/delete_by_query.json
@@ -32,7 +32,6 @@
         "dfs_query_then_fetch"
       ],
       "search_timeout": "",
-      "size": "",
       "max_docs": "all documents",
       "sort": [],
       "_source": [],
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/enrich.delete_policy.json b/src/plugins/console/server/lib/spec_definitions/json/generated/enrich.delete_policy.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/enrich.delete_policy.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/enrich.delete_policy.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/enrich.execute_policy.json b/src/plugins/console/server/lib/spec_definitions/json/generated/enrich.execute_policy.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/enrich.execute_policy.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/enrich.execute_policy.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/enrich.get_policy.json b/src/plugins/console/server/lib/spec_definitions/json/generated/enrich.get_policy.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/enrich.get_policy.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/enrich.get_policy.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/enrich.put_policy.json b/src/plugins/console/server/lib/spec_definitions/json/generated/enrich.put_policy.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/enrich.put_policy.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/enrich.put_policy.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/enrich.stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/enrich.stats.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/enrich.stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/enrich.stats.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/eql.delete.json b/src/plugins/console/server/lib/spec_definitions/json/generated/eql.delete.json
new file mode 100644
index 0000000000000..4bc4846f628a0
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/eql.delete.json
@@ -0,0 +1,11 @@
+{
+  "eql.delete": {
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_eql/search/{id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/eql.get.json b/src/plugins/console/server/lib/spec_definitions/json/generated/eql.get.json
new file mode 100644
index 0000000000000..4aa740c333beb
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/eql.get.json
@@ -0,0 +1,15 @@
+{
+  "eql.get": {
+    "url_params": {
+      "wait_for_completion_timeout": "",
+      "keep_alive": ""
+    },
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_eql/search/{id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/eql.get_status.json b/src/plugins/console/server/lib/spec_definitions/json/generated/eql.get_status.json
new file mode 100644
index 0000000000000..68fe8aff70046
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/eql.get_status.json
@@ -0,0 +1,11 @@
+{
+  "eql.get_status": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_eql/search/status/{id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/get-async-eql-status-api.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/eql.search.json b/src/plugins/console/server/lib/spec_definitions/json/generated/eql.search.json
new file mode 100644
index 0000000000000..67e7a1729c295
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/eql.search.json
@@ -0,0 +1,17 @@
+{
+  "eql.search": {
+    "url_params": {
+      "wait_for_completion_timeout": "",
+      "keep_on_completion": "__flag__",
+      "keep_alive": ""
+    },
+    "methods": [
+      "GET",
+      "POST"
+    ],
+    "patterns": [
+      "{indices}/_eql/search"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/exists.json b/src/plugins/console/server/lib/spec_definitions/json/generated/exists.json
index a6799b9e361cd..7d66dad050e5d 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/exists.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/exists.json
@@ -13,8 +13,7 @@
       "version_type": [
         "internal",
         "external",
-        "external_gte",
-        "force"
+        "external_gte"
       ]
     },
     "methods": [
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/exists_source.json b/src/plugins/console/server/lib/spec_definitions/json/generated/exists_source.json
index 9ffc4b55f3037..6811940cb0f1e 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/exists_source.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/exists_source.json
@@ -12,8 +12,7 @@
       "version_type": [
         "internal",
         "external",
-        "external_gte",
-        "force"
+        "external_gte"
       ]
     },
     "methods": [
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/features.get_features.json b/src/plugins/console/server/lib/spec_definitions/json/generated/features.get_features.json
new file mode 100644
index 0000000000000..abbf74b880f1a
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/features.get_features.json
@@ -0,0 +1,14 @@
+{
+  "features.get_features": {
+    "url_params": {
+      "master_timeout": ""
+    },
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_features"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/get-features-api.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/features.reset_features.json b/src/plugins/console/server/lib/spec_definitions/json/generated/features.reset_features.json
new file mode 100644
index 0000000000000..98280afdab1a0
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/features.reset_features.json
@@ -0,0 +1,11 @@
+{
+  "features.reset_features": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_features/_reset"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/reset-features-api.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/fleet.global_checkpoints.json b/src/plugins/console/server/lib/spec_definitions/json/generated/fleet.global_checkpoints.json
new file mode 100644
index 0000000000000..29f37c9099de2
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/fleet.global_checkpoints.json
@@ -0,0 +1,17 @@
+{
+  "fleet.global_checkpoints": {
+    "url_params": {
+      "wait_for_advance": "__flag__",
+      "wait_for_index": "__flag__",
+      "checkpoints": [],
+      "timeout": ""
+    },
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "{indices}/_fleet/global_checkpoints"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/get-global-checkpoints.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/get.json b/src/plugins/console/server/lib/spec_definitions/json/generated/get.json
index 5a72761c7c32e..396396f7550ca 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/get.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/get.json
@@ -13,8 +13,7 @@
       "version_type": [
         "internal",
         "external",
-        "external_gte",
-        "force"
+        "external_gte"
       ]
     },
     "methods": [
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/get_script_context.json b/src/plugins/console/server/lib/spec_definitions/json/generated/get_script_context.json
index 528c261df7707..f3808d568e989 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/get_script_context.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/get_script_context.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_script_context"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/painless/master/painless-contexts.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/get_script_languages.json b/src/plugins/console/server/lib/spec_definitions/json/generated/get_script_languages.json
index 10ea433ca68c5..a872885615d05 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/get_script_languages.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/get_script_languages.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_script_language"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-scripting.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/get_source.json b/src/plugins/console/server/lib/spec_definitions/json/generated/get_source.json
index 8201960363a78..de1b5b0f3de21 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/get_source.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/get_source.json
@@ -12,8 +12,7 @@
       "version_type": [
         "internal",
         "external",
-        "external_gte",
-        "force"
+        "external_gte"
       ]
     },
     "methods": [
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/graph.explore.json b/src/plugins/console/server/lib/spec_definitions/json/generated/graph.explore.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/graph.explore.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/graph.explore.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.delete_lifecycle.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.delete_lifecycle.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.delete_lifecycle.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.delete_lifecycle.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.explain_lifecycle.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.explain_lifecycle.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.explain_lifecycle.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.explain_lifecycle.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.get_lifecycle.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.get_lifecycle.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.get_lifecycle.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.get_lifecycle.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.get_status.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.get_status.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.get_status.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.get_status.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.migrate_to_data_tiers.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.migrate_to_data_tiers.json
new file mode 100644
index 0000000000000..acafe1183a893
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.migrate_to_data_tiers.json
@@ -0,0 +1,14 @@
+{
+  "ilm.migrate_to_data_tiers": {
+    "url_params": {
+      "dry_run": "__flag__"
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_ilm/migrate_to_data_tiers"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-migrate-to-data-tiers.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.move_to_step.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.move_to_step.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.move_to_step.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.move_to_step.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.put_lifecycle.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.put_lifecycle.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.put_lifecycle.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.put_lifecycle.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.remove_policy.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.remove_policy.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.remove_policy.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.remove_policy.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.retry.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.retry.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.retry.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.retry.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.set_policy.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.set_policy.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.set_policy.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.set_policy.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.start.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.start.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.start.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.start.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.stop.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ilm.stop.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ilm.stop.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ilm.stop.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/index.json b/src/plugins/console/server/lib/spec_definitions/json/generated/index.json
index 25977806776a7..c6b290a58812b 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/index.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/index.json
@@ -21,7 +21,8 @@
       ],
       "if_seq_no": "",
       "if_primary_term": "",
-      "pipeline": ""
+      "pipeline": "",
+      "require_alias": "__flag__"
     },
     "methods": [
       "PUT",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.add_block.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.add_block.json
new file mode 100644
index 0000000000000..ff2623b100bda
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.add_block.json
@@ -0,0 +1,24 @@
+{
+  "indices.add_block": {
+    "url_params": {
+      "timeout": "",
+      "master_timeout": "",
+      "ignore_unavailable": "__flag__",
+      "allow_no_indices": "__flag__",
+      "expand_wildcards": [
+        "open",
+        "closed",
+        "hidden",
+        "none",
+        "all"
+      ]
+    },
+    "methods": [
+      "PUT"
+    ],
+    "patterns": [
+      "{indices}/_block/{block}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/index-modules-blocks.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.create.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.create.json
index 1970f88b30958..8227e38d3c6d9 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.create.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.create.json
@@ -1,7 +1,6 @@
 {
   "indices.create": {
     "url_params": {
-      "include_type_name": "__flag__",
       "wait_for_active_shards": "",
       "timeout": "",
       "master_timeout": ""
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.create_data_stream.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.create_data_stream.json
new file mode 100644
index 0000000000000..832d5b8de1f47
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.create_data_stream.json
@@ -0,0 +1,11 @@
+{
+  "indices.create_data_stream": {
+    "methods": [
+      "PUT"
+    ],
+    "patterns": [
+      "_data_stream/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/data-streams.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.data_streams_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.data_streams_stats.json
new file mode 100644
index 0000000000000..6a88c351ff700
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.data_streams_stats.json
@@ -0,0 +1,12 @@
+{
+  "indices.data_streams_stats": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_data_stream/_stats",
+      "_data_stream/{name}/_stats"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/data-streams.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.delete_data_stream.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.delete_data_stream.json
new file mode 100644
index 0000000000000..9b91e3deb3a08
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.delete_data_stream.json
@@ -0,0 +1,20 @@
+{
+  "indices.delete_data_stream": {
+    "url_params": {
+      "expand_wildcards": [
+        "open",
+        "closed",
+        "hidden",
+        "none",
+        "all"
+      ]
+    },
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_data_stream/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/data-streams.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.delete_index_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.delete_index_template.json
new file mode 100644
index 0000000000000..ef3f836207f17
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.delete_index_template.json
@@ -0,0 +1,15 @@
+{
+  "indices.delete_index_template": {
+    "url_params": {
+      "timeout": "",
+      "master_timeout": ""
+    },
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_index_template/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-templates.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.disk_usage.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.disk_usage.json
new file mode 100644
index 0000000000000..fe7d378b2b168
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.disk_usage.json
@@ -0,0 +1,24 @@
+{
+  "indices.disk_usage": {
+    "url_params": {
+      "run_expensive_tasks": "__flag__",
+      "flush": "__flag__",
+      "ignore_unavailable": "__flag__",
+      "allow_no_indices": "__flag__",
+      "expand_wildcards": [
+        "open",
+        "closed",
+        "hidden",
+        "none",
+        "all"
+      ]
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "{indices}/_disk_usage"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-disk-usage.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.exists_index_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.exists_index_template.json
new file mode 100644
index 0000000000000..97fa8cf55576f
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.exists_index_template.json
@@ -0,0 +1,16 @@
+{
+  "indices.exists_index_template": {
+    "url_params": {
+      "flat_settings": "__flag__",
+      "master_timeout": "",
+      "local": "__flag__"
+    },
+    "methods": [
+      "HEAD"
+    ],
+    "patterns": [
+      "_index_template/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-templates.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/indices.freeze.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.freeze.json
similarity index 75%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/indices.freeze.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/indices.freeze.json
index 06e8c606f59f7..77c765b90bcdc 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/indices.freeze.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.freeze.json
@@ -8,17 +8,14 @@
       "expand_wildcards": [
         "open",
         "closed",
+        "hidden",
         "none",
         "all"
       ],
       "wait_for_active_shards": ""
     },
-    "methods": [
-      "POST"
-    ],
-    "patterns": [
-      "{indices}/_freeze"
-    ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/frozen.html"
+    "methods": [],
+    "patterns": [],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/freeze-index-api.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get.json
index 6df796ed6c4cf..99a654d023ba2 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get.json
@@ -1,7 +1,6 @@
 {
   "indices.get": {
     "url_params": {
-      "include_type_name": "__flag__",
       "local": "__flag__",
       "ignore_unavailable": "__flag__",
       "allow_no_indices": "__flag__",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_data_stream.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_data_stream.json
new file mode 100644
index 0000000000000..45199a60f337d
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_data_stream.json
@@ -0,0 +1,21 @@
+{
+  "indices.get_data_stream": {
+    "url_params": {
+      "expand_wildcards": [
+        "open",
+        "closed",
+        "hidden",
+        "none",
+        "all"
+      ]
+    },
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_data_stream",
+      "_data_stream/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/data-streams.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_field_mapping.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_field_mapping.json
index c95e2efc73fab..c50919af0a2f3 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_field_mapping.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_field_mapping.json
@@ -1,7 +1,6 @@
 {
   "indices.get_field_mapping": {
     "url_params": {
-      "include_type_name": "__flag__",
       "include_defaults": "__flag__",
       "ignore_unavailable": "__flag__",
       "allow_no_indices": "__flag__",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_index_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_index_template.json
new file mode 100644
index 0000000000000..142b75f22c2a6
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_index_template.json
@@ -0,0 +1,17 @@
+{
+  "indices.get_index_template": {
+    "url_params": {
+      "flat_settings": "__flag__",
+      "master_timeout": "",
+      "local": "__flag__"
+    },
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_index_template",
+      "_index_template/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-templates.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_mapping.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_mapping.json
index 555137d0e2ee0..f484f0dca0669 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_mapping.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_mapping.json
@@ -1,7 +1,6 @@
 {
   "indices.get_mapping": {
     "url_params": {
-      "include_type_name": "__flag__",
       "ignore_unavailable": "__flag__",
       "allow_no_indices": "__flag__",
       "expand_wildcards": [
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_template.json
index d5f52ec76b374..f5902929c25cc 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_template.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.get_template.json
@@ -1,7 +1,6 @@
 {
   "indices.get_template": {
     "url_params": {
-      "include_type_name": "__flag__",
       "flat_settings": "__flag__",
       "master_timeout": "",
       "local": "__flag__"
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.migrate_to_data_stream.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.migrate_to_data_stream.json
new file mode 100644
index 0000000000000..45cd033801e55
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.migrate_to_data_stream.json
@@ -0,0 +1,11 @@
+{
+  "indices.migrate_to_data_stream": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_data_stream/_migrate/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/data-streams.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.promote_data_stream.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.promote_data_stream.json
new file mode 100644
index 0000000000000..a92b9a7a4a40d
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.promote_data_stream.json
@@ -0,0 +1,11 @@
+{
+  "indices.promote_data_stream": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_data_stream/_promote/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/data-streams.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_index_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_index_template.json
new file mode 100644
index 0000000000000..0ce27c1d9d21e
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_index_template.json
@@ -0,0 +1,17 @@
+{
+  "indices.put_index_template": {
+    "url_params": {
+      "create": "__flag__",
+      "cause": "",
+      "master_timeout": ""
+    },
+    "methods": [
+      "PUT",
+      "POST"
+    ],
+    "patterns": [
+      "_index_template/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-templates.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_mapping.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_mapping.json
index e36783c815e3f..5b8ce2b8b4350 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_mapping.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_mapping.json
@@ -1,7 +1,6 @@
 {
   "indices.put_mapping": {
     "url_params": {
-      "include_type_name": "__flag__",
       "timeout": "",
       "master_timeout": "",
       "ignore_unavailable": "__flag__",
@@ -12,7 +11,8 @@
         "hidden",
         "none",
         "all"
-      ]
+      ],
+      "write_index_only": "__flag__"
     },
     "methods": [
       "PUT",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_template.json
index 8fb31277da44e..537428f3c53c9 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_template.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.put_template.json
@@ -1,11 +1,9 @@
 {
   "indices.put_template": {
     "url_params": {
-      "include_type_name": "__flag__",
       "order": "",
       "create": "__flag__",
-      "master_timeout": "",
-      "flat_settings": "__flag__"
+      "master_timeout": ""
     },
     "methods": [
       "PUT",
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/indices.reload_search_analyzers.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.reload_search_analyzers.json
similarity index 96%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/indices.reload_search_analyzers.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/indices.reload_search_analyzers.json
index 13ae3a0fd4d18..d4d1d8c52b349 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/indices.reload_search_analyzers.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.reload_search_analyzers.json
@@ -6,6 +6,7 @@
       "expand_wildcards": [
         "open",
         "closed",
+        "hidden",
         "none",
         "all"
       ]
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.resolve_index.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.resolve_index.json
new file mode 100644
index 0000000000000..574d07f1e4324
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.resolve_index.json
@@ -0,0 +1,20 @@
+{
+  "indices.resolve_index": {
+    "url_params": {
+      "expand_wildcards": [
+        "open",
+        "closed",
+        "hidden",
+        "none",
+        "all"
+      ]
+    },
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_resolve/index/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-resolve-index-api.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.rollover.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.rollover.json
index 7fa76a687eb77..19e0f1f909ab8 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.rollover.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.rollover.json
@@ -1,7 +1,6 @@
 {
   "indices.rollover": {
     "url_params": {
-      "include_type_name": "__flag__",
       "timeout": "",
       "dry_run": "__flag__",
       "master_timeout": "",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.shrink.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.shrink.json
index 6fbdea0f1244b..31acc86a2fa56 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.shrink.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.shrink.json
@@ -1,7 +1,6 @@
 {
   "indices.shrink": {
     "url_params": {
-      "copy_settings": "__flag__",
       "timeout": "",
       "master_timeout": "",
       "wait_for_active_shards": ""
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.simulate_index_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.simulate_index_template.json
new file mode 100644
index 0000000000000..e122bd844e9bc
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.simulate_index_template.json
@@ -0,0 +1,16 @@
+{
+  "indices.simulate_index_template": {
+    "url_params": {
+      "create": "__flag__",
+      "cause": "",
+      "master_timeout": ""
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_index_template/_simulate_index/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-templates.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.simulate_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.simulate_template.json
new file mode 100644
index 0000000000000..9e174799e6c07
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.simulate_template.json
@@ -0,0 +1,17 @@
+{
+  "indices.simulate_template": {
+    "url_params": {
+      "create": "__flag__",
+      "cause": "",
+      "master_timeout": ""
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_index_template/_simulate",
+      "_index_template/_simulate/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-templates.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.split.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.split.json
index 68f2e338cd201..1bfbaa078b796 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.split.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.split.json
@@ -1,7 +1,6 @@
 {
   "indices.split": {
     "url_params": {
-      "copy_settings": "__flag__",
       "timeout": "",
       "master_timeout": "",
       "wait_for_active_shards": ""
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.stats.json
index 1fa32265c91ee..9cdcbdf672d8c 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/indices.stats.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.stats.json
@@ -34,6 +34,7 @@
     "url_components": {
       "metrics": [
         "_all",
+        "bulk",
         "completion",
         "docs",
         "fielddata",
@@ -47,7 +48,6 @@
         "search",
         "segments",
         "store",
-        "suggest",
         "warmer"
       ],
       "indices": null
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/indices.unfreeze.json b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.unfreeze.json
similarity index 75%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/indices.unfreeze.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/indices.unfreeze.json
index 186a671347240..3e87971cb66f5 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/indices.unfreeze.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/indices.unfreeze.json
@@ -8,17 +8,14 @@
       "expand_wildcards": [
         "open",
         "closed",
+        "hidden",
         "none",
         "all"
       ],
       "wait_for_active_shards": ""
     },
-    "methods": [
-      "POST"
-    ],
-    "patterns": [
-      "{indices}/_unfreeze"
-    ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/frozen.html"
+    "methods": [],
+    "patterns": [],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/unfreeze-index-api.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ingest.geo_ip_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ingest.geo_ip_stats.json
new file mode 100644
index 0000000000000..2993eca9f0af5
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ingest.geo_ip_stats.json
@@ -0,0 +1,11 @@
+{
+  "ingest.geo_ip_stats": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_ingest/geoip/stats"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/geoip-stats-api.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ingest.get_pipeline.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ingest.get_pipeline.json
index cffcbb1261f90..df90b976444c1 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/ingest.get_pipeline.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ingest.get_pipeline.json
@@ -1,6 +1,7 @@
 {
   "ingest.get_pipeline": {
     "url_params": {
+      "summary": "__flag__",
       "master_timeout": ""
     },
     "methods": [
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.delete.json b/src/plugins/console/server/lib/spec_definitions/json/generated/license.delete.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.delete.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/license.delete.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.get.json b/src/plugins/console/server/lib/spec_definitions/json/generated/license.get.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.get.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/license.get.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.get_basic_status.json b/src/plugins/console/server/lib/spec_definitions/json/generated/license.get_basic_status.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.get_basic_status.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/license.get_basic_status.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.get_trial_status.json b/src/plugins/console/server/lib/spec_definitions/json/generated/license.get_trial_status.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.get_trial_status.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/license.get_trial_status.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.post.json b/src/plugins/console/server/lib/spec_definitions/json/generated/license.post.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.post.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/license.post.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.post_start_basic.json b/src/plugins/console/server/lib/spec_definitions/json/generated/license.post_start_basic.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.post_start_basic.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/license.post_start_basic.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.post_start_trial.json b/src/plugins/console/server/lib/spec_definitions/json/generated/license.post_start_trial.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/license.post_start_trial.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/license.post_start_trial.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/logstash.delete_pipeline.json b/src/plugins/console/server/lib/spec_definitions/json/generated/logstash.delete_pipeline.json
new file mode 100644
index 0000000000000..9e2c32e287253
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/logstash.delete_pipeline.json
@@ -0,0 +1,11 @@
+{
+  "logstash.delete_pipeline": {
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_logstash/pipeline/{id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/logstash-api-delete-pipeline.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/logstash.get_pipeline.json b/src/plugins/console/server/lib/spec_definitions/json/generated/logstash.get_pipeline.json
new file mode 100644
index 0000000000000..a6b3a69b53a60
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/logstash.get_pipeline.json
@@ -0,0 +1,11 @@
+{
+  "logstash.get_pipeline": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_logstash/pipeline/{id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/logstash-api-get-pipeline.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/logstash.put_pipeline.json b/src/plugins/console/server/lib/spec_definitions/json/generated/logstash.put_pipeline.json
new file mode 100644
index 0000000000000..9640ced182898
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/logstash.put_pipeline.json
@@ -0,0 +1,11 @@
+{
+  "logstash.put_pipeline": {
+    "methods": [
+      "PUT"
+    ],
+    "patterns": [
+      "_logstash/pipeline/{id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/logstash-api-put-pipeline.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/migration.deprecations.json b/src/plugins/console/server/lib/spec_definitions/json/generated/migration.deprecations.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/migration.deprecations.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/migration.deprecations.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/migration.get_assistance.json b/src/plugins/console/server/lib/spec_definitions/json/generated/migration.get_assistance.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/migration.get_assistance.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/migration.get_assistance.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/migration.upgrade.json b/src/plugins/console/server/lib/spec_definitions/json/generated/migration.upgrade.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/migration.upgrade.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/migration.upgrade.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.close_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.close_job.json
similarity index 90%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.close_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.close_job.json
index b0f2c6489b30e..4fd0b7ccf98a7 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.close_job.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.close_job.json
@@ -1,6 +1,7 @@
 {
   "ml.close_job": {
     "url_params": {
+      "allow_no_match": "__flag__",
       "allow_no_jobs": "__flag__",
       "force": "__flag__",
       "timeout": ""
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_calendar.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_calendar.json
similarity index 51%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_calendar.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_calendar.json
index 97e5898072a08..7ccf7ef673070 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_calendar.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_calendar.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_ml/calendars/{calendar_id}"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-delete-calendar.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_calendar_event.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_calendar_event.json
similarity index 54%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_calendar_event.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_calendar_event.json
index 85ea5add0b60b..7ee8ef376a4db 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_calendar_event.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_calendar_event.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_ml/calendars/{calendar_id}/events/{event_id}"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-delete-calendar-event.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_calendar_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_calendar_job.json
similarity index 54%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_calendar_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_calendar_job.json
index 6665f52eeb90d..b97667900fe35 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_calendar_job.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_calendar_job.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_ml/calendars/{calendar_id}/jobs/{job_id}"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-delete-calendar-job.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_data_frame_analytics.json
similarity index 85%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_data_frame_analytics.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_data_frame_analytics.json
index 2e4593f339212..a46bfdf8318db 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_data_frame_analytics.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_data_frame_analytics.json
@@ -1,7 +1,8 @@
 {
   "ml.delete_data_frame_analytics": {
     "url_params": {
-      "force": "__flag__"
+      "force": "__flag__",
+      "timeout": ""
     },
     "methods": [
       "DELETE"
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_datafeed.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_datafeed.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_datafeed.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_datafeed.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_expired_data.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_expired_data.json
new file mode 100644
index 0000000000000..1515821cb1628
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_expired_data.json
@@ -0,0 +1,16 @@
+{
+  "ml.delete_expired_data": {
+    "url_params": {
+      "requests_per_second": "",
+      "timeout": ""
+    },
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_ml/_delete_expired_data/{job_id}",
+      "_ml/_delete_expired_data"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-delete-expired-data.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_filter.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_filter.json
similarity index 51%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_filter.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_filter.json
index 8210a2acd71d0..515986d44d77c 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_filter.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_filter.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_ml/filters/{filter_id}"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-delete-filter.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_forecast.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_forecast.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_forecast.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_forecast.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_job.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_job.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_model_snapshot.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_model_snapshot.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_model_snapshot.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_model_snapshot.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_trained_model.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_trained_model.json
similarity index 65%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_trained_model.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_trained_model.json
index 343fa904c4216..75592c5964ed0 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_trained_model.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_trained_model.json
@@ -4,8 +4,8 @@
       "DELETE"
     ],
     "patterns": [
-      "_ml/inference/{model_id}"
+      "_ml/trained_models/{model_id}"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/delete-inference.html"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/delete-trained-models.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_trained_model_alias.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_trained_model_alias.json
new file mode 100644
index 0000000000000..cd27f21b1d6e4
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.delete_trained_model_alias.json
@@ -0,0 +1,11 @@
+{
+  "ml.delete_trained_model_alias": {
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_ml/trained_models/{model_id}/model_aliases/{model_alias}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/delete-trained-models-aliases.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.estimate_model_memory.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.estimate_model_memory.json
new file mode 100644
index 0000000000000..94b149e542d43
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.estimate_model_memory.json
@@ -0,0 +1,11 @@
+{
+  "ml.estimate_model_memory": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_ml/anomaly_detectors/_estimate_model_memory"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-apis.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.evaluate_data_frame.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.evaluate_data_frame.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.evaluate_data_frame.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.evaluate_data_frame.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.explain_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.explain_data_frame_analytics.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.explain_data_frame_analytics.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.explain_data_frame_analytics.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.find_file_structure.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.find_file_structure.json
similarity index 88%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.find_file_structure.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.find_file_structure.json
index 6e7163ae2b740..9ede28306e313 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.find_file_structure.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.find_file_structure.json
@@ -25,8 +25,8 @@
       "POST"
     ],
     "patterns": [
-      "_ml/find_file_structure"
+      "_text_structure/find_structure"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-find-file-structure.html"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/find-structure.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.flush_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.flush_job.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.flush_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.flush_job.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.forecast.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.forecast.json
similarity index 52%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.forecast.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.forecast.json
index 3a8849aad3e4d..d2b53c11cb985 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.forecast.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.forecast.json
@@ -2,13 +2,15 @@
   "ml.forecast": {
     "url_params": {
       "duration": "",
-      "expires_in": ""
+      "expires_in": "",
+      "max_model_memory": ""
     },
     "methods": [
       "POST"
     ],
     "patterns": [
       "_ml/anomaly_detectors/{job_id}/_forecast"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-forecast.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_buckets.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_buckets.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_buckets.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_buckets.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_calendar_events.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_calendar_events.json
similarity index 67%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_calendar_events.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_calendar_events.json
index 8999af6320dfa..f8886067dd80e 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_calendar_events.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_calendar_events.json
@@ -12,6 +12,7 @@
     ],
     "patterns": [
       "_ml/calendars/{calendar_id}/events"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-get-calendar-event.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_calendars.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_calendars.json
similarity index 65%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_calendars.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_calendars.json
index 87f582b5c364d..575f2573d1ee9 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_calendars.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_calendars.json
@@ -11,6 +11,7 @@
     "patterns": [
       "_ml/calendars",
       "_ml/calendars/{calendar_id}"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-get-calendar.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_categories.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_categories.json
similarity index 88%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_categories.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_categories.json
index 64edb196bb366..1083760d7594f 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_categories.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_categories.json
@@ -2,7 +2,8 @@
   "ml.get_categories": {
     "url_params": {
       "from": 0,
-      "size": 0
+      "size": 0,
+      "partition_field_value": ""
     },
     "methods": [
       "GET",
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics.json
similarity index 86%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics.json
index ecccec9c7e059..cccaa516110aa 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics.json
@@ -3,7 +3,8 @@
     "url_params": {
       "allow_no_match": "__flag__",
       "from": 0,
-      "size": 0
+      "size": 0,
+      "exclude_generated": "__flag__"
     },
     "methods": [
       "GET"
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics_stats.json
similarity index 89%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics_stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics_stats.json
index 3ae103f79f798..20fbb2981a28c 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics_stats.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_data_frame_analytics_stats.json
@@ -3,7 +3,8 @@
     "url_params": {
       "allow_no_match": "__flag__",
       "from": 0,
-      "size": 0
+      "size": 0,
+      "verbose": "__flag__"
     },
     "methods": [
       "GET"
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_datafeed_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_datafeed_stats.json
similarity index 90%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_datafeed_stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_datafeed_stats.json
index 2971b8a7f6c63..75ece20e87443 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_datafeed_stats.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_datafeed_stats.json
@@ -1,6 +1,7 @@
 {
   "ml.get_datafeed_stats": {
     "url_params": {
+      "allow_no_match": "__flag__",
       "allow_no_datafeeds": "__flag__"
     },
     "methods": [
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_datafeeds.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_datafeeds.json
similarity index 71%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_datafeeds.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_datafeeds.json
index deeb81d692739..ec557966a7271 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_datafeeds.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_datafeeds.json
@@ -1,7 +1,9 @@
 {
   "ml.get_datafeeds": {
     "url_params": {
-      "allow_no_datafeeds": "__flag__"
+      "allow_no_match": "__flag__",
+      "allow_no_datafeeds": "__flag__",
+      "exclude_generated": "__flag__"
     },
     "methods": [
       "GET"
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_filters.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_filters.json
similarity index 63%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_filters.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_filters.json
index 9b06e618a0b0c..df5747e143412 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_filters.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_filters.json
@@ -10,6 +10,7 @@
     "patterns": [
       "_ml/filters",
       "_ml/filters/{filter_id}"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-get-filter.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_influencers.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_influencers.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_influencers.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_influencers.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_job_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_job_stats.json
similarity index 90%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_job_stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_job_stats.json
index 6173b3ebdc6d0..48dd9e52cd990 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_job_stats.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_job_stats.json
@@ -1,6 +1,7 @@
 {
   "ml.get_job_stats": {
     "url_params": {
+      "allow_no_match": "__flag__",
       "allow_no_jobs": "__flag__"
     },
     "methods": [
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_jobs.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_jobs.json
similarity index 72%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_jobs.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_jobs.json
index 2486684424670..b46c86559ea09 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_jobs.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_jobs.json
@@ -1,7 +1,9 @@
 {
   "ml.get_jobs": {
     "url_params": {
-      "allow_no_jobs": "__flag__"
+      "allow_no_match": "__flag__",
+      "allow_no_jobs": "__flag__",
+      "exclude_generated": "__flag__"
     },
     "methods": [
       "GET"
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_model_snapshots.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_model_snapshots.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_model_snapshots.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_model_snapshots.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_overall_buckets.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_overall_buckets.json
similarity index 93%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_overall_buckets.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_overall_buckets.json
index 3a88c9d8ab9c9..e374f6c5ef63f 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_overall_buckets.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_overall_buckets.json
@@ -7,6 +7,7 @@
       "exclude_interim": "__flag__",
       "start": "",
       "end": "",
+      "allow_no_match": "__flag__",
       "allow_no_jobs": "__flag__"
     },
     "methods": [
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_records.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_records.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_records.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_records.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_trained_models.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_trained_models.json
similarity index 64%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_trained_models.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_trained_models.json
index 76598ee015c6d..19f169fa98e86 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_trained_models.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_trained_models.json
@@ -2,19 +2,21 @@
   "ml.get_trained_models": {
     "url_params": {
       "allow_no_match": "__flag__",
+      "include": "",
       "include_model_definition": "__flag__",
       "decompress_definition": "__flag__",
       "from": 0,
       "size": 0,
-      "tags": []
+      "tags": [],
+      "exclude_generated": "__flag__"
     },
     "methods": [
       "GET"
     ],
     "patterns": [
-      "_ml/inference/{model_id}",
-      "_ml/inference"
+      "_ml/trained_models/{model_id}",
+      "_ml/trained_models"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/get-inference.html"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/get-trained-models.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_trained_models_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_trained_models_stats.json
similarity index 66%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_trained_models_stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_trained_models_stats.json
index ab05e203b3980..44d06c78aef70 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.get_trained_models_stats.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.get_trained_models_stats.json
@@ -9,9 +9,9 @@
       "GET"
     ],
     "patterns": [
-      "_ml/inference/{model_id}/_stats",
-      "_ml/inference/_stats"
+      "_ml/trained_models/{model_id}/_stats",
+      "_ml/trained_models/_stats"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/get-inference-stats.html"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/get-trained-models-stats.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.infer_trained_model_deployment.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.infer_trained_model_deployment.json
new file mode 100644
index 0000000000000..644942801d2f6
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.infer_trained_model_deployment.json
@@ -0,0 +1,14 @@
+{
+  "ml.infer_trained_model_deployment": {
+    "url_params": {
+      "timeout": ""
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_ml/trained_models/{model_id}/deployment/_infer"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-infer-trained-model-deployment.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.info.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.info.json
new file mode 100644
index 0000000000000..e09491dacf1fd
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.info.json
@@ -0,0 +1,11 @@
+{
+  "ml.info": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_ml/info"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/get-ml-info.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.open_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.open_job.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.open_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.open_job.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.post_calendar_events.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.post_calendar_events.json
similarity index 52%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.post_calendar_events.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.post_calendar_events.json
index 89ce2df63315b..9d0947c4704a1 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.post_calendar_events.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.post_calendar_events.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_ml/calendars/{calendar_id}/events"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-post-calendar-event.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.post_data.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.post_data.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.post_data.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.post_data.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.preview_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.preview_data_frame_analytics.json
new file mode 100644
index 0000000000000..bc3e0a4fd54b5
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.preview_data_frame_analytics.json
@@ -0,0 +1,13 @@
+{
+  "ml.preview_data_frame_analytics": {
+    "methods": [
+      "GET",
+      "POST"
+    ],
+    "patterns": [
+      "_ml/data_frame/analytics/_preview",
+      "_ml/data_frame/analytics/{id}/_preview"
+    ],
+    "documentation": "http://www.elastic.co/guide/en/elasticsearch/reference/current/preview-dfanalytics.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.preview_datafeed.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.preview_datafeed.json
similarity index 65%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.preview_datafeed.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.preview_datafeed.json
index 6eb537804134b..29dbabd67d60b 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.preview_datafeed.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.preview_datafeed.json
@@ -1,10 +1,12 @@
 {
   "ml.preview_datafeed": {
     "methods": [
-      "GET"
+      "GET",
+      "POST"
     ],
     "patterns": [
-      "_ml/datafeeds/{datafeed_id}/_preview"
+      "_ml/datafeeds/{datafeed_id}/_preview",
+      "_ml/datafeeds/_preview"
     ],
     "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-preview-datafeed.html"
   }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_calendar.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_calendar.json
similarity index 51%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_calendar.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_calendar.json
index 7452d1b4b9707..c60a9b60f4ca0 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_calendar.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_calendar.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_ml/calendars/{calendar_id}"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-put-calendar.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_calendar_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_calendar_job.json
similarity index 53%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_calendar_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_calendar_job.json
index 08dc3d77b5f25..5a3ac8e0b3243 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_calendar_job.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_calendar_job.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_ml/calendars/{calendar_id}/jobs/{job_id}"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-put-calendar-job.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_data_frame_analytics.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_data_frame_analytics.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_data_frame_analytics.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_datafeed.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_datafeed.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_datafeed.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_datafeed.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_filter.json
similarity index 58%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_filter.json
index 7a48994bd1a6c..ad9caa9417da9 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_job.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_filter.json
@@ -1,11 +1,11 @@
 {
-  "ml.put_job": {
+  "ml.put_filter": {
     "methods": [
       "PUT"
     ],
     "patterns": [
-      "_ml/anomaly_detectors/{job_id}"
+      "_ml/filters/{filter_id}"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-put-job.html"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-put-filter.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_job.json
new file mode 100644
index 0000000000000..a55ee4ab21a63
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_job.json
@@ -0,0 +1,23 @@
+{
+  "ml.put_job": {
+    "url_params": {
+      "ignore_unavailable": "__flag__",
+      "allow_no_indices": "__flag__",
+      "ignore_throttled": "__flag__",
+      "expand_wildcards": [
+        "open",
+        "closed",
+        "hidden",
+        "none",
+        "all"
+      ]
+    },
+    "methods": [
+      "PUT"
+    ],
+    "patterns": [
+      "_ml/anomaly_detectors/{job_id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-put-job.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_trained_model.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_trained_model.json
new file mode 100644
index 0000000000000..9b95f6891d474
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_trained_model.json
@@ -0,0 +1,11 @@
+{
+  "ml.put_trained_model": {
+    "methods": [
+      "PUT"
+    ],
+    "patterns": [
+      "_ml/trained_models/{model_id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/put-trained-models.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_trained_model_alias.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_trained_model_alias.json
new file mode 100644
index 0000000000000..a83d54220b31a
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.put_trained_model_alias.json
@@ -0,0 +1,14 @@
+{
+  "ml.put_trained_model_alias": {
+    "url_params": {
+      "reassign": "__flag__"
+    },
+    "methods": [
+      "PUT"
+    ],
+    "patterns": [
+      "_ml/trained_models/{model_id}/model_aliases/{model_alias}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/put-trained-models-aliases.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.reset_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.reset_job.json
new file mode 100644
index 0000000000000..79441afbdebf7
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.reset_job.json
@@ -0,0 +1,14 @@
+{
+  "ml.reset_job": {
+    "url_params": {
+      "wait_for_completion": "__flag__"
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_ml/anomaly_detectors/{job_id}/_reset"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-reset-job.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.revert_model_snapshot.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.revert_model_snapshot.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.revert_model_snapshot.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.revert_model_snapshot.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.set_upgrade_mode.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.set_upgrade_mode.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.set_upgrade_mode.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.set_upgrade_mode.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.start_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.start_data_frame_analytics.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.start_data_frame_analytics.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.start_data_frame_analytics.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.start_datafeed.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.start_datafeed.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.start_datafeed.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.start_datafeed.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.start_trained_model_deployment.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.start_trained_model_deployment.json
new file mode 100644
index 0000000000000..49e246c90d8e1
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.start_trained_model_deployment.json
@@ -0,0 +1,14 @@
+{
+  "ml.start_trained_model_deployment": {
+    "url_params": {
+      "timeout": ""
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_ml/trained_models/{model_id}/deployment/_start"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-start-trained-model-deployment.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.stop_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.stop_data_frame_analytics.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.stop_data_frame_analytics.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.stop_data_frame_analytics.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.stop_datafeed.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.stop_datafeed.json
similarity index 90%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.stop_datafeed.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.stop_datafeed.json
index d6769ed58148f..b52f1e22bddf8 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.stop_datafeed.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.stop_datafeed.json
@@ -1,6 +1,7 @@
 {
   "ml.stop_datafeed": {
     "url_params": {
+      "allow_no_match": "__flag__",
       "allow_no_datafeeds": "__flag__",
       "force": "__flag__",
       "timeout": ""
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.stop_trained_model_deployment.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.stop_trained_model_deployment.json
new file mode 100644
index 0000000000000..94b34f597fc3b
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.stop_trained_model_deployment.json
@@ -0,0 +1,11 @@
+{
+  "ml.stop_trained_model_deployment": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_ml/trained_models/{model_id}/deployment/_stop"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/stop-trained-model-deployment.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_data_frame_analytics.json
new file mode 100644
index 0000000000000..e3134770742cb
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_data_frame_analytics.json
@@ -0,0 +1,11 @@
+{
+  "ml.update_data_frame_analytics": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_ml/data_frame/analytics/{id}/_update"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/update-dfanalytics.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.update_datafeed.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_datafeed.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.update_datafeed.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_datafeed.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.update_filter.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_filter.json
similarity index 52%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.update_filter.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_filter.json
index 3f48013c2be1c..16b6aedb404d3 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.update_filter.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_filter.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_ml/filters/{filter_id}/_update"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-update-filter.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.update_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_job.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.update_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_job.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.update_model_snapshot.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_model_snapshot.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.update_model_snapshot.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.update_model_snapshot.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.upgrade.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.upgrade.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.upgrade.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.upgrade.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/ml.upgrade_job_snapshot.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.upgrade_job_snapshot.json
new file mode 100644
index 0000000000000..6818eab2bb084
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.upgrade_job_snapshot.json
@@ -0,0 +1,15 @@
+{
+  "ml.upgrade_job_snapshot": {
+    "url_params": {
+      "timeout": "",
+      "wait_for_completion": "__flag__"
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_upgrade"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-upgrade-job-model-snapshot.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.validate.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.validate.json
similarity index 54%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.validate.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.validate.json
index 298c7cf6dce26..da07f1a2fa203 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.validate.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.validate.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_ml/anomaly_detectors/_validate"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/machine-learning/current/ml-jobs.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.validate_detector.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.validate_detector.json
similarity index 58%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.validate_detector.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ml.validate_detector.json
index 5e6d7daeea772..73527bd28c5d8 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.validate_detector.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/ml.validate_detector.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_ml/anomaly_detectors/_validate/detector"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/machine-learning/current/ml-jobs.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/monitoring.bulk.json b/src/plugins/console/server/lib/spec_definitions/json/generated/monitoring.bulk.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/monitoring.bulk.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/monitoring.bulk.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/msearch.json b/src/plugins/console/server/lib/spec_definitions/json/generated/msearch.json
index ecb71e9ba23c0..d460bf2b1add5 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/msearch.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/msearch.json
@@ -3,9 +3,7 @@
     "url_params": {
       "search_type": [
         "query_then_fetch",
-        "query_and_fetch",
-        "dfs_query_then_fetch",
-        "dfs_query_and_fetch"
+        "dfs_query_then_fetch"
       ],
       "max_concurrent_searches": "",
       "typed_keys": "__flag__",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/msearch_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/msearch_template.json
index 0b0ca087b1819..cc7cfbd6e82b6 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/msearch_template.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/msearch_template.json
@@ -3,9 +3,7 @@
     "url_params": {
       "search_type": [
         "query_then_fetch",
-        "query_and_fetch",
-        "dfs_query_then_fetch",
-        "dfs_query_and_fetch"
+        "dfs_query_then_fetch"
       ],
       "typed_keys": "__flag__",
       "max_concurrent_searches": "",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/mtermvectors.json b/src/plugins/console/server/lib/spec_definitions/json/generated/mtermvectors.json
index 72a134eca4d2e..20c3daca849c7 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/mtermvectors.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/mtermvectors.json
@@ -15,8 +15,7 @@
       "version_type": [
         "internal",
         "external",
-        "external_gte",
-        "force"
+        "external_gte"
       ]
     },
     "methods": [
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/nodes.stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/nodes.stats.json
index e194a6d42c031..cfbcf69b39b7a 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/nodes.stats.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/nodes.stats.json
@@ -12,7 +12,8 @@
       ],
       "types": [],
       "timeout": "",
-      "include_segment_file_sizes": "__flag__"
+      "include_segment_file_sizes": "__flag__",
+      "include_unloaded_segments": "__flag__"
     },
     "methods": [
       "GET"
@@ -33,6 +34,7 @@
         "discovery",
         "fs",
         "http",
+        "indexing_pressure",
         "indices",
         "jvm",
         "os",
@@ -42,6 +44,7 @@
       ],
       "index_metric": [
         "_all",
+        "bulk",
         "completion",
         "docs",
         "fielddata",
@@ -55,7 +58,6 @@
         "search",
         "segments",
         "store",
-        "suggest",
         "warmer"
       ]
     },
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/open_point_in_time.json b/src/plugins/console/server/lib/spec_definitions/json/generated/open_point_in_time.json
new file mode 100644
index 0000000000000..9ce78acbc1a2a
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/open_point_in_time.json
@@ -0,0 +1,25 @@
+{
+  "open_point_in_time": {
+    "url_params": {
+      "preference": "random",
+      "routing": "",
+      "ignore_unavailable": "__flag__",
+      "expand_wildcards": [
+        "open",
+        "closed",
+        "hidden",
+        "none",
+        "all"
+      ],
+      "keep_alive": ""
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_pit",
+      "{indices}/_pit"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/point-in-time-api.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/render_search_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/render_search_template.json
index e206140f9d16a..84377591e270b 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/render_search_template.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/render_search_template.json
@@ -8,6 +8,6 @@
       "_render/template",
       "_render/template/{id}"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/search-template.html#_validating_templates"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/render-search-template-api.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.delete_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.delete_job.json
new file mode 100644
index 0000000000000..4f7b37006c3b6
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.delete_job.json
@@ -0,0 +1,11 @@
+{
+  "rollup.delete_job": {
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_rollup/job/{id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/rollup-delete-job.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.get_jobs.json b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.get_jobs.json
similarity index 53%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.get_jobs.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/rollup.get_jobs.json
index 49524b394167c..70ce98063d57c 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.get_jobs.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.get_jobs.json
@@ -6,6 +6,7 @@
     "patterns": [
       "_rollup/job/{id}",
       "_rollup/job/"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/rollup-get-job.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.get_rollup_caps.json b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.get_rollup_caps.json
similarity index 53%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.get_rollup_caps.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/rollup.get_rollup_caps.json
index 8a0ef67a0ad4e..9d39f5a4e2ba8 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.get_rollup_caps.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.get_rollup_caps.json
@@ -6,6 +6,7 @@
     "patterns": [
       "_rollup/data/{id}",
       "_rollup/data/"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/rollup-get-rollup-caps.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.get_rollup_index_caps.json b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.get_rollup_index_caps.json
similarity index 50%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.get_rollup_index_caps.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/rollup.get_rollup_index_caps.json
index 325115553c294..f7ae6d14f675c 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.get_rollup_index_caps.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.get_rollup_index_caps.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "{indices}/_rollup/data"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/rollup-get-rollup-index-caps.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.put_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.put_job.json
new file mode 100644
index 0000000000000..7970008f8c8f4
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.put_job.json
@@ -0,0 +1,11 @@
+{
+  "rollup.put_job": {
+    "methods": [
+      "PUT"
+    ],
+    "patterns": [
+      "_rollup/job/{id}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/rollup-put-job.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.rollup.json b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.rollup.json
new file mode 100644
index 0000000000000..c3cc629abac80
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.rollup.json
@@ -0,0 +1,11 @@
+{
+  "rollup.rollup": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "{indices}/_rollup/{rollup_index}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/xpack-rollup.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.rollup_search.json b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.rollup_search.json
similarity index 68%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.rollup_search.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/rollup.rollup_search.json
index a1771126a71b4..431e5e532a323 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.rollup_search.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.rollup_search.json
@@ -10,6 +10,7 @@
     ],
     "patterns": [
       "{indices}/_rollup_search"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/rollup-search.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.start_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.start_job.json
similarity index 50%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.start_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/rollup.start_job.json
index 9714275072b07..39ced395166c7 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.start_job.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.start_job.json
@@ -5,6 +5,7 @@
     ],
     "patterns": [
       "_rollup/job/{id}/_start"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/rollup-start-job.html"
   }
 }
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.stop_job.json b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.stop_job.json
similarity index 64%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.stop_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/rollup.stop_job.json
index 70931030b4402..a1290cd388a09 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.stop_job.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/rollup.stop_job.json
@@ -9,6 +9,7 @@
     ],
     "patterns": [
       "_rollup/job/{id}/_stop"
-    ]
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/rollup-stop-job.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/search.json b/src/plugins/console/server/lib/spec_definitions/json/generated/search.json
index 78b969d3ed8f2..f5e3a0041c7a6 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/search.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/search.json
@@ -49,7 +49,7 @@
       "suggest_text": "",
       "timeout": "",
       "track_scores": "__flag__",
-      "track_total_hits": "__flag__",
+      "track_total_hits": "",
       "allow_partial_search_results": "__flag__",
       "typed_keys": "__flag__",
       "version": "__flag__",
@@ -58,7 +58,8 @@
       "batched_reduce_size": "",
       "max_concurrent_shard_requests": "",
       "pre_filter_shard_size": "",
-      "rest_total_hits_as_int": "__flag__"
+      "rest_total_hits_as_int": "__flag__",
+      "min_compatible_shard_node": ""
     },
     "methods": [
       "GET",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/search_template.json b/src/plugins/console/server/lib/spec_definitions/json/generated/search_template.json
index 748326522e5c2..6d7b3aa34c107 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/search_template.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/search_template.json
@@ -16,9 +16,7 @@
       "scroll": "",
       "search_type": [
         "query_then_fetch",
-        "query_and_fetch",
-        "dfs_query_then_fetch",
-        "dfs_query_and_fetch"
+        "dfs_query_then_fetch"
       ],
       "explain": "__flag__",
       "profile": "__flag__",
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.cache_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.cache_stats.json
new file mode 100644
index 0000000000000..5a53319c164f8
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.cache_stats.json
@@ -0,0 +1,15 @@
+{
+  "searchable_snapshots.cache_stats": {
+    "url_params": {
+      "master_timeout": ""
+    },
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_searchable_snapshots/cache/stats",
+      "_searchable_snapshots/{nodes}/cache/stats"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/searchable-snapshots-api-cache-stats.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.clear_cache.json b/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.clear_cache.json
new file mode 100644
index 0000000000000..428991f758cdb
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.clear_cache.json
@@ -0,0 +1,23 @@
+{
+  "searchable_snapshots.clear_cache": {
+    "url_params": {
+      "ignore_unavailable": "__flag__",
+      "allow_no_indices": "__flag__",
+      "expand_wildcards": [
+        "open",
+        "closed",
+        "none",
+        "all"
+      ],
+      "index": []
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_searchable_snapshots/cache/clear",
+      "{indices}/_searchable_snapshots/cache/clear"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/searchable-snapshots-apis.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.mount.json b/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.mount.json
new file mode 100644
index 0000000000000..6556c466120da
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.mount.json
@@ -0,0 +1,16 @@
+{
+  "searchable_snapshots.mount": {
+    "url_params": {
+      "master_timeout": "",
+      "wait_for_completion": "__flag__",
+      "storage": ""
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_snapshot/{repository}/{snapshot}/_mount"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/searchable-snapshots-api-mount-snapshot.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.stats.json
new file mode 100644
index 0000000000000..ccf7522634a0e
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/searchable_snapshots.stats.json
@@ -0,0 +1,19 @@
+{
+  "searchable_snapshots.stats": {
+    "url_params": {
+      "level": [
+        "cluster",
+        "indices",
+        "shards"
+      ]
+    },
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_searchable_snapshots/stats",
+      "{indices}/_searchable_snapshots/stats"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/searchable-snapshots-api-stats.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.authenticate.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.authenticate.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.authenticate.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.authenticate.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.change_password.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.change_password.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.change_password.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.change_password.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_api_key_cache.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_api_key_cache.json
new file mode 100644
index 0000000000000..0046dab4074e6
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_api_key_cache.json
@@ -0,0 +1,11 @@
+{
+  "security.clear_api_key_cache": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_security/api_key/{ids}/_clear_cache"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-clear-api-key-cache.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_cached_privileges.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_cached_privileges.json
new file mode 100644
index 0000000000000..aaab692cefc35
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_cached_privileges.json
@@ -0,0 +1,11 @@
+{
+  "security.clear_cached_privileges": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_security/privilege/{application}/_clear_cache"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-clear-privilege-cache.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.clear_cached_realms.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_cached_realms.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.clear_cached_realms.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_cached_realms.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.clear_cached_roles.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_cached_roles.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.clear_cached_roles.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_cached_roles.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_cached_service_tokens.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_cached_service_tokens.json
new file mode 100644
index 0000000000000..2fc747518fbc3
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.clear_cached_service_tokens.json
@@ -0,0 +1,11 @@
+{
+  "security.clear_cached_service_tokens": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_security/service/{namespace}/{service}/credential/token/{name}/_clear_cache"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-clear-service-token-caches.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.create_api_key.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.create_api_key.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.create_api_key.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.create_api_key.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.create_service_token.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.create_service_token.json
new file mode 100644
index 0000000000000..71c6ccedddc74
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.create_service_token.json
@@ -0,0 +1,20 @@
+{
+  "security.create_service_token": {
+    "url_params": {
+      "refresh": [
+        "true",
+        "false",
+        "wait_for"
+      ]
+    },
+    "methods": [
+      "PUT",
+      "POST"
+    ],
+    "patterns": [
+      "_security/service/{namespace}/{service}/credential/token/{name}",
+      "_security/service/{namespace}/{service}/credential/token"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-service-token.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.delete_privileges.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_privileges.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.delete_privileges.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_privileges.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.delete_role.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_role.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.delete_role.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_role.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.delete_role_mapping.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_role_mapping.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.delete_role_mapping.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_role_mapping.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_service_token.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_service_token.json
new file mode 100644
index 0000000000000..bfdfeb79cb27e
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_service_token.json
@@ -0,0 +1,18 @@
+{
+  "security.delete_service_token": {
+    "url_params": {
+      "refresh": [
+        "true",
+        "false",
+        "wait_for"
+      ]
+    },
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_security/service/{namespace}/{service}/credential/token/{name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-delete-service-token.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.delete_user.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_user.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.delete_user.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.delete_user.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.disable_user.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.disable_user.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.disable_user.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.disable_user.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.enable_user.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.enable_user.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.enable_user.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.enable_user.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.enroll_kibana.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.enroll_kibana.json
new file mode 100644
index 0000000000000..630adedd03ad7
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.enroll_kibana.json
@@ -0,0 +1,11 @@
+{
+  "security.enroll_kibana": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_security/enroll/kibana"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/security-api-enroll-kibana.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.enroll_node.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.enroll_node.json
new file mode 100644
index 0000000000000..d9cb7da17ed6e
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.enroll_node.json
@@ -0,0 +1,11 @@
+{
+  "security.enroll_node": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_security/enroll/node"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/security-api-node-enrollment.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_api_key.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_api_key.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_api_key.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.get_api_key.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_builtin_privileges.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_builtin_privileges.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_builtin_privileges.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.get_builtin_privileges.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_privileges.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_privileges.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_privileges.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.get_privileges.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_role.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_role.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_role.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.get_role.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_role_mapping.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_role_mapping.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_role_mapping.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.get_role_mapping.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_service_accounts.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_service_accounts.json
new file mode 100644
index 0000000000000..41afc1de8df5c
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_service_accounts.json
@@ -0,0 +1,13 @@
+{
+  "security.get_service_accounts": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_security/service/{namespace}/{service}",
+      "_security/service/{namespace}",
+      "_security/service"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-service-accounts.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_service_credentials.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_service_credentials.json
new file mode 100644
index 0000000000000..b98029aaae367
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_service_credentials.json
@@ -0,0 +1,11 @@
+{
+  "security.get_service_credentials": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_security/service/{namespace}/{service}/credential"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-service-credentials.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_token.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_token.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_token.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.get_token.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_user.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_user.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_user.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.get_user.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_user_privileges.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_user_privileges.json
similarity index 76%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_user_privileges.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.get_user_privileges.json
index 63bf8d6969344..1b939d2d9a29e 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.get_user_privileges.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.get_user_privileges.json
@@ -6,6 +6,6 @@
     "patterns": [
       "_security/user/_privileges"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-privileges.html"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-user-privileges.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.grant_api_key.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.grant_api_key.json
new file mode 100644
index 0000000000000..4d1a56e4fb0bb
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.grant_api_key.json
@@ -0,0 +1,18 @@
+{
+  "security.grant_api_key": {
+    "url_params": {
+      "refresh": [
+        "true",
+        "false",
+        "wait_for"
+      ]
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_security/api_key/grant"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-grant-api-key.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.has_privileges.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.has_privileges.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.has_privileges.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.has_privileges.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.invalidate_api_key.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.invalidate_api_key.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.invalidate_api_key.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.invalidate_api_key.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.invalidate_token.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.invalidate_token.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.invalidate_token.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.invalidate_token.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.put_privileges.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.put_privileges.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.put_privileges.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.put_privileges.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.put_role.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.put_role.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.put_role.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.put_role.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.put_role_mapping.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.put_role_mapping.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.put_role_mapping.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.put_role_mapping.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.put_user.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.put_user.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/security.put_user.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/security.put_user.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_authenticate.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_authenticate.json
new file mode 100644
index 0000000000000..5ed30f2a4ef83
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_authenticate.json
@@ -0,0 +1,11 @@
+{
+  "security.saml_authenticate": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_security/saml/authenticate"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-saml-authenticate.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_complete_logout.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_complete_logout.json
new file mode 100644
index 0000000000000..7ecc4bdbc8784
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_complete_logout.json
@@ -0,0 +1,11 @@
+{
+  "security.saml_complete_logout": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_security/saml/complete_logout"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-saml-complete-logout.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_invalidate.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_invalidate.json
new file mode 100644
index 0000000000000..cea5236c474f4
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_invalidate.json
@@ -0,0 +1,11 @@
+{
+  "security.saml_invalidate": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_security/saml/invalidate"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-saml-invalidate.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_logout.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_logout.json
new file mode 100644
index 0000000000000..4300c948199b3
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_logout.json
@@ -0,0 +1,11 @@
+{
+  "security.saml_logout": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_security/saml/logout"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-saml-logout.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_prepare_authentication.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_prepare_authentication.json
new file mode 100644
index 0000000000000..fa4303ccfedae
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_prepare_authentication.json
@@ -0,0 +1,11 @@
+{
+  "security.saml_prepare_authentication": {
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_security/saml/prepare"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-saml-prepare-authentication.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_service_provider_metadata.json b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_service_provider_metadata.json
new file mode 100644
index 0000000000000..a77953309c9ce
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/security.saml_service_provider_metadata.json
@@ -0,0 +1,11 @@
+{
+  "security.saml_service_provider_metadata": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_security/saml/metadata/{realm_name}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-saml-sp-metadata.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/shutdown.delete_node.json b/src/plugins/console/server/lib/spec_definitions/json/generated/shutdown.delete_node.json
new file mode 100644
index 0000000000000..18605b2afc549
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/shutdown.delete_node.json
@@ -0,0 +1,11 @@
+{
+  "shutdown.delete_node": {
+    "methods": [
+      "DELETE"
+    ],
+    "patterns": [
+      "_nodes/{nodes}/shutdown"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/shutdown.get_node.json b/src/plugins/console/server/lib/spec_definitions/json/generated/shutdown.get_node.json
new file mode 100644
index 0000000000000..0b9c9139b57e3
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/shutdown.get_node.json
@@ -0,0 +1,12 @@
+{
+  "shutdown.get_node": {
+    "methods": [
+      "GET"
+    ],
+    "patterns": [
+      "_nodes/shutdown",
+      "_nodes/{nodes}/shutdown"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/shutdown.put_node.json b/src/plugins/console/server/lib/spec_definitions/json/generated/shutdown.put_node.json
new file mode 100644
index 0000000000000..aee49831305f1
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/shutdown.put_node.json
@@ -0,0 +1,11 @@
+{
+  "shutdown.put_node": {
+    "methods": [
+      "PUT"
+    ],
+    "patterns": [
+      "_nodes/{nodes}/shutdown"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.delete_lifecycle.json b/src/plugins/console/server/lib/spec_definitions/json/generated/slm.delete_lifecycle.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.delete_lifecycle.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/slm.delete_lifecycle.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.execute_lifecycle.json b/src/plugins/console/server/lib/spec_definitions/json/generated/slm.execute_lifecycle.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.execute_lifecycle.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/slm.execute_lifecycle.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.execute_retention.json b/src/plugins/console/server/lib/spec_definitions/json/generated/slm.execute_retention.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.execute_retention.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/slm.execute_retention.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.get_lifecycle.json b/src/plugins/console/server/lib/spec_definitions/json/generated/slm.get_lifecycle.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.get_lifecycle.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/slm.get_lifecycle.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.get_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/slm.get_stats.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.get_stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/slm.get_stats.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.get_status.json b/src/plugins/console/server/lib/spec_definitions/json/generated/slm.get_status.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.get_status.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/slm.get_status.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.put_lifecycle.json b/src/plugins/console/server/lib/spec_definitions/json/generated/slm.put_lifecycle.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.put_lifecycle.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/slm.put_lifecycle.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.start.json b/src/plugins/console/server/lib/spec_definitions/json/generated/slm.start.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.start.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/slm.start.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.stop.json b/src/plugins/console/server/lib/spec_definitions/json/generated/slm.stop.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/slm.stop.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/slm.stop.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.cleanup_repository.json b/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.cleanup_repository.json
index eed3e597dc070..cd29d6c300dc6 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.cleanup_repository.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.cleanup_repository.json
@@ -10,6 +10,6 @@
     "patterns": [
       "_snapshot/{repository}/_cleanup"
     ],
-    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-snapshots.html"
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/clean-up-snapshot-repo-api.html"
   }
 }
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.clone.json b/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.clone.json
new file mode 100644
index 0000000000000..ef8eedf78ac91
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.clone.json
@@ -0,0 +1,14 @@
+{
+  "snapshot.clone": {
+    "url_params": {
+      "master_timeout": ""
+    },
+    "methods": [
+      "PUT"
+    ],
+    "patterns": [
+      "_snapshot/{repository}/{snapshot}/_clone/{target_snapshot}"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-snapshots.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.get.json b/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.get.json
index b37141728f6b7..8edb85f416b48 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.get.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.get.json
@@ -3,7 +3,12 @@
     "url_params": {
       "master_timeout": "",
       "ignore_unavailable": "__flag__",
-      "verbose": "__flag__"
+      "index_details": "__flag__",
+      "verbose": "__flag__",
+      "sort": ["start_time", "duration", "name", "index_count"],
+      "size": "",
+      "order": "",
+      "after": ""
     },
     "methods": [
       "GET"
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.repository_analyze.json b/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.repository_analyze.json
new file mode 100644
index 0000000000000..cf591a66ad2fd
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/snapshot.repository_analyze.json
@@ -0,0 +1,24 @@
+{
+  "snapshot.repository_analyze": {
+    "url_params": {
+      "blob_count": "",
+      "concurrency": "",
+      "read_node_count": "",
+      "early_read_node_count": "",
+      "seed": "",
+      "rare_action_probability": "",
+      "max_blob_size": "",
+      "max_total_data_size": "",
+      "timeout": "",
+      "detailed": "__flag__",
+      "rarely_abort_writes": "__flag__"
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_snapshot/{repository}/_analyze"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-snapshots.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/sql.clear_cursor.json b/src/plugins/console/server/lib/spec_definitions/json/generated/sql.clear_cursor.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/sql.clear_cursor.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/sql.clear_cursor.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/sql.query.json b/src/plugins/console/server/lib/spec_definitions/json/generated/sql.query.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/sql.query.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/sql.query.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/sql.translate.json b/src/plugins/console/server/lib/spec_definitions/json/generated/sql.translate.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/sql.translate.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/sql.translate.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ssl.certificates.json b/src/plugins/console/server/lib/spec_definitions/json/generated/ssl.certificates.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ssl.certificates.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/ssl.certificates.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/tasks.cancel.json b/src/plugins/console/server/lib/spec_definitions/json/generated/tasks.cancel.json
index 7a84c6acb53a7..2583876b93625 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/tasks.cancel.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/tasks.cancel.json
@@ -3,7 +3,8 @@
     "url_params": {
       "nodes": [],
       "actions": [],
-      "parent_task_id": ""
+      "parent_task_id": "",
+      "wait_for_completion": "__flag__"
     },
     "methods": [
       "POST"
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/terms_enum.json b/src/plugins/console/server/lib/spec_definitions/json/generated/terms_enum.json
new file mode 100644
index 0000000000000..c1cb06b8a195a
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/terms_enum.json
@@ -0,0 +1,12 @@
+{
+  "terms_enum": {
+    "methods": [
+      "GET",
+      "POST"
+    ],
+    "patterns": [
+      "{indices}/_terms_enum"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/search-terms-enum.html"
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/termvectors.json b/src/plugins/console/server/lib/spec_definitions/json/generated/termvectors.json
index d94cffc38b7af..53ea7a9d6cbf6 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/termvectors.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/termvectors.json
@@ -14,8 +14,7 @@
       "version_type": [
         "internal",
         "external",
-        "external_gte",
-        "force"
+        "external_gte"
       ]
     },
     "methods": [
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/text_structure.find_structure.json b/src/plugins/console/server/lib/spec_definitions/json/generated/text_structure.find_structure.json
new file mode 100644
index 0000000000000..8b5e576b495a3
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/text_structure.find_structure.json
@@ -0,0 +1,32 @@
+{
+  "text_structure.find_structure": {
+    "url_params": {
+      "lines_to_sample": 0,
+      "line_merge_size_limit": 0,
+      "timeout": "",
+      "charset": "",
+      "format": [
+        "ndjson",
+        "xml",
+        "delimited",
+        "semi_structured_text"
+      ],
+      "has_header_row": "__flag__",
+      "column_names": [],
+      "delimiter": "",
+      "quote": "",
+      "should_trim_fields": "__flag__",
+      "grok_pattern": "",
+      "timestamp_field": "",
+      "timestamp_format": "",
+      "explain": "__flag__"
+    },
+    "methods": [
+      "POST"
+    ],
+    "patterns": [
+      "_text_structure/find_structure"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/find-structure.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.cat_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/transform.cat_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.cat_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/transform.cat_transform.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.delete_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/transform.delete_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.delete_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/transform.delete_transform.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.get_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/transform.get_transform.json
similarity index 81%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.get_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/transform.get_transform.json
index 2875ff8b91937..3a50ff7fc3c1c 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.get_transform.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/transform.get_transform.json
@@ -3,7 +3,8 @@
     "url_params": {
       "from": 0,
       "size": 0,
-      "allow_no_match": "__flag__"
+      "allow_no_match": "__flag__",
+      "exclude_generated": "__flag__"
     },
     "methods": [
       "GET"
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.get_transform_stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/transform.get_transform_stats.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.get_transform_stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/transform.get_transform_stats.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.preview_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/transform.preview_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.preview_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/transform.preview_transform.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.put_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/transform.put_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.put_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/transform.put_transform.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.start_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/transform.start_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.start_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/transform.start_transform.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.stop_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/transform.stop_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.stop_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/transform.stop_transform.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.update_transform.json b/src/plugins/console/server/lib/spec_definitions/json/generated/transform.update_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/transform.update_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/transform.update_transform.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/update.json b/src/plugins/console/server/lib/spec_definitions/json/generated/update.json
index 43945dfada35c..4dd33978a77b8 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/update.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/update.json
@@ -15,7 +15,8 @@
       "routing": "",
       "timeout": "",
       "if_seq_no": "",
-      "if_primary_term": ""
+      "if_primary_term": "",
+      "require_alias": "__flag__"
     },
     "methods": [
       "POST"
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/update_by_query.json b/src/plugins/console/server/lib/spec_definitions/json/generated/update_by_query.json
index 596f8f8b83963..b4b88312e638e 100644
--- a/src/plugins/console/server/lib/spec_definitions/json/generated/update_by_query.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/update_by_query.json
@@ -33,7 +33,6 @@
         "dfs_query_then_fetch"
       ],
       "search_timeout": "",
-      "size": "",
       "max_docs": "all documents",
       "sort": [],
       "_source": [],
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.ack_watch.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.ack_watch.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.ack_watch.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/watcher.ack_watch.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.activate_watch.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.activate_watch.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.activate_watch.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/watcher.activate_watch.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.deactivate_watch.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.deactivate_watch.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.deactivate_watch.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/watcher.deactivate_watch.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.delete_watch.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.delete_watch.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.delete_watch.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/watcher.delete_watch.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.execute_watch.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.execute_watch.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.execute_watch.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/watcher.execute_watch.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.get_watch.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.get_watch.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.get_watch.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/watcher.get_watch.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.put_watch.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.put_watch.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.put_watch.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/watcher.put_watch.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.query_watches.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.query_watches.json
new file mode 100644
index 0000000000000..ea6f03a5672c1
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.query_watches.json
@@ -0,0 +1,12 @@
+{
+  "watcher.query_watches": {
+    "methods": [
+      "GET",
+      "POST"
+    ],
+    "patterns": [
+      "_watcher/_query/watches"
+    ],
+    "documentation": "https://www.elastic.co/guide/en/elasticsearch/reference/current/watcher-api-query-watches.html"
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.start.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.start.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.start.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/watcher.start.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.stats.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.stats.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/watcher.stats.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.stop.json b/src/plugins/console/server/lib/spec_definitions/json/generated/watcher.stop.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/watcher.stop.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/watcher.stop.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/xpack.info.json b/src/plugins/console/server/lib/spec_definitions/json/generated/xpack.info.json
similarity index 78%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/xpack.info.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/xpack.info.json
index 5b555dc129390..da92c12c5fd69 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/xpack.info.json
+++ b/src/plugins/console/server/lib/spec_definitions/json/generated/xpack.info.json
@@ -1,7 +1,8 @@
 {
   "xpack.info": {
     "url_params": {
-      "categories": []
+      "categories": [],
+      "accept_enterprise": "__flag__"
     },
     "methods": [
       "GET"
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/xpack.ssl.certificates.json b/src/plugins/console/server/lib/spec_definitions/json/generated/xpack.ssl.certificates.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/xpack.ssl.certificates.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/xpack.ssl.certificates.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/xpack.usage.json b/src/plugins/console/server/lib/spec_definitions/json/generated/xpack.usage.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/xpack.usage.json
rename to src/plugins/console/server/lib/spec_definitions/json/generated/xpack.usage.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/async_search.submit.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/async_search.submit.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/async_search.submit.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/async_search.submit.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ccr.follow.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ccr.follow.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ccr.follow.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ccr.follow.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ccr.forget_follower.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ccr.forget_follower.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ccr.forget_follower.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ccr.forget_follower.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ccr.put_auto_follow_pattern.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ccr.put_auto_follow_pattern.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ccr.put_auto_follow_pattern.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ccr.put_auto_follow_pattern.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ccr.resume_follow.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ccr.resume_follow.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ccr.resume_follow.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ccr.resume_follow.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/enrich.put_policy.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/enrich.put_policy.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/enrich.put_policy.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/enrich.put_policy.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ilm.move_to_step.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ilm.move_to_step.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ilm.move_to_step.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ilm.move_to_step.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ilm.put_lifecycle.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ilm.put_lifecycle.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ilm.put_lifecycle.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ilm.put_lifecycle.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.evaluate_data_frame.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.evaluate_data_frame.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.evaluate_data_frame.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.evaluate_data_frame.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.explain_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.explain_data_frame_analytics.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.explain_data_frame_analytics.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.explain_data_frame_analytics.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_buckets.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_buckets.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_buckets.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_buckets.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_calendar_events.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_calendar_events.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_calendar_events.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_calendar_events.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_calendars.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_calendars.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_calendars.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_calendars.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_categories.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_categories.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_categories.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_categories.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_influencers.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_influencers.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_influencers.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_influencers.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_model_snapshots.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_model_snapshots.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_model_snapshots.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_model_snapshots.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_overall_buckets.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_overall_buckets.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_overall_buckets.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_overall_buckets.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_records.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_records.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.get_records.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.get_records.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.post_calendar_events.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.post_calendar_events.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.post_calendar_events.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.post_calendar_events.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.put_calendar.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.put_calendar.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.put_calendar.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.put_calendar.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.put_data_frame_analytics.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.put_data_frame_analytics.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.put_data_frame_analytics.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.put_data_frame_analytics.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.put_datafeed.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.put_datafeed.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.put_datafeed.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.put_datafeed.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.put_job.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.put_job.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.put_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.put_job.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.put_trained_model.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.put_trained_model.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.put_trained_model.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.put_trained_model.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.revert_model_snapshot.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.revert_model_snapshot.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.revert_model_snapshot.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.revert_model_snapshot.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.update_datafeed.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.update_datafeed.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.update_datafeed.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.update_datafeed.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.update_job.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.update_job.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.update_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.update_job.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.update_model_snapshot.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/ml.update_model_snapshot.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/ml.update_model_snapshot.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/ml.update_model_snapshot.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.authenticate.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.authenticate.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.authenticate.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/security.authenticate.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.change_password.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.change_password.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.change_password.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/security.change_password.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.create_api_key.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.create_api_key.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.create_api_key.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/security.create_api_key.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.get_token.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.get_token.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.get_token.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/security.get_token.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.has_privileges.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.has_privileges.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.has_privileges.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/security.has_privileges.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.invalidate_api_key.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.invalidate_api_key.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.invalidate_api_key.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/security.invalidate_api_key.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.invalidate_token.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.invalidate_token.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.invalidate_token.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/security.invalidate_token.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.put_role.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.put_role.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.put_role.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/security.put_role.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.put_role_mapping.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.put_role_mapping.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.put_role_mapping.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/security.put_role_mapping.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.put_user.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.put_user.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/security.put_user.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/security.put_user.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_authenticate.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_authenticate.json
new file mode 100644
index 0000000000000..a1d50daa70572
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_authenticate.json
@@ -0,0 +1,9 @@
+{
+  "security.saml_authenticate": {
+    "data_autocomplete_rules": {
+     "content": "",
+      "ids": [],
+      "realm": ""
+    }
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_complete_logout.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_complete_logout.json
new file mode 100644
index 0000000000000..b9d5b83e0424c
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_complete_logout.json
@@ -0,0 +1,10 @@
+{
+  "security.saml_complete_logout": {
+    "data_autocomplete_rules": {
+      "realm": "",
+      "ids": [],
+      "query_string": "",
+      "content": ""
+    }
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_invalidate.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_invalidate.json
new file mode 100644
index 0000000000000..f4a27d659c360
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_invalidate.json
@@ -0,0 +1,9 @@
+{
+  "security.saml_invalidate": {
+    "data_autocomplete_rules": {
+      "query_string": "",
+      "acs": "",
+      "realm": ""
+    }
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_logout.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_logout.json
new file mode 100644
index 0000000000000..40e5c6bc09299
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_logout.json
@@ -0,0 +1,8 @@
+{
+  "security.saml_logout": {
+    "data_autocomplete_rules": {
+      "token": "",
+      "refresh_token": ""
+    }
+  }
+}
diff --git a/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_prepare_authentication.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_prepare_authentication.json
new file mode 100644
index 0000000000000..4ebdd53c95166
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/overrides/security.saml_prepare_authentication.json
@@ -0,0 +1,8 @@
+{
+  "security.saml_prepare_authentication": {
+    "data_autocomplete_rules": {
+      "acs": "",
+      "realm": ""
+    }
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/slm.put_lifecycle.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/slm.put_lifecycle.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/slm.put_lifecycle.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/slm.put_lifecycle.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/slm.start.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/slm.start.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/slm.start.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/slm.start.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/slm.stop.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/slm.stop.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/slm.stop.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/slm.stop.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/sql.query.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/sql.query.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/sql.query.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/sql.query.json
diff --git a/src/plugins/console/server/lib/spec_definitions/json/overrides/terms_enum.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/terms_enum.json
new file mode 100644
index 0000000000000..3a3681cefe072
--- /dev/null
+++ b/src/plugins/console/server/lib/spec_definitions/json/overrides/terms_enum.json
@@ -0,0 +1,12 @@
+{
+  "terms_enum": {
+    "data_autocomplete_rules": {
+      "field": "",
+      "string": "",
+      "size": "",
+      "timeout": "",
+      "case_insensitive": { "__one_of": [true, false] },
+      "index_filter": ""
+    }
+  }
+}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/transform.get_transform_stats.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/transform.get_transform_stats.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/transform.get_transform_stats.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/transform.get_transform_stats.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/transform.preview_transform.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/transform.preview_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/transform.preview_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/transform.preview_transform.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/transform.put_transform.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/transform.put_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/transform.put_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/transform.put_transform.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/transform.stop_transform.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/transform.stop_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/transform.stop_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/transform.stop_transform.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/transform.update_transform.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/transform.update_transform.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/transform.update_transform.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/transform.update_transform.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.graph.explore.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.graph.explore.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.graph.explore.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.graph.explore.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.info.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.info.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.info.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.info.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.license.post.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.license.post.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.license.post.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.license.post.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.rollup.delete_job.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.rollup.delete_job.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.rollup.delete_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.rollup.delete_job.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.rollup.put_job.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.rollup.put_job.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.rollup.put_job.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.rollup.put_job.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.rollup.rollup_search.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.rollup.rollup_search.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.rollup.rollup_search.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.rollup.rollup_search.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.authenticate.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.authenticate.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.authenticate.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.authenticate.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.change_password.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.change_password.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.change_password.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.change_password.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.get_token.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.get_token.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.get_token.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.get_token.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.invalidate_token.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.invalidate_token.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.invalidate_token.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.invalidate_token.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.put_role.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.put_role.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.put_role.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.put_role.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.put_role_mapping.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.put_role_mapping.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.put_role_mapping.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.put_role_mapping.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.put_user.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.put_user.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.security.put_user.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.security.put_user.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.watcher.execute_watch.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.watcher.execute_watch.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.watcher.execute_watch.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.watcher.execute_watch.json
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.watcher.put_watch.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.watcher.put_watch.json
similarity index 100%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/json/overrides/xpack.watcher.put_watch.json
rename to src/plugins/console/server/lib/spec_definitions/json/overrides/xpack.watcher.put_watch.json
diff --git a/src/plugins/dashboard/public/application/top_nav/save_modal.tsx b/src/plugins/dashboard/public/application/top_nav/save_modal.tsx
index 79ac3917fb968..b0ed1ad0de9b6 100644
--- a/src/plugins/dashboard/public/application/top_nav/save_modal.tsx
+++ b/src/plugins/dashboard/public/application/top_nav/save_modal.tsx
@@ -8,6 +8,7 @@
 
 import React, { Fragment } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
 import { EuiFormRow, EuiTextArea, EuiSwitch } from '@elastic/eui';
 
 import type { SavedObjectsTaggingApi } from '../../services/saved_objects_tagging_oss';
@@ -148,7 +149,9 @@ export class DashboardSaveModal extends React.Component<Props, State> {
         title={this.props.title}
         showCopyOnSave={this.props.showCopyOnSave}
         initialCopyOnSave={this.props.showCopyOnSave}
-        objectType="dashboard"
+        objectType={i18n.translate('dashboard.topNav.saveModal.objectType', {
+          defaultMessage: 'dashboard',
+        })}
         options={this.renderDashboardSaveOptions()}
         showDescription={false}
       />
diff --git a/src/plugins/data/common/index_patterns/types.ts b/src/plugins/data/common/index_patterns/types.ts
index b03e745df74a6..58cc6d0478d5e 100644
--- a/src/plugins/data/common/index_patterns/types.ts
+++ b/src/plugins/data/common/index_patterns/types.ts
@@ -150,9 +150,17 @@ export type AggregationRestrictions = Record<
     time_zone?: string;
   }
 >;
+
 export interface TypeMeta {
   aggs?: Record<string, AggregationRestrictions>;
-  [key: string]: any;
+  params?: {
+    rollup_index: string;
+  };
+}
+
+export enum IndexPatternType {
+  DEFAULT = 'default',
+  ROLLUP = 'rollup',
 }
 
 export type FieldSpecConflictDescriptions = Record<string, string[]>;
diff --git a/src/plugins/data/common/search/expressions/esaggs/request_handler.ts b/src/plugins/data/common/search/expressions/esaggs/request_handler.ts
index 61193c52a5e74..bf931966f5bae 100644
--- a/src/plugins/data/common/search/expressions/esaggs/request_handler.ts
+++ b/src/plugins/data/common/search/expressions/esaggs/request_handler.ts
@@ -100,8 +100,6 @@ export const handleRequest = async ({
   requestSearchSource.setField('filter', filters);
   requestSearchSource.setField('query', query);
 
-  inspectorAdapters.requests?.reset();
-
   const { rawResponse: response } = await requestSearchSource
     .fetch$({
       abortSignal,
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index e9e50ebfaf138..9af1cbf95d94d 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -269,6 +269,7 @@ export {
   IndexPatternLoadExpressionFunctionDefinition,
   fieldList,
   INDEX_PATTERN_SAVED_OBJECT_TYPE,
+  IndexPatternType,
 } from '../common';
 
 export { DuplicateIndexPatternError } from '../common/index_patterns/errors';
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index b8af7c12d57fc..6c0ddd000f30a 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -1688,14 +1688,26 @@ export class IndexPatternsService {
     updateSavedObject(indexPattern: IndexPattern, saveAttempts?: number, ignoreErrors?: boolean): Promise<void | Error>;
 }
 
+// Warning: (ae-missing-release-tag) "IndexPatternType" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export enum IndexPatternType {
+    // (undocumented)
+    DEFAULT = "default",
+    // (undocumented)
+    ROLLUP = "rollup"
+}
+
 // Warning: (ae-missing-release-tag) "TypeMeta" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
 export interface IndexPatternTypeMeta {
-    // (undocumented)
-    [key: string]: any;
     // (undocumented)
     aggs?: Record<string, IndexPatternAggRestrictions>;
+    // (undocumented)
+    params?: {
+        rollup_index: string;
+    };
 }
 
 // Warning: (ae-missing-release-tag) "injectReferences" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -2766,20 +2778,20 @@ export interface WaitUntilNextSessionCompletesOptions {
 // src/plugins/data/public/index.ts:238:27 - (ae-forgotten-export) The symbol "validateIndexPattern" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/index.ts:238:27 - (ae-forgotten-export) The symbol "flattenHitWrapper" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/index.ts:238:27 - (ae-forgotten-export) The symbol "formatHitProvider" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:409:20 - (ae-forgotten-export) The symbol "getResponseInspectorStats" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:409:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:409:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:411:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:412:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:421:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:422:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:423:1 - (ae-forgotten-export) The symbol "IpAddress" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:424:1 - (ae-forgotten-export) The symbol "isDateHistogramBucketAggConfig" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:428:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:429:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:432:1 - (ae-forgotten-export) The symbol "parseInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:433:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:436:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:410:20 - (ae-forgotten-export) The symbol "getResponseInspectorStats" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:410:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:410:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:412:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:413:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:422:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:423:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:424:1 - (ae-forgotten-export) The symbol "IpAddress" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:425:1 - (ae-forgotten-export) The symbol "isDateHistogramBucketAggConfig" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:429:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:430:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:433:1 - (ae-forgotten-export) The symbol "parseInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:434:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:437:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/query/state_sync/connect_to_query_state.ts:34:5 - (ae-forgotten-export) The symbol "FilterStateStore" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/search/session/session_service.ts:62:5 - (ae-forgotten-export) The symbol "UrlGeneratorStateMapping" needs to be exported by the entry point index.d.ts
 
diff --git a/src/plugins/data/public/ui/filter_bar/filter_bar.tsx b/src/plugins/data/public/ui/filter_bar/filter_bar.tsx
index 4655bbf8e91a5..cc796ad749f0b 100644
--- a/src/plugins/data/public/ui/filter_bar/filter_bar.tsx
+++ b/src/plugins/data/public/ui/filter_bar/filter_bar.tsx
@@ -77,7 +77,7 @@ function FilterBarUI(props: Props) {
 
     const button = (
       <EuiButtonEmpty
-        size="xs"
+        size="s"
         onClick={() => setIsAddFilterPopoverOpen(true)}
         data-test-subj="addFilter"
         className="globalFilterBar__addButton"
diff --git a/src/plugins/discover/public/application/apps/main/components/top_nav/on_save_search.tsx b/src/plugins/discover/public/application/apps/main/components/top_nav/on_save_search.tsx
index f4b969e977254..c3d1df096c32f 100644
--- a/src/plugins/discover/public/application/apps/main/components/top_nav/on_save_search.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/top_nav/on_save_search.tsx
@@ -135,7 +135,9 @@ export async function onSaveSearch({
       onClose={() => {}}
       title={savedSearch.title}
       showCopyOnSave={!!savedSearch.id}
-      objectType="search"
+      objectType={i18n.translate('discover.localMenu.saveSaveSearchObjectType', {
+        defaultMessage: 'search',
+      })}
       description={i18n.translate('discover.localMenu.saveSaveSearchDescription', {
         defaultMessage:
           'Save your Discover search so you can use it in visualizations and dashboards',
diff --git a/src/plugins/discover/public/application/apps/main/services/use_saved_search.ts b/src/plugins/discover/public/application/apps/main/services/use_saved_search.ts
index 8c847b54078eb..b449d35dca9ad 100644
--- a/src/plugins/discover/public/application/apps/main/services/use_saved_search.ts
+++ b/src/plugins/discover/public/application/apps/main/services/use_saved_search.ts
@@ -279,13 +279,21 @@ export const useSavedSearch = ({
     ).pipe(debounceTime(100));
 
     const subscription = fetch$.subscribe((val) => {
-      fetchAll(val === 'reset');
+      try {
+        fetchAll(val === 'reset');
+      } catch (error) {
+        data$.next({
+          state: FetchStatus.ERROR,
+          fetchError: error,
+        });
+      }
     });
 
     return () => {
       subscription.unsubscribe();
     };
   }, [
+    data$,
     data.query.queryString,
     filterManager,
     refetch$,
diff --git a/src/plugins/discover/public/application/components/table/table.test.tsx b/src/plugins/discover/public/application/components/table/table.test.tsx
index a38a9e41aa242..5a8d3e7d2db46 100644
--- a/src/plugins/discover/public/application/components/table/table.test.tsx
+++ b/src/plugins/discover/public/application/components/table/table.test.tsx
@@ -334,6 +334,33 @@ describe('DocViewTable at Discover Doc with Fields API', () => {
             },
           },
         },
+        {
+          name: 'city',
+          displayName: 'city',
+          type: 'keyword',
+          isMapped: true,
+          readFromDocValues: true,
+          searchable: true,
+          shortDotsEnable: false,
+          scripted: false,
+          filterable: false,
+        },
+        {
+          name: 'city.raw',
+          displayName: 'city.raw',
+          type: 'string',
+          isMapped: true,
+          spec: {
+            subType: {
+              multi: {
+                parent: 'city',
+              },
+            },
+          },
+          shortDotsEnable: false,
+          scripted: false,
+          filterable: false,
+        },
       ],
     },
     metaFields: ['_index', '_type', '_score', '_id'],
@@ -380,6 +407,7 @@ describe('DocViewTable at Discover Doc with Fields API', () => {
       customer_first_name: 'Betty',
       'customer_first_name.keyword': 'Betty',
       'customer_first_name.nickname': 'Betsy',
+      'city.raw': 'Los Angeles',
     },
   };
   const props = {
@@ -417,6 +445,8 @@ describe('DocViewTable at Discover Doc with Fields API', () => {
       findTestSubject(component, 'tableDocViewRow-customer_first_name.nickname-multifieldBadge')
         .length
     ).toBe(1);
+
+    expect(findTestSubject(component, 'tableDocViewRow-city.raw').length).toBe(1);
   });
 
   it('does not render multifield rows if showMultiFields flag is not set', () => {
@@ -449,5 +479,7 @@ describe('DocViewTable at Discover Doc with Fields API', () => {
       findTestSubject(component, 'tableDocViewRow-customer_first_name.nickname-multifieldBadge')
         .length
     ).toBe(0);
+
+    expect(findTestSubject(component, 'tableDocViewRow-city.raw').length).toBe(1);
   });
 });
diff --git a/src/plugins/discover/public/application/components/table/table.tsx b/src/plugins/discover/public/application/components/table/table.tsx
index 065b146105a65..2d261805d8eb8 100644
--- a/src/plugins/discover/public/application/components/table/table.tsx
+++ b/src/plugins/discover/public/application/components/table/table.tsx
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { useCallback, useMemo } from 'react';
+import React, { useCallback, useMemo, useState } from 'react';
 import { EuiInMemoryTable } from '@elastic/eui';
 import { IndexPattern, IndexPatternField } from '../../../../../data/public';
 import { SHOW_MULTIFIELDS } from '../../../../common';
@@ -60,6 +60,8 @@ export const DocViewerTable = ({
     indexPattern?.fields,
   ]);
 
+  const [childParentFieldsMap] = useState({} as Record<string, string>);
+
   const formattedHit = useMemo(() => indexPattern?.formatHit(hit, 'html'), [hit, indexPattern]);
 
   const tableColumns = useMemo(() => {
@@ -92,11 +94,21 @@ export const DocViewerTable = ({
   }
 
   const flattened = indexPattern.flattenHit(hit);
+  Object.keys(flattened).forEach((key) => {
+    const field = mapping(key);
+    if (field && field.spec?.subType?.multi?.parent) {
+      childParentFieldsMap[field.name] = field.spec.subType.multi.parent;
+    }
+  });
   const items: FieldRecord[] = Object.keys(flattened)
     .filter((fieldName) => {
       const fieldMapping = mapping(fieldName);
       const isMultiField = !!fieldMapping?.spec?.subType?.multi;
-      return isMultiField ? showMultiFields : true;
+      if (!isMultiField) {
+        return true;
+      }
+      const parent = childParentFieldsMap[fieldName];
+      return showMultiFields || (parent && !flattened.hasOwnProperty(parent));
     })
     .sort((fieldA, fieldB) => {
       const mappingA = mapping(fieldA);
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts
index 1152290f7d553..0a6f2cc2c2b18 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts
@@ -62,7 +62,7 @@ export const UseArray = ({
   const uniqueId = useRef(0);
 
   const form = useFormContext();
-  const { __getFieldDefaultValue } = form;
+  const { getFieldDefaultValue } = form;
 
   const getNewItemAtIndex = useCallback(
     (index: number): ArrayItem => ({
@@ -75,7 +75,7 @@ export const UseArray = ({
 
   const fieldDefaultValue = useMemo<ArrayItem[]>(() => {
     const defaultValues = readDefaultValueOnForm
-      ? (__getFieldDefaultValue(path) as any[])
+      ? (getFieldDefaultValue(path) as any[])
       : undefined;
 
     const getInitialItemsFromValues = (values: any[]): ArrayItem[] =>
@@ -88,13 +88,7 @@ export const UseArray = ({
     return defaultValues
       ? getInitialItemsFromValues(defaultValues)
       : new Array(initialNumberOfItems).fill('').map((_, i) => getNewItemAtIndex(i));
-  }, [
-    path,
-    initialNumberOfItems,
-    readDefaultValueOnForm,
-    __getFieldDefaultValue,
-    getNewItemAtIndex,
-  ]);
+  }, [path, initialNumberOfItems, readDefaultValueOnForm, getFieldDefaultValue, getNewItemAtIndex]);
 
   // Create a new hook field with the "isIncludedInOutput" set to false so we don't use its value to build the final form data.
   // Apart from that the field behaves like a normal field and is hooked into the form validation lifecycle.
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx
index 3a5fbaba8f3b8..45fa2e977a6c7 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx
@@ -59,8 +59,7 @@ function UseFieldComp<T = unknown, FormType = FormData, I = T>(props: Props<T, F
   } else {
     if (readDefaultValueOnForm) {
       // Read the field initial value from the "defaultValue" object passed to the form
-      fieldConfig.initialValue =
-        (form.__getFieldDefaultValue(path) as T) ?? fieldConfig.defaultValue;
+      fieldConfig.initialValue = (form.getFieldDefaultValue(path) as T) ?? fieldConfig.defaultValue;
     }
   }
 
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.test.tsx
new file mode 100644
index 0000000000000..0e5dd7eb82e72
--- /dev/null
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.test.tsx
@@ -0,0 +1,140 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { act } from 'react-dom/test-utils';
+import { registerTestBed } from '../shared_imports';
+
+import { Form, UseField } from '../components';
+import React from 'react';
+import { useForm } from '.';
+import { emptyField } from '../../helpers/field_validators';
+import { FieldHook, FieldValidateResponse, VALIDATION_TYPES } from '..';
+
+describe('useField() hook', () => {
+  describe('field.validate()', () => {
+    const EMPTY_VALUE = '   ';
+
+    test('It should not invalidate a field with arrayItem validation when isBlocking is false', async () => {
+      let fieldHook: FieldHook;
+
+      const TestField = ({ field }: { field: FieldHook }) => {
+        fieldHook = field;
+        return null;
+      };
+
+      const TestForm = () => {
+        const { form } = useForm();
+
+        return (
+          <Form form={form}>
+            <UseField
+              path="test-path"
+              component={TestField}
+              config={{
+                validations: [
+                  {
+                    validator: emptyField('error-message'),
+                    type: VALIDATION_TYPES.ARRAY_ITEM,
+                    isBlocking: false,
+                  },
+                ],
+              }}
+            />
+          </Form>
+        );
+      };
+
+      registerTestBed(TestForm)();
+
+      let validateResponse: FieldValidateResponse;
+
+      await act(async () => {
+        validateResponse = await fieldHook!.validate({
+          value: EMPTY_VALUE,
+          validationType: VALIDATION_TYPES.ARRAY_ITEM,
+        });
+      });
+
+      // validation fails for ARRAY_ITEM with a non-blocking validation error
+      expect(validateResponse!).toEqual({
+        isValid: false,
+        errors: [
+          {
+            code: 'ERR_FIELD_MISSING',
+            path: 'test-path',
+            message: 'error-message',
+            __isBlocking__: false,
+            validationType: 'arrayItem',
+          },
+        ],
+      });
+
+      // expect the field to be valid because the validation error is non-blocking
+      expect(fieldHook!.isValid).toBe(true);
+    });
+
+    test('It should invalidate an arrayItem field when isBlocking is true', async () => {
+      let fieldHook: FieldHook;
+
+      const TestField = ({ field }: { field: FieldHook }) => {
+        fieldHook = field;
+        return null;
+      };
+
+      const TestForm = () => {
+        const { form } = useForm();
+
+        return (
+          <Form form={form}>
+            <UseField
+              path="test-path"
+              component={TestField}
+              config={{
+                validations: [
+                  {
+                    validator: emptyField('error-message'),
+                    type: VALIDATION_TYPES.ARRAY_ITEM,
+                    isBlocking: true,
+                  },
+                ],
+              }}
+            />
+          </Form>
+        );
+      };
+
+      registerTestBed(TestForm)();
+
+      let validateResponse: FieldValidateResponse;
+
+      await act(async () => {
+        validateResponse = await fieldHook!.validate({
+          value: EMPTY_VALUE,
+          validationType: VALIDATION_TYPES.ARRAY_ITEM,
+        });
+      });
+
+      // validation fails for ARRAY_ITEM with a blocking validation error
+      expect(validateResponse!).toEqual({
+        isValid: false,
+        errors: [
+          {
+            code: 'ERR_FIELD_MISSING',
+            path: 'test-path',
+            message: 'error-message',
+            __isBlocking__: true,
+            validationType: 'arrayItem',
+          },
+        ],
+      });
+
+      // expect the field to be invalid because the validation error is blocking
+      expect(fieldHook!.isValid).toBe(false);
+    });
+  });
+});
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
index 0cf1bb3601667..77bb17d7b9e60 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
@@ -15,6 +15,7 @@ import {
   FieldValidateResponse,
   ValidationError,
   FormData,
+  ValidationConfig,
 } from '../types';
 import { FIELD_TYPES, VALIDATION_TYPES } from '../constants';
 
@@ -189,10 +190,12 @@ export const useField = <T, FormType = FormData, I = T>(
       {
         formData,
         value: valueToValidate,
+        onlyBlocking: runOnlyBlockingValidations,
         validationTypeToValidate,
       }: {
         formData: any;
         value: I;
+        onlyBlocking: boolean;
         validationTypeToValidate?: string;
       },
       clearFieldErrors: FieldHook['clearErrors']
@@ -203,10 +206,31 @@ export const useField = <T, FormType = FormData, I = T>(
 
       // By default, for fields that have an asynchronous validation
       // we will clear the errors as soon as the field value changes.
-      clearFieldErrors([VALIDATION_TYPES.FIELD, VALIDATION_TYPES.ASYNC]);
+      clearFieldErrors([
+        validationTypeToValidate ?? VALIDATION_TYPES.FIELD,
+        VALIDATION_TYPES.ASYNC,
+      ]);
 
       cancelInflightValidation();
 
+      const doByPassValidation = ({
+        type: validationType,
+        isBlocking,
+      }: ValidationConfig<FormType, string, I>) => {
+        if (
+          typeof validationTypeToValidate !== 'undefined' &&
+          validationType !== validationTypeToValidate
+        ) {
+          return true;
+        }
+
+        if (runOnlyBlockingValidations && isBlocking === false) {
+          return true;
+        }
+
+        return false;
+      };
+
       const runAsync = async () => {
         const validationErrors: ValidationError[] = [];
 
@@ -219,10 +243,7 @@ export const useField = <T, FormType = FormData, I = T>(
             type: validationType = VALIDATION_TYPES.FIELD,
           } = validation;
 
-          if (
-            typeof validationTypeToValidate !== 'undefined' &&
-            validationType !== validationTypeToValidate
-          ) {
+          if (doByPassValidation(validation)) {
             continue;
           }
 
@@ -265,10 +286,7 @@ export const useField = <T, FormType = FormData, I = T>(
             type: validationType = VALIDATION_TYPES.FIELD,
           } = validation;
 
-          if (
-            typeof validationTypeToValidate !== 'undefined' &&
-            validationType !== validationTypeToValidate
-          ) {
+          if (doByPassValidation(validation)) {
             continue;
           }
 
@@ -344,6 +362,7 @@ export const useField = <T, FormType = FormData, I = T>(
         formData = __getFormData$().value,
         value: valueToValidate = value,
         validationType,
+        onlyBlocking = false,
       } = validationData;
 
       setIsValidated(true);
@@ -377,6 +396,7 @@ export const useField = <T, FormType = FormData, I = T>(
           formData,
           value: valueToValidate,
           validationTypeToValidate: validationType,
+          onlyBlocking,
         },
         clearErrors
       );
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
index 40fc179c73c3b..92a9876f1cd30 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
@@ -10,7 +10,7 @@ import React, { useEffect } from 'react';
 import { act } from 'react-dom/test-utils';
 
 import { registerTestBed, getRandomString, TestBed } from '../shared_imports';
-
+import { emptyField } from '../../helpers/field_validators';
 import { Form, UseField } from '../components';
 import {
   FormSubmitHandler,
@@ -18,7 +18,8 @@ import {
   FormHook,
   ValidationFunc,
   FieldConfig,
-} from '../types';
+  VALIDATION_TYPES,
+} from '..';
 import { useForm } from './use_form';
 
 interface MyForm {
@@ -501,4 +502,74 @@ describe('useForm() hook', () => {
       expect(isValid).toBeUndefined(); // Make sure it is "undefined" and not "false".
     });
   });
+
+  describe('form.validate()', () => {
+    test('should not invalidate a field with arrayItem validation when validating a form', async () => {
+      const TestComp = () => {
+        const { form } = useForm();
+        formHook = form;
+
+        return (
+          <Form form={form}>
+            <UseField
+              path="test-path"
+              config={{
+                validations: [
+                  {
+                    validator: emptyField('error-message'),
+                    type: VALIDATION_TYPES.ARRAY_ITEM,
+                    isBlocking: false,
+                  },
+                ],
+              }}
+            />
+          </Form>
+        );
+      };
+
+      registerTestBed(TestComp)();
+
+      let isValid: boolean = false;
+
+      await act(async () => {
+        isValid = await formHook!.validate();
+      });
+
+      expect(isValid).toBe(true);
+    });
+
+    test('should invalidate a field with a blocking arrayItem validation when validating a form', async () => {
+      const TestComp = () => {
+        const { form } = useForm();
+        formHook = form;
+
+        return (
+          <Form form={form}>
+            <UseField
+              path="test-path"
+              config={{
+                validations: [
+                  {
+                    validator: emptyField('error-message'),
+                    type: VALIDATION_TYPES.ARRAY_ITEM,
+                    isBlocking: true,
+                  },
+                ],
+              }}
+            />
+          </Form>
+        );
+      };
+
+      registerTestBed(TestComp)();
+
+      let isValid: boolean = false;
+
+      await act(async () => {
+        isValid = await formHook!.validate();
+      });
+
+      expect(isValid).toBe(false);
+    });
+  });
 });
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
index fb334afb22b13..dcf2cb37d6542 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
@@ -151,14 +151,14 @@ export function useForm<T extends FormData = FormData, I extends FormData = T>(
   }, [fieldsToArray]);
 
   const validateFields: FormHook<T, I>['__validateFields'] = useCallback(
-    async (fieldNames) => {
+    async (fieldNames, onlyBlocking = false) => {
       const fieldsToValidate = fieldNames
         .map((name) => fieldsRefs.current[name])
         .filter((field) => field !== undefined);
 
       const formData = getFormData$().value;
       const validationResult = await Promise.all(
-        fieldsToValidate.map((field) => field.validate({ formData }))
+        fieldsToValidate.map((field) => field.validate({ formData, onlyBlocking }))
       );
 
       if (isMounted.current === false) {
@@ -257,11 +257,6 @@ export function useForm<T extends FormData = FormData, I extends FormData = T>(
     [getFormData$, updateFormData$, fieldsToArray]
   );
 
-  const getFieldDefaultValue: FormHook<T, I>['__getFieldDefaultValue'] = useCallback(
-    (fieldName) => get(defaultValueDeserialized.current, fieldName),
-    []
-  );
-
   const readFieldConfigFromSchema: FormHook<T, I>['__readFieldConfigFromSchema'] = useCallback(
     (fieldName) => {
       const config = (get(schema ?? {}, fieldName) as FieldConfig) || {};
@@ -315,7 +310,8 @@ export function useForm<T extends FormData = FormData, I extends FormData = T>(
     if (fieldsToValidate.length === 0) {
       isFormValid = fieldsArray.every(isFieldValid);
     } else {
-      ({ isFormValid } = await validateFields(fieldsToValidate.map((field) => field.path)));
+      const fieldPathsToValidate = fieldsToValidate.map((field) => field.path);
+      ({ isFormValid } = await validateFields(fieldPathsToValidate, true));
     }
 
     setIsValid(isFormValid);
@@ -338,6 +334,11 @@ export function useForm<T extends FormData = FormData, I extends FormData = T>(
 
   const getFields: FormHook<T, I>['getFields'] = useCallback(() => fieldsRefs.current, []);
 
+  const getFieldDefaultValue: FormHook<T, I>['getFieldDefaultValue'] = useCallback(
+    (fieldName) => get(defaultValueDeserialized.current, fieldName),
+    []
+  );
+
   const submit: FormHook<T, I>['submit'] = useCallback(
     async (e) => {
       if (e) {
@@ -430,6 +431,7 @@ export function useForm<T extends FormData = FormData, I extends FormData = T>(
       setFieldValue,
       setFieldErrors,
       getFields,
+      getFieldDefaultValue,
       getFormData,
       getErrors,
       reset,
@@ -438,7 +440,6 @@ export function useForm<T extends FormData = FormData, I extends FormData = T>(
       __updateFormDataAt: updateFormDataAt,
       __updateDefaultValueAt: updateDefaultValueAt,
       __readFieldConfigFromSchema: readFieldConfigFromSchema,
-      __getFieldDefaultValue: getFieldDefaultValue,
       __addField: addField,
       __removeField: removeField,
       __validateFields: validateFields,
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
index 75c918d4340f2..4e9ff29f0cdd3 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
@@ -36,6 +36,8 @@ export interface FormHook<T extends FormData = FormData, I extends FormData = T>
   setFieldErrors: (fieldName: string, errors: ValidationError[]) => void;
   /** Access the fields on the form. */
   getFields: () => FieldsMap;
+  /** Access the defaultValue for a specific field */
+  getFieldDefaultValue: (path: string) => unknown;
   /**
    * Return the form data. It accepts an optional options object with an `unflatten` parameter (defaults to `true`).
    * If you are only interested in the raw form data, pass `unflatten: false` to the handler
@@ -53,12 +55,13 @@ export interface FormHook<T extends FormData = FormData, I extends FormData = T>
   __addField: (field: FieldHook) => void;
   __removeField: (fieldNames: string | string[]) => void;
   __validateFields: (
-    fieldNames: string[]
+    fieldNames: string[],
+    /** Run only blocking validations */
+    onlyBlocking?: boolean
   ) => Promise<{ areFieldsValid: boolean; isFormValid: boolean | undefined }>;
   __updateFormDataAt: (field: string, value: unknown) => void;
   __updateDefaultValueAt: (field: string, value: unknown) => void;
   __readFieldConfigFromSchema: (field: string) => FieldConfig;
-  __getFieldDefaultValue: (path: string) => unknown;
 }
 
 export type FormSchema<T extends FormData = FormData> = {
@@ -137,6 +140,7 @@ export interface FieldHook<T = unknown, I = T> {
     formData?: any;
     value?: I;
     validationType?: string;
+    onlyBlocking?: boolean;
   }) => FieldValidateResponse | Promise<FieldValidateResponse>;
   reset: (options?: { resetValue?: boolean; defaultValue?: T }) => unknown | undefined;
   // Flag to indicate if the field value will be included in the form data outputted
diff --git a/src/plugins/expressions/common/execution/execution.test.ts b/src/plugins/expressions/common/execution/execution.test.ts
index 8c6f457105d42..2e9d4b91908a0 100644
--- a/src/plugins/expressions/common/execution/execution.test.ts
+++ b/src/plugins/expressions/common/execution/execution.test.ts
@@ -339,6 +339,14 @@ describe('Execution', () => {
       });
       expect(execution.inspectorAdapters).toBe(inspectorAdapters);
     });
+
+    test('it should reset the request adapter only on startup', async () => {
+      const inspectorAdapters = { requests: { reset: jest.fn() } };
+      await run('add val={add 5 | access "value"}', {
+        inspectorAdapters,
+      });
+      expect(inspectorAdapters.requests.reset).toHaveBeenCalledTimes(1);
+    });
   });
 
   describe('expression abortion', () => {
diff --git a/src/plugins/expressions/common/execution/execution.ts b/src/plugins/expressions/common/execution/execution.ts
index 47209c348257e..ef925b3a68294 100644
--- a/src/plugins/expressions/common/execution/execution.ts
+++ b/src/plugins/expressions/common/execution/execution.ts
@@ -280,13 +280,18 @@ export class Execution<
    * because in legacy interpreter it was set to `null` by default.
    */
   public start(
-    input: Input = null as any
+    input: Input = null as any,
+    isSubExpression?: boolean
   ): Observable<ExecutionResult<Output | ExpressionValueError>> {
     if (this.hasStarted) throw new Error('Execution already started.');
     this.hasStarted = true;
     this.input = input;
     this.state.transitions.start();
 
+    if (!isSubExpression) {
+      this.context.inspectorAdapters.requests?.reset();
+    }
+
     if (isObservable<Input>(input)) {
       input.subscribe(this.input$);
     } else if (isPromise(input)) {
@@ -534,7 +539,7 @@ export class Execution<
         );
         this.childExecutions.push(execution);
 
-        return execution.start(input);
+        return execution.start(input, true);
       case 'string':
       case 'number':
       case 'null':
diff --git a/src/plugins/expressions/public/public.api.md b/src/plugins/expressions/public/public.api.md
index 2d9c6d94cfa6d..55655cfc5d156 100644
--- a/src/plugins/expressions/public/public.api.md
+++ b/src/plugins/expressions/public/public.api.md
@@ -120,7 +120,7 @@ export class Execution<Input = unknown, Output = unknown, InspectorAdapters exte
     // (undocumented)
     resolveArgs(fnDef: ExpressionFunction, input: unknown, argAsts: any): Observable<any>;
     readonly result: Observable<ExecutionResult<Output | ExpressionValueError>>;
-    start(input?: Input): Observable<ExecutionResult<Output | ExpressionValueError>>;
+    start(input?: Input, isSubExpression?: boolean): Observable<ExecutionResult<Output | ExpressionValueError>>;
     // Warning: (ae-forgotten-export) The symbol "ExecutionResult" needs to be exported by the entry point index.d.ts
     readonly state: ExecutionContainer<ExecutionResult<Output | ExpressionValueError>>;
 }
diff --git a/src/plugins/expressions/server/server.api.md b/src/plugins/expressions/server/server.api.md
index ec16d95ea8a3f..a34727e7a770f 100644
--- a/src/plugins/expressions/server/server.api.md
+++ b/src/plugins/expressions/server/server.api.md
@@ -118,7 +118,7 @@ export class Execution<Input = unknown, Output = unknown, InspectorAdapters exte
     // (undocumented)
     resolveArgs(fnDef: ExpressionFunction, input: unknown, argAsts: any): Observable<any>;
     readonly result: Observable<ExecutionResult<Output | ExpressionValueError>>;
-    start(input?: Input): Observable<ExecutionResult<Output | ExpressionValueError>>;
+    start(input?: Input, isSubExpression?: boolean): Observable<ExecutionResult<Output | ExpressionValueError>>;
     // Warning: (ae-forgotten-export) The symbol "ExecutionResult" needs to be exported by the entry point index.d.ts
     readonly state: ExecutionContainer<ExecutionResult<Output | ExpressionValueError>>;
 }
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/__snapshots__/indexed_fields_table.test.tsx.snap b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/__snapshots__/indexed_fields_table.test.tsx.snap
index 32a2b936edd00..c03899554ffff 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/__snapshots__/indexed_fields_table.test.tsx.snap
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/__snapshots__/indexed_fields_table.test.tsx.snap
@@ -1,5 +1,148 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
+exports[`IndexedFieldsTable IndexedFieldsTable with rollup index pattern should render normally 1`] = `
+<div>
+  <Table
+    deleteField={[Function]}
+    editField={[Function]}
+    indexPattern={
+      Object {
+        "getFormatterForFieldNoDefault": [Function],
+        "getNonScriptedFields": [Function],
+        "type": "rollup",
+        "typeMeta": Object {
+          "aggs": Object {
+            "avg": Object {
+              "amount": Object {
+                "agg": "avg",
+              },
+            },
+            "date_histogram": Object {
+              "timestamp": Object {
+                "agg": "date_histogram",
+                "delay": "30s",
+                "fixed_interval": "30s",
+                "time_zone": "UTC",
+              },
+            },
+            "histogram": Object {
+              "amount": Object {
+                "agg": "histogram",
+                "interval": 5,
+              },
+            },
+            "max": Object {
+              "amount": Object {
+                "agg": "max",
+              },
+            },
+            "min": Object {
+              "amount": Object {
+                "agg": "min",
+              },
+            },
+            "sum": Object {
+              "amount": Object {
+                "agg": "sum",
+              },
+            },
+            "terms": Object {
+              "Elastic": Object {
+                "agg": "terms",
+              },
+            },
+            "value_count": Object {
+              "amount": Object {
+                "agg": "value_count",
+              },
+            },
+          },
+          "params": Object {
+            "rollup-index": "rollup",
+          },
+        },
+      }
+    }
+    items={
+      Array [
+        Object {
+          "displayName": "Elastic",
+          "esTypes": Array [
+            "keyword",
+          ],
+          "excluded": false,
+          "format": "",
+          "hasRuntime": false,
+          "info": Array [
+            "Rollup aggregations:",
+            "terms",
+          ],
+          "isMapped": false,
+          "kbnType": undefined,
+          "name": "Elastic",
+          "searchable": true,
+          "type": "keyword",
+        },
+        Object {
+          "displayName": "timestamp",
+          "esTypes": Array [
+            "date",
+          ],
+          "excluded": false,
+          "format": "",
+          "hasRuntime": false,
+          "info": Array [
+            "Rollup aggregations:",
+            "date_histogram (interval: 30s, delay: 30s, UTC)",
+          ],
+          "isMapped": false,
+          "kbnType": undefined,
+          "name": "timestamp",
+          "type": "date",
+        },
+        Object {
+          "displayName": "conflictingField",
+          "esTypes": Array [
+            "keyword",
+            "long",
+          ],
+          "excluded": false,
+          "format": "",
+          "hasRuntime": false,
+          "info": Array [],
+          "isMapped": false,
+          "kbnType": undefined,
+          "name": "conflictingField",
+          "type": "keyword, long",
+        },
+        Object {
+          "displayName": "amount",
+          "esTypes": Array [
+            "long",
+          ],
+          "excluded": false,
+          "format": "",
+          "hasRuntime": false,
+          "info": Array [
+            "Rollup aggregations:",
+            "histogram (interval: 5)",
+            "avg",
+            "max",
+            "min",
+            "sum",
+            "value_count",
+          ],
+          "isMapped": false,
+          "kbnType": undefined,
+          "name": "amount",
+          "type": "long",
+        },
+      ]
+    }
+  />
+</div>
+`;
+
 exports[`IndexedFieldsTable should filter based on the query bar 1`] = `
 <div>
   <Table
@@ -124,6 +267,20 @@ exports[`IndexedFieldsTable should render normally 1`] = `
           "name": "conflictingField",
           "type": "keyword, long",
         },
+        Object {
+          "displayName": "amount",
+          "esTypes": Array [
+            "long",
+          ],
+          "excluded": false,
+          "format": "",
+          "hasRuntime": false,
+          "info": Array [],
+          "isMapped": false,
+          "kbnType": undefined,
+          "name": "amount",
+          "type": "long",
+        },
       ]
     }
   />
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.test.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.test.tsx
index b9957534d8c69..163152b52e80b 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.test.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.test.tsx
@@ -8,13 +8,13 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
-import { IIndexPattern } from 'src/plugins/data/public';
+import { IndexPattern } from 'src/plugins/data/public';
 import { IndexedFieldItem } from '../../types';
 import { Table, renderFieldName } from './table';
 
 const indexPattern = {
   timeFieldName: 'timestamp',
-} as IIndexPattern;
+} as IndexPattern;
 
 const items: IndexedFieldItem[] = [
   {
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx
index e587ada6695cb..6d37e8f13d6b3 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx
@@ -8,8 +8,9 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
-import { IndexPatternField, IndexPattern } from 'src/plugins/data/public';
+import { IndexPatternField, IndexPattern, IndexPatternType } from 'src/plugins/data/public';
 import { IndexedFieldsTable } from './indexed_fields_table';
+import { RollupIndexPatternListConfig } from '../../../service/list';
 
 jest.mock('@elastic/eui', () => ({
   EuiFlexGroup: 'eui-flex-group',
@@ -28,7 +29,8 @@ jest.mock('./components/table', () => ({
 const helpers = {
   editField: (fieldName: string) => {},
   deleteField: (fieldName: string) => {},
-  getFieldInfo: () => [],
+  // getFieldInfo handles non rollups as well
+  getFieldInfo: new RollupIndexPatternListConfig().getFieldInfo,
 };
 
 const indexPattern = ({
@@ -36,6 +38,34 @@ const indexPattern = ({
   getFormatterForFieldNoDefault: () => ({ params: () => ({}) }),
 } as unknown) as IndexPattern;
 
+const rollupIndexPattern = ({
+  type: IndexPatternType.ROLLUP,
+  typeMeta: {
+    params: {
+      'rollup-index': 'rollup',
+    },
+    aggs: {
+      date_histogram: {
+        timestamp: {
+          agg: 'date_histogram',
+          fixed_interval: '30s',
+          delay: '30s',
+          time_zone: 'UTC',
+        },
+      },
+      terms: { Elastic: { agg: 'terms' } },
+      histogram: { amount: { agg: 'histogram', interval: 5 } },
+      avg: { amount: { agg: 'avg' } },
+      max: { amount: { agg: 'max' } },
+      min: { amount: { agg: 'min' } },
+      sum: { amount: { agg: 'sum' } },
+      value_count: { amount: { agg: 'value_count' } },
+    },
+  },
+  getNonScriptedFields: () => fields,
+  getFormatterForFieldNoDefault: () => ({ params: () => ({}) }),
+} as unknown) as IndexPattern;
+
 const mockFieldToIndexPatternField = (
   spec: Record<string, string | string[] | boolean | undefined>
 ) => {
@@ -51,6 +81,7 @@ const fields = [
   },
   { name: 'timestamp', displayName: 'timestamp', esTypes: ['date'] },
   { name: 'conflictingField', displayName: 'conflictingField', esTypes: ['keyword', 'long'] },
+  { name: 'amount', displayName: 'amount', esTypes: ['long'] },
 ].map(mockFieldToIndexPatternField);
 
 describe('IndexedFieldsTable', () => {
@@ -115,4 +146,26 @@ describe('IndexedFieldsTable', () => {
 
     expect(component).toMatchSnapshot();
   });
+
+  describe('IndexedFieldsTable with rollup index pattern', () => {
+    test('should render normally', async () => {
+      const component = shallow(
+        <IndexedFieldsTable
+          fields={fields}
+          indexPattern={rollupIndexPattern}
+          helpers={helpers}
+          fieldWildcardMatcher={() => {
+            return () => false;
+          }}
+          indexedFieldTypeFilter=""
+          fieldFilter=""
+        />
+      );
+
+      await new Promise((resolve) => process.nextTick(resolve));
+      component.update();
+
+      expect(component).toMatchSnapshot();
+    });
+  });
 });
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.tsx
index ee1147997079f..4e9aeb1874c89 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.tsx
@@ -8,7 +8,7 @@
 
 import React, { Component } from 'react';
 import { createSelector } from 'reselect';
-import { IndexPatternField, IndexPattern, IFieldType } from '../../../../../../plugins/data/public';
+import { IndexPatternField, IndexPattern } from '../../../../../../plugins/data/public';
 import { Table } from './components/table';
 import { IndexedFieldItem } from './types';
 
@@ -20,7 +20,7 @@ interface IndexedFieldsTableProps {
   helpers: {
     editField: (fieldName: string) => void;
     deleteField: (fieldName: string) => void;
-    getFieldInfo: (indexPattern: IndexPattern, field: IFieldType) => string[];
+    getFieldInfo: (indexPattern: IndexPattern, field: IndexPatternField) => string[];
   };
   fieldWildcardMatcher: (filters: any[]) => (val: any) => boolean;
 }
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/index_pattern_table.tsx b/src/plugins/index_pattern_management/public/components/index_pattern_table/index_pattern_table.tsx
index 6bd06528084ce..6405a81282471 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/index_pattern_table.tsx
+++ b/src/plugins/index_pattern_management/public/components/index_pattern_table/index_pattern_table.tsx
@@ -132,7 +132,7 @@ export const IndexPatternTable = ({ canSave, history }: Props) => {
         }
       ) => (
         <>
-          <EuiButtonEmpty size="xs" {...reactRouterNavigate(history, `patterns/${index.id}`)}>
+          <EuiButtonEmpty size="s" {...reactRouterNavigate(history, `patterns/${index.id}`)}>
             {name}
           </EuiButtonEmpty>
           &emsp;
diff --git a/src/plugins/index_pattern_management/public/service/list/config.ts b/src/plugins/index_pattern_management/public/service/list/config.ts
index e13f8c1c06241..4be27fc47d0db 100644
--- a/src/plugins/index_pattern_management/public/service/list/config.ts
+++ b/src/plugins/index_pattern_management/public/service/list/config.ts
@@ -7,8 +7,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { IIndexPattern, IFieldType } from 'src/plugins/data/public';
-import { SimpleSavedObject } from 'src/core/public';
+import { IndexPattern, IndexPatternField, IndexPatternType } from '../../../../data/public';
 
 export interface IndexPatternTag {
   key: string;
@@ -23,12 +22,9 @@ const defaultIndexPatternListName = i18n.translate(
 );
 
 export class IndexPatternListConfig {
-  public readonly key = 'default';
+  public readonly key: IndexPatternType = IndexPatternType.DEFAULT;
 
-  public getIndexPatternTags(
-    indexPattern: IIndexPattern | SimpleSavedObject<IIndexPattern>,
-    isDefault: boolean
-  ): IndexPatternTag[] {
+  public getIndexPatternTags(indexPattern: IndexPattern, isDefault: boolean): IndexPatternTag[] {
     return isDefault
       ? [
           {
@@ -39,11 +35,11 @@ export class IndexPatternListConfig {
       : [];
   }
 
-  public getFieldInfo(indexPattern: IIndexPattern, field: IFieldType): string[] {
+  public getFieldInfo(indexPattern: IndexPattern, field: IndexPatternField): string[] {
     return [];
   }
 
-  public areScriptedFieldsEnabled(indexPattern: IIndexPattern): boolean {
+  public areScriptedFieldsEnabled(indexPattern: IndexPattern): boolean {
     return true;
   }
 }
diff --git a/src/plugins/index_pattern_management/public/service/list/manager.ts b/src/plugins/index_pattern_management/public/service/list/manager.ts
index bdb2d47057f1f..d9cefbd8001a5 100644
--- a/src/plugins/index_pattern_management/public/service/list/manager.ts
+++ b/src/plugins/index_pattern_management/public/service/list/manager.ts
@@ -6,13 +6,11 @@
  * Side Public License, v 1.
  */
 
-import { IIndexPattern, IFieldType } from 'src/plugins/data/public';
-import { SimpleSavedObject } from 'src/core/public';
+import { IndexPattern, IndexPatternField } from 'src/plugins/data/public';
 import { once } from 'lodash';
 import { CoreStart } from '../../../../../core/public';
 import { IndexPatternListConfig, IndexPatternTag } from './config';
 import { CONFIG_ROLLUPS } from '../../constants';
-// @ts-ignore
 import { RollupIndexPatternListConfig } from './rollup_list_config';
 
 interface IndexPatternListManagerStart {
@@ -32,10 +30,7 @@ export class IndexPatternListManager {
       return configs;
     });
     return {
-      getIndexPatternTags: (
-        indexPattern: IIndexPattern | SimpleSavedObject<IIndexPattern>,
-        isDefault: boolean
-      ) =>
+      getIndexPatternTags: (indexPattern: IndexPattern, isDefault: boolean) =>
         getConfigs().reduce(
           (tags: IndexPatternTag[], config) =>
             config.getIndexPatternTags
@@ -44,14 +39,14 @@ export class IndexPatternListManager {
           []
         ),
 
-      getFieldInfo: (indexPattern: IIndexPattern, field: IFieldType): string[] =>
+      getFieldInfo: (indexPattern: IndexPattern, field: IndexPatternField): string[] =>
         getConfigs().reduce(
           (info: string[], config) =>
             config.getFieldInfo ? info.concat(config.getFieldInfo(indexPattern, field)) : info,
           []
         ),
 
-      areScriptedFieldsEnabled: (indexPattern: IIndexPattern): boolean =>
+      areScriptedFieldsEnabled: (indexPattern: IndexPattern): boolean =>
         getConfigs().every((config) =>
           config.areScriptedFieldsEnabled ? config.areScriptedFieldsEnabled(indexPattern) : true
         ),
diff --git a/src/plugins/index_pattern_management/public/service/list/rollup_list_config.js b/src/plugins/index_pattern_management/public/service/list/rollup_list_config.ts
similarity index 69%
rename from src/plugins/index_pattern_management/public/service/list/rollup_list_config.js
rename to src/plugins/index_pattern_management/public/service/list/rollup_list_config.ts
index 9a80d5fd0d622..bb9da0d461701 100644
--- a/src/plugins/index_pattern_management/public/service/list/rollup_list_config.js
+++ b/src/plugins/index_pattern_management/public/service/list/rollup_list_config.ts
@@ -6,18 +6,17 @@
  * Side Public License, v 1.
  */
 
+import { IndexPattern, IndexPatternField, IndexPatternType } from '../../../../data/public';
 import { IndexPatternListConfig } from '.';
 
-function isRollup(indexPattern) {
-  return (
-    indexPattern.type === 'rollup' || (indexPattern.get && indexPattern.get('type') === 'rollup')
-  );
+function isRollup(indexPattern: IndexPattern) {
+  return indexPattern.type === IndexPatternType.ROLLUP;
 }
 
 export class RollupIndexPatternListConfig extends IndexPatternListConfig {
-  key = 'rollup';
+  key = IndexPatternType.ROLLUP;
 
-  getIndexPatternTags = (indexPattern) => {
+  getIndexPatternTags = (indexPattern: IndexPattern) => {
     return isRollup(indexPattern)
       ? [
           {
@@ -28,13 +27,13 @@ export class RollupIndexPatternListConfig extends IndexPatternListConfig {
       : [];
   };
 
-  getFieldInfo = (indexPattern, field) => {
+  getFieldInfo = (indexPattern: IndexPattern, field: IndexPatternField) => {
     if (!isRollup(indexPattern)) {
       return [];
     }
 
     const allAggs = indexPattern.typeMeta && indexPattern.typeMeta.aggs;
-    const fieldAggs = allAggs && Object.keys(allAggs).filter((agg) => allAggs[agg][field]);
+    const fieldAggs = allAggs && Object.keys(allAggs).filter((agg) => allAggs[agg][field.name]);
 
     if (!fieldAggs || !fieldAggs.length) {
       return [];
@@ -42,13 +41,12 @@ export class RollupIndexPatternListConfig extends IndexPatternListConfig {
 
     return ['Rollup aggregations:'].concat(
       fieldAggs.map((aggName) => {
-        const agg = allAggs[aggName][field];
+        const agg = allAggs![aggName][field.name];
         switch (aggName) {
           case 'date_histogram':
-            return `${aggName} (interval: ${agg.interval}, ${
+            return `${aggName} (interval: ${agg.fixed_interval}, ${
               agg.delay ? `delay: ${agg.delay},` : ''
             } ${agg.time_zone})`;
-            break;
           case 'histogram':
             return `${aggName} (interval: ${agg.interval})`;
           default:
@@ -58,7 +56,7 @@ export class RollupIndexPatternListConfig extends IndexPatternListConfig {
     );
   };
 
-  areScriptedFieldsEnabled = (indexPattern) => {
+  areScriptedFieldsEnabled = (indexPattern: IndexPattern) => {
     return !isRollup(indexPattern);
   };
 }
diff --git a/src/plugins/kibana_react/public/page_template/page_template.test.tsx b/src/plugins/kibana_react/public/page_template/page_template.test.tsx
index 43f96a6c2b98c..2fdedce23b09b 100644
--- a/src/plugins/kibana_react/public/page_template/page_template.test.tsx
+++ b/src/plugins/kibana_react/public/page_template/page_template.test.tsx
@@ -125,4 +125,20 @@ describe('KibanaPageTemplate', () => {
     );
     expect(component).toMatchSnapshot();
   });
+
+  test('render sidebar classes', () => {
+    const component = shallow(
+      <KibanaPageTemplate
+        solutionNav={{
+          name: 'Solution',
+          icon: 'solution',
+          items: navItems,
+        }}
+        pageSideBarProps={{ className: 'customClass' }}
+      />
+    );
+    expect(component.prop('pageSideBarProps').className).toEqual(
+      'kbnPageTemplate__pageSideBar customClass'
+    );
+  });
 });
diff --git a/src/plugins/kibana_react/public/page_template/page_template.tsx b/src/plugins/kibana_react/public/page_template/page_template.tsx
index dabec978b67a4..1e63f2e068508 100644
--- a/src/plugins/kibana_react/public/page_template/page_template.tsx
+++ b/src/plugins/kibana_react/public/page_template/page_template.tsx
@@ -48,6 +48,7 @@ export const KibanaPageTemplate: FunctionComponent<KibanaPageTemplateProps> = ({
   isEmptyState,
   restrictWidth = true,
   pageSideBar,
+  pageSideBarProps,
   solutionNav,
   ...rest
 }) => {
@@ -117,8 +118,8 @@ export const KibanaPageTemplate: FunctionComponent<KibanaPageTemplateProps> = ({
       pageSideBar={pageSideBar}
       pageSideBarProps={{
         paddingSize: solutionNav ? 'none' : 'l',
-        ...rest.pageSideBarProps,
-        className: classNames(sideBarClasses, rest.pageSideBarProps?.className),
+        ...pageSideBarProps,
+        className: classNames(sideBarClasses, pageSideBarProps?.className),
       }}
       {...rest}
     >
diff --git a/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.tsx b/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.tsx
index 523bf07f828c9..f4ca53a9a974e 100644
--- a/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.tsx
+++ b/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.tsx
@@ -42,7 +42,7 @@ export function TopNavMenuItem(props: TopNavMenuData) {
       {upperFirst(props.label || props.id!)}
     </EuiButton>
   ) : (
-    <EuiHeaderLink size="xs" color="primary" {...commonButtonProps}>
+    <EuiHeaderLink size="s" color="primary" {...commonButtonProps}>
       {upperFirst(props.label || props.id!)}
     </EuiHeaderLink>
   );
diff --git a/src/plugins/visualize/public/application/utils/get_top_nav_config.tsx b/src/plugins/visualize/public/application/utils/get_top_nav_config.tsx
index da01f9d44879b..82757e9a8e357 100644
--- a/src/plugins/visualize/public/application/utils/get_top_nav_config.tsx
+++ b/src/plugins/visualize/public/application/utils/get_top_nav_config.tsx
@@ -449,7 +449,9 @@ export const getTopNavConfig = (
                     onSave={onSave}
                     options={tagOptions}
                     getAppNameFromId={stateTransfer.getAppNameFromId}
-                    objectType={'visualization'}
+                    objectType={i18n.translate('visualize.topNavMenu.saveVisualizationObjectType', {
+                      defaultMessage: 'visualization',
+                    })}
                     onClose={() => {}}
                     originatingApp={originatingApp}
                     returnToOriginSwitchLabel={
@@ -475,7 +477,9 @@ export const getTopNavConfig = (
                     canSaveByReference={Boolean(visualizeCapabilities.save)}
                     onSave={onSave}
                     tagOptions={tagOptions}
-                    objectType={'visualization'}
+                    objectType={i18n.translate('visualize.topNavMenu.saveVisualizationObjectType', {
+                      defaultMessage: 'visualization',
+                    })}
                     onClose={() => {}}
                   />
                 );
diff --git a/test/functional/apps/context/_context_navigation.js b/test/functional/apps/context/_context_navigation.js
index 2efc145b12561..7f72d44c50ea0 100644
--- a/test/functional/apps/context/_context_navigation.js
+++ b/test/functional/apps/context/_context_navigation.js
@@ -21,8 +21,7 @@ export default function ({ getService, getPageObjects }) {
   const PageObjects = getPageObjects(['common', 'context', 'discover', 'timePicker']);
   const kibanaServer = getService('kibanaServer');
 
-  // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/104364
-  describe.skip('discover - context - back navigation', function contextSize() {
+  describe('discover - context - back navigation', function contextSize() {
     before(async function () {
       await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
       await kibanaServer.uiSettings.update({ 'doc_table:legacy': true });
diff --git a/test/functional/apps/context/_discover_navigation.js b/test/functional/apps/context/_discover_navigation.js
index 6a2298ba48cb4..a09be8b35ba8f 100644
--- a/test/functional/apps/context/_discover_navigation.js
+++ b/test/functional/apps/context/_discover_navigation.js
@@ -32,8 +32,7 @@ export default function ({ getService, getPageObjects }) {
   const browser = getService('browser');
   const kibanaServer = getService('kibanaServer');
 
-  // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/104413
-  describe.skip('context link in discover', () => {
+  describe('context link in discover', () => {
     before(async () => {
       await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
       await kibanaServer.uiSettings.update({
diff --git a/test/functional/apps/dashboard/saved_search_embeddable.ts b/test/functional/apps/dashboard/saved_search_embeddable.ts
index 33d015a4c6019..5bcec338aad1e 100644
--- a/test/functional/apps/dashboard/saved_search_embeddable.ts
+++ b/test/functional/apps/dashboard/saved_search_embeddable.ts
@@ -17,8 +17,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const kibanaServer = getService('kibanaServer');
   const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'timePicker', 'discover']);
 
-  // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/104365
-  describe.skip('dashboard saved search embeddable', () => {
+  describe('dashboard saved search embeddable', () => {
     before(async () => {
       await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/logstash_functional');
       await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/dashboard/current/data');
diff --git a/test/functional/apps/dashboard/view_edit.ts b/test/functional/apps/dashboard/view_edit.ts
index 1ca70112c3d1e..b29b07f9df4e4 100644
--- a/test/functional/apps/dashboard/view_edit.ts
+++ b/test/functional/apps/dashboard/view_edit.ts
@@ -19,8 +19,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const dashboardName = 'dashboard with filter';
   const filterBar = getService('filterBar');
 
-  // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/104467
-  describe.skip('dashboard view edit mode', function viewEditModeTests() {
+  describe('dashboard view edit mode', function viewEditModeTests() {
     before(async () => {
       await esArchiver.load('test/functional/fixtures/es_archiver/dashboard/current/kibana');
       await kibanaServer.uiSettings.replace({
diff --git a/test/functional/apps/discover/_date_nested.ts b/test/functional/apps/discover/_date_nested.ts
new file mode 100644
index 0000000000000..8297d84832ff6
--- /dev/null
+++ b/test/functional/apps/discover/_date_nested.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const testSubjects = getService('testSubjects');
+  const PageObjects = getPageObjects(['common', 'timePicker', 'discover']);
+  const security = getService('security');
+
+  describe('timefield is a date in a nested field', function () {
+    before(async function () {
+      await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/date_nested');
+      await security.testUser.setRoles(['kibana_admin', 'kibana_date_nested']);
+      await PageObjects.common.navigateToApp('discover');
+    });
+
+    after(async function unloadMakelogs() {
+      await security.testUser.restoreDefaults();
+      await esArchiver.unload('test/functional/fixtures/es_archiver/date_nested');
+    });
+
+    it('should show an error message', async function () {
+      await PageObjects.discover.selectIndexPattern('date-nested');
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await testSubjects.existOrFail('discoverNoResultsError');
+    });
+  });
+}
diff --git a/test/functional/apps/discover/_discover.ts b/test/functional/apps/discover/_discover.ts
index 245b895d75b3a..bb75b4441f880 100644
--- a/test/functional/apps/discover/_discover.ts
+++ b/test/functional/apps/discover/_discover.ts
@@ -38,8 +38,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.timePicker.setDefaultAbsoluteRange();
     });
 
-    // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/104409
-    describe.skip('query', function () {
+    describe('query', function () {
       const queryName1 = 'Query # 1';
 
       it('should show correct time range string by timepicker', async function () {
diff --git a/test/functional/apps/discover/_field_data.ts b/test/functional/apps/discover/_field_data.ts
index ec9f9cf65e0fa..338d17ba31ff4 100644
--- a/test/functional/apps/discover/_field_data.ts
+++ b/test/functional/apps/discover/_field_data.ts
@@ -33,7 +33,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
       await PageObjects.common.navigateToApp('discover');
     });
-
     describe('field data', function () {
       it('search php should show the correct hit count', async function () {
         const expectedHitCount = '445';
diff --git a/test/functional/apps/discover/_saved_queries.ts b/test/functional/apps/discover/_saved_queries.ts
index 29073c5fe4ebb..20f2cab907d9b 100644
--- a/test/functional/apps/discover/_saved_queries.ts
+++ b/test/functional/apps/discover/_saved_queries.ts
@@ -40,8 +40,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.timePicker.setDefaultAbsoluteRange();
     });
 
-    // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/104366
-    describe.skip('saved query management component functionality', function () {
+    describe('saved query management component functionality', function () {
       before(async function () {
         // set up a query with filters and a time filter
         log.debug('set up a query with filters to save');
diff --git a/test/functional/apps/discover/index.ts b/test/functional/apps/discover/index.ts
index a17bf53e7f478..3a18a55fe138b 100644
--- a/test/functional/apps/discover/index.ts
+++ b/test/functional/apps/discover/index.ts
@@ -12,8 +12,7 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const browser = getService('browser');
 
-  // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/104466
-  describe.skip('discover app', function () {
+  describe('discover app', function () {
     this.tags('ciGroup6');
 
     before(function () {
@@ -51,5 +50,6 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./_indexpattern_with_unmapped_fields'));
     loadTestFile(require.resolve('./_runtime_fields_editor'));
     loadTestFile(require.resolve('./_huge_fields'));
+    loadTestFile(require.resolve('./_date_nested'));
   });
 }
diff --git a/test/functional/config.js b/test/functional/config.js
index c2c856517c58e..1c0c519f21e4c 100644
--- a/test/functional/config.js
+++ b/test/functional/config.js
@@ -247,6 +247,21 @@ export default async function ({ readConfigFile }) {
           },
           kibana: [],
         },
+
+        kibana_date_nested: {
+          elasticsearch: {
+            cluster: [],
+            indices: [
+              {
+                names: ['date-nested'],
+                privileges: ['read', 'view_index_metadata'],
+                field_security: { grant: ['*'], except: [] },
+              },
+            ],
+            run_as: [],
+          },
+          kibana: [],
+        },
         kibana_message_with_newline: {
           elasticsearch: {
             cluster: [],
diff --git a/test/functional/fixtures/es_archiver/date_nested/data.json b/test/functional/fixtures/es_archiver/date_nested/data.json
new file mode 100644
index 0000000000000..0bdb3fc510a63
--- /dev/null
+++ b/test/functional/fixtures/es_archiver/date_nested/data.json
@@ -0,0 +1,30 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "index-pattern:date-nested",
+    "index": ".kibana",
+    "source": {
+      "index-pattern": {
+       "fields":"[]",
+        "timeFieldName": "@timestamp",
+        "title": "date-nested"
+      },
+      "type": "index-pattern"
+    }
+  }
+}
+
+
+{
+  "type": "doc",
+  "value": {
+    "id": "date-nested-1",
+    "index": "date-nested",
+    "source": {
+      "message" : "test",
+      "nested": {
+        "timestamp": "2021-06-30T12:00:00.123Z"
+      }
+    }
+  }
+}
diff --git a/test/functional/fixtures/es_archiver/date_nested/mappings.json b/test/functional/fixtures/es_archiver/date_nested/mappings.json
new file mode 100644
index 0000000000000..f30e5863f4f8b
--- /dev/null
+++ b/test/functional/fixtures/es_archiver/date_nested/mappings.json
@@ -0,0 +1,22 @@
+{
+  "type": "index",
+  "value": {
+    "index": "date-nested",
+    "mappings": {
+      "properties": {
+        "message": {
+          "type": "text"
+        },
+        "nested": {
+          "type": "nested"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "0",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
diff --git a/tsconfig.json b/tsconfig.json
index f6df8fcbb6406..082325306e379 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -76,7 +76,6 @@
     { "path": "./x-pack/plugins/canvas/tsconfig.json" },
     { "path": "./x-pack/plugins/cases/tsconfig.json" },
     { "path": "./x-pack/plugins/cloud/tsconfig.json" },
-    { "path": "./x-pack/plugins/console_extensions/tsconfig.json" },
     { "path": "./x-pack/plugins/data_enhanced/tsconfig.json" },
     { "path": "./x-pack/plugins/dashboard_mode/tsconfig.json" },
     { "path": "./x-pack/plugins/discover_enhanced/tsconfig.json" },
diff --git a/tsconfig.refs.json b/tsconfig.refs.json
index e08b50cc055c1..bbaf18d29ae2a 100644
--- a/tsconfig.refs.json
+++ b/tsconfig.refs.json
@@ -63,7 +63,6 @@
     { "path": "./x-pack/plugins/canvas/tsconfig.json" },
     { "path": "./x-pack/plugins/cases/tsconfig.json" },
     { "path": "./x-pack/plugins/cloud/tsconfig.json" },
-    { "path": "./x-pack/plugins/console_extensions/tsconfig.json" },
     { "path": "./x-pack/plugins/dashboard_enhanced/tsconfig.json" },
     { "path": "./x-pack/plugins/data_enhanced/tsconfig.json" },
     { "path": "./x-pack/plugins/dashboard_mode/tsconfig.json" },
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/ActionMenu/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/ActionMenu/index.tsx
index 63ba7047696ca..4e6544a20f301 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/ActionMenu/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/ActionMenu/index.tsx
@@ -6,12 +6,7 @@
  */
 
 import React from 'react';
-import {
-  EuiButtonEmpty,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiToolTip,
-} from '@elastic/eui';
+import { EuiHeaderLinks, EuiHeaderLink, EuiToolTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import {
   createExploratoryViewUrl,
@@ -62,38 +57,29 @@ export function UXActionMenu({
     <HeaderMenuPortal
       setHeaderActionMenu={appMountParameters.setHeaderActionMenu}
     >
-      <EuiFlexGroup
-        alignItems="center"
-        gutterSize="s"
-        responsive={false}
-        style={{ paddingRight: 20 }}
-      >
-        <EuiFlexItem>
-          <EuiToolTip position="top" content={<p>{ANALYZE_MESSAGE}</p>}>
-            <EuiButtonEmpty
-              size="xs"
-              color="text"
-              href={uxExploratoryViewLink}
-              iconType="visBarVerticalStacked"
-            >
-              {ANALYZE_DATA}
-            </EuiButtonEmpty>
-          </EuiToolTip>
-        </EuiFlexItem>
-        <EuiFlexItem>
-          <EuiButtonEmpty
-            iconType="indexOpen"
-            iconSide="left"
-            href={kibana.services?.application?.getUrlForApp(
-              '/home#/tutorial/apm'
-            )}
+      <EuiHeaderLinks gutterSize="xs">
+        <EuiToolTip position="top" content={<p>{ANALYZE_MESSAGE}</p>}>
+          <EuiHeaderLink
+            color="text"
+            href={uxExploratoryViewLink}
+            iconType="visBarVerticalStacked"
           >
-            {i18n.translate('xpack.apm.addDataButtonLabel', {
-              defaultMessage: 'Add data',
-            })}
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-      </EuiFlexGroup>
+            {ANALYZE_DATA}
+          </EuiHeaderLink>
+        </EuiToolTip>
+        <EuiHeaderLink
+          color="primary"
+          iconType="indexOpen"
+          iconSide="left"
+          href={kibana.services?.application?.getUrlForApp(
+            '/home#/tutorial/apm'
+          )}
+        >
+          {i18n.translate('xpack.apm.addDataButtonLabel', {
+            defaultMessage: 'Add data',
+          })}
+        </EuiHeaderLink>
+      </EuiHeaderLinks>
     </HeaderMenuPortal>
   );
 }
diff --git a/x-pack/plugins/apm/public/components/app/Settings/agent_configurations/index.tsx b/x-pack/plugins/apm/public/components/app/Settings/agent_configurations/index.tsx
index 1ca7f46a0b26f..32c93e43175df 100644
--- a/x-pack/plugins/apm/public/components/app/Settings/agent_configurations/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/Settings/agent_configurations/index.tsx
@@ -18,7 +18,6 @@ import { i18n } from '@kbn/i18n';
 import { isEmpty } from 'lodash';
 import React from 'react';
 import { useLocation } from 'react-router-dom';
-import { useTrackPageview } from '../../../../../../observability/public';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { createAgentConfigurationHref } from '../../../shared/Links/apm/agentConfigurationLinks';
@@ -34,9 +33,6 @@ export function AgentConfigurations() {
     { preservePreviousData: false, showToastOnError: false }
   );
 
-  useTrackPageview({ app: 'apm', path: 'agent_configuration' });
-  useTrackPageview({ app: 'apm', path: 'agent_configuration', delay: 15000 });
-
   const hasConfigurations = !isEmpty(data.configurations);
 
   return (
diff --git a/x-pack/plugins/apm/public/components/app/Settings/schema/confirm_switch_modal.tsx b/x-pack/plugins/apm/public/components/app/Settings/schema/confirm_switch_modal.tsx
index 04817aaf84f3e..5bb93c251777f 100644
--- a/x-pack/plugins/apm/public/components/app/Settings/schema/confirm_switch_modal.tsx
+++ b/x-pack/plugins/apm/public/components/app/Settings/schema/confirm_switch_modal.tsx
@@ -15,6 +15,7 @@ import {
   htmlIdGenerator,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
+import { useUiTracker } from '../../../../../../observability/public';
 import { ElasticDocsLink } from '../../../shared/Links/ElasticDocsLink';
 
 interface Props {
@@ -27,6 +28,7 @@ export function ConfirmSwitchModal({
   onCancel,
   unsupportedConfigs,
 }: Props) {
+  const trackApmEvent = useUiTracker({ app: 'apm' });
   const [isConfirmChecked, setIsConfirmChecked] = useState(false);
   const hasUnsupportedConfigs = !!unsupportedConfigs.length;
   return (
@@ -48,7 +50,12 @@ export function ConfirmSwitchModal({
         }
       )}
       defaultFocusedButton="confirm"
-      onConfirm={onConfirm}
+      onConfirm={() => {
+        trackApmEvent({
+          metric: 'confirm_data_stream_switch',
+        });
+        onConfirm();
+      }}
       confirmButtonDisabled={!isConfirmChecked}
     >
       <p>
diff --git a/x-pack/plugins/apm/public/components/app/Settings/schema/index.tsx b/x-pack/plugins/apm/public/components/app/Settings/schema/index.tsx
index 5a67ce28e9e1a..0c95648a1cefc 100644
--- a/x-pack/plugins/apm/public/components/app/Settings/schema/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/Settings/schema/index.tsx
@@ -142,9 +142,7 @@ async function createCloudApmPackagePolicy(
 ) {
   updateLocalStorage(FETCH_STATUS.LOADING);
   try {
-    const {
-      cloud_apm_package_policy: cloudApmPackagePolicy,
-    } = await callApmApi({
+    const { cloudApmPackagePolicy } = await callApmApi({
       endpoint: 'POST /api/apm/fleet/cloud_apm_package_policy',
       signal: null,
     });
diff --git a/x-pack/plugins/apm/public/components/app/correlations/index.tsx b/x-pack/plugins/apm/public/components/app/correlations/index.tsx
index 2b32ece14e5cd..9ad5088bb0bcf 100644
--- a/x-pack/plugins/apm/public/components/app/correlations/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/correlations/index.tsx
@@ -104,16 +104,7 @@ export function Correlations() {
         width: '20%',
       });
     }
-    if (urlParams.transactionName) {
-      properties.push({
-        label: i18n.translate('xpack.apm.correlations.transactionLabel', {
-          defaultMessage: 'Transaction',
-        }),
-        fieldName: TRANSACTION_NAME,
-        val: urlParams.transactionName,
-        width: '20%',
-      });
-    }
+
     if (urlParams.environment) {
       properties.push({
         label: i18n.translate('xpack.apm.correlations.environmentLabel', {
@@ -125,6 +116,17 @@ export function Correlations() {
       });
     }
 
+    if (urlParams.transactionName) {
+      properties.push({
+        label: i18n.translate('xpack.apm.correlations.transactionLabel', {
+          defaultMessage: 'Transaction',
+        }),
+        fieldName: TRANSACTION_NAME,
+        val: urlParams.transactionName,
+        width: '20%',
+      });
+    }
+
     return properties;
   }, [serviceName, urlParams.environment, urlParams.transactionName]);
 
diff --git a/x-pack/plugins/apm/public/components/app/correlations/ml_latency_correlations.tsx b/x-pack/plugins/apm/public/components/app/correlations/ml_latency_correlations.tsx
index f9536353747ee..03fab3e788639 100644
--- a/x-pack/plugins/apm/public/components/app/correlations/ml_latency_correlations.tsx
+++ b/x-pack/plugins/apm/public/components/app/correlations/ml_latency_correlations.tsx
@@ -36,6 +36,7 @@ import { useCorrelations } from './use_correlations';
 import { push } from '../../shared/Links/url_helpers';
 import { useUiTracker } from '../../../../../observability/public';
 import { asPreciseDecimal } from '../../../../common/utils/formatters';
+import { LatencyCorrelationsHelpPopover } from './ml_latency_correlations_help_popover';
 
 const DEFAULT_PERCENTILE_THRESHOLD = 95;
 const isErrorMessage = (arg: unknown): arg is Error => {
@@ -60,17 +61,16 @@ export function MlLatencyCorrelations({ onClose }: Props) {
   } = useApmPluginContext();
 
   const { serviceName } = useParams<{ serviceName: string }>();
-  const { urlParams } = useUrlParams();
-
-  const fetchOptions = useMemo(
-    () => ({
-      ...{
-        serviceName,
-        ...urlParams,
-      },
-    }),
-    [serviceName, urlParams]
-  );
+  const {
+    urlParams: {
+      environment,
+      kuery,
+      transactionName,
+      transactionType,
+      start,
+      end,
+    },
+  } = useUrlParams();
 
   const {
     error,
@@ -84,7 +84,15 @@ export function MlLatencyCorrelations({ onClose }: Props) {
   } = useCorrelations({
     index: 'apm-*',
     ...{
-      ...fetchOptions,
+      ...{
+        environment,
+        kuery,
+        serviceName,
+        transactionName,
+        transactionType,
+        start,
+        end,
+      },
       percentileThreshold: DEFAULT_PERCENTILE_THRESHOLD,
     },
   });
@@ -151,7 +159,7 @@ export function MlLatencyCorrelations({ onClose }: Props) {
               'xpack.apm.correlations.latencyCorrelations.correlationsTable.correlationColumnDescription',
               {
                 defaultMessage:
-                  'The impact of a field on the latency of the service, ranging from 0 to 1.',
+                  'The correlation score [0-1] of an attribute; the greater the score, the more an attribute increases latency.',
               }
             )}
           >
@@ -263,20 +271,6 @@ export function MlLatencyCorrelations({ onClose }: Props) {
 
   return (
     <>
-      <EuiText size="s" color="subdued">
-        <p>
-          {i18n.translate(
-            'xpack.apm.correlations.latencyCorrelations.description',
-            {
-              defaultMessage:
-                'What is slowing down my service? Correlations will help discover a slower performance in a particular cohort of your data.',
-            }
-          )}
-        </p>
-      </EuiText>
-
-      <EuiSpacer size="m" />
-
       <EuiFlexGroup>
         <EuiFlexItem grow={false}>
           {!isRunning && (
@@ -320,6 +314,9 @@ export function MlLatencyCorrelations({ onClose }: Props) {
             </EuiFlexItem>
           </EuiFlexGroup>
         </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <LatencyCorrelationsHelpPopover />
+        </EuiFlexItem>
       </EuiFlexGroup>
 
       <EuiSpacer size="m" />
@@ -332,8 +329,7 @@ export function MlLatencyCorrelations({ onClose }: Props) {
                 {
                   defaultMessage: 'Latency distribution for {name}',
                   values: {
-                    name:
-                      fetchOptions.transactionName ?? fetchOptions.serviceName,
+                    name: transactionName ?? serviceName,
                   },
                 }
               )}
diff --git a/x-pack/plugins/apm/public/components/app/correlations/ml_latency_correlations_help_popover.tsx b/x-pack/plugins/apm/public/components/app/correlations/ml_latency_correlations_help_popover.tsx
new file mode 100644
index 0000000000000..1f9a41c1139cd
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/correlations/ml_latency_correlations_help_popover.tsx
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { HelpPopover, HelpPopoverButton } from '../help_popover/help_popover';
+
+export function LatencyCorrelationsHelpPopover() {
+  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+
+  return (
+    <HelpPopover
+      anchorPosition="leftUp"
+      button={
+        <HelpPopoverButton
+          onClick={() => {
+            setIsPopoverOpen(!isPopoverOpen);
+          }}
+        />
+      }
+      closePopover={() => setIsPopoverOpen(false)}
+      isOpen={isPopoverOpen}
+      title={i18n.translate('xpack.apm.correlations.latencyPopoverTitle', {
+        defaultMessage: 'Latency correlations',
+      })}
+    >
+      <p>
+        <FormattedMessage
+          id="xpack.apm.correlations.latencyPopoverBasicExplanation"
+          defaultMessage="Correlations help you discover which attributes are contributing to increased transaction response times or latency."
+        />
+      </p>
+      <p>
+        <FormattedMessage
+          id="xpack.apm.correlations.latencyPopoverChartExplanation"
+          defaultMessage="The latency distribution chart visualizes the overall latency of the transactions in the service. When you hover over attributes in the table, their latency distribution is added to the chart."
+        />
+      </p>
+      <p>
+        <FormattedMessage
+          id="xpack.apm.correlations.latencyPopoverTableExplanation"
+          defaultMessage="The table is sorted by correlation coefficients that range from 0 to 1. Attributes with higher correlation values are more likely to contribute to high latency transactions."
+        />
+      </p>
+      <p>
+        <FormattedMessage
+          id="xpack.apm.correlations.latencyPopoverPerformanceExplanation"
+          defaultMessage="This analysis performs statistical searches across a large number of attributes. For large time ranges and services with high transaction throughput, this might take some time. Reduce the time range to improve performance."
+        />
+      </p>
+      <p>
+        <FormattedMessage
+          id="xpack.apm.correlations.latencyPopoverFilterExplanation"
+          defaultMessage="You can also add or remove filters to affect the queries in the APM app."
+        />
+      </p>
+    </HelpPopover>
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/app/correlations/use_correlations.ts b/x-pack/plugins/apm/public/components/app/correlations/use_correlations.ts
index 8c874571d23db..2baeb63fa4a23 100644
--- a/x-pack/plugins/apm/public/components/app/correlations/use_correlations.ts
+++ b/x-pack/plugins/apm/public/components/app/correlations/use_correlations.ts
@@ -36,6 +36,7 @@ interface RawResponse {
   took: number;
   values: SearchServiceValue[];
   overallHistogram: HistogramItem[];
+  log: string[];
 }
 
 export const useCorrelations = (params: CorrelationsOptions) => {
diff --git a/x-pack/plugins/apm/public/components/app/error_group_details/index.tsx b/x-pack/plugins/apm/public/components/app/error_group_details/index.tsx
index 344393d42506f..225186cab12c8 100644
--- a/x-pack/plugins/apm/public/components/app/error_group_details/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/error_group_details/index.tsx
@@ -17,7 +17,6 @@ import {
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { euiStyled } from '../../../../../../../src/plugins/kibana_react/common';
-import { useTrackPageview } from '../../../../../observability/public';
 import { NOT_AVAILABLE_LABEL } from '../../../../common/i18n';
 import { useUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useErrorGroupDistributionFetcher } from '../../../hooks/use_error_group_distribution_fetcher';
@@ -128,9 +127,6 @@ export function ErrorGroupDetails({
     groupId,
   });
 
-  useTrackPageview({ app: 'apm', path: 'error_group_details' });
-  useTrackPageview({ app: 'apm', path: 'error_group_details', delay: 15000 });
-
   if (!errorGroupData || !errorDistributionData) {
     return <ErrorGroupHeader groupId={groupId} />;
   }
diff --git a/x-pack/plugins/apm/public/components/app/error_group_overview/index.tsx b/x-pack/plugins/apm/public/components/app/error_group_overview/index.tsx
index 4c622758e6c8b..8d8d0cb9c107c 100644
--- a/x-pack/plugins/apm/public/components/app/error_group_overview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/error_group_overview/index.tsx
@@ -14,7 +14,6 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
-import { useTrackPageview } from '../../../../../observability/public';
 import { useUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useErrorGroupDistributionFetcher } from '../../../hooks/use_error_group_distribution_fetcher';
 import { useFetcher } from '../../../hooks/use_fetcher';
@@ -60,12 +59,6 @@ export function ErrorGroupOverview({ serviceName }: ErrorGroupOverviewProps) {
     [environment, kuery, serviceName, start, end, sortField, sortDirection]
   );
 
-  useTrackPageview({
-    app: 'apm',
-    path: 'error_group_overview',
-  });
-  useTrackPageview({ app: 'apm', path: 'error_group_overview', delay: 15000 });
-
   if (!errorDistributionData || !errorGroupListData) {
     return null;
   }
diff --git a/x-pack/plugins/apm/public/components/app/help_popover/help_popover.tsx b/x-pack/plugins/apm/public/components/app/help_popover/help_popover.tsx
new file mode 100644
index 0000000000000..def310f1d8140
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/help_popover/help_popover.tsx
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { ReactNode } from 'react';
+import { i18n } from '@kbn/i18n';
+import {
+  EuiButtonIcon,
+  EuiLinkButtonProps,
+  EuiPopover,
+  EuiPopoverProps,
+  EuiPopoverTitle,
+  EuiText,
+} from '@elastic/eui';
+import { euiStyled } from '../../../../../../../src/plugins/kibana_react/common';
+
+const PopoverContent = euiStyled(EuiText)`
+  max-width: 480px;
+  max-height: 40vh;
+`;
+
+export function HelpPopoverButton({
+  onClick,
+}: {
+  onClick: EuiLinkButtonProps['onClick'];
+}) {
+  return (
+    <EuiButtonIcon
+      className="apmHelpPopover__buttonIcon"
+      size="s"
+      iconType="help"
+      aria-label={i18n.translate('xpack.apm.helpPopover.ariaLabel', {
+        defaultMessage: 'Help',
+      })}
+      onClick={onClick}
+    />
+  );
+}
+
+export function HelpPopover({
+  anchorPosition,
+  button,
+  children,
+  closePopover,
+  isOpen,
+  title,
+}: {
+  anchorPosition?: EuiPopoverProps['anchorPosition'];
+  button: EuiPopoverProps['button'];
+  children: ReactNode;
+  closePopover: EuiPopoverProps['closePopover'];
+  isOpen: EuiPopoverProps['isOpen'];
+  title?: string;
+}) {
+  return (
+    <EuiPopover
+      anchorPosition={anchorPosition}
+      button={button}
+      closePopover={closePopover}
+      isOpen={isOpen}
+      panelPaddingSize="s"
+      ownFocus
+    >
+      {title && <EuiPopoverTitle paddingSize="s">{title}</EuiPopoverTitle>}
+
+      <PopoverContent size="s">{children}</PopoverContent>
+    </EuiPopover>
+  );
+}
diff --git a/x-pack/plugins/console_extensions/server/config.ts b/x-pack/plugins/apm/public/components/app/help_popover/index.tsx
similarity index 56%
rename from x-pack/plugins/console_extensions/server/config.ts
rename to x-pack/plugins/apm/public/components/app/help_popover/index.tsx
index 15b06bf93ffbe..b1d53722c7bb5 100644
--- a/x-pack/plugins/console_extensions/server/config.ts
+++ b/x-pack/plugins/apm/public/components/app/help_popover/index.tsx
@@ -5,10 +5,4 @@
  * 2.0.
  */
 
-import { schema, TypeOf } from '@kbn/config-schema';
-
-export type ConfigType = TypeOf<typeof config>;
-
-export const config = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-});
+export { HelpPopoverButton, HelpPopover } from './help_popover';
diff --git a/x-pack/plugins/apm/public/components/app/service_inventory/index.tsx b/x-pack/plugins/apm/public/components/app/service_inventory/index.tsx
index cac94885511c1..ef0a5f2df0434 100644
--- a/x-pack/plugins/apm/public/components/app/service_inventory/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_inventory/index.tsx
@@ -9,7 +9,6 @@ import { EuiFlexGroup, EuiFlexItem, EuiLink } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { useEffect } from 'react';
 import { toMountPoint } from '../../../../../../../src/plugins/kibana_react/public';
-import { useTrackPageview } from '../../../../../observability/public';
 import { useAnomalyDetectionJobsContext } from '../../../context/anomaly_detection_jobs/use_anomaly_detection_jobs_context';
 import { useApmPluginContext } from '../../../context/apm_plugin/use_apm_plugin_context';
 import { useUrlParams } from '../../../context/url_params_context/use_url_params';
@@ -92,13 +91,6 @@ export function ServiceInventory() {
   const { core } = useApmPluginContext();
   const { servicesData, servicesStatus } = useServicesFetcher();
 
-  // The page is called "service inventory" to avoid confusion with the
-  // "service overview", but this is tracked in some dashboards because it's the
-  // initial landing page for APM, so it stays as "services_overview" (plural.)
-  // for backward compatibility.
-  useTrackPageview({ app: 'apm', path: 'services_overview' });
-  useTrackPageview({ app: 'apm', path: 'services_overview', delay: 15000 });
-
   const {
     anomalyDetectionJobsData,
     anomalyDetectionJobsStatus,
diff --git a/x-pack/plugins/apm/public/components/app/service_map/index.tsx b/x-pack/plugins/apm/public/components/app/service_map/index.tsx
index 582eafe7553af..22adb10512d7a 100644
--- a/x-pack/plugins/apm/public/components/app/service_map/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_map/index.tsx
@@ -13,7 +13,6 @@ import {
 } from '@elastic/eui';
 import React, { PropsWithChildren, ReactNode } from 'react';
 import { isActivePlatinumLicense } from '../../../../common/license_check';
-import { useTrackPageview } from '../../../../../observability/public';
 import {
   invalidLicenseMessage,
   SERVICE_MAP_TIMEOUT_ERROR,
@@ -106,9 +105,6 @@ export function ServiceMap({
   const PADDING_BOTTOM = 24;
   const heightWithPadding = height - PADDING_BOTTOM;
 
-  useTrackPageview({ app: 'apm', path: 'service_map' });
-  useTrackPageview({ app: 'apm', path: 'service_map', delay: 15000 });
-
   if (!license) {
     return null;
   }
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/index.tsx b/x-pack/plugins/apm/public/components/app/service_overview/index.tsx
index fce543b05c6c3..374b2d59ea347 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/index.tsx
@@ -7,7 +7,6 @@
 
 import { EuiFlexGroup, EuiFlexItem, EuiPanel } from '@elastic/eui';
 import React from 'react';
-import { useTrackPageview } from '../../../../../observability/public';
 import { isRumAgentName, isIosAgentName } from '../../../../common/agent_name';
 import { AnnotationsContextProvider } from '../../../context/annotations/annotations_context';
 import { useApmServiceContext } from '../../../context/apm_service/use_apm_service_context';
@@ -35,9 +34,6 @@ interface ServiceOverviewProps {
 export function ServiceOverview({ serviceName }: ServiceOverviewProps) {
   const { agentName } = useApmServiceContext();
 
-  useTrackPageview({ app: 'apm', path: 'service_overview' });
-  useTrackPageview({ app: 'apm', path: 'service_overview', delay: 15000 });
-
   // The default EuiFlexGroup breaks at 768, but we want to break at 992, so we
   // observe the window width and set the flex directions of rows accordingly
   const { isMedium } = useBreakPoints();
diff --git a/x-pack/plugins/apm/public/components/app/trace_overview/index.tsx b/x-pack/plugins/apm/public/components/app/trace_overview/index.tsx
index d280b36a603ba..ccb5fea72432c 100644
--- a/x-pack/plugins/apm/public/components/app/trace_overview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/trace_overview/index.tsx
@@ -6,7 +6,6 @@
  */
 
 import React from 'react';
-import { useTrackPageview } from '../../../../../observability/public';
 import { useUrlParams } from '../../../context/url_params_context/use_url_params';
 import { FETCH_STATUS, useFetcher } from '../../../hooks/use_fetcher';
 import { APIReturnType } from '../../../services/rest/createCallApmApi';
@@ -43,9 +42,6 @@ export function TraceOverview() {
     [environment, kuery, start, end]
   );
 
-  useTrackPageview({ app: 'apm', path: 'traces_overview' });
-  useTrackPageview({ app: 'apm', path: 'traces_overview', delay: 15000 });
-
   return (
     <>
       <SearchBar />
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/index.tsx b/x-pack/plugins/apm/public/components/app/transaction_details/index.tsx
index 1e13e224a511a..40f50e768e76e 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/index.tsx
@@ -9,7 +9,6 @@ import { EuiHorizontalRule, EuiPanel, EuiSpacer, EuiTitle } from '@elastic/eui';
 import { flatten, isEmpty } from 'lodash';
 import React from 'react';
 import { useHistory } from 'react-router-dom';
-import { useTrackPageview } from '../../../../../observability/public';
 import { ChartPointerEventContextProvider } from '../../../context/chart_pointer_event/chart_pointer_event_context';
 import { useUrlParams } from '../../../context/url_params_context/use_url_params';
 import { FETCH_STATUS } from '../../../hooks/use_fetcher';
@@ -41,9 +40,6 @@ export function TransactionDetails() {
   } = useWaterfallFetcher();
   const { transactionName } = urlParams;
 
-  useTrackPageview({ app: 'apm', path: 'transaction_details' });
-  useTrackPageview({ app: 'apm', path: 'transaction_details', delay: 15000 });
-
   const selectedSample = flatten(
     distributionData.buckets.map((bucket) => bucket.samples)
   ).find(
diff --git a/x-pack/plugins/apm/public/components/app/transaction_overview/index.tsx b/x-pack/plugins/apm/public/components/app/transaction_overview/index.tsx
index 041c12822357c..2435e5fc5a1f6 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_overview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_overview/index.tsx
@@ -17,7 +17,6 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { Location } from 'history';
 import React from 'react';
 import { useLocation } from 'react-router-dom';
-import { useTrackPageview } from '../../../../../observability/public';
 import { useApmServiceContext } from '../../../context/apm_service/use_apm_service_context';
 import { IUrlParams } from '../../../context/url_params_context/types';
 import { useUrlParams } from '../../../context/url_params_context/use_url_params';
@@ -62,8 +61,6 @@ export function TransactionOverview({ serviceName }: TransactionOverviewProps) {
   // redirect to first transaction type
   useRedirect(getRedirectLocation({ location, transactionType, urlParams }));
 
-  useTrackPageview({ app: 'apm', path: 'transaction_overview' });
-  useTrackPageview({ app: 'apm', path: 'transaction_overview', delay: 15000 });
   const {
     transactionListData,
     transactionListStatus,
diff --git a/x-pack/plugins/apm/public/components/routing/app_root.tsx b/x-pack/plugins/apm/public/components/routing/app_root.tsx
index 8fc59a01eeca0..a924c1f31cbef 100644
--- a/x-pack/plugins/apm/public/components/routing/app_root.tsx
+++ b/x-pack/plugins/apm/public/components/routing/app_root.tsx
@@ -9,7 +9,7 @@ import { ApmRoute } from '@elastic/apm-rum-react';
 import euiDarkVars from '@elastic/eui/dist/eui_theme_dark.json';
 import euiLightVars from '@elastic/eui/dist/eui_theme_light.json';
 import React from 'react';
-import { Route, Router, Switch } from 'react-router-dom';
+import { Route, RouteComponentProps, Router, Switch } from 'react-router-dom';
 import { DefaultTheme, ThemeProvider } from 'styled-components';
 import { APP_WRAPPER_CLASS } from '../../../../../../src/core/public';
 import {
@@ -17,20 +17,21 @@ import {
   RedirectAppLinks,
   useUiSetting$,
 } from '../../../../../../src/plugins/kibana_react/public';
+import { HeaderMenuPortal } from '../../../../observability/public';
 import { ScrollToTopOnPathChange } from '../../components/app/Main/ScrollToTopOnPathChange';
+import { AnomalyDetectionJobsContextProvider } from '../../context/anomaly_detection_jobs/anomaly_detection_jobs_context';
 import {
   ApmPluginContext,
   ApmPluginContextValue,
 } from '../../context/apm_plugin/apm_plugin_context';
+import { useApmPluginContext } from '../../context/apm_plugin/use_apm_plugin_context';
 import { LicenseProvider } from '../../context/license/license_context';
 import { UrlParamsProvider } from '../../context/url_params_context/url_params_context';
 import { useApmBreadcrumbs } from '../../hooks/use_apm_breadcrumbs';
 import { ApmPluginStartDeps } from '../../plugin';
-import { HeaderMenuPortal } from '../../../../observability/public';
 import { ApmHeaderActionMenu } from '../shared/apm_header_action_menu';
-import { useApmPluginContext } from '../../context/apm_plugin/use_apm_plugin_context';
-import { AnomalyDetectionJobsContextProvider } from '../../context/anomaly_detection_jobs/anomaly_detection_jobs_context';
 import { apmRouteConfig } from './apm_route_config';
+import { TelemetryWrapper } from './telemetry_wrapper';
 
 export function ApmAppRoot({
   apmPluginContextValue,
@@ -62,9 +63,18 @@ export function ApmAppRoot({
 
                       <Route component={ScrollToTopOnPathChange} />
                       <Switch>
-                        {apmRouteConfig.map((route, i) => (
-                          <ApmRoute key={i} {...route} />
-                        ))}
+                        {apmRouteConfig.map((route, i) => {
+                          const { component, render, ...rest } = route;
+                          return (
+                            <ApmRoute
+                              key={i}
+                              {...rest}
+                              component={(props: RouteComponentProps) => {
+                                return TelemetryWrapper({ route, props });
+                              }}
+                            />
+                          );
+                        })}
                       </Switch>
                     </ApmThemeProvider>
                   </AnomalyDetectionJobsContextProvider>
diff --git a/x-pack/plugins/apm/public/components/routing/telemetry_wrapper.tsx b/x-pack/plugins/apm/public/components/routing/telemetry_wrapper.tsx
new file mode 100644
index 0000000000000..fc3fc6a338d18
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/routing/telemetry_wrapper.tsx
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { RouteComponentProps } from 'react-router-dom';
+import { useTrackPageview } from '../../../../observability/public';
+import { APMRouteDefinition } from '../../application/routes';
+import { redirectTo } from './redirect_to';
+
+export function TelemetryWrapper({
+  route,
+  props,
+}: {
+  route: APMRouteDefinition;
+  props: RouteComponentProps;
+}) {
+  const { component, render, path } = route;
+  const pathAsString = path as string;
+
+  useTrackPageview({ app: 'apm', path: pathAsString });
+  useTrackPageview({ app: 'apm', path: pathAsString, delay: 15000 });
+
+  if (component) {
+    return React.createElement(component, props);
+  }
+  if (render) {
+    return <>{render(props)}</>;
+  }
+  return <>{redirectTo('/')}</>;
+}
diff --git a/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/alerting_popover_flyout.tsx b/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/alerting_popover_flyout.tsx
index ca73f6ddd05b3..4abd36a277311 100644
--- a/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/alerting_popover_flyout.tsx
+++ b/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/alerting_popover_flyout.tsx
@@ -66,7 +66,6 @@ export function AlertingPopoverAndFlyout({
 
   const button = (
     <EuiHeaderLink
-      size="xs"
       color="text"
       iconType="arrowDown"
       iconSide="right"
diff --git a/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/anomaly_detection_setup_link.tsx b/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/anomaly_detection_setup_link.tsx
index b800ef41fbcac..2d2bf32229c84 100644
--- a/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/anomaly_detection_setup_link.tsx
+++ b/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/anomaly_detection_setup_link.tsx
@@ -43,7 +43,6 @@ export function AnomalyDetectionSetupLink() {
 
   return (
     <EuiHeaderLink
-      size="xs"
       color="text"
       href={getAPMHref({ basePath, path: '/settings/anomaly-detection' })}
       style={{ whiteSpace: 'nowrap' }}
diff --git a/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/index.tsx b/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/index.tsx
index af207f54200f9..7d000a29dcbec 100644
--- a/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/index.tsx
@@ -41,7 +41,7 @@ export function ApmHeaderActionMenu() {
 
   return (
     <EuiHeaderLinks gutterSize="xs">
-      <EuiHeaderLink size="xs" color="text" href={apmHref('/settings')}>
+      <EuiHeaderLink color="text" href={apmHref('/settings')}>
         {i18n.translate('xpack.apm.settingsLinkLabel', {
           defaultMessage: 'Settings',
         })}
diff --git a/x-pack/plugins/apm/server/lib/alerts/test_utils/index.ts b/x-pack/plugins/apm/server/lib/alerts/test_utils/index.ts
index 1366503ea1428..679f33707b5b5 100644
--- a/x-pack/plugins/apm/server/lib/alerts/test_utils/index.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/test_utils/index.ts
@@ -70,8 +70,14 @@ export const createRuleTypeMocks = () => {
     executor: async ({ params }: { params: Record<string, any> }) => {
       return alertExecutor({
         services,
-        rule: { consumer: APM_SERVER_FEATURE_ID },
         params,
+        rule: {
+          consumer: APM_SERVER_FEATURE_ID,
+          name: 'name',
+          producer: 'producer',
+          ruleTypeId: 'ruleTypeId',
+          ruleTypeName: 'ruleTypeName',
+        },
         startedAt: new Date(),
       });
     },
diff --git a/x-pack/plugins/apm/server/lib/fleet/sync_agent_configs_to_apm_package_policies.ts b/x-pack/plugins/apm/server/lib/fleet/sync_agent_configs_to_apm_package_policies.ts
index 4294c5b82cd63..1365ddc28ddb2 100644
--- a/x-pack/plugins/apm/server/lib/fleet/sync_agent_configs_to_apm_package_policies.ts
+++ b/x-pack/plugins/apm/server/lib/fleet/sync_agent_configs_to_apm_package_policies.ts
@@ -10,6 +10,7 @@ import {
   CoreStart,
   SavedObjectsClientContract,
 } from 'kibana/server';
+import { TelemetryUsageCounter } from '../../routes/typings';
 import { APMPluginStartDependencies } from '../../types';
 import { getInternalSavedObjectsClient } from '../helpers/get_internal_saved_objects_client';
 import { Setup } from '../helpers/setup_request';
@@ -21,11 +22,19 @@ export async function syncAgentConfigsToApmPackagePolicies({
   core,
   fleetPluginStart,
   setup,
+  telemetryUsageCounter,
 }: {
   core: { setup: CoreSetup; start: () => Promise<CoreStart> };
   fleetPluginStart: NonNullable<APMPluginStartDependencies['fleet']>;
   setup: Setup;
+  telemetryUsageCounter?: TelemetryUsageCounter;
 }) {
+  if (telemetryUsageCounter) {
+    telemetryUsageCounter.incrementCounter({
+      counterName: 'sync_agent_config_to_apm_package_policies',
+      counterType: 'success',
+    });
+  }
   const coreStart = await core.start();
   const esClient = coreStart.elasticsearch.client.asInternalUser;
   const [
diff --git a/x-pack/plugins/apm/server/lib/index_pattern/create_static_index_pattern.test.ts b/x-pack/plugins/apm/server/lib/index_pattern/create_static_index_pattern.test.ts
index a5340c1220b44..ef869a0ed6cfa 100644
--- a/x-pack/plugins/apm/server/lib/index_pattern/create_static_index_pattern.test.ts
+++ b/x-pack/plugins/apm/server/lib/index_pattern/create_static_index_pattern.test.ts
@@ -13,6 +13,11 @@ import { APMConfig } from '../..';
 
 function getMockSavedObjectsClient() {
   return ({
+    get: jest.fn(() => ({
+      attributes: {
+        title: 'apm-*',
+      },
+    })),
     create: jest.fn(),
   } as unknown) as InternalSavedObjectsClient;
 }
@@ -22,14 +27,12 @@ describe('createStaticIndexPattern', () => {
     const setup = {} as Setup;
 
     const savedObjectsClient = getMockSavedObjectsClient();
-    await createStaticIndexPattern(
+    await createStaticIndexPattern({
       setup,
-      {
-        'xpack.apm.autocreateApmIndexPattern': false,
-      } as APMConfig,
+      config: { 'xpack.apm.autocreateApmIndexPattern': false } as APMConfig,
       savedObjectsClient,
-      'default'
-    );
+      spaceId: 'default',
+    });
     expect(savedObjectsClient.create).not.toHaveBeenCalled();
   });
 
@@ -43,14 +46,12 @@ describe('createStaticIndexPattern', () => {
 
     const savedObjectsClient = getMockSavedObjectsClient();
 
-    await createStaticIndexPattern(
+    await createStaticIndexPattern({
       setup,
-      {
-        'xpack.apm.autocreateApmIndexPattern': true,
-      } as APMConfig,
+      config: { 'xpack.apm.autocreateApmIndexPattern': true } as APMConfig,
       savedObjectsClient,
-      'default'
-    );
+      spaceId: 'default',
+    });
     expect(savedObjectsClient.create).not.toHaveBeenCalled();
   });
 
@@ -64,15 +65,73 @@ describe('createStaticIndexPattern', () => {
 
     const savedObjectsClient = getMockSavedObjectsClient();
 
-    await createStaticIndexPattern(
+    await createStaticIndexPattern({
       setup,
-      {
+      config: { 'xpack.apm.autocreateApmIndexPattern': true } as APMConfig,
+      savedObjectsClient,
+      spaceId: 'default',
+    });
+
+    expect(savedObjectsClient.create).toHaveBeenCalled();
+  });
+
+  it(`should upgrade an index pattern if 'apm_oss.indexPattern' does not match title`, async () => {
+    const setup = {} as Setup;
+
+    // does have APM data
+    jest
+      .spyOn(HistoricalAgentData, 'hasHistoricalAgentData')
+      .mockResolvedValue(true);
+
+    const savedObjectsClient = getMockSavedObjectsClient();
+    const apmIndexPatternTitle = 'traces-apm*,logs-apm*,metrics-apm*,apm-*';
+
+    await createStaticIndexPattern({
+      setup,
+      config: {
         'xpack.apm.autocreateApmIndexPattern': true,
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        'apm_oss.indexPattern': apmIndexPatternTitle,
       } as APMConfig,
       savedObjectsClient,
-      'default'
+      spaceId: 'default',
+    });
+
+    expect(savedObjectsClient.get).toHaveBeenCalled();
+    expect(savedObjectsClient.create).toHaveBeenCalled();
+    // @ts-ignore
+    expect(savedObjectsClient.create.mock.calls[0][1].title).toBe(
+      apmIndexPatternTitle
     );
+    // @ts-ignore
+    expect(savedObjectsClient.create.mock.calls[0][2].overwrite).toBe(true);
+  });
+
+  it(`should not upgrade an index pattern if 'apm_oss.indexPattern' already match existing title`, async () => {
+    const setup = {} as Setup;
+
+    // does have APM data
+    jest
+      .spyOn(HistoricalAgentData, 'hasHistoricalAgentData')
+      .mockResolvedValue(true);
+
+    const savedObjectsClient = getMockSavedObjectsClient();
+    const apmIndexPatternTitle = 'apm-*';
+
+    await createStaticIndexPattern({
+      setup,
+      config: {
+        'xpack.apm.autocreateApmIndexPattern': true,
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        'apm_oss.indexPattern': apmIndexPatternTitle,
+      } as APMConfig,
+      savedObjectsClient,
+      spaceId: 'default',
+    });
 
+    expect(savedObjectsClient.get).toHaveBeenCalled();
     expect(savedObjectsClient.create).toHaveBeenCalled();
+    // @ts-ignore
+    expect(savedObjectsClient.create.mock.calls[0][2].overwrite).toBe(false);
   });
 });
diff --git a/x-pack/plugins/apm/server/lib/index_pattern/create_static_index_pattern.ts b/x-pack/plugins/apm/server/lib/index_pattern/create_static_index_pattern.ts
index a2944d6241d2d..5dbee59b4ce86 100644
--- a/x-pack/plugins/apm/server/lib/index_pattern/create_static_index_pattern.ts
+++ b/x-pack/plugins/apm/server/lib/index_pattern/create_static_index_pattern.ts
@@ -15,13 +15,23 @@ import { InternalSavedObjectsClient } from '../helpers/get_internal_saved_object
 import { withApmSpan } from '../../utils/with_apm_span';
 import { getApmIndexPatternTitle } from './get_apm_index_pattern_title';
 
-export async function createStaticIndexPattern(
-  setup: Setup,
-  config: APMRouteHandlerResources['config'],
-  savedObjectsClient: InternalSavedObjectsClient,
-  spaceId: string | undefined,
-  overwrite = false
-): Promise<boolean> {
+type ApmIndexPatternAttributes = typeof apmIndexPattern.attributes & {
+  title: string;
+};
+
+export async function createStaticIndexPattern({
+  setup,
+  config,
+  savedObjectsClient,
+  spaceId,
+  overwrite = false,
+}: {
+  setup: Setup;
+  config: APMRouteHandlerResources['config'];
+  savedObjectsClient: InternalSavedObjectsClient;
+  spaceId?: string;
+  overwrite?: boolean;
+}): Promise<boolean> {
   return withApmSpan('create_static_index_pattern', async () => {
     // don't autocreate APM index pattern if it's been disabled via the config
     if (!config['xpack.apm.autocreateApmIndexPattern']) {
@@ -35,8 +45,31 @@ export async function createStaticIndexPattern(
       return false;
     }
 
+    const apmIndexPatternTitle = getApmIndexPatternTitle(config);
+
+    if (!overwrite) {
+      try {
+        const {
+          attributes: { title: existingApmIndexPatternTitle },
+        }: {
+          attributes: ApmIndexPatternAttributes;
+        } = await savedObjectsClient.get(
+          'index-pattern',
+          APM_STATIC_INDEX_PATTERN_ID
+        );
+        // if the existing index pattern does not matches the new one, force an update
+        if (existingApmIndexPatternTitle !== apmIndexPatternTitle) {
+          overwrite = true;
+        }
+      } catch (e) {
+        // if the index pattern (saved object) is not found, then we can continue with creation
+        if (!SavedObjectsErrorHelpers.isNotFoundError(e)) {
+          throw e;
+        }
+      }
+    }
+
     try {
-      const apmIndexPatternTitle = getApmIndexPatternTitle(config);
       await withApmSpan('create_index_pattern_saved_object', () =>
         savedObjectsClient.create(
           'index-pattern',
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/async_search_service.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/async_search_service.ts
index 7a511fc60fd06..155cb1f4615bd 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/async_search_service.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/async_search_service.ts
@@ -11,7 +11,7 @@ import { fetchTransactionDurationFieldCandidates } from './query_field_candidate
 import { fetchTransactionDurationFieldValuePairs } from './query_field_value_pairs';
 import { fetchTransactionDurationPercentiles } from './query_percentiles';
 import { fetchTransactionDurationCorrelation } from './query_correlation';
-import { fetchTransactionDurationHistogramRangesteps } from './query_histogram_rangesteps';
+import { fetchTransactionDurationHistogramRangeSteps } from './query_histogram_range_steps';
 import { fetchTransactionDurationRanges, HistogramItem } from './query_ranges';
 import type {
   AsyncSearchProviderProgress,
@@ -24,6 +24,8 @@ import { fetchTransactionDurationFractions } from './query_fractions';
 const CORRELATION_THRESHOLD = 0.3;
 const KS_TEST_THRESHOLD = 0.1;
 
+const currentTimeAsString = () => new Date().toISOString();
+
 export const asyncSearchServiceProvider = (
   esClient: ElasticsearchClient,
   params: SearchServiceParams
@@ -31,6 +33,9 @@ export const asyncSearchServiceProvider = (
   let isCancelled = false;
   let isRunning = true;
   let error: Error;
+  const log: string[] = [];
+  const logMessage = (message: string) =>
+    log.push(`${currentTimeAsString()}: ${message}`);
 
   const progress: AsyncSearchProviderProgress = {
     started: Date.now(),
@@ -53,13 +58,17 @@ export const asyncSearchServiceProvider = (
   let percentileThresholdValue: number;
 
   const cancel = () => {
+    logMessage(`Service cancelled.`);
     isCancelled = true;
   };
 
   const fetchCorrelations = async () => {
     try {
       // 95th percentile to be displayed as a marker in the log log chart
-      const percentileThreshold = await fetchTransactionDurationPercentiles(
+      const {
+        totalDocs,
+        percentiles: percentileThreshold,
+      } = await fetchTransactionDurationPercentiles(
         esClient,
         params,
         params.percentileThreshold ? [params.percentileThreshold] : undefined
@@ -67,12 +76,32 @@ export const asyncSearchServiceProvider = (
       percentileThresholdValue =
         percentileThreshold[`${params.percentileThreshold}.0`];
 
-      const histogramRangeSteps = await fetchTransactionDurationHistogramRangesteps(
+      logMessage(
+        `Fetched ${params.percentileThreshold}th percentile value of ${percentileThresholdValue} based on ${totalDocs} documents.`
+      );
+
+      // finish early if we weren't able to identify the percentileThresholdValue.
+      if (percentileThresholdValue === undefined) {
+        logMessage(
+          `Abort service since percentileThresholdValue could not be determined.`
+        );
+        progress.loadedHistogramStepsize = 1;
+        progress.loadedOverallHistogram = 1;
+        progress.loadedFieldCanditates = 1;
+        progress.loadedFieldValuePairs = 1;
+        progress.loadedHistograms = 1;
+        isRunning = false;
+        return;
+      }
+
+      const histogramRangeSteps = await fetchTransactionDurationHistogramRangeSteps(
         esClient,
         params
       );
       progress.loadedHistogramStepsize = 1;
 
+      logMessage(`Loaded histogram range steps.`);
+
       if (isCancelled) {
         isRunning = false;
         return;
@@ -86,6 +115,8 @@ export const asyncSearchServiceProvider = (
       progress.loadedOverallHistogram = 1;
       overallHistogram = overallLogHistogramChartData;
 
+      logMessage(`Loaded overall histogram chart data.`);
+
       if (isCancelled) {
         isRunning = false;
         return;
@@ -93,13 +124,13 @@ export const asyncSearchServiceProvider = (
 
       // Create an array of ranges [2, 4, 6, ..., 98]
       const percents = Array.from(range(2, 100, 2));
-      const percentilesRecords = await fetchTransactionDurationPercentiles(
-        esClient,
-        params,
-        percents
-      );
+      const {
+        percentiles: percentilesRecords,
+      } = await fetchTransactionDurationPercentiles(esClient, params, percents);
       const percentiles = Object.values(percentilesRecords);
 
+      logMessage(`Loaded percentiles.`);
+
       if (isCancelled) {
         isRunning = false;
         return;
@@ -110,6 +141,8 @@ export const asyncSearchServiceProvider = (
         params
       );
 
+      logMessage(`Identified ${fieldCandidates.length} fieldCandidates.`);
+
       progress.loadedFieldCanditates = 1;
 
       const fieldValuePairs = await fetchTransactionDurationFieldValuePairs(
@@ -119,6 +152,8 @@ export const asyncSearchServiceProvider = (
         progress
       );
 
+      logMessage(`Identified ${fieldValuePairs.length} fieldValuePairs.`);
+
       if (isCancelled) {
         isRunning = false;
         return;
@@ -133,6 +168,8 @@ export const asyncSearchServiceProvider = (
         totalDocCount,
       } = await fetchTransactionDurationFractions(esClient, params, ranges);
 
+      logMessage(`Loaded fractions and totalDocCount of ${totalDocCount}.`);
+
       async function* fetchTransactionDurationHistograms() {
         for (const item of shuffle(fieldValuePairs)) {
           if (item === undefined || isCancelled) {
@@ -185,7 +222,11 @@ export const asyncSearchServiceProvider = (
               yield undefined;
             }
           } catch (e) {
-            error = e;
+            // don't fail the whole process for individual correlation queries, just add the error to the internal log.
+            logMessage(
+              `Failed to fetch correlation/kstest for '${item.field}/${item.value}'`
+            );
+            yield undefined;
           }
         }
       }
@@ -199,10 +240,14 @@ export const asyncSearchServiceProvider = (
         progress.loadedHistograms = loadedHistograms / fieldValuePairs.length;
       }
 
-      isRunning = false;
+      logMessage(
+        `Identified ${values.length} significant correlations out of ${fieldValuePairs.length} field/value pairs.`
+      );
     } catch (e) {
       error = e;
     }
+
+    isRunning = false;
   };
 
   fetchCorrelations();
@@ -212,6 +257,7 @@ export const asyncSearchServiceProvider = (
 
     return {
       error,
+      log,
       isRunning,
       loaded: Math.round(progress.getOverallProgress() * 100),
       overallHistogram,
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/get_query_with_params.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/get_query_with_params.test.ts
index 12e897ab3eec9..016355b3a6415 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/get_query_with_params.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/get_query_with_params.test.ts
@@ -10,10 +10,23 @@ import { getQueryWithParams } from './get_query_with_params';
 describe('correlations', () => {
   describe('getQueryWithParams', () => {
     it('returns the most basic query filtering on processor.event=transaction', () => {
-      const query = getQueryWithParams({ params: { index: 'apm-*' } });
+      const query = getQueryWithParams({
+        params: { index: 'apm-*', start: '2020', end: '2021' },
+      });
       expect(query).toEqual({
         bool: {
-          filter: [{ term: { 'processor.event': 'transaction' } }],
+          filter: [
+            { term: { 'processor.event': 'transaction' } },
+            {
+              range: {
+                '@timestamp': {
+                  format: 'epoch_millis',
+                  gte: 1577836800000,
+                  lte: 1609459200000,
+                },
+              },
+            },
+          ],
         },
       });
     });
@@ -24,8 +37,8 @@ describe('correlations', () => {
           index: 'apm-*',
           serviceName: 'actualServiceName',
           transactionName: 'actualTransactionName',
-          start: '01-01-2021',
-          end: '31-01-2021',
+          start: '2020',
+          end: '2021',
           environment: 'dev',
           percentileThresholdValue: 75,
         },
@@ -33,22 +46,17 @@ describe('correlations', () => {
       expect(query).toEqual({
         bool: {
           filter: [
-            { term: { 'processor.event': 'transaction' } },
-            {
-              term: {
-                'service.name': 'actualServiceName',
-              },
-            },
             {
               term: {
-                'transaction.name': 'actualTransactionName',
+                'processor.event': 'transaction',
               },
             },
             {
               range: {
                 '@timestamp': {
-                  gte: '01-01-2021',
-                  lte: '31-01-2021',
+                  format: 'epoch_millis',
+                  gte: 1577836800000,
+                  lte: 1609459200000,
                 },
               },
             },
@@ -57,6 +65,16 @@ describe('correlations', () => {
                 'service.environment': 'dev',
               },
             },
+            {
+              term: {
+                'service.name': 'actualServiceName',
+              },
+            },
+            {
+              term: {
+                'transaction.name': 'actualTransactionName',
+              },
+            },
             {
               range: {
                 'transaction.duration.us': {
@@ -71,7 +89,7 @@ describe('correlations', () => {
 
     it('returns a query considering a custom field/value pair', () => {
       const query = getQueryWithParams({
-        params: { index: 'apm-*' },
+        params: { index: 'apm-*', start: '2020', end: '2021' },
         fieldName: 'actualFieldName',
         fieldValue: 'actualFieldValue',
       });
@@ -79,6 +97,15 @@ describe('correlations', () => {
         bool: {
           filter: [
             { term: { 'processor.event': 'transaction' } },
+            {
+              range: {
+                '@timestamp': {
+                  format: 'epoch_millis',
+                  gte: 1577836800000,
+                  lte: 1609459200000,
+                },
+              },
+            },
             {
               term: {
                 actualFieldName: 'actualFieldValue',
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/get_query_with_params.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/get_query_with_params.ts
index 08ba4b23fec35..e0ddfc1b053b5 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/get_query_with_params.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/get_query_with_params.ts
@@ -5,16 +5,19 @@
  * 2.0.
  */
 
+import { pipe } from 'fp-ts/lib/pipeable';
+import { getOrElse } from 'fp-ts/lib/Either';
+import { failure } from 'io-ts/lib/PathReporter';
+import * as t from 'io-ts';
+
 import type { estypes } from '@elastic/elasticsearch';
-import {
-  PROCESSOR_EVENT,
-  SERVICE_NAME,
-  TRANSACTION_DURATION,
-  TRANSACTION_NAME,
-} from '../../../../common/elasticsearch_fieldnames';
+import { TRANSACTION_DURATION } from '../../../../common/elasticsearch_fieldnames';
 import type { SearchServiceParams } from '../../../../common/search_strategies/correlations/types';
-import { environmentQuery as getEnvironmentQuery } from '../../../utils/queries';
-import { ProcessorEvent } from '../../../../common/processor_event';
+import { rangeRt } from '../../../routes/default_api_types';
+
+import { Setup, SetupTimeRange } from '../../helpers/setup_request';
+
+import { getCorrelationsFilters } from '../../correlations/get_filters';
 
 const getPercentileThresholdValueQuery = (
   percentileThresholdValue: number | undefined
@@ -39,26 +42,6 @@ export const getTermsQuery = (
   return fieldName && fieldValue ? [{ term: { [fieldName]: fieldValue } }] : [];
 };
 
-const getRangeQuery = (
-  start?: string,
-  end?: string
-): estypes.QueryDslQueryContainer[] => {
-  if (start === undefined && end === undefined) {
-    return [];
-  }
-
-  return [
-    {
-      range: {
-        '@timestamp': {
-          ...(start !== undefined ? { gte: start } : {}),
-          ...(end !== undefined ? { lte: end } : {}),
-        },
-      },
-    },
-  ];
-};
-
 interface QueryParams {
   params: SearchServiceParams;
   fieldName?: string;
@@ -71,21 +54,37 @@ export const getQueryWithParams = ({
 }: QueryParams) => {
   const {
     environment,
+    kuery,
     serviceName,
     start,
     end,
     percentileThresholdValue,
+    transactionType,
     transactionName,
   } = params;
+
+  // converts string based start/end to epochmillis
+  const setup = pipe(
+    rangeRt.decode({ start, end }),
+    getOrElse<t.Errors, { start: number; end: number }>((errors) => {
+      throw new Error(failure(errors).join('\n'));
+    })
+  ) as Setup & SetupTimeRange;
+
+  const filters = getCorrelationsFilters({
+    setup,
+    environment,
+    kuery,
+    serviceName,
+    transactionType,
+    transactionName,
+  });
+
   return {
     bool: {
       filter: [
-        ...getTermsQuery(PROCESSOR_EVENT, ProcessorEvent.transaction),
-        ...getTermsQuery(SERVICE_NAME, serviceName),
-        ...getTermsQuery(TRANSACTION_NAME, transactionName),
+        ...filters,
         ...getTermsQuery(fieldName, fieldValue),
-        ...getRangeQuery(start, end),
-        ...getEnvironmentQuery(environment),
         ...getPercentileThresholdValueQuery(percentileThresholdValue),
       ] as estypes.QueryDslQueryContainer[],
     },
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_correlation.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_correlation.test.ts
index 24741ebaa2dae..678328dce1a19 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_correlation.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_correlation.test.ts
@@ -15,7 +15,7 @@ import {
   BucketCorrelation,
 } from './query_correlation';
 
-const params = { index: 'apm-*' };
+const params = { index: 'apm-*', start: '2020', end: '2021' };
 const expectations = [1, 3, 5];
 const ranges = [{ to: 1 }, { from: 1, to: 3 }, { from: 3, to: 5 }, { from: 5 }];
 const fractions = [1, 2, 4, 5];
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_field_candidates.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_field_candidates.test.ts
index 89bdd4280d324..8929b31b3ecb1 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_field_candidates.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_field_candidates.test.ts
@@ -16,7 +16,7 @@ import {
   shouldBeExcluded,
 } from './query_field_candidates';
 
-const params = { index: 'apm-*' };
+const params = { index: 'apm-*', start: '2020', end: '2021' };
 
 describe('query_field_candidates', () => {
   describe('shouldBeExcluded', () => {
@@ -61,6 +61,15 @@ describe('query_field_candidates', () => {
                         'processor.event': 'transaction',
                       },
                     },
+                    {
+                      range: {
+                        '@timestamp': {
+                          format: 'epoch_millis',
+                          gte: 1577836800000,
+                          lte: 1609459200000,
+                        },
+                      },
+                    },
                   ],
                 },
               },
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_field_value_pairs.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_field_value_pairs.test.ts
index ea5a1f55bc924..7ffbc5208e41e 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_field_value_pairs.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_field_value_pairs.test.ts
@@ -16,7 +16,7 @@ import {
   getTermsAggRequest,
 } from './query_field_value_pairs';
 
-const params = { index: 'apm-*' };
+const params = { index: 'apm-*', start: '2020', end: '2021' };
 
 describe('query_field_value_pairs', () => {
   describe('getTermsAggRequest', () => {
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_fractions.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_fractions.test.ts
index 6052841d277c3..3e7d4a52e4de2 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_fractions.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_fractions.test.ts
@@ -14,7 +14,7 @@ import {
   getTransactionDurationRangesRequest,
 } from './query_fractions';
 
-const params = { index: 'apm-*' };
+const params = { index: 'apm-*', start: '2020', end: '2021' };
 const ranges = [{ to: 1 }, { from: 1, to: 3 }, { from: 3, to: 5 }, { from: 5 }];
 
 describe('query_fractions', () => {
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram.test.ts
index 2be9446352260..ace9177947960 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram.test.ts
@@ -14,7 +14,7 @@ import {
   getTransactionDurationHistogramRequest,
 } from './query_histogram';
 
-const params = { index: 'apm-*' };
+const params = { index: 'apm-*', start: '2020', end: '2021' };
 const interval = 100;
 
 describe('query_histogram', () => {
@@ -40,6 +40,15 @@ describe('query_histogram', () => {
                     'processor.event': 'transaction',
                   },
                 },
+                {
+                  range: {
+                    '@timestamp': {
+                      format: 'epoch_millis',
+                      gte: 1577836800000,
+                      lte: 1609459200000,
+                    },
+                  },
+                },
               ],
             },
           },
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_interval.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_interval.test.ts
index 9ed529ccabddb..ebd78f1248510 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_interval.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_interval.test.ts
@@ -14,7 +14,7 @@ import {
   getHistogramIntervalRequest,
 } from './query_histogram_interval';
 
-const params = { index: 'apm-*' };
+const params = { index: 'apm-*', start: '2020', end: '2021' };
 
 describe('query_histogram_interval', () => {
   describe('getHistogramIntervalRequest', () => {
@@ -43,6 +43,15 @@ describe('query_histogram_interval', () => {
                     'processor.event': 'transaction',
                   },
                 },
+                {
+                  range: {
+                    '@timestamp': {
+                      format: 'epoch_millis',
+                      gte: 1577836800000,
+                      lte: 1609459200000,
+                    },
+                  },
+                },
               ],
             },
           },
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_rangesteps.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_range_steps.test.ts
similarity index 77%
rename from x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_rangesteps.test.ts
rename to x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_range_steps.test.ts
index bb366ea29fed4..76aab1cd979c9 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_rangesteps.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_range_steps.test.ts
@@ -10,13 +10,13 @@ import type { estypes } from '@elastic/elasticsearch';
 import type { ElasticsearchClient } from 'src/core/server';
 
 import {
-  fetchTransactionDurationHistogramRangesteps,
+  fetchTransactionDurationHistogramRangeSteps,
   getHistogramIntervalRequest,
-} from './query_histogram_rangesteps';
+} from './query_histogram_range_steps';
 
-const params = { index: 'apm-*' };
+const params = { index: 'apm-*', start: '2020', end: '2021' };
 
-describe('query_histogram_rangesteps', () => {
+describe('query_histogram_range_steps', () => {
   describe('getHistogramIntervalRequest', () => {
     it('returns the request body for the histogram interval request', () => {
       const req = getHistogramIntervalRequest(params);
@@ -43,6 +43,15 @@ describe('query_histogram_rangesteps', () => {
                     'processor.event': 'transaction',
                   },
                 },
+                {
+                  range: {
+                    '@timestamp': {
+                      format: 'epoch_millis',
+                      gte: 1577836800000,
+                      lte: 1609459200000,
+                    },
+                  },
+                },
               ],
             },
           },
@@ -53,13 +62,14 @@ describe('query_histogram_rangesteps', () => {
     });
   });
 
-  describe('fetchTransactionDurationHistogramRangesteps', () => {
+  describe('fetchTransactionDurationHistogramRangeSteps', () => {
     it('fetches the range steps for the log histogram', async () => {
       const esClientSearchMock = jest.fn((req: estypes.SearchRequest): {
         body: estypes.SearchResponse;
       } => {
         return {
           body: ({
+            hits: { total: { value: 10 } },
             aggregations: {
               transaction_duration_max: {
                 value: 10000,
@@ -76,7 +86,7 @@ describe('query_histogram_rangesteps', () => {
         search: esClientSearchMock,
       } as unknown) as ElasticsearchClient;
 
-      const resp = await fetchTransactionDurationHistogramRangesteps(
+      const resp = await fetchTransactionDurationHistogramRangeSteps(
         esClientMock,
         params
       );
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_rangesteps.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_range_steps.ts
similarity index 83%
rename from x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_rangesteps.ts
rename to x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_range_steps.ts
index e537165ca53f3..6ee5dd6bcdf83 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_rangesteps.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_histogram_range_steps.ts
@@ -23,6 +23,14 @@ import type { SearchServiceParams } from '../../../../common/search_strategies/c
 
 import { getQueryWithParams } from './get_query_with_params';
 
+const getHistogramRangeSteps = (min: number, max: number, steps: number) => {
+  // A d3 based scale function as a helper to get equally distributed bins on a log scale.
+  const logFn = scaleLog().domain([min, max]).range([1, steps]);
+  return [...Array(steps).keys()]
+    .map(logFn.invert)
+    .map((d) => (isNaN(d) ? 0 : d));
+};
+
 export const getHistogramIntervalRequest = (
   params: SearchServiceParams
 ): estypes.SearchRequest => ({
@@ -37,19 +45,24 @@ export const getHistogramIntervalRequest = (
   },
 });
 
-export const fetchTransactionDurationHistogramRangesteps = async (
+export const fetchTransactionDurationHistogramRangeSteps = async (
   esClient: ElasticsearchClient,
   params: SearchServiceParams
 ): Promise<number[]> => {
+  const steps = 100;
+
   const resp = await esClient.search(getHistogramIntervalRequest(params));
 
+  if ((resp.body.hits.total as estypes.SearchTotalHits).value === 0) {
+    return getHistogramRangeSteps(0, 1, 100);
+  }
+
   if (resp.body.aggregations === undefined) {
     throw new Error(
-      'fetchTransactionDurationHistogramInterval failed, did not return aggregations.'
+      'fetchTransactionDurationHistogramRangeSteps failed, did not return aggregations.'
     );
   }
 
-  const steps = 100;
   const min = (resp.body.aggregations
     .transaction_duration_min as estypes.AggregationsValueAggregate).value;
   const max =
@@ -57,9 +70,5 @@ export const fetchTransactionDurationHistogramRangesteps = async (
       .transaction_duration_max as estypes.AggregationsValueAggregate).value *
     2;
 
-  // A d3 based scale function as a helper to get equally distributed bins on a log scale.
-  const logFn = scaleLog().domain([min, max]).range([1, steps]);
-  return [...Array(steps).keys()]
-    .map(logFn.invert)
-    .map((d) => (isNaN(d) ? 0 : d));
+  return getHistogramRangeSteps(min, max, steps);
 };
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_percentiles.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_percentiles.test.ts
index 0c319aee0fb2b..f0d01a4849f9f 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_percentiles.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_percentiles.test.ts
@@ -14,7 +14,7 @@ import {
   getTransactionDurationPercentilesRequest,
 } from './query_percentiles';
 
-const params = { index: 'apm-*' };
+const params = { index: 'apm-*', start: '2020', end: '2021' };
 
 describe('query_percentiles', () => {
   describe('getTransactionDurationPercentilesRequest', () => {
@@ -41,10 +41,20 @@ describe('query_percentiles', () => {
                     'processor.event': 'transaction',
                   },
                 },
+                {
+                  range: {
+                    '@timestamp': {
+                      format: 'epoch_millis',
+                      gte: 1577836800000,
+                      lte: 1609459200000,
+                    },
+                  },
+                },
               ],
             },
           },
           size: 0,
+          track_total_hits: true,
         },
         index: params.index,
       });
@@ -53,6 +63,7 @@ describe('query_percentiles', () => {
 
   describe('fetchTransactionDurationPercentiles', () => {
     it('fetches the percentiles', async () => {
+      const totalDocs = 10;
       const percentilesValues = {
         '1.0': 5.0,
         '5.0': 25.0,
@@ -68,6 +79,7 @@ describe('query_percentiles', () => {
       } => {
         return {
           body: ({
+            hits: { total: { value: totalDocs } },
             aggregations: {
               transaction_duration_percentiles: {
                 values: percentilesValues,
@@ -86,7 +98,7 @@ describe('query_percentiles', () => {
         params
       );
 
-      expect(resp).toEqual(percentilesValues);
+      expect(resp).toEqual({ percentiles: percentilesValues, totalDocs });
       expect(esClientSearchMock).toHaveBeenCalledTimes(1);
     });
   });
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_percentiles.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_percentiles.ts
index 18dcefb59a11a..c80f5d836c0ef 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_percentiles.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_percentiles.ts
@@ -38,6 +38,7 @@ export const getTransactionDurationPercentilesRequest = (
   return {
     index: params.index,
     body: {
+      track_total_hits: true,
       query,
       size: 0,
       aggs: {
@@ -61,7 +62,7 @@ export const fetchTransactionDurationPercentiles = async (
   percents?: number[],
   fieldName?: string,
   fieldValue?: string
-): Promise<Record<string, number>> => {
+): Promise<{ totalDocs: number; percentiles: Record<string, number> }> => {
   const resp = await esClient.search<ResponseHit>(
     getTransactionDurationPercentilesRequest(
       params,
@@ -71,14 +72,22 @@ export const fetchTransactionDurationPercentiles = async (
     )
   );
 
+  // return early with no results if the search didn't return any documents
+  if ((resp.body.hits.total as estypes.SearchTotalHits).value === 0) {
+    return { totalDocs: 0, percentiles: {} };
+  }
+
   if (resp.body.aggregations === undefined) {
     throw new Error(
       'fetchTransactionDurationPercentiles failed, did not return aggregations.'
     );
   }
-  return (
-    (resp.body.aggregations
-      .transaction_duration_percentiles as estypes.AggregationsTDigestPercentilesAggregate)
-      .values ?? {}
-  );
+
+  return {
+    totalDocs: (resp.body.hits.total as estypes.SearchTotalHits).value,
+    percentiles:
+      (resp.body.aggregations
+        .transaction_duration_percentiles as estypes.AggregationsTDigestPercentilesAggregate)
+        .values ?? {},
+  };
 };
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_ranges.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_ranges.test.ts
index 9451928e47ded..7d18efc360563 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_ranges.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/query_ranges.test.ts
@@ -14,7 +14,7 @@ import {
   getTransactionDurationRangesRequest,
 } from './query_ranges';
 
-const params = { index: 'apm-*' };
+const params = { index: 'apm-*', start: '2020', end: '2021' };
 const rangeSteps = [1, 3, 5];
 
 describe('query_ranges', () => {
@@ -59,6 +59,15 @@ describe('query_ranges', () => {
                     'processor.event': 'transaction',
                   },
                 },
+                {
+                  range: {
+                    '@timestamp': {
+                      format: 'epoch_millis',
+                      gte: 1577836800000,
+                      lte: 1609459200000,
+                    },
+                  },
+                },
               ],
             },
           },
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/search_strategy.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/search_strategy.test.ts
index 6d4bfcdde9994..09775cb2eb034 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/search_strategy.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/search_strategy.test.ts
@@ -122,6 +122,8 @@ describe('APM Correlations search strategy', () => {
       } as unknown) as SearchStrategyDependencies;
       params = {
         index: 'apm-*',
+        start: '2020',
+        end: '2021',
       };
     });
 
@@ -154,10 +156,22 @@ describe('APM Correlations search strategy', () => {
               },
               query: {
                 bool: {
-                  filter: [{ term: { 'processor.event': 'transaction' } }],
+                  filter: [
+                    { term: { 'processor.event': 'transaction' } },
+                    {
+                      range: {
+                        '@timestamp': {
+                          format: 'epoch_millis',
+                          gte: 1577836800000,
+                          lte: 1609459200000,
+                        },
+                      },
+                    },
+                  ],
                 },
               },
               size: 0,
+              track_total_hits: true,
             })
           );
         });
@@ -167,11 +181,17 @@ describe('APM Correlations search strategy', () => {
         it('retrieves the current request', async () => {
           const searchStrategy = await apmCorrelationsSearchStrategyProvider();
           const response = await searchStrategy
-            .search({ id: 'my-search-id', params }, {}, mockDeps)
+            .search({ params }, {}, mockDeps)
             .toPromise();
 
-          expect(response).toEqual(
-            expect.objectContaining({ id: 'my-search-id' })
+          const searchStrategyId = response.id;
+
+          const response2 = await searchStrategy
+            .search({ id: searchStrategyId, params }, {}, mockDeps)
+            .toPromise();
+
+          expect(response2).toEqual(
+            expect.objectContaining({ id: searchStrategyId })
           );
         });
       });
@@ -226,7 +246,7 @@ describe('APM Correlations search strategy', () => {
 
         expect(response2.id).toEqual(response1.id);
         expect(response2).toEqual(
-          expect.objectContaining({ loaded: 10, isRunning: false })
+          expect.objectContaining({ loaded: 100, isRunning: false })
         );
       });
     });
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/search_strategy.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/search_strategy.ts
index d6b4e0e7094b3..8f2e6913c0d06 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/search_strategy.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/search_strategy.ts
@@ -41,14 +41,40 @@ export const apmCorrelationsSearchStrategyProvider = (): ISearchStrategy<
         throw new Error('Invalid request parameters.');
       }
 
-      const id = request.id ?? uuid();
+      // The function to fetch the current state of the async search service.
+      // This will be either an existing service for a follow up fetch or a new one for new requests.
+      let getAsyncSearchServiceState: ReturnType<
+        typeof asyncSearchServiceProvider
+      >;
+
+      // If the request includes an ID, we require that the async search service already exists
+      // otherwise we throw an error. The client should never poll a service that's been cancelled or finished.
+      // This also avoids instantiating async search services when the service gets called with random IDs.
+      if (typeof request.id === 'string') {
+        const existingGetAsyncSearchServiceState = asyncSearchServiceMap.get(
+          request.id
+        );
 
-      const getAsyncSearchServiceState =
-        asyncSearchServiceMap.get(id) ??
-        asyncSearchServiceProvider(deps.esClient.asCurrentUser, request.params);
+        if (typeof existingGetAsyncSearchServiceState === 'undefined') {
+          throw new Error(
+            `AsyncSearchService with ID '${request.id}' does not exist.`
+          );
+        }
+
+        getAsyncSearchServiceState = existingGetAsyncSearchServiceState;
+      } else {
+        getAsyncSearchServiceState = asyncSearchServiceProvider(
+          deps.esClient.asCurrentUser,
+          request.params
+        );
+      }
+
+      // Reuse the request's id or create a new one.
+      const id = request.id ?? uuid();
 
       const {
         error,
+        log,
         isRunning,
         loaded,
         started,
@@ -76,6 +102,7 @@ export const apmCorrelationsSearchStrategyProvider = (): ISearchStrategy<
         isRunning,
         isPartial: isRunning,
         rawResponse: {
+          log,
           took,
           values,
           percentileThresholdValue,
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/correlations/utils/aggregation_utils.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/correlations/utils/aggregation_utils.test.ts
index 63de0a59d4894..4313ad58ecbc0 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/correlations/utils/aggregation_utils.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/correlations/utils/aggregation_utils.test.ts
@@ -14,6 +14,7 @@ describe('aggregation utils', () => {
       expect(expectations).toEqual([0, 0.5, 1]);
       expect(ranges).toEqual([{ to: 0 }, { from: 0, to: 1 }, { from: 1 }]);
     });
+
     it('returns expectations and ranges based on given percentiles #2', async () => {
       const { expectations, ranges } = computeExpectationsAndRanges([1, 3, 5]);
       expect(expectations).toEqual([1, 2, 4, 5]);
@@ -24,6 +25,7 @@ describe('aggregation utils', () => {
         { from: 5 },
       ]);
     });
+
     it('returns expectations and ranges with adjusted fractions', async () => {
       const { expectations, ranges } = computeExpectationsAndRanges([
         1,
@@ -45,5 +47,97 @@ describe('aggregation utils', () => {
         { from: 5 },
       ]);
     });
+
+    // TODO identify these results derived from the array of percentiles are usable with the ES correlation aggregation
+    it('returns expectation and ranges adjusted when percentiles have equal values', async () => {
+      const { expectations, ranges } = computeExpectationsAndRanges([
+        5000,
+        5000,
+        3090428,
+        3090428,
+        3090428,
+        3618812,
+        3618812,
+        3618812,
+        3618812,
+        3696636,
+        3696636,
+        3696636,
+        3696636,
+        3696636,
+        3696636,
+      ]);
+      expect(expectations).toEqual([
+        5000,
+        1856256.7999999998,
+        3392361.714285714,
+        3665506.4,
+        3696636,
+      ]);
+      expect(ranges).toEqual([
+        {
+          to: 5000,
+        },
+        {
+          from: 5000,
+          to: 5000,
+        },
+        {
+          from: 5000,
+          to: 3090428,
+        },
+        {
+          from: 3090428,
+          to: 3090428,
+        },
+        {
+          from: 3090428,
+          to: 3090428,
+        },
+        {
+          from: 3090428,
+          to: 3618812,
+        },
+        {
+          from: 3618812,
+          to: 3618812,
+        },
+        {
+          from: 3618812,
+          to: 3618812,
+        },
+        {
+          from: 3618812,
+          to: 3618812,
+        },
+        {
+          from: 3618812,
+          to: 3696636,
+        },
+        {
+          from: 3696636,
+          to: 3696636,
+        },
+        {
+          from: 3696636,
+          to: 3696636,
+        },
+        {
+          from: 3696636,
+          to: 3696636,
+        },
+        {
+          from: 3696636,
+          to: 3696636,
+        },
+        {
+          from: 3696636,
+          to: 3696636,
+        },
+        {
+          from: 3696636,
+        },
+      ]);
+    });
   });
 });
diff --git a/x-pack/plugins/apm/server/routes/fleet.ts b/x-pack/plugins/apm/server/routes/fleet.ts
index b760014d6af89..66843f4f0df4d 100644
--- a/x-pack/plugins/apm/server/routes/fleet.ts
+++ b/x-pack/plugins/apm/server/routes/fleet.ts
@@ -25,8 +25,6 @@ import { createCloudApmPackgePolicy } from '../lib/fleet/create_cloud_apm_packag
 import { getUnsupportedApmServerSchema } from '../lib/fleet/get_unsupported_apm_server_schema';
 import { isSuperuser } from '../lib/fleet/is_superuser';
 import { getInternalSavedObjectsClient } from '../lib/helpers/get_internal_saved_objects_client';
-import { setupRequest } from '../lib/helpers/setup_request';
-import { createStaticIndexPattern } from '../lib/index_pattern/create_static_index_pattern';
 
 const hasFleetDataRoute = createApmServerRoute({
   endpoint: 'GET /api/apm/fleet/has_data',
@@ -156,7 +154,7 @@ const createCloudApmPackagePolicyRoute = createApmServerRoute({
   endpoint: 'POST /api/apm/fleet/cloud_apm_package_policy',
   options: { tags: ['access:apm', 'access:apm_write'] },
   handler: async (resources) => {
-    const { plugins, context, config, request, logger, core } = resources;
+    const { plugins, context, config, request, logger } = resources;
     const cloudApmMigrationEnabled =
       config['xpack.apm.agent.migrations.enabled'];
     if (!plugins.fleet || !plugins.security) {
@@ -174,7 +172,7 @@ const createCloudApmPackagePolicyRoute = createApmServerRoute({
       throw Boom.forbidden(CLOUD_SUPERUSER_REQUIRED_MESSAGE);
     }
 
-    const cloudApmAackagePolicy = await createCloudApmPackgePolicy({
+    const cloudApmPackagePolicy = await createCloudApmPackgePolicy({
       cloudPluginSetup,
       fleetPluginStart,
       savedObjectsClient,
@@ -182,25 +180,7 @@ const createCloudApmPackagePolicyRoute = createApmServerRoute({
       logger,
     });
 
-    const [setup, internalSavedObjectsClient] = await Promise.all([
-      setupRequest(resources),
-      core
-        .start()
-        .then(({ savedObjects }) => savedObjects.createInternalRepository()),
-    ]);
-
-    const spaceId = plugins.spaces?.setup.spacesService.getSpaceId(request);
-
-    // force update the index pattern title with data streams
-    await createStaticIndexPattern(
-      setup,
-      config,
-      internalSavedObjectsClient,
-      spaceId,
-      true
-    );
-
-    return { cloud_apm_package_policy: cloudApmAackagePolicy };
+    return { cloudApmPackagePolicy };
   },
 });
 
diff --git a/x-pack/plugins/apm/server/routes/index_pattern.ts b/x-pack/plugins/apm/server/routes/index_pattern.ts
index aa70cde4f96ae..190baf3bbc270 100644
--- a/x-pack/plugins/apm/server/routes/index_pattern.ts
+++ b/x-pack/plugins/apm/server/routes/index_pattern.ts
@@ -32,12 +32,12 @@ const staticIndexPatternRoute = createApmServerRoute({
 
     const spaceId = spaces?.setup.spacesService.getSpaceId(request);
 
-    const didCreateIndexPattern = await createStaticIndexPattern(
+    const didCreateIndexPattern = await createStaticIndexPattern({
       setup,
       config,
       savedObjectsClient,
-      spaceId
-    );
+      spaceId,
+    });
 
     return { created: didCreateIndexPattern };
   },
diff --git a/x-pack/plugins/apm/server/routes/register_routes/index.ts b/x-pack/plugins/apm/server/routes/register_routes/index.ts
index 8e6070de722be..16e77f59f4d02 100644
--- a/x-pack/plugins/apm/server/routes/register_routes/index.ts
+++ b/x-pack/plugins/apm/server/routes/register_routes/index.ts
@@ -18,9 +18,12 @@ import {
   routeValidationObject,
 } from '@kbn/server-route-repository';
 import { mergeRt, jsonRt } from '@kbn/io-ts-utils';
-import { UsageCollectionSetup } from '../../../../../../src/plugins/usage_collection/server';
 import { pickKeys } from '../../../common/utils/pick_keys';
-import { APMRouteHandlerResources, InspectResponse } from '../typings';
+import {
+  APMRouteHandlerResources,
+  InspectResponse,
+  TelemetryUsageCounter,
+} from '../typings';
 import type { ApmPluginRequestHandlerContext } from '../typings';
 
 const inspectRt = t.exact(
@@ -56,9 +59,7 @@ export function registerRoutes({
   repository: ServerRouteRepository<APMRouteHandlerResources>;
   config: APMRouteHandlerResources['config'];
   ruleDataClient: APMRouteHandlerResources['ruleDataClient'];
-  telemetryUsageCounter?: ReturnType<
-    UsageCollectionSetup['createUsageCounter']
-  >;
+  telemetryUsageCounter?: TelemetryUsageCounter;
 }) {
   const routes = repository.getRoutes();
 
@@ -104,6 +105,7 @@ export function registerRoutes({
               logger,
               core,
               plugins,
+              telemetryUsageCounter,
               params: merge(
                 {
                   query: {
diff --git a/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts b/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
index 05eec47893793..f50770cb5ded7 100644
--- a/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
+++ b/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
@@ -79,7 +79,7 @@ const deleteAgentConfigurationRoute = createApmServerRoute({
   }),
   handler: async (resources) => {
     const setup = await setupRequest(resources);
-    const { params, logger, core } = resources;
+    const { params, logger, core, telemetryUsageCounter } = resources;
 
     const { service } = params.body;
 
@@ -106,6 +106,7 @@ const deleteAgentConfigurationRoute = createApmServerRoute({
         core,
         fleetPluginStart: await resources.plugins.fleet.start(),
         setup,
+        telemetryUsageCounter,
       });
       logger.info(
         `Updated Fleet integration policy for APM to remove the deleted agent configuration.`
@@ -128,7 +129,7 @@ const createOrUpdateAgentConfigurationRoute = createApmServerRoute({
   ]),
   handler: async (resources) => {
     const setup = await setupRequest(resources);
-    const { params, logger, core } = resources;
+    const { params, logger, core, telemetryUsageCounter } = resources;
     const { body, query } = params;
 
     // if the config already exists, it is fetched and updated
@@ -162,6 +163,7 @@ const createOrUpdateAgentConfigurationRoute = createApmServerRoute({
         core,
         fleetPluginStart: await resources.plugins.fleet.start(),
         setup,
+        telemetryUsageCounter,
       });
       logger.info(
         `Saved latest agent settings to Fleet integration policy for APM.`
diff --git a/x-pack/plugins/apm/server/routes/typings.ts b/x-pack/plugins/apm/server/routes/typings.ts
index 56a5950c27367..4279cfd84328c 100644
--- a/x-pack/plugins/apm/server/routes/typings.ts
+++ b/x-pack/plugins/apm/server/routes/typings.ts
@@ -18,6 +18,7 @@ import type { RacApiRequestHandlerContext } from '../../../rule_registry/server'
 import { LicensingApiRequestHandlerContext } from '../../../licensing/server';
 import { APMConfig } from '..';
 import { APMPluginDependencies } from '../types';
+import { UsageCollectionSetup } from '../../../../../src/plugins/usage_collection/server';
 
 export interface ApmPluginRequestHandlerContext extends RequestHandlerContext {
   licensing: LicensingApiRequestHandlerContext;
@@ -47,6 +48,10 @@ export interface APMRouteCreateOptions {
   };
 }
 
+export type TelemetryUsageCounter = ReturnType<
+  UsageCollectionSetup['createUsageCounter']
+>;
+
 export interface APMRouteHandlerResources {
   request: KibanaRequest;
   context: ApmPluginRequestHandlerContext;
@@ -68,4 +73,5 @@ export interface APMRouteHandlerResources {
     };
   };
   ruleDataClient: RuleDataClient;
+  telemetryUsageCounter?: TelemetryUsageCounter;
 }
diff --git a/x-pack/plugins/canvas/public/components/function_reference_generator/function_reference_generator.tsx b/x-pack/plugins/canvas/public/components/function_reference_generator/function_reference_generator.tsx
index 81532816d9c83..eb394801f549c 100644
--- a/x-pack/plugins/canvas/public/components/function_reference_generator/function_reference_generator.tsx
+++ b/x-pack/plugins/canvas/public/components/function_reference_generator/function_reference_generator.tsx
@@ -29,7 +29,7 @@ export const FunctionReferenceGenerator: FC<Props> = ({ functionRegistry }) => {
   };
 
   return (
-    <EuiButtonEmpty color="danger" flush="left" size="xs" iconType="beaker" onClick={copyDocs}>
+    <EuiButtonEmpty color="danger" flush="left" size="s" iconType="beaker" onClick={copyDocs}>
       Generate function reference
     </EuiButtonEmpty>
   );
diff --git a/x-pack/plugins/canvas/public/components/help_menu/help_menu.tsx b/x-pack/plugins/canvas/public/components/help_menu/help_menu.tsx
index 2877ccf41056d..af1850beb5290 100644
--- a/x-pack/plugins/canvas/public/components/help_menu/help_menu.tsx
+++ b/x-pack/plugins/canvas/public/components/help_menu/help_menu.tsx
@@ -46,13 +46,13 @@ export const HelpMenu: FC<Props> = ({ functionRegistry }) => {
 
   return (
     <>
-      <EuiButtonEmpty size="xs" flush="left" iconType="keyboardShortcut" onClick={showFlyout}>
+      <EuiButtonEmpty size="s" flush="left" iconType="keyboardShortcut" onClick={showFlyout}>
         {strings.getKeyboardShortcutsLinkLabel()}
       </EuiButtonEmpty>
 
       {FunctionReferenceGenerator ? (
         <Suspense fallback={null}>
-          <EuiSpacer size="s" />
+          <EuiSpacer size="xs" />
           <FunctionReferenceGenerator functionRegistry={functionRegistry} />
         </Suspense>
       ) : null}
diff --git a/x-pack/plugins/canvas/public/components/workpad_header/edit_menu/__stories__/__snapshots__/edit_menu.stories.storyshot b/x-pack/plugins/canvas/public/components/workpad_header/edit_menu/__stories__/__snapshots__/edit_menu.stories.storyshot
index cc33ae3526c0c..f2bc9c57cbcc6 100644
--- a/x-pack/plugins/canvas/public/components/workpad_header/edit_menu/__stories__/__snapshots__/edit_menu.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/workpad_header/edit_menu/__stories__/__snapshots__/edit_menu.stories.storyshot
@@ -9,7 +9,7 @@ exports[`Storyshots components/WorkpadHeader/EditMenu 2 elements selected 1`] =
   >
     <button
       aria-label="Edit options"
-      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
       data-test-subj="canvasWorkpadEditMenuButton"
       disabled={false}
       onClick={[Function]}
@@ -38,7 +38,7 @@ exports[`Storyshots components/WorkpadHeader/EditMenu 3+ elements selected 1`] =
   >
     <button
       aria-label="Edit options"
-      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
       data-test-subj="canvasWorkpadEditMenuButton"
       disabled={false}
       onClick={[Function]}
@@ -67,7 +67,7 @@ exports[`Storyshots components/WorkpadHeader/EditMenu clipboard data exists 1`]
   >
     <button
       aria-label="Edit options"
-      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
       data-test-subj="canvasWorkpadEditMenuButton"
       disabled={false}
       onClick={[Function]}
@@ -96,7 +96,7 @@ exports[`Storyshots components/WorkpadHeader/EditMenu default 1`] = `
   >
     <button
       aria-label="Edit options"
-      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
       data-test-subj="canvasWorkpadEditMenuButton"
       disabled={false}
       onClick={[Function]}
@@ -125,7 +125,7 @@ exports[`Storyshots components/WorkpadHeader/EditMenu single element selected 1`
   >
     <button
       aria-label="Edit options"
-      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
       data-test-subj="canvasWorkpadEditMenuButton"
       disabled={false}
       onClick={[Function]}
@@ -154,7 +154,7 @@ exports[`Storyshots components/WorkpadHeader/EditMenu single grouped element sel
   >
     <button
       aria-label="Edit options"
-      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
       data-test-subj="canvasWorkpadEditMenuButton"
       disabled={false}
       onClick={[Function]}
diff --git a/x-pack/plugins/canvas/public/components/workpad_header/edit_menu/edit_menu.component.tsx b/x-pack/plugins/canvas/public/components/workpad_header/edit_menu/edit_menu.component.tsx
index c78bdb2a78821..efc7f2fae8f8b 100644
--- a/x-pack/plugins/canvas/public/components/workpad_header/edit_menu/edit_menu.component.tsx
+++ b/x-pack/plugins/canvas/public/components/workpad_header/edit_menu/edit_menu.component.tsx
@@ -248,7 +248,7 @@ export const EditMenu: FunctionComponent<Props> = ({
 
   const editControl = (togglePopover: React.MouseEventHandler<any>) => (
     <EuiButtonEmpty
-      size="xs"
+      size="s"
       aria-label={strings.getEditMenuLabel()}
       onClick={togglePopover}
       data-test-subj="canvasWorkpadEditMenuButton"
diff --git a/x-pack/plugins/canvas/public/components/workpad_header/share_menu/__stories__/__snapshots__/share_menu.stories.storyshot b/x-pack/plugins/canvas/public/components/workpad_header/share_menu/__stories__/__snapshots__/share_menu.stories.storyshot
index c78ff5bf781ec..e9dc2e4011530 100644
--- a/x-pack/plugins/canvas/public/components/workpad_header/share_menu/__stories__/__snapshots__/share_menu.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/workpad_header/share_menu/__stories__/__snapshots__/share_menu.stories.storyshot
@@ -10,7 +10,7 @@ exports[`Storyshots components/WorkpadHeader/ShareMenu minimal 1`] = `
     >
       <button
         aria-label="Share this workpad"
-        className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+        className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
         data-test-subj="shareTopNavButton"
         disabled={false}
         onClick={[Function]}
@@ -41,7 +41,7 @@ exports[`Storyshots components/WorkpadHeader/ShareMenu with Reporting 1`] = `
     >
       <button
         aria-label="Share this workpad"
-        className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+        className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
         data-test-subj="shareTopNavButton"
         disabled={false}
         onClick={[Function]}
diff --git a/x-pack/plugins/canvas/public/components/workpad_header/share_menu/share_menu.component.tsx b/x-pack/plugins/canvas/public/components/workpad_header/share_menu/share_menu.component.tsx
index 8d150d3d36972..e59bf284258fc 100644
--- a/x-pack/plugins/canvas/public/components/workpad_header/share_menu/share_menu.component.tsx
+++ b/x-pack/plugins/canvas/public/components/workpad_header/share_menu/share_menu.component.tsx
@@ -125,7 +125,7 @@ export const ShareMenu: FunctionComponent<Props> = ({
 
   const shareControl = (togglePopover: React.MouseEventHandler<any>) => (
     <EuiButtonEmpty
-      size="xs"
+      size="s"
       aria-label={strings.getShareWorkpadMessage()}
       onClick={togglePopover}
       data-test-subj="shareTopNavButton"
diff --git a/x-pack/plugins/canvas/public/components/workpad_header/view_menu/__stories__/__snapshots__/view_menu.stories.storyshot b/x-pack/plugins/canvas/public/components/workpad_header/view_menu/__stories__/__snapshots__/view_menu.stories.storyshot
index 5dcfe67ad22c2..8ba10b2b20b12 100644
--- a/x-pack/plugins/canvas/public/components/workpad_header/view_menu/__stories__/__snapshots__/view_menu.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/workpad_header/view_menu/__stories__/__snapshots__/view_menu.stories.storyshot
@@ -9,7 +9,7 @@ exports[`Storyshots components/WorkpadHeader/ViewMenu edit mode 1`] = `
   >
     <button
       aria-label="View options"
-      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
       disabled={false}
       onClick={[Function]}
       type="button"
@@ -37,7 +37,7 @@ exports[`Storyshots components/WorkpadHeader/ViewMenu read only mode 1`] = `
   >
     <button
       aria-label="View options"
-      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
       disabled={false}
       onClick={[Function]}
       type="button"
@@ -65,7 +65,7 @@ exports[`Storyshots components/WorkpadHeader/ViewMenu with autoplay enabled 1`]
   >
     <button
       aria-label="View options"
-      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
       disabled={false}
       onClick={[Function]}
       type="button"
@@ -93,7 +93,7 @@ exports[`Storyshots components/WorkpadHeader/ViewMenu with refresh enabled 1`] =
   >
     <button
       aria-label="View options"
-      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall"
+      className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
       disabled={false}
       onClick={[Function]}
       type="button"
diff --git a/x-pack/plugins/canvas/public/components/workpad_header/view_menu/view_menu.component.tsx b/x-pack/plugins/canvas/public/components/workpad_header/view_menu/view_menu.component.tsx
index 168ddc690c4d4..b001ad04caa44 100644
--- a/x-pack/plugins/canvas/public/components/workpad_header/view_menu/view_menu.component.tsx
+++ b/x-pack/plugins/canvas/public/components/workpad_header/view_menu/view_menu.component.tsx
@@ -177,7 +177,7 @@ export const ViewMenu: FunctionComponent<Props> = ({
   };
 
   const viewControl = (togglePopover: React.MouseEventHandler<any>) => (
-    <EuiButtonEmpty size="xs" aria-label={strings.getViewMenuLabel()} onClick={togglePopover}>
+    <EuiButtonEmpty size="s" aria-label={strings.getViewMenuLabel()} onClick={togglePopover}>
       {strings.getViewMenuButtonLabel()}
     </EuiButtonEmpty>
   );
diff --git a/x-pack/plugins/cases/docs/README.md b/x-pack/plugins/cases/docs/README.md
index 85482d98dc509..16e9311958763 100644
--- a/x-pack/plugins/cases/docs/README.md
+++ b/x-pack/plugins/cases/docs/README.md
@@ -19,7 +19,7 @@ yarn global add typedoc typedoc-plugin-markdown
 
 ```bash
 cd x-pack/plugins/cases/docs
-npx typedoc --options cases_client_typedoc.json
+npx typedoc --gitRemote upstream --options cases_client_typedoc.json
 ```
 
 After running the above commands the files in the `server` directory will be updated to match the new tsdocs.
diff --git a/x-pack/plugins/cases/docs/cases_client/classes/client.casesclient.md b/x-pack/plugins/cases/docs/cases_client/classes/client.casesclient.md
index bd07a44a2bfdf..b3bef7b36b571 100644
--- a/x-pack/plugins/cases/docs/cases_client/classes/client.casesclient.md
+++ b/x-pack/plugins/cases/docs/cases_client/classes/client.casesclient.md
@@ -45,7 +45,7 @@ Client wrapper that contains accessor methods for individual entities within the
 
 **Returns:** [*CasesClient*](client.casesclient.md)
 
-Defined in: [client.ts:28](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L28)
+Defined in: [client.ts:28](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L28)
 
 ## Properties
 
@@ -53,7 +53,7 @@ Defined in: [client.ts:28](https://github.com/jonathan-buttner/kibana/blob/b65ed
 
 • `Private` `Readonly` **\_attachments**: [*AttachmentsSubClient*](../interfaces/attachments_client.attachmentssubclient.md)
 
-Defined in: [client.ts:24](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L24)
+Defined in: [client.ts:24](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L24)
 
 ___
 
@@ -61,7 +61,7 @@ ___
 
 • `Private` `Readonly` **\_cases**: [*CasesSubClient*](../interfaces/cases_client.casessubclient.md)
 
-Defined in: [client.ts:23](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L23)
+Defined in: [client.ts:23](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L23)
 
 ___
 
@@ -69,7 +69,7 @@ ___
 
 • `Private` `Readonly` **\_casesClientInternal**: *CasesClientInternal*
 
-Defined in: [client.ts:22](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L22)
+Defined in: [client.ts:22](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L22)
 
 ___
 
@@ -77,7 +77,7 @@ ___
 
 • `Private` `Readonly` **\_configure**: [*ConfigureSubClient*](../interfaces/configure_client.configuresubclient.md)
 
-Defined in: [client.ts:27](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L27)
+Defined in: [client.ts:27](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L27)
 
 ___
 
@@ -85,7 +85,7 @@ ___
 
 • `Private` `Readonly` **\_stats**: [*StatsSubClient*](../interfaces/stats_client.statssubclient.md)
 
-Defined in: [client.ts:28](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L28)
+Defined in: [client.ts:28](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L28)
 
 ___
 
@@ -93,7 +93,7 @@ ___
 
 • `Private` `Readonly` **\_subCases**: [*SubCasesClient*](../interfaces/sub_cases_client.subcasesclient.md)
 
-Defined in: [client.ts:26](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L26)
+Defined in: [client.ts:26](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L26)
 
 ___
 
@@ -101,7 +101,7 @@ ___
 
 • `Private` `Readonly` **\_userActions**: [*UserActionsSubClient*](../interfaces/user_actions_client.useractionssubclient.md)
 
-Defined in: [client.ts:25](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L25)
+Defined in: [client.ts:25](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L25)
 
 ## Accessors
 
@@ -113,7 +113,7 @@ Retrieves an interface for interacting with attachments (comments) entities.
 
 **Returns:** [*AttachmentsSubClient*](../interfaces/attachments_client.attachmentssubclient.md)
 
-Defined in: [client.ts:50](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L50)
+Defined in: [client.ts:50](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L50)
 
 ___
 
@@ -125,7 +125,7 @@ Retrieves an interface for interacting with cases entities.
 
 **Returns:** [*CasesSubClient*](../interfaces/cases_client.casessubclient.md)
 
-Defined in: [client.ts:43](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L43)
+Defined in: [client.ts:43](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L43)
 
 ___
 
@@ -137,7 +137,7 @@ Retrieves an interface for interacting with the configuration of external connec
 
 **Returns:** [*ConfigureSubClient*](../interfaces/configure_client.configuresubclient.md)
 
-Defined in: [client.ts:76](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L76)
+Defined in: [client.ts:76](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L76)
 
 ___
 
@@ -149,7 +149,7 @@ Retrieves an interface for retrieving statistics related to the cases entities.
 
 **Returns:** [*StatsSubClient*](../interfaces/stats_client.statssubclient.md)
 
-Defined in: [client.ts:83](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L83)
+Defined in: [client.ts:83](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L83)
 
 ___
 
@@ -163,7 +163,7 @@ Currently this functionality is disabled and will throw an error if this functio
 
 **Returns:** [*SubCasesClient*](../interfaces/sub_cases_client.subcasesclient.md)
 
-Defined in: [client.ts:66](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L66)
+Defined in: [client.ts:66](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L66)
 
 ___
 
@@ -175,4 +175,4 @@ Retrieves an interface for interacting with the user actions associated with the
 
 **Returns:** [*UserActionsSubClient*](../interfaces/user_actions_client.useractionssubclient.md)
 
-Defined in: [client.ts:57](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/client.ts#L57)
+Defined in: [client.ts:57](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/client.ts#L57)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_add.addargs.md b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_add.addargs.md
index f8f7babd15b90..0fafb377bcc41 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_add.addargs.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_add.addargs.md
@@ -21,14 +21,14 @@ The arguments needed for creating a new attachment to a case.
 
 The case ID that this attachment will be associated with
 
-Defined in: [attachments/add.ts:305](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/add.ts#L305)
+Defined in: [attachments/add.ts:305](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/add.ts#L305)
 
 ___
 
 ### comment
 
-• **comment**: { `comment`: *string* ; `owner`: *string* ; `type`: user  } \| { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  }
+• **comment**: { `comment`: *string* ; `owner`: *string* ; `type`: user  } \| { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } \| { `actions`: { targets: { hostname: string; endpointId: string; }[]; type: string; } ; `comment`: *string* ; `owner`: *string* ; `type`: actions  }
 
 The attachment values.
 
-Defined in: [attachments/add.ts:309](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/add.ts#L309)
+Defined in: [attachments/add.ts:309](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/add.ts#L309)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_client.attachmentssubclient.md b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_client.attachmentssubclient.md
index 57141796f6f67..ff9744583cfaf 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_client.attachmentssubclient.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_client.attachmentssubclient.md
@@ -35,7 +35,7 @@ Adds an attachment to a case.
 
 **Returns:** *Promise*<[*ICaseResponse*](typedoc_interfaces.icaseresponse.md)\>
 
-Defined in: [attachments/client.ts:35](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/client.ts#L35)
+Defined in: [attachments/client.ts:35](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/client.ts#L35)
 
 ___
 
@@ -53,7 +53,7 @@ Deletes a single attachment for a specific case.
 
 **Returns:** *Promise*<void\>
 
-Defined in: [attachments/client.ts:43](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/client.ts#L43)
+Defined in: [attachments/client.ts:43](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/client.ts#L43)
 
 ___
 
@@ -71,7 +71,7 @@ Deletes all attachments associated with a single case.
 
 **Returns:** *Promise*<void\>
 
-Defined in: [attachments/client.ts:39](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/client.ts#L39)
+Defined in: [attachments/client.ts:39](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/client.ts#L39)
 
 ___
 
@@ -89,13 +89,13 @@ Retrieves all comments matching the search criteria.
 
 **Returns:** *Promise*<[*ICommentsResponse*](typedoc_interfaces.icommentsresponse.md)\>
 
-Defined in: [attachments/client.ts:47](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/client.ts#L47)
+Defined in: [attachments/client.ts:47](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/client.ts#L47)
 
 ___
 
 ### get
 
-▸ **get**(`getArgs`: [*GetArgs*](attachments_get.getargs.md)): *Promise*<{ `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }\>
+▸ **get**(`getArgs`: [*GetArgs*](attachments_get.getargs.md)): *Promise*<{ `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `actions`: { targets: { hostname: string; endpointId: string; }[]; type: string; } ; `comment`: *string* ; `owner`: *string* ; `type`: actions  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }\>
 
 Retrieves a single attachment for a case.
 
@@ -105,9 +105,9 @@ Retrieves a single attachment for a case.
 | :------ | :------ |
 | `getArgs` | [*GetArgs*](attachments_get.getargs.md) |
 
-**Returns:** *Promise*<{ `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }\>
+**Returns:** *Promise*<{ `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `actions`: { targets: { hostname: string; endpointId: string; }[]; type: string; } ; `comment`: *string* ; `owner`: *string* ; `type`: actions  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }\>
 
-Defined in: [attachments/client.ts:59](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/client.ts#L59)
+Defined in: [attachments/client.ts:59](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/client.ts#L59)
 
 ___
 
@@ -125,7 +125,7 @@ Gets all attachments for a single case.
 
 **Returns:** *Promise*<[*IAllCommentsResponse*](typedoc_interfaces.iallcommentsresponse.md)\>
 
-Defined in: [attachments/client.ts:55](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/client.ts#L55)
+Defined in: [attachments/client.ts:55](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/client.ts#L55)
 
 ___
 
@@ -143,7 +143,7 @@ Retrieves all alerts attach to a case given a single case ID
 
 **Returns:** *Promise*<{ `attached_at`: *string* ; `id`: *string* ; `index`: *string*  }[]\>
 
-Defined in: [attachments/client.ts:51](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/client.ts#L51)
+Defined in: [attachments/client.ts:51](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/client.ts#L51)
 
 ___
 
@@ -163,4 +163,4 @@ The request must include all fields for the attachment. Even the fields that are
 
 **Returns:** *Promise*<[*ICaseResponse*](typedoc_interfaces.icaseresponse.md)\>
 
-Defined in: [attachments/client.ts:65](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/client.ts#L65)
+Defined in: [attachments/client.ts:65](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/client.ts#L65)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_delete.deleteallargs.md b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_delete.deleteallargs.md
index d134c92e282a3..39c72e81a9935 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_delete.deleteallargs.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_delete.deleteallargs.md
@@ -21,7 +21,7 @@ Parameters for deleting all comments of a case or sub case.
 
 The case ID to delete all attachments for
 
-Defined in: [attachments/delete.ts:31](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/delete.ts#L31)
+Defined in: [attachments/delete.ts:31](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/delete.ts#L31)
 
 ___
 
@@ -31,4 +31,4 @@ ___
 
 If specified the caseID will be ignored and this value will be used to find a sub case for deleting all the attachments
 
-Defined in: [attachments/delete.ts:35](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/delete.ts#L35)
+Defined in: [attachments/delete.ts:35](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/delete.ts#L35)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_delete.deleteargs.md b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_delete.deleteargs.md
index a1c177bad8a09..fb7e61fa1521f 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_delete.deleteargs.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_delete.deleteargs.md
@@ -22,7 +22,7 @@ Parameters for deleting a single attachment of a case or sub case.
 
 The attachment ID to delete
 
-Defined in: [attachments/delete.ts:49](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/delete.ts#L49)
+Defined in: [attachments/delete.ts:49](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/delete.ts#L49)
 
 ___
 
@@ -32,7 +32,7 @@ ___
 
 The case ID to delete an attachment from
 
-Defined in: [attachments/delete.ts:45](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/delete.ts#L45)
+Defined in: [attachments/delete.ts:45](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/delete.ts#L45)
 
 ___
 
@@ -42,4 +42,4 @@ ___
 
 If specified the caseID will be ignored and this value will be used to find a sub case for deleting the attachment
 
-Defined in: [attachments/delete.ts:53](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/delete.ts#L53)
+Defined in: [attachments/delete.ts:53](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/delete.ts#L53)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.findargs.md b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.findargs.md
index dcd4deb28b687..826a05f5865ab 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.findargs.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.findargs.md
@@ -21,7 +21,7 @@ Parameters for finding attachments of a case
 
 The case ID for finding associated attachments
 
-Defined in: [attachments/get.ts:47](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/get.ts#L47)
+Defined in: [attachments/get.ts:47](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/get.ts#L47)
 
 ___
 
@@ -48,4 +48,4 @@ Optional parameters for filtering the returned attachments
 | `sortOrder` | *undefined* \| ``"desc"`` \| ``"asc"`` |
 | `subCaseId` | *undefined* \| *string* |
 
-Defined in: [attachments/get.ts:51](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/get.ts#L51)
+Defined in: [attachments/get.ts:51](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/get.ts#L51)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getallalertsattachtocase.md b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getallalertsattachtocase.md
index d935823054b03..abeeaca19b23e 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getallalertsattachtocase.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getallalertsattachtocase.md
@@ -18,4 +18,4 @@
 
 The ID of the case to retrieve the alerts from
 
-Defined in: [attachments/get.ts:87](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/get.ts#L87)
+Defined in: [attachments/get.ts:87](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/get.ts#L87)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getallargs.md b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getallargs.md
index 9577e89b46074..9ea29437d5c2c 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getallargs.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getallargs.md
@@ -22,7 +22,7 @@ Parameters for retrieving all attachments of a case
 
 The case ID to retrieve all attachments for
 
-Defined in: [attachments/get.ts:61](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/get.ts#L61)
+Defined in: [attachments/get.ts:61](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/get.ts#L61)
 
 ___
 
@@ -32,7 +32,7 @@ ___
 
 Optionally include the attachments associated with a sub case
 
-Defined in: [attachments/get.ts:65](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/get.ts#L65)
+Defined in: [attachments/get.ts:65](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/get.ts#L65)
 
 ___
 
@@ -42,4 +42,4 @@ ___
 
 If included the case ID will be ignored and the attachments will be retrieved from the specified ID of the sub case
 
-Defined in: [attachments/get.ts:69](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/get.ts#L69)
+Defined in: [attachments/get.ts:69](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/get.ts#L69)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getargs.md b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getargs.md
index 5530ad8bd936e..e46d83d795f48 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getargs.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_get.getargs.md
@@ -19,7 +19,7 @@
 
 The ID of the attachment to retrieve
 
-Defined in: [attachments/get.ts:80](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/get.ts#L80)
+Defined in: [attachments/get.ts:80](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/get.ts#L80)
 
 ___
 
@@ -29,4 +29,4 @@ ___
 
 The ID of the case to retrieve an attachment from
 
-Defined in: [attachments/get.ts:76](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/get.ts#L76)
+Defined in: [attachments/get.ts:76](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/get.ts#L76)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_update.updateargs.md b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_update.updateargs.md
index ce586a6bfdfbd..23d7c88c9c864 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_update.updateargs.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/attachments_update.updateargs.md
@@ -22,7 +22,7 @@ Parameters for updating a single attachment
 
 The ID of the case that is associated with this attachment
 
-Defined in: [attachments/update.ts:32](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/update.ts#L32)
+Defined in: [attachments/update.ts:32](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/update.ts#L32)
 
 ___
 
@@ -32,14 +32,14 @@ ___
 
 The ID of a sub case, if specified a sub case will be searched for to perform the attachment update instead of on a case
 
-Defined in: [attachments/update.ts:40](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/update.ts#L40)
+Defined in: [attachments/update.ts:40](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/update.ts#L40)
 
 ___
 
 ### updateRequest
 
-• **updateRequest**: { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `id`: *string* ; `version`: *string*  }
+• **updateRequest**: { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `id`: *string* ; `version`: *string*  } & { `actions`: { targets: { hostname: string; endpointId: string; }[]; type: string; } ; `comment`: *string* ; `owner`: *string* ; `type`: actions  } & { `id`: *string* ; `version`: *string*  }
 
 The full attachment request with the fields updated with appropriate values
 
-Defined in: [attachments/update.ts:36](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/attachments/update.ts#L36)
+Defined in: [attachments/update.ts:36](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/attachments/update.ts#L36)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/cases_client.casessubclient.md b/x-pack/plugins/cases/docs/cases_client/interfaces/cases_client.casessubclient.md
index 52cf2fbaf1ef1..45285066b4608 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/cases_client.casessubclient.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/cases_client.casessubclient.md
@@ -36,7 +36,7 @@ Creates a case.
 
 **Returns:** *Promise*<[*ICaseResponse*](typedoc_interfaces.icaseresponse.md)\>
 
-Defined in: [cases/client.ts:49](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/client.ts#L49)
+Defined in: [cases/client.ts:49](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/client.ts#L49)
 
 ___
 
@@ -56,7 +56,7 @@ Delete a case and all its comments.
 
 **Returns:** *Promise*<void\>
 
-Defined in: [cases/client.ts:73](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/client.ts#L73)
+Defined in: [cases/client.ts:73](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/client.ts#L73)
 
 ___
 
@@ -76,7 +76,7 @@ If the `owner` field is left empty then all the cases that the user has access t
 
 **Returns:** *Promise*<[*ICasesFindResponse*](typedoc_interfaces.icasesfindresponse.md)\>
 
-Defined in: [cases/client.ts:55](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/client.ts#L55)
+Defined in: [cases/client.ts:55](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/client.ts#L55)
 
 ___
 
@@ -94,7 +94,7 @@ Retrieves a single case with the specified ID.
 
 **Returns:** *Promise*<[*ICaseResponse*](typedoc_interfaces.icaseresponse.md)\>
 
-Defined in: [cases/client.ts:59](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/client.ts#L59)
+Defined in: [cases/client.ts:59](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/client.ts#L59)
 
 ___
 
@@ -112,7 +112,7 @@ Retrieves the cases ID and title that have the requested alert attached to them
 
 **Returns:** *Promise*<{ `id`: *string* ; `title`: *string*  }[]\>
 
-Defined in: [cases/client.ts:85](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/client.ts#L85)
+Defined in: [cases/client.ts:85](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/client.ts#L85)
 
 ___
 
@@ -131,7 +131,7 @@ Retrieves all the reporters across all accessible cases.
 
 **Returns:** *Promise*<{ `email`: *undefined* \| ``null`` \| *string* ; `full_name`: *undefined* \| ``null`` \| *string* ; `username`: *undefined* \| ``null`` \| *string*  }[]\>
 
-Defined in: [cases/client.ts:81](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/client.ts#L81)
+Defined in: [cases/client.ts:81](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/client.ts#L81)
 
 ___
 
@@ -150,7 +150,7 @@ Retrieves all the tags across all cases the user making the request has access t
 
 **Returns:** *Promise*<string[]\>
 
-Defined in: [cases/client.ts:77](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/client.ts#L77)
+Defined in: [cases/client.ts:77](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/client.ts#L77)
 
 ___
 
@@ -168,7 +168,7 @@ Pushes a specific case to an external system.
 
 **Returns:** *Promise*<[*ICaseResponse*](typedoc_interfaces.icaseresponse.md)\>
 
-Defined in: [cases/client.ts:63](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/client.ts#L63)
+Defined in: [cases/client.ts:63](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/client.ts#L63)
 
 ___
 
@@ -186,4 +186,4 @@ Update the specified cases with the passed in values.
 
 **Returns:** *Promise*<[*ICasesResponse*](typedoc_interfaces.icasesresponse.md)\>
 
-Defined in: [cases/client.ts:67](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/client.ts#L67)
+Defined in: [cases/client.ts:67](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/client.ts#L67)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/cases_get.casesbyalertidparams.md b/x-pack/plugins/cases/docs/cases_client/interfaces/cases_get.casesbyalertidparams.md
index 4992ed035721b..257269ca64566 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/cases_get.casesbyalertidparams.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/cases_get.casesbyalertidparams.md
@@ -21,7 +21,7 @@ Parameters for finding cases IDs using an alert ID
 
 The alert ID to search for
 
-Defined in: [cases/get.ts:44](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/get.ts#L44)
+Defined in: [cases/get.ts:44](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/get.ts#L44)
 
 ___
 
@@ -37,4 +37,4 @@ The filtering options when searching for associated cases.
 | :------ | :------ |
 | `owner` | *undefined* \| *string* \| *string*[] |
 
-Defined in: [cases/get.ts:48](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/get.ts#L48)
+Defined in: [cases/get.ts:48](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/get.ts#L48)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/cases_get.getparams.md b/x-pack/plugins/cases/docs/cases_client/interfaces/cases_get.getparams.md
index a4dfc7301e543..16cc952746818 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/cases_get.getparams.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/cases_get.getparams.md
@@ -22,7 +22,7 @@ The parameters for retrieving a case
 
 Case ID
 
-Defined in: [cases/get.ts:145](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/get.ts#L145)
+Defined in: [cases/get.ts:145](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/get.ts#L145)
 
 ___
 
@@ -32,7 +32,7 @@ ___
 
 Whether to include the attachments for a case in the response
 
-Defined in: [cases/get.ts:149](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/get.ts#L149)
+Defined in: [cases/get.ts:149](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/get.ts#L149)
 
 ___
 
@@ -42,4 +42,4 @@ ___
 
 Whether to include the attachments for all children of a case in the response
 
-Defined in: [cases/get.ts:153](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/get.ts#L153)
+Defined in: [cases/get.ts:153](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/get.ts#L153)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/cases_push.pushparams.md b/x-pack/plugins/cases/docs/cases_client/interfaces/cases_push.pushparams.md
index 0ed510700af8a..3aa6ee77941a8 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/cases_push.pushparams.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/cases_push.pushparams.md
@@ -21,7 +21,7 @@ Parameters for pushing a case to an external system
 
 The ID of a case
 
-Defined in: [cases/push.ts:53](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/push.ts#L53)
+Defined in: [cases/push.ts:53](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/push.ts#L53)
 
 ___
 
@@ -31,4 +31,4 @@ ___
 
 The ID of an external system to push to
 
-Defined in: [cases/push.ts:57](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/push.ts#L57)
+Defined in: [cases/push.ts:57](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/push.ts#L57)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/configure_client.configuresubclient.md b/x-pack/plugins/cases/docs/cases_client/interfaces/configure_client.configuresubclient.md
index 98a6c3a2fcbbf..f94e7d6c7f49e 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/configure_client.configuresubclient.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/configure_client.configuresubclient.md
@@ -31,7 +31,7 @@ Creates a configuration if one does not already exist. If one exists it is delet
 
 **Returns:** *Promise*<[*ICasesConfigureResponse*](typedoc_interfaces.icasesconfigureresponse.md)\>
 
-Defined in: [configure/client.ts:98](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/configure/client.ts#L98)
+Defined in: [configure/client.ts:98](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/configure/client.ts#L98)
 
 ___
 
@@ -50,7 +50,7 @@ Retrieves the external connector configuration for a particular case owner.
 
 **Returns:** *Promise*<{} \| [*ICasesConfigureResponse*](typedoc_interfaces.icasesconfigureresponse.md)\>
 
-Defined in: [configure/client.ts:80](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/configure/client.ts#L80)
+Defined in: [configure/client.ts:80](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/configure/client.ts#L80)
 
 ___
 
@@ -62,7 +62,7 @@ Retrieves the valid external connectors supported by the cases plugin.
 
 **Returns:** *Promise*<FindActionResult[]\>
 
-Defined in: [configure/client.ts:84](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/configure/client.ts#L84)
+Defined in: [configure/client.ts:84](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/configure/client.ts#L84)
 
 ___
 
@@ -81,4 +81,4 @@ Updates a particular configuration with new values.
 
 **Returns:** *Promise*<[*ICasesConfigureResponse*](typedoc_interfaces.icasesconfigureresponse.md)\>
 
-Defined in: [configure/client.ts:91](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/configure/client.ts#L91)
+Defined in: [configure/client.ts:91](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/configure/client.ts#L91)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/stats_client.statssubclient.md b/x-pack/plugins/cases/docs/cases_client/interfaces/stats_client.statssubclient.md
index cc0f30055597d..9bbf3cdaf015f 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/stats_client.statssubclient.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/stats_client.statssubclient.md
@@ -29,4 +29,4 @@ Retrieves the total number of open, closed, and in-progress cases.
 
 **Returns:** *Promise*<{ `count_closed_cases`: *number* ; `count_in_progress_cases`: *number* ; `count_open_cases`: *number*  }\>
 
-Defined in: [stats/client.ts:34](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/stats/client.ts#L34)
+Defined in: [stats/client.ts:34](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/stats/client.ts#L34)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/sub_cases_client.subcasesclient.md b/x-pack/plugins/cases/docs/cases_client/interfaces/sub_cases_client.subcasesclient.md
index 5c0369709c0f0..e3ca5a756f8a7 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/sub_cases_client.subcasesclient.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/sub_cases_client.subcasesclient.md
@@ -31,7 +31,7 @@ Deletes the specified entities and their attachments.
 
 **Returns:** *Promise*<void\>
 
-Defined in: [sub_cases/client.ts:68](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/sub_cases/client.ts#L68)
+Defined in: [sub_cases/client.ts:68](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/sub_cases/client.ts#L68)
 
 ___
 
@@ -49,7 +49,7 @@ Retrieves the sub cases matching the search criteria.
 
 **Returns:** *Promise*<[*ISubCasesFindResponse*](typedoc_interfaces.isubcasesfindresponse.md)\>
 
-Defined in: [sub_cases/client.ts:72](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/sub_cases/client.ts#L72)
+Defined in: [sub_cases/client.ts:72](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/sub_cases/client.ts#L72)
 
 ___
 
@@ -67,7 +67,7 @@ Retrieves a single sub case.
 
 **Returns:** *Promise*<[*ISubCaseResponse*](typedoc_interfaces.isubcaseresponse.md)\>
 
-Defined in: [sub_cases/client.ts:76](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/sub_cases/client.ts#L76)
+Defined in: [sub_cases/client.ts:76](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/sub_cases/client.ts#L76)
 
 ___
 
@@ -86,4 +86,4 @@ Updates the specified sub cases to the new values included in the request.
 
 **Returns:** *Promise*<[*ISubCasesResponse*](typedoc_interfaces.isubcasesresponse.md)\>
 
-Defined in: [sub_cases/client.ts:80](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/sub_cases/client.ts#L80)
+Defined in: [sub_cases/client.ts:80](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/sub_cases/client.ts#L80)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasepostrequest.md b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasepostrequest.md
index 70533a15fe616..5f9189ea41e48 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasepostrequest.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasepostrequest.md
@@ -29,7 +29,7 @@ the docs are huge.
 
 ### connector
 
-• **connector**: { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  }
+• **connector**: { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { caseId: string \| null; } ; `type`: swimlane  }
 
 Inherited from: CasePostRequest.connector
 
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icaseresponse.md b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icaseresponse.md
index 5db55e5552473..dc591a508844b 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icaseresponse.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icaseresponse.md
@@ -57,7 +57,7 @@ ___
 
 ### comments
 
-• **comments**: *undefined* \| { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[]
+• **comments**: *undefined* \| { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `actions`: { targets: { hostname: string; endpointId: string; }[]; type: string; } ; `comment`: *string* ; `owner`: *string* ; `type`: actions  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[]
 
 Inherited from: CaseResponse.comments
 
@@ -65,7 +65,7 @@ ___
 
 ### connector
 
-• **connector**: { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  }
+• **connector**: { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { caseId: string \| null; } ; `type`: swimlane  }
 
 Inherited from: CaseResponse.connector
 
@@ -159,7 +159,7 @@ ___
 
 ### subCases
 
-• **subCases**: *undefined* \| { `status`: CaseStatuses  } & { `closed_at`: ``null`` \| *string* ; `closed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `created_at`: *string* ; `created_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `totalAlerts`: *number* ; `totalComment`: *number* ; `version`: *string*  } & { `comments`: *undefined* \| { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[]  }[]
+• **subCases**: *undefined* \| { `status`: CaseStatuses  } & { `closed_at`: ``null`` \| *string* ; `closed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `created_at`: *string* ; `created_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `totalAlerts`: *number* ; `totalComment`: *number* ; `version`: *string*  } & { `comments`: *undefined* \| { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `actions`: { targets: { hostname: string; endpointId: string; }[]; type: string; } ; `comment`: *string* ; `owner`: *string* ; `type`: actions  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[]  }[]
 
 Inherited from: CaseResponse.subCases
 
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigurepatch.md b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigurepatch.md
index 3854fda03fb6a..9ab5341a2dbc6 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigurepatch.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigurepatch.md
@@ -30,7 +30,7 @@ ___
 
 ### connector
 
-• **connector**: *undefined* \| { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  }
+• **connector**: *undefined* \| { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { caseId: string \| null; } ; `type`: swimlane  }
 
 Inherited from: CasesConfigurePatch.connector
 
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigurerequest.md b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigurerequest.md
index 548e1a5c48f58..0b1c11ac548a6 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigurerequest.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigurerequest.md
@@ -30,7 +30,7 @@ ___
 
 ### connector
 
-• **connector**: { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  }
+• **connector**: { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { caseId: string \| null; } ; `type`: swimlane  }
 
 Inherited from: CasesConfigureRequest.connector
 
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigureresponse.md b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigureresponse.md
index c493a4c6c0f0c..42c7378431c1b 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigureresponse.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesconfigureresponse.md
@@ -38,7 +38,7 @@ ___
 
 ### connector
 
-• **connector**: { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  }
+• **connector**: { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { caseId: string \| null; } ; `type`: swimlane  }
 
 Inherited from: CasesConfigureResponse.connector
 
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesfindresponse.md b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesfindresponse.md
index 9be5fd5743a8e..06e14d219cde0 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesfindresponse.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasesfindresponse.md
@@ -26,7 +26,7 @@
 
 ### cases
 
-• **cases**: { `connector`: { id: string; name: string; } & { type: ConnectorTypes.jira; fields: { issueType: string \| null; priority: string \| null; parent: string \| null; } \| null; } & { id: string; name: string; } & { type: ConnectorTypes.resilient; fields: { incidentTypes: string[] \| null; severityCode: string \| null; } \| null; } & { id: string; name: string; } & { type: ConnectorTypes.serviceNowITSM; fields: { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } \| null; } & { id: string; name: string; } & { type: ConnectorTypes.serviceNowSIR; fields: { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } \| null; } & { id: string; name: string; } & { type: ConnectorTypes.none; fields: null; } ; `description`: *string* ; `owner`: *string* ; `settings`: { syncAlerts: boolean; } ; `status`: CaseStatuses ; `tags`: *string*[] ; `title`: *string* ; `type`: CaseType  } & { `closed_at`: ``null`` \| *string* ; `closed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `external_service`: ``null`` \| { connector\_id: string; connector\_name: string; external\_id: string; external\_title: string; external\_url: string; } & { pushed\_at: string; pushed\_by: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `totalAlerts`: *number* ; `totalComment`: *number* ; `version`: *string*  } & { `comments`: *undefined* \| { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[] ; `subCaseIds`: *undefined* \| *string*[] ; `subCases`: *undefined* \| { `status`: CaseStatuses  } & { `closed_at`: ``null`` \| *string* ; `closed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `created_at`: *string* ; `created_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `totalAlerts`: *number* ; `totalComment`: *number* ; `version`: *string*  } & { comments?: ((({ comment: string; type: CommentType.user; owner: string; } & { associationType: AssociationType; created\_at: string; created\_by: { email: string \| null \| undefined; full\_name: string \| ... 1 more ... \| undefined; username: string \| ... 1 more ... \| undefined; }; ... 4 more ...; updated\_by: { ...; } ...[]  }[]
+• **cases**: { `connector`: { id: string; name: string; } & { type: ConnectorTypes.jira; fields: { issueType: string \| null; priority: string \| null; parent: string \| null; } \| null; } & { id: string; name: string; } & { type: ConnectorTypes.none; fields: null; } & { id: string; name: string; } & { type: ConnectorTypes.resilient; fields: { incidentTypes: string[] \| null; severityCode: string \| null; } \| null; } & { id: string; name: string; } & { type: ConnectorTypes.serviceNowITSM; fields: { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } \| null; } & { id: string; name: string; } & { type: ConnectorTypes.serviceNowSIR; fields: { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } \| null; } & { id: string; name: string; } & { type: ConnectorTypes.swimlane; fields: { caseId: string \| null; } \| null; } ; `description`: *string* ; `owner`: *string* ; `settings`: { syncAlerts: boolean; } ; `status`: CaseStatuses ; `tags`: *string*[] ; `title`: *string* ; `type`: CaseType  } & { `closed_at`: ``null`` \| *string* ; `closed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `external_service`: ``null`` \| { connector\_id: string; connector\_name: string; external\_id: string; external\_title: string; external\_url: string; } & { pushed\_at: string; pushed\_by: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `totalAlerts`: *number* ; `totalComment`: *number* ; `version`: *string*  } & { `comments`: *undefined* \| { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `actions`: { targets: { hostname: string; endpointId: string; }[]; type: string; } ; `comment`: *string* ; `owner`: *string* ; `type`: actions  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[] ; `subCaseIds`: *undefined* \| *string*[] ; `subCases`: *undefined* \| { `status`: CaseStatuses  } & { `closed_at`: ``null`` \| *string* ; `closed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `created_at`: *string* ; `created_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `totalAlerts`: *number* ; `totalComment`: *number* ; `version`: *string*  } & { comments?: ((({ comment: string; type: CommentType.user; owner: string; } & { associationType: AssociationType; created\_at: string; created\_by: { email: string \| null \| undefined; full\_name: string \| ... 1 more ... \| undefined; username: string \| ... 1 more ... \| undefined; }; ... 4 more ...; updated\_by: { ...; } ...[]  }[]
 
 Inherited from: CasesFindResponse.cases
 
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasespatchrequest.md b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasespatchrequest.md
index bfdb3b7315e55..d4747a1836cc4 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasespatchrequest.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icasespatchrequest.md
@@ -20,6 +20,6 @@
 
 ### cases
 
-• **cases**: { `connector`: *undefined* \| { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  } ; `description`: *undefined* \| *string* ; `owner`: *undefined* \| *string* ; `settings`: *undefined* \| { `syncAlerts`: *boolean*  } ; `status`: *undefined* \| open \| *any*[*any*] \| closed ; `tags`: *undefined* \| *string*[] ; `title`: *undefined* \| *string* ; `type`: *undefined* \| collection \| individual  } & { `id`: *string* ; `version`: *string*  }[]
+• **cases**: { `connector`: *undefined* \| { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { issueType: string \| null; priority: string \| null; parent: string \| null; } ; `type`: jira  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` ; `type`: none  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { incidentTypes: string[] \| null; severityCode: string \| null; } ; `type`: resilient  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { impact: string \| null; severity: string \| null; urgency: string \| null; category: string \| null; subcategory: string \| null; } ; `type`: serviceNowITSM  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { category: string \| null; destIp: boolean \| null; malwareHash: boolean \| null; malwareUrl: boolean \| null; priority: string \| null; sourceIp: boolean \| null; subcategory: string \| null; } ; `type`: serviceNowSIR  } & { `id`: *string* ; `name`: *string*  } & { `fields`: ``null`` \| { caseId: string \| null; } ; `type`: swimlane  } ; `description`: *undefined* \| *string* ; `owner`: *undefined* \| *string* ; `settings`: *undefined* \| { `syncAlerts`: *boolean*  } ; `status`: *undefined* \| open \| *any*[*any*] \| closed ; `tags`: *undefined* \| *string*[] ; `title`: *undefined* \| *string* ; `type`: *undefined* \| collection \| individual  } & { `id`: *string* ; `version`: *string*  }[]
 
 Inherited from: CasesPatchRequest.cases
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icommentsresponse.md b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icommentsresponse.md
index d34480b2c633c..4a720e2c6d9be 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icommentsresponse.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.icommentsresponse.md
@@ -23,7 +23,7 @@
 
 ### comments
 
-• **comments**: { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[]
+• **comments**: { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `actions`: { targets: { hostname: string; endpointId: string; }[]; type: string; } ; `comment`: *string* ; `owner`: *string* ; `type`: actions  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[]
 
 Inherited from: CommentsResponse.comments
 
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.isubcaseresponse.md b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.isubcaseresponse.md
index b33b280d2e753..a6bf610f86349 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.isubcaseresponse.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.isubcaseresponse.md
@@ -48,7 +48,7 @@ ___
 
 ### comments
 
-• **comments**: *undefined* \| { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[]
+• **comments**: *undefined* \| { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `actions`: { targets: { hostname: string; endpointId: string; }[]; type: string; } ; `comment`: *string* ; `owner`: *string* ; `type`: actions  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[]
 
 Inherited from: SubCaseResponse.comments
 
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.isubcasesfindresponse.md b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.isubcasesfindresponse.md
index 35d63126f608a..61fb60a54db00 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.isubcasesfindresponse.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/typedoc_interfaces.isubcasesfindresponse.md
@@ -66,7 +66,7 @@ ___
 
 ### subCases
 
-• **subCases**: { `status`: CaseStatuses  } & { `closed_at`: ``null`` \| *string* ; `closed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `created_at`: *string* ; `created_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `totalAlerts`: *number* ; `totalComment`: *number* ; `version`: *string*  } & { `comments`: *undefined* \| { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[]  }[]
+• **subCases**: { `status`: CaseStatuses  } & { `closed_at`: ``null`` \| *string* ; `closed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `created_at`: *string* ; `created_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `totalAlerts`: *number* ; `totalComment`: *number* ; `version`: *string*  } & { `comments`: *undefined* \| { `comment`: *string* ; `owner`: *string* ; `type`: user  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `alertId`: *string* \| *string*[] ; `index`: *string* \| *string*[] ; `owner`: *string* ; `rule`: { id: string \| null; name: string \| null; } ; `type`: alert \| generatedAlert  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  } & { `actions`: { targets: { hostname: string; endpointId: string; }[]; type: string; } ; `comment`: *string* ; `owner`: *string* ; `type`: actions  } & { `associationType`: AssociationType ; `created_at`: *string* ; `created_by`: { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `owner`: *string* ; `pushed_at`: ``null`` \| *string* ; `pushed_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; } ; `updated_at`: ``null`` \| *string* ; `updated_by`: ``null`` \| { email: string \| null \| undefined; full\_name: string \| null \| undefined; username: string \| null \| undefined; }  } & { `id`: *string* ; `version`: *string*  }[]  }[]
 
 Inherited from: SubCasesFindResponse.subCases
 
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/user_actions_client.useractionget.md b/x-pack/plugins/cases/docs/cases_client/interfaces/user_actions_client.useractionget.md
index 5f0cc89239fd8..1cbebef379dbd 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/user_actions_client.useractionget.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/user_actions_client.useractionget.md
@@ -21,7 +21,7 @@ Parameters for retrieving user actions for a particular case
 
 The ID of the case
 
-Defined in: [user_actions/client.ts:19](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/user_actions/client.ts#L19)
+Defined in: [user_actions/client.ts:19](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/user_actions/client.ts#L19)
 
 ___
 
@@ -31,4 +31,4 @@ ___
 
 If specified then a sub case will be used for finding all the user actions
 
-Defined in: [user_actions/client.ts:23](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/user_actions/client.ts#L23)
+Defined in: [user_actions/client.ts:23](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/user_actions/client.ts#L23)
diff --git a/x-pack/plugins/cases/docs/cases_client/interfaces/user_actions_client.useractionssubclient.md b/x-pack/plugins/cases/docs/cases_client/interfaces/user_actions_client.useractionssubclient.md
index df2641adf5a8c..065f20b4cefcb 100644
--- a/x-pack/plugins/cases/docs/cases_client/interfaces/user_actions_client.useractionssubclient.md
+++ b/x-pack/plugins/cases/docs/cases_client/interfaces/user_actions_client.useractionssubclient.md
@@ -28,4 +28,4 @@ Retrieves all user actions for a particular case.
 
 **Returns:** *Promise*<[*ICaseUserActionsResponse*](typedoc_interfaces.icaseuseractionsresponse.md)\>
 
-Defined in: [user_actions/client.ts:33](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/user_actions/client.ts#L33)
+Defined in: [user_actions/client.ts:33](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/user_actions/client.ts#L33)
diff --git a/x-pack/plugins/cases/docs/cases_client/modules/cases_get.md b/x-pack/plugins/cases/docs/cases_client/modules/cases_get.md
index d4ca13501294a..4c165866cec47 100644
--- a/x-pack/plugins/cases/docs/cases_client/modules/cases_get.md
+++ b/x-pack/plugins/cases/docs/cases_client/modules/cases_get.md
@@ -31,7 +31,7 @@ Retrieves the reporters from all the cases.
 
 **Returns:** *Promise*<User[]\>
 
-Defined in: [cases/get.ts:290](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/get.ts#L290)
+Defined in: [cases/get.ts:289](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/get.ts#L289)
 
 ___
 
@@ -50,4 +50,4 @@ Retrieves the tags from all the cases.
 
 **Returns:** *Promise*<string[]\>
 
-Defined in: [cases/get.ts:240](https://github.com/jonathan-buttner/kibana/blob/b65ed845242/x-pack/plugins/cases/server/client/cases/get.ts#L240)
+Defined in: [cases/get.ts:239](https://github.com/elastic/kibana/blob/a80791aa4cc/x-pack/plugins/cases/server/client/cases/get.ts#L239)
diff --git a/x-pack/plugins/cases/public/components/__mock__/form.ts b/x-pack/plugins/cases/public/components/__mock__/form.ts
index 6d3e8353e630a..aa40ea0421b4c 100644
--- a/x-pack/plugins/cases/public/components/__mock__/form.ts
+++ b/x-pack/plugins/cases/public/components/__mock__/form.ts
@@ -23,6 +23,7 @@ export const mockFormHook = {
   setFieldErrors: jest.fn(),
   getFields: jest.fn(),
   getFormData: jest.fn(),
+  getFieldDefaultValue: jest.fn(),
   /* Returns a list of all errors in the form */
   getErrors: jest.fn(),
   reset: jest.fn(),
@@ -33,7 +34,6 @@ export const mockFormHook = {
   __validateFields: jest.fn(),
   __updateFormDataAt: jest.fn(),
   __readFieldConfigFromSchema: jest.fn(),
-  __getFieldDefaultValue: jest.fn(),
 };
 
 export const getFormMock = (sampleData: any) => ({
diff --git a/x-pack/plugins/cases/public/components/user_action_tree/index.test.tsx b/x-pack/plugins/cases/public/components/user_action_tree/index.test.tsx
index 610399c31928b..be1516843184d 100644
--- a/x-pack/plugins/cases/public/components/user_action_tree/index.test.tsx
+++ b/x-pack/plugins/cases/public/components/user_action_tree/index.test.tsx
@@ -13,7 +13,14 @@ import routeData from 'react-router';
 
 import { getFormMock, useFormMock, useFormDataMock } from '../__mock__/form';
 import { useUpdateComment } from '../../containers/use_update_comment';
-import { basicCase, basicPush, getUserAction } from '../../containers/mock';
+import {
+  basicCase,
+  basicPush,
+  getUserAction,
+  getHostIsolationUserAction,
+  hostIsolationComment,
+  hostReleaseComment,
+} from '../../containers/mock';
 import { UserActionTree } from '.';
 import { TestProviders } from '../../common/mock';
 import { Ecs } from '../../../common';
@@ -368,4 +375,82 @@ describe(`UserActionTree`, () => {
       ).toEqual(true);
     });
   });
+  describe('Host isolation action', () => {
+    it('renders in the cases details view', async () => {
+      const isolateAction = [getHostIsolationUserAction()];
+      const props = {
+        ...defaultProps,
+        caseUserActions: isolateAction,
+        data: { ...defaultProps.data, comments: [...basicCase.comments, hostIsolationComment()] },
+      };
+
+      const wrapper = mount(
+        <TestProviders>
+          <UserActionTree {...props} />
+        </TestProviders>
+      );
+      await waitFor(() => {
+        expect(wrapper.find(`[data-test-subj="endpoint-action"]`).exists()).toBe(true);
+      });
+    });
+
+    it('shows the correct username', async () => {
+      const isolateAction = [getHostIsolationUserAction()];
+      const props = {
+        ...defaultProps,
+        caseUserActions: isolateAction,
+        data: { ...defaultProps.data, comments: [hostIsolationComment()] },
+      };
+
+      const wrapper = mount(
+        <TestProviders>
+          <UserActionTree {...props} />
+        </TestProviders>
+      );
+      await waitFor(() => {
+        expect(wrapper.find(`[data-test-subj="user-action-avatar"]`).first().prop('name')).toEqual(
+          defaultProps.data.createdBy.fullName
+        );
+      });
+    });
+
+    it('shows a lock icon if the action is isolate', async () => {
+      const isolateAction = [getHostIsolationUserAction()];
+      const props = {
+        ...defaultProps,
+        caseUserActions: isolateAction,
+        data: { ...defaultProps.data, comments: [hostIsolationComment()] },
+      };
+
+      const wrapper = mount(
+        <TestProviders>
+          <UserActionTree {...props} />
+        </TestProviders>
+      );
+      await waitFor(() => {
+        expect(
+          wrapper.find(`[data-test-subj="endpoint-action"]`).first().prop('timelineIcon')
+        ).toBe('lock');
+      });
+    });
+    it('shows a lockOpen icon if the action is unisolate/release', async () => {
+      const isolateAction = [getHostIsolationUserAction()];
+      const props = {
+        ...defaultProps,
+        caseUserActions: isolateAction,
+        data: { ...defaultProps.data, comments: [hostReleaseComment()] },
+      };
+
+      const wrapper = mount(
+        <TestProviders>
+          <UserActionTree {...props} />
+        </TestProviders>
+      );
+      await waitFor(() => {
+        expect(
+          wrapper.find(`[data-test-subj="endpoint-action"]`).first().prop('timelineIcon')
+        ).toBe('lockOpen');
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/cases/public/components/user_action_tree/user_action_host_isolation_comment_event.test.tsx b/x-pack/plugins/cases/public/components/user_action_tree/user_action_host_isolation_comment_event.test.tsx
new file mode 100644
index 0000000000000..636cd7e40aac1
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/user_action_tree/user_action_host_isolation_comment_event.test.tsx
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+import { HostIsolationCommentEvent } from './user_action_host_isolation_comment_event';
+
+const defaultProps = () => {
+  return {
+    type: 'isolate',
+    endpoints: [{ endpointId: 'e1', hostname: 'host1' }],
+    href: jest.fn(),
+    onClick: jest.fn(),
+  };
+};
+
+describe('UserActionHostIsolationCommentEvent', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('renders with the correct action and hostname', async () => {
+    const wrapper = mount(<HostIsolationCommentEvent {...defaultProps()} />);
+    expect(wrapper.find(`[data-test-subj="actions-link-e1"]`).first().exists()).toBeTruthy();
+    expect(wrapper.text()).toBe('isolated host host1');
+  });
+
+  it('navigates to app on link click', async () => {
+    const onActionsLinkClick = jest.fn();
+
+    const wrapper = mount(
+      <HostIsolationCommentEvent {...defaultProps()} onClick={onActionsLinkClick} />
+    );
+
+    wrapper.find(`[data-test-subj="actions-link-e1"]`).first().simulate('click');
+    expect(onActionsLinkClick).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/cases/public/components/user_action_tree/user_action_host_isolation_comment_event.tsx b/x-pack/plugins/cases/public/components/user_action_tree/user_action_host_isolation_comment_event.tsx
index d363e874a4e0d..2381d31b3ada8 100644
--- a/x-pack/plugins/cases/public/components/user_action_tree/user_action_host_isolation_comment_event.tsx
+++ b/x-pack/plugins/cases/public/components/user_action_tree/user_action_host_isolation_comment_event.tsx
@@ -44,7 +44,7 @@ const HostIsolationCommentEventComponent: React.FC<Props> = ({
       <LinkAnchor
         onClick={onLinkClick}
         href={endpointDetailsHref}
-        data-test-subj={`endpointDetails-activity-log-link-${endpoints[0].endpointId}`}
+        data-test-subj={`actions-link-${endpoints[0].endpointId}`}
       >
         {endpoints[0].hostname}
       </LinkAnchor>
diff --git a/x-pack/plugins/cases/public/containers/mock.ts b/x-pack/plugins/cases/public/containers/mock.ts
index a900010235c9f..c955bb34240e2 100644
--- a/x-pack/plugins/cases/public/containers/mock.ts
+++ b/x-pack/plugins/cases/public/containers/mock.ts
@@ -76,6 +76,58 @@ export const alertComment: Comment = {
   version: 'WzQ3LDFc',
 };
 
+export const hostIsolationComment: () => Comment = () => {
+  return {
+    type: CommentType.actions,
+    comment: 'I just isolated the host!',
+    id: 'isolate-comment-id',
+    actions: {
+      targets: [
+        {
+          hostname: 'host1',
+          endpointId: '001',
+        },
+      ],
+      type: 'isolate',
+    },
+    associationType: AssociationType.case,
+    createdAt: basicCreatedAt,
+    createdBy: elasticUser,
+    owner: SECURITY_SOLUTION_OWNER,
+    pushedAt: null,
+    pushedBy: null,
+    updatedAt: null,
+    updatedBy: null,
+    version: 'WzQ3LDFc',
+  };
+};
+
+export const hostReleaseComment: () => Comment = () => {
+  return {
+    type: CommentType.actions,
+    comment: 'I just released the host!',
+    id: 'isolate-comment-id',
+    actions: {
+      targets: [
+        {
+          hostname: 'host1',
+          endpointId: '001',
+        },
+      ],
+      type: 'unisolate',
+    },
+    associationType: AssociationType.case,
+    createdAt: basicCreatedAt,
+    createdBy: elasticUser,
+    owner: SECURITY_SOLUTION_OWNER,
+    pushedAt: null,
+    pushedBy: null,
+    updatedAt: null,
+    updatedBy: null,
+    version: 'WzQ3LDFc',
+  };
+};
+
 export const basicCase: Case = {
   type: CaseType.individual,
   owner: SECURITY_SOLUTION_OWNER,
@@ -374,6 +426,15 @@ export const getAlertUserAction = () => ({
   newValue: '{"type":"alert","alertId":"alert-id-1","index":"index-id-1"}',
 });
 
+export const getHostIsolationUserAction = () => ({
+  ...basicAction,
+  actionId: 'isolate-action-id',
+  actionField: ['comment'] as UserActionField,
+  action: 'create' as UserAction,
+  commentId: 'isolate-comment-id',
+  newValue: 'some value',
+});
+
 export const caseUserActions: CaseUserActions[] = [
   getUserAction(['description'], 'create'),
   getUserAction(['comment'], 'create'),
diff --git a/x-pack/plugins/cases/server/client/cases/mock.ts b/x-pack/plugins/cases/server/client/cases/mock.ts
index 23db57c6d3097..313d6cd12a6db 100644
--- a/x-pack/plugins/cases/server/client/cases/mock.ts
+++ b/x-pack/plugins/cases/server/client/cases/mock.ts
@@ -52,6 +52,106 @@ export const comment: CommentResponse = {
   version: 'WzEsMV0=',
 };
 
+export const isolateCommentActions: CommentResponse = {
+  associationType: AssociationType.case,
+  id: 'mock-action-comment-1',
+  comment: 'Isolating this for investigation',
+  type: CommentType.actions as const,
+  created_at: '2019-11-25T21:55:00.177Z',
+  actions: {
+    targets: [
+      {
+        endpointId: '123',
+        hostname: 'windows-host-1',
+      },
+    ],
+    type: 'isolate',
+  },
+  created_by: {
+    full_name: 'elastic',
+    email: 'testemail@elastic.co',
+    username: 'elastic',
+  },
+  owner: SECURITY_SOLUTION_OWNER,
+  pushed_at: null,
+  pushed_by: null,
+  updated_at: '2019-11-25T21:55:00.177Z',
+  updated_by: {
+    full_name: 'elastic',
+    email: 'testemail@elastic.co',
+    username: 'elastic',
+  },
+  version: 'WzEsMV0=',
+};
+
+export const releaseCommentActions: CommentResponse = {
+  associationType: AssociationType.case,
+  id: 'mock-action-comment-1',
+  comment: 'Releasing this for investigation',
+  type: CommentType.actions as const,
+  created_at: '2019-11-25T21:55:00.177Z',
+  actions: {
+    targets: [
+      {
+        endpointId: '123',
+        hostname: 'windows-host-1',
+      },
+    ],
+    type: 'unisolate',
+  },
+  created_by: {
+    full_name: 'elastic',
+    email: 'testemail@elastic.co',
+    username: 'elastic',
+  },
+  owner: SECURITY_SOLUTION_OWNER,
+  pushed_at: null,
+  pushed_by: null,
+  updated_at: '2019-11-25T21:55:00.177Z',
+  updated_by: {
+    full_name: 'elastic',
+    email: 'testemail@elastic.co',
+    username: 'elastic',
+  },
+  version: 'WzEsMV0=',
+};
+
+export const isolateCommentActionsMultipleTargets: CommentResponse = {
+  associationType: AssociationType.case,
+  id: 'mock-action-comment-1',
+  comment: 'Isolating this for investigation',
+  type: CommentType.actions as const,
+  created_at: '2019-11-25T21:55:00.177Z',
+  actions: {
+    targets: [
+      {
+        endpointId: '123',
+        hostname: 'windows-host-1',
+      },
+      {
+        endpointId: '456',
+        hostname: 'windows-host-2',
+      },
+    ],
+    type: 'isolate',
+  },
+  created_by: {
+    full_name: 'elastic',
+    email: 'testemail@elastic.co',
+    username: 'elastic',
+  },
+  owner: SECURITY_SOLUTION_OWNER,
+  pushed_at: null,
+  pushed_by: null,
+  updated_at: '2019-11-25T21:55:00.177Z',
+  updated_by: {
+    full_name: 'elastic',
+    email: 'testemail@elastic.co',
+    username: 'elastic',
+  },
+  version: 'WzEsMV0=',
+};
+
 export const commentAlert: CommentResponse = {
   associationType: AssociationType.case,
   id: 'mock-comment-1',
diff --git a/x-pack/plugins/cases/server/client/cases/utils.test.ts b/x-pack/plugins/cases/server/client/cases/utils.test.ts
index bfd5d1279420b..d7c45d3e1e9ae 100644
--- a/x-pack/plugins/cases/server/client/cases/utils.test.ts
+++ b/x-pack/plugins/cases/server/client/cases/utils.test.ts
@@ -18,6 +18,9 @@ import {
   commentAlert,
   commentAlertMultipleIds,
   commentGeneratedAlert,
+  isolateCommentActions,
+  releaseCommentActions,
+  isolateCommentActionsMultipleTargets,
 } from './mock';
 
 import {
@@ -37,6 +40,52 @@ const formatComment = {
   comment: 'Wow, good luck catching that bad meanie!',
 };
 
+const formatIsolateActionComment = {
+  commentId: isolateCommentActions.id,
+  comment: 'Isolating this for investigation',
+  actions: {
+    targets: [
+      {
+        hostname: 'windows-host-1',
+        endpointId: '123',
+      },
+    ],
+    type: 'isolate',
+  },
+};
+
+const formatReleaseActionComment = {
+  commentId: releaseCommentActions.id,
+  comment: 'Releasing this for investigation',
+  actions: {
+    targets: [
+      {
+        hostname: 'windows-host-1',
+        endpointId: '123',
+      },
+    ],
+    type: 'unisolate',
+  },
+};
+
+const formatIsolateCommentActionsMultipleTargets = {
+  commentId: isolateCommentActionsMultipleTargets.id,
+  comment: 'Isolating this for investigation',
+  actions: {
+    targets: [
+      {
+        hostname: 'windows-host-1',
+        endpointId: '123',
+      },
+      {
+        hostname: 'windows-host-2',
+        endpointId: '456',
+      },
+    ],
+    type: 'isolate',
+  },
+};
+
 const params = { ...basicParams };
 
 describe('utils', () => {
@@ -289,6 +338,42 @@ describe('utils', () => {
         },
       ]);
     });
+
+    test('transform isolate action comment', () => {
+      const comments = [isolateCommentActions];
+      const res = transformComments(comments, ['informationCreated']);
+      const actionText = `Isolated host ${formatIsolateActionComment.actions.targets[0].hostname} with comment: ${formatIsolateActionComment.comment}`;
+      expect(res).toEqual([
+        {
+          commentId: formatIsolateActionComment.commentId,
+          comment: `${actionText} (created at ${comments[0].created_at} by ${comments[0].created_by.full_name})`,
+        },
+      ]);
+    });
+
+    test('transform release action comment', () => {
+      const comments = [releaseCommentActions];
+      const res = transformComments(comments, ['informationCreated']);
+      const actionText = `Released host ${formatReleaseActionComment.actions.targets[0].hostname} with comment: ${formatReleaseActionComment.comment}`;
+      expect(res).toEqual([
+        {
+          commentId: formatReleaseActionComment.commentId,
+          comment: `${actionText} (created at ${comments[0].created_at} by ${comments[0].created_by.full_name})`,
+        },
+      ]);
+    });
+
+    test('transform isolate action comment with multiple hosts', () => {
+      const comments = [isolateCommentActionsMultipleTargets];
+      const res = transformComments(comments, ['informationCreated']);
+      const actionText = `Isolated host ${formatIsolateCommentActionsMultipleTargets.actions.targets[0].hostname} and 1 more with comment: ${formatIsolateCommentActionsMultipleTargets.comment}`;
+      expect(res).toEqual([
+        {
+          commentId: formatIsolateCommentActionsMultipleTargets.commentId,
+          comment: `${actionText} (created at ${comments[0].created_at} by ${comments[0].created_by.full_name})`,
+        },
+      ]);
+    });
   });
 
   describe('transformers', () => {
@@ -523,8 +608,7 @@ describe('utils', () => {
             },
           ],
         },
-        // Remove second push
-        userActions: userActions.filter((item, index) => index !== 4),
+        userActions,
         connector,
         mappings: [
           ...mappings,
@@ -551,7 +635,7 @@ describe('utils', () => {
       ]);
     });
 
-    it('it removes alerts correctly', async () => {
+    it('it filters out the alerts from the comments correctly', async () => {
       const res = await createIncident({
         actionsClient: actionsMock,
         theCase: {
@@ -582,6 +666,32 @@ describe('utils', () => {
       ]);
     });
 
+    it('does not add the alerts count comment if all alerts have been pushed', async () => {
+      const res = await createIncident({
+        actionsClient: actionsMock,
+        theCase: {
+          ...theCase,
+          comments: [
+            { ...commentObj, id: 'comment-user-1', pushed_at: '2019-11-25T21:55:00.177Z' },
+            { ...commentGeneratedAlert, pushed_at: '2019-11-25T21:55:00.177Z' },
+          ],
+        },
+        userActions,
+        connector,
+        mappings,
+        alerts: [],
+        casesConnectors,
+      });
+
+      expect(res.comments).toEqual([
+        {
+          comment:
+            'Wow, good luck catching that bad meanie! (added at 2019-11-25T21:55:00.177Z by elastic)',
+          commentId: 'comment-user-1',
+        },
+      ]);
+    });
+
     it('updates an existing incident', async () => {
       const existingIncidentData = {
         priority: null,
@@ -644,22 +754,6 @@ describe('utils', () => {
       });
     });
 
-    it('throws error if connector is not supported', async () => {
-      expect.assertions(2);
-      createIncident({
-        actionsClient: actionsMock,
-        theCase,
-        userActions,
-        connector: { ...connector, actionTypeId: 'not-supported' },
-        mappings,
-        alerts: [],
-        casesConnectors,
-      }).catch((e) => {
-        expect(e).not.toBeNull();
-        expect(e).toEqual(new Error('Invalid external service'));
-      });
-    });
-
     describe('getLatestPushInfo', () => {
       it('it returns the latest push information correctly', async () => {
         const res = getLatestPushInfo('456', userActions);
diff --git a/x-pack/plugins/cases/server/client/cases/utils.ts b/x-pack/plugins/cases/server/client/cases/utils.ts
index f5a10d705e095..617191462c556 100644
--- a/x-pack/plugins/cases/server/client/cases/utils.ts
+++ b/x-pack/plugins/cases/server/client/cases/utils.ts
@@ -19,6 +19,7 @@ import {
   CommentAttributes,
   CommentRequestUserType,
   CommentRequestAlertType,
+  CommentRequestActionsType,
 } from '../../../common';
 import { ActionsClient } from '../../../../actions/server';
 import { CasesClientGetAlertsResponse } from '../../client/alerts/types';
@@ -76,18 +77,69 @@ const getCommentContent = (comment: CommentResponse): string => {
   } else if (comment.type === CommentType.alert || comment.type === CommentType.generatedAlert) {
     const ids = getAlertIds(comment);
     return `Alert with ids ${ids.join(', ')} added to case`;
+  } else if (
+    comment.type === CommentType.actions &&
+    (comment.actions.type === 'isolate' || comment.actions.type === 'unisolate')
+  ) {
+    const firstHostname =
+      comment.actions.targets?.length > 0 ? comment.actions.targets[0].hostname : 'unknown';
+    const totalHosts = comment.actions.targets.length;
+    const actionText = comment.actions.type === 'isolate' ? 'Isolated' : 'Released';
+    const additionalHostsText = totalHosts - 1 > 0 ? `and ${totalHosts - 1} more ` : ``;
+
+    return `${actionText} host ${firstHostname} ${additionalHostsText}with comment: ${comment.comment}`;
   }
 
   return '';
 };
 
-const countAlerts = (comments: CaseResponse['comments']): number =>
-  comments?.reduce<number>((total, comment) => {
-    if (comment.type === CommentType.alert || comment.type === CommentType.generatedAlert) {
-      return total + (Array.isArray(comment.alertId) ? comment.alertId.length : 1);
-    }
-    return total;
-  }, 0) ?? 0;
+interface CountAlertsInfo {
+  totalComments: number;
+  pushed: number;
+  totalAlerts: number;
+}
+
+const getAlertsInfo = (
+  comments: CaseResponse['comments']
+): { totalAlerts: number; hasUnpushedAlertComments: boolean } => {
+  const countingInfo = { totalComments: 0, pushed: 0, totalAlerts: 0 };
+
+  const res =
+    comments?.reduce<CountAlertsInfo>(({ totalComments, pushed, totalAlerts }, comment) => {
+      if (comment.type === CommentType.alert || comment.type === CommentType.generatedAlert) {
+        return {
+          totalComments: totalComments + 1,
+          pushed: comment.pushed_at != null ? pushed + 1 : pushed,
+          totalAlerts: totalAlerts + (Array.isArray(comment.alertId) ? comment.alertId.length : 1),
+        };
+      }
+      return { totalComments, pushed, totalAlerts };
+    }, countingInfo) ?? countingInfo;
+
+  return {
+    totalAlerts: res.totalAlerts,
+    hasUnpushedAlertComments: res.totalComments > res.pushed,
+  };
+};
+
+const addAlertMessage = (
+  caseId: string,
+  caseComments: CaseResponse['comments'],
+  comments: ExternalServiceComment[]
+): ExternalServiceComment[] => {
+  const { totalAlerts, hasUnpushedAlertComments } = getAlertsInfo(caseComments);
+
+  const newComments = [...comments];
+
+  if (hasUnpushedAlertComments) {
+    newComments.push({
+      comment: `Elastic Alerts attached to the case: ${totalAlerts}`,
+      commentId: `${caseId}-total-alerts`,
+    });
+  }
+
+  return newComments;
+};
 
 export const createIncident = async ({
   actionsClient,
@@ -161,11 +213,10 @@ export const createIncident = async ({
   const commentsToBeUpdated = caseComments?.filter(
     (comment) =>
       // We push only user's comments
-      comment.type === CommentType.user && commentsIdsToBeUpdated.has(comment.id)
+      (comment.type === CommentType.user || comment.type === CommentType.actions) &&
+      commentsIdsToBeUpdated.has(comment.id)
   );
 
-  const totalAlerts = countAlerts(caseComments);
-
   let comments: ExternalServiceComment[] = [];
 
   if (commentsToBeUpdated && Array.isArray(commentsToBeUpdated) && commentsToBeUpdated.length > 0) {
@@ -175,12 +226,7 @@ export const createIncident = async ({
     }
   }
 
-  if (totalAlerts > 0) {
-    comments.push({
-      comment: `Elastic Alerts attached to the case: ${totalAlerts}`,
-      commentId: `${theCase.id}-total-alerts`,
-    });
-  }
+  comments = addAlertMessage(theCase.id, caseComments, comments);
 
   return { incident, comments };
 };
@@ -322,7 +368,7 @@ export const isCommentAlertType = (
 
 export const getCommentContextFromAttributes = (
   attributes: CommentAttributes
-): CommentRequestUserType | CommentRequestAlertType => {
+): CommentRequestUserType | CommentRequestAlertType | CommentRequestActionsType => {
   const owner = attributes.owner;
   switch (attributes.type) {
     case CommentType.user:
@@ -340,6 +386,16 @@ export const getCommentContextFromAttributes = (
         rule: attributes.rule,
         owner,
       };
+    case CommentType.actions:
+      return {
+        type: attributes.type,
+        comment: attributes.comment,
+        actions: {
+          targets: attributes.actions.targets,
+          type: attributes.actions.type,
+        },
+        owner,
+      };
     default:
       return {
         type: CommentType.user,
diff --git a/x-pack/plugins/console_extensions/README.md b/x-pack/plugins/console_extensions/README.md
deleted file mode 100644
index 49d83d2888d6b..0000000000000
--- a/x-pack/plugins/console_extensions/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Console extensions
-
-This plugin provides autocomplete definitions of licensed APIs to the OSS Console plugin.
\ No newline at end of file
diff --git a/x-pack/plugins/console_extensions/kibana.json b/x-pack/plugins/console_extensions/kibana.json
deleted file mode 100644
index 9411523d3f6dd..0000000000000
--- a/x-pack/plugins/console_extensions/kibana.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "id": "consoleExtensions",
-  "version": "1.0.0",
-  "kibanaVersion": "kibana",
-  "requiredPlugins": ["console"],
-  "server": true,
-  "ui": false
-}
diff --git a/x-pack/plugins/console_extensions/server/index.ts b/x-pack/plugins/console_extensions/server/index.ts
deleted file mode 100644
index a03111a487090..0000000000000
--- a/x-pack/plugins/console_extensions/server/index.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { PluginInitializerContext, PluginConfigDescriptor } from 'kibana/server';
-
-import { config as configSchema, ConfigType } from './config';
-import { ConsoleExtensionsServerPlugin } from './plugin';
-
-export const plugin = (ctx: PluginInitializerContext) => new ConsoleExtensionsServerPlugin(ctx);
-
-export const config: PluginConfigDescriptor<ConfigType> = {
-  schema: configSchema,
-};
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/js/ingest.ts b/x-pack/plugins/console_extensions/server/lib/spec_definitions/js/ingest.ts
deleted file mode 100644
index 36ebfa589b823..0000000000000
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/js/ingest.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-// NOTE: This is copy-pasted from es_6_0/ingest.js in OSS Console.
-const commonPipelineParams = {
-  on_failure: [],
-  ignore_failure: {
-    __one_of: [false, true],
-  },
-  if: '',
-  tag: '',
-};
-
-// Based on https://www.elastic.co/guide/en/elasticsearch/reference/master/enrich-processor.html
-const enrichProcessorDefinition = {
-  enrich: {
-    __template: {
-      policy_name: '',
-      field: '',
-      target_field: '',
-    },
-    policy_name: '',
-    field: '',
-    target_field: '',
-    ignore_missing: {
-      __one_of: [false, true],
-    },
-    override: {
-      __one_of: [true, false],
-    },
-    max_matches: 1,
-    shape_relation: 'INTERSECTS',
-    ...commonPipelineParams,
-  },
-};
-
-// Based on https://www.elastic.co/guide/en/elasticsearch/reference/master/inference-processor.html
-const inferenceProcessorDefinition = {
-  inference: {
-    __template: {
-      model_id: '',
-      inference_config: {},
-      field_mappings: {},
-    },
-    target_field: '',
-    model_id: '',
-    field_mappings: {
-      __template: {},
-    },
-    inference_config: {
-      regression: {
-        __template: {},
-        results_field: '',
-      },
-      classification: {
-        __template: {},
-        results_field: '',
-        num_top_classes: 2,
-        top_classes_results_field: '',
-      },
-    },
-    ...commonPipelineParams,
-  },
-};
-
-export const processors = [enrichProcessorDefinition, inferenceProcessorDefinition];
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_expired_data.json b/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_expired_data.json
deleted file mode 100644
index 4afa9e323b030..0000000000000
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.delete_expired_data.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "ml.delete_expired_data": {
-    "methods": [
-      "DELETE"
-    ],
-    "patterns": [
-      "_ml/_delete_expired_data"
-    ]
-  }
-}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.info.json b/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.info.json
deleted file mode 100644
index 51b571776ead9..0000000000000
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.info.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "ml.info": {
-    "methods": [
-      "GET"
-    ],
-    "patterns": [
-      "_ml/info"
-    ]
-  }
-}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_filter.json b/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_filter.json
deleted file mode 100644
index 6d57c433d71f4..0000000000000
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_filter.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "ml.put_filter": {
-    "methods": [
-      "PUT"
-    ],
-    "patterns": [
-      "_ml/filters/{filter_id}"
-    ]
-  }
-}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_trained_model.json b/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_trained_model.json
deleted file mode 100644
index 27d0393be6086..0000000000000
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/ml.put_trained_model.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "ml.put_trained_model": {
-    "methods": [
-      "PUT"
-    ],
-    "patterns": [
-      "_ml/inference/{model_id}"
-    ],
-    "documentation": "TODO"
-  }
-}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.delete_job.json b/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.delete_job.json
deleted file mode 100644
index 8ecf617751a51..0000000000000
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.delete_job.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "rollup.delete_job": {
-    "methods": [
-      "DELETE"
-    ],
-    "patterns": [
-      "_rollup/job/{id}"
-    ]
-  }
-}
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.put_job.json b/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.put_job.json
deleted file mode 100644
index 7734fd54a1ab1..0000000000000
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/json/generated/rollup.put_job.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "rollup.put_job": {
-    "methods": [
-      "PUT"
-    ],
-    "patterns": [
-      "_rollup/job/{id}"
-    ]
-  }
-}
diff --git a/x-pack/plugins/console_extensions/server/plugin.ts b/x-pack/plugins/console_extensions/server/plugin.ts
deleted file mode 100644
index 9ea3f314296ee..0000000000000
--- a/x-pack/plugins/console_extensions/server/plugin.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { join } from 'path';
-import { CoreSetup, CoreStart, Logger, Plugin, PluginInitializerContext } from 'kibana/server';
-
-import { ConsoleSetup, ConsoleStart } from '../../../../src/plugins/console/server';
-
-import { processors } from './lib/spec_definitions/js';
-
-interface SetupDependencies {
-  console: ConsoleSetup;
-}
-
-interface StartDependencies {
-  console: ConsoleStart;
-}
-
-const CONSOLE_XPACK_JSON_SPEC_PATH = join(__dirname, 'lib/spec_definitions/json');
-
-export class ConsoleExtensionsServerPlugin implements Plugin<void, void, SetupDependencies> {
-  log: Logger;
-  constructor(private readonly ctx: PluginInitializerContext) {
-    this.log = this.ctx.logger.get();
-  }
-
-  setup(core: CoreSetup, { console: { addExtensionSpecFilePath } }: SetupDependencies) {
-    addExtensionSpecFilePath(CONSOLE_XPACK_JSON_SPEC_PATH);
-    this.log.debug(`Added extension path to ${CONSOLE_XPACK_JSON_SPEC_PATH}...`);
-  }
-
-  start(core: CoreStart, { console: { addProcessorDefinition } }: StartDependencies) {
-    processors.forEach((processor) => addProcessorDefinition(processor));
-    this.log.debug('Added processor definition extensions.');
-  }
-}
diff --git a/x-pack/plugins/console_extensions/tsconfig.json b/x-pack/plugins/console_extensions/tsconfig.json
deleted file mode 100644
index 5ad28f230a0bb..0000000000000
--- a/x-pack/plugins/console_extensions/tsconfig.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "extends": "../../../tsconfig.base.json",
-  "compilerOptions": {
-    "composite": true,
-    "outDir": "./target/types",
-    "emitDeclarationOnly": true,
-    "declaration": true,
-    "declarationMap": true
-  },
-  "include": [
-    "server/**/*"
-  ],
-  "references": [
-    { "path": "../../../src/core/tsconfig.json" },
-    { "path": "../../../src/plugins/console/tsconfig.json" }
-  ]
-}
diff --git a/x-pack/plugins/data_enhanced/server/search/session/check_non_persiseted_sessions.ts b/x-pack/plugins/data_enhanced/server/search/session/check_non_persiseted_sessions.ts
index 8c75ce91cac6a..2115ce85eeb27 100644
--- a/x-pack/plugins/data_enhanced/server/search/session/check_non_persiseted_sessions.ts
+++ b/x-pack/plugins/data_enhanced/server/search/session/check_non_persiseted_sessions.ts
@@ -59,7 +59,11 @@ function checkNonPersistedSessionsPage(
         `${SEARCH_SESSIONS_CLEANUP_TASK_TYPE} Found ${nonPersistedSearchSessions.total} sessions, processing ${nonPersistedSearchSessions.saved_objects.length}`
       );
 
-      const updatedSessions = await getAllSessionsStatusUpdates(deps, nonPersistedSearchSessions);
+      const updatedSessions = await getAllSessionsStatusUpdates(
+        deps,
+        config,
+        nonPersistedSearchSessions
+      );
       const deletedSessionIds: string[] = [];
 
       await Promise.all(
diff --git a/x-pack/plugins/data_enhanced/server/search/session/check_persisted_sessions.ts b/x-pack/plugins/data_enhanced/server/search/session/check_persisted_sessions.ts
index 0d51e97952275..3e89383c16d5e 100644
--- a/x-pack/plugins/data_enhanced/server/search/session/check_persisted_sessions.ts
+++ b/x-pack/plugins/data_enhanced/server/search/session/check_persisted_sessions.ts
@@ -36,7 +36,11 @@ function checkPersistedSessionsPage(
         `${SEARCH_SESSIONS_TASK_TYPE} Found ${persistedSearchSessions.total} sessions, processing ${persistedSearchSessions.saved_objects.length}`
       );
 
-      const updatedSessions = await getAllSessionsStatusUpdates(deps, persistedSearchSessions);
+      const updatedSessions = await getAllSessionsStatusUpdates(
+        deps,
+        config,
+        persistedSearchSessions
+      );
       await bulkUpdateSessions(deps, updatedSessions);
 
       return persistedSearchSessions;
diff --git a/x-pack/plugins/data_enhanced/server/search/session/expire_persisted_sessions.ts b/x-pack/plugins/data_enhanced/server/search/session/expire_persisted_sessions.ts
index e261c324f440f..61d1635dabe1b 100644
--- a/x-pack/plugins/data_enhanced/server/search/session/expire_persisted_sessions.ts
+++ b/x-pack/plugins/data_enhanced/server/search/session/expire_persisted_sessions.ts
@@ -36,7 +36,7 @@ function checkSessionExpirationPage(
         `${SEARCH_SESSIONS_EXPIRE_TASK_TYPE} Found ${searchSessions.total} sessions, processing ${searchSessions.saved_objects.length}`
       );
 
-      const updatedSessions = await getAllSessionsStatusUpdates(deps, searchSessions);
+      const updatedSessions = await getAllSessionsStatusUpdates(deps, config, searchSessions);
       await bulkUpdateSessions(deps, updatedSessions);
 
       return searchSessions;
diff --git a/x-pack/plugins/data_enhanced/server/search/session/get_session_status.test.ts b/x-pack/plugins/data_enhanced/server/search/session/get_session_status.test.ts
index fc86e75297393..c3946e5af16fa 100644
--- a/x-pack/plugins/data_enhanced/server/search/session/get_session_status.test.ts
+++ b/x-pack/plugins/data_enhanced/server/search/session/get_session_status.test.ts
@@ -5,16 +5,21 @@
  * 2.0.
  */
 
-import { SearchStatus } from './types';
+import { SearchSessionsConfig, SearchStatus } from './types';
 import { getSessionStatus } from './get_session_status';
 import { SearchSessionStatus } from '../../../../../../src/plugins/data/common';
+import moment from 'moment';
 
 describe('getSessionStatus', () => {
+  const mockConfig = ({
+    notTouchedInProgressTimeout: moment.duration(1, 'm'),
+  } as unknown) as SearchSessionsConfig;
   test("returns an in_progress status if there's nothing inside the session", () => {
     const session: any = {
       idMapping: {},
+      touched: moment(),
     };
-    expect(getSessionStatus(session)).toBe(SearchSessionStatus.IN_PROGRESS);
+    expect(getSessionStatus(session, mockConfig)).toBe(SearchSessionStatus.IN_PROGRESS);
   });
 
   test("returns an error status if there's at least one error", () => {
@@ -25,7 +30,25 @@ describe('getSessionStatus', () => {
         c: { status: SearchStatus.COMPLETE },
       },
     };
-    expect(getSessionStatus(session)).toBe(SearchSessionStatus.ERROR);
+    expect(getSessionStatus(session, mockConfig)).toBe(SearchSessionStatus.ERROR);
+  });
+
+  test('expires a empty session after a minute', () => {
+    const session: any = {
+      idMapping: {},
+      touched: moment().subtract(2, 'm'),
+    };
+    expect(getSessionStatus(session, mockConfig)).toBe(SearchSessionStatus.EXPIRED);
+  });
+
+  test('doesnt expire a full session after a minute', () => {
+    const session: any = {
+      idMapping: {
+        a: { status: SearchStatus.IN_PROGRESS },
+      },
+      touched: moment().subtract(2, 'm'),
+    };
+    expect(getSessionStatus(session, mockConfig)).toBe(SearchSessionStatus.IN_PROGRESS);
   });
 
   test('returns a complete status if all are complete', () => {
@@ -36,7 +59,7 @@ describe('getSessionStatus', () => {
         c: { status: SearchStatus.COMPLETE },
       },
     };
-    expect(getSessionStatus(session)).toBe(SearchSessionStatus.COMPLETE);
+    expect(getSessionStatus(session, mockConfig)).toBe(SearchSessionStatus.COMPLETE);
   });
 
   test('returns a running status if some are still running', () => {
@@ -47,6 +70,6 @@ describe('getSessionStatus', () => {
         c: { status: SearchStatus.IN_PROGRESS },
       },
     };
-    expect(getSessionStatus(session)).toBe(SearchSessionStatus.IN_PROGRESS);
+    expect(getSessionStatus(session, mockConfig)).toBe(SearchSessionStatus.IN_PROGRESS);
   });
 });
diff --git a/x-pack/plugins/data_enhanced/server/search/session/get_session_status.ts b/x-pack/plugins/data_enhanced/server/search/session/get_session_status.ts
index 23e02eedc0004..e7ae52b6c88ae 100644
--- a/x-pack/plugins/data_enhanced/server/search/session/get_session_status.ts
+++ b/x-pack/plugins/data_enhanced/server/search/session/get_session_status.ts
@@ -5,16 +5,28 @@
  * 2.0.
  */
 
+import moment from 'moment';
 import {
   SearchSessionSavedObjectAttributes,
   SearchSessionStatus,
 } from '../../../../../../src/plugins/data/common/';
-import { SearchStatus } from './types';
+import { SearchSessionsConfig, SearchStatus } from './types';
 
-export function getSessionStatus(session: SearchSessionSavedObjectAttributes): SearchSessionStatus {
+export function getSessionStatus(
+  session: SearchSessionSavedObjectAttributes,
+  config: SearchSessionsConfig
+): SearchSessionStatus {
   const searchStatuses = Object.values(session.idMapping);
+  const curTime = moment();
   if (searchStatuses.some((item) => item.status === SearchStatus.ERROR)) {
     return SearchSessionStatus.ERROR;
+  } else if (
+    searchStatuses.length === 0 &&
+    curTime.diff(moment(session.touched), 'ms') >
+      moment.duration(config.notTouchedInProgressTimeout).asMilliseconds()
+  ) {
+    // Expire empty sessions that weren't touched for a minute
+    return SearchSessionStatus.EXPIRED;
   } else if (
     searchStatuses.length > 0 &&
     searchStatuses.every((item) => item.status === SearchStatus.COMPLETE)
diff --git a/x-pack/plugins/data_enhanced/server/search/session/update_session_status.test.ts b/x-pack/plugins/data_enhanced/server/search/session/update_session_status.test.ts
index 485a30fd54951..d9e3fa6f8cab3 100644
--- a/x-pack/plugins/data_enhanced/server/search/session/update_session_status.test.ts
+++ b/x-pack/plugins/data_enhanced/server/search/session/update_session_status.test.ts
@@ -21,6 +21,7 @@ import {
 
 describe('bulkUpdateSessions', () => {
   let mockClient: any;
+  const mockConfig: any = {};
   let savedObjectsClient: jest.Mocked<SavedObjectsClientContract>;
   const mockLogger: any = {
     debug: jest.fn(),
@@ -66,6 +67,7 @@ describe('bulkUpdateSessions', () => {
           client: mockClient,
           logger: mockLogger,
         },
+        mockConfig,
         so
       );
 
@@ -105,6 +107,7 @@ describe('bulkUpdateSessions', () => {
           client: mockClient,
           logger: mockLogger,
         },
+        mockConfig,
         so
       );
 
@@ -139,6 +142,7 @@ describe('bulkUpdateSessions', () => {
           client: mockClient,
           logger: mockLogger,
         },
+        mockConfig,
         so
       );
 
@@ -176,6 +180,7 @@ describe('bulkUpdateSessions', () => {
           client: mockClient,
           logger: mockLogger,
         },
+        mockConfig,
         so
       );
 
@@ -219,6 +224,7 @@ describe('bulkUpdateSessions', () => {
           client: mockClient,
           logger: mockLogger,
         },
+        mockConfig,
         so
       );
 
diff --git a/x-pack/plugins/data_enhanced/server/search/session/update_session_status.ts b/x-pack/plugins/data_enhanced/server/search/session/update_session_status.ts
index 1c484467bef63..4758e7cb22684 100644
--- a/x-pack/plugins/data_enhanced/server/search/session/update_session_status.ts
+++ b/x-pack/plugins/data_enhanced/server/search/session/update_session_status.ts
@@ -13,11 +13,17 @@ import {
 } from '../../../../../../src/plugins/data/common';
 import { getSearchStatus } from './get_search_status';
 import { getSessionStatus } from './get_session_status';
-import { CheckSearchSessionsDeps, SearchSessionsResponse, SearchStatus } from './types';
+import {
+  CheckSearchSessionsDeps,
+  SearchSessionsConfig,
+  SearchSessionsResponse,
+  SearchStatus,
+} from './types';
 import { isSearchSessionExpired } from './utils';
 
 export async function updateSessionStatus(
   { logger, client }: CheckSearchSessionsDeps,
+  config: SearchSessionsConfig,
   session: SavedObjectsFindResult<SearchSessionSavedObjectAttributes>
 ) {
   let sessionUpdated = false;
@@ -61,7 +67,7 @@ export async function updateSessionStatus(
   // And only then derive the session's status
   const sessionStatus = isExpired
     ? SearchSessionStatus.EXPIRED
-    : getSessionStatus(session.attributes);
+    : getSessionStatus(session.attributes, config);
   if (sessionStatus !== session.attributes.status) {
     const now = new Date().toISOString();
     session.attributes.status = sessionStatus;
@@ -79,13 +85,14 @@ export async function updateSessionStatus(
 
 export async function getAllSessionsStatusUpdates(
   deps: CheckSearchSessionsDeps,
+  config: SearchSessionsConfig,
   searchSessions: SearchSessionsResponse
 ) {
   const updatedSessions = new Array<SavedObjectsFindResult<SearchSessionSavedObjectAttributes>>();
 
   await Promise.all(
     searchSessions.saved_objects.map(async (session) => {
-      const updated = await updateSessionStatus(deps, session);
+      const updated = await updateSessionStatus(deps, config, session);
 
       if (updated) {
         updatedSessions.push(session);
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/file_data_visualizer_view/file_error_callouts.tsx b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/file_data_visualizer_view/file_error_callouts.tsx
index 62d860c1513e8..12e92f2936fff 100644
--- a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/file_data_visualizer_view/file_error_callouts.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/file_data_visualizer_view/file_error_callouts.tsx
@@ -107,7 +107,7 @@ export const FileCouldNotBeRead: FC<FileCouldNotBeReadProps> = ({
               defaultMessage="If you know something about this data, such as the file format or timestamp format, adding initial overrides may help us to infer the rest of the structure."
             />
             <br />
-            <EuiButtonEmpty onClick={showEditFlyout} flush="left" size="xs">
+            <EuiButtonEmpty onClick={showEditFlyout} flush="left" size="s">
               <FormattedMessage
                 id="xpack.dataVisualizer.file.fileErrorCallouts.overrideButton"
                 defaultMessage="Apply override settings"
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
index ec55eddec2a79..f45c4a89d006c 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
@@ -68,6 +68,7 @@ import { TimeBuckets } from '../../services/time_buckets';
 import { extractSearchData } from '../../utils/saved_search_utils';
 import { DataVisualizerIndexPatternManagement } from '../index_pattern_management';
 import { ResultLink } from '../../../common/components/results_links';
+import { extractErrorProperties } from '../../utils/error_utils';
 
 interface DataVisualizerPageState {
   overallStats: OverallStats;
@@ -371,9 +372,16 @@ export const IndexDataVisualizerView: FC<IndexDataVisualizerViewProps> = (dataVi
         earliest,
         latest
       );
+      // Because load overall stats perform queries in batches
+      // there could be multiple errors
+      if (Array.isArray(allStats.errors) && allStats.errors.length > 0) {
+        allStats.errors.forEach((err: any) => {
+          dataLoader.displayError(extractErrorProperties(err));
+        });
+      }
       setOverallStats(allStats);
     } catch (err) {
-      dataLoader.displayError(err);
+      dataLoader.displayError(err.body ?? err);
     }
   }
 
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/data_loader/data_loader.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/data_loader/data_loader.ts
index 4a3c971cc57cd..1b92eaddd1343 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/data_loader/data_loader.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/data_loader/data_loader.ts
@@ -109,17 +109,17 @@ export class DataLoader {
             'The request may have timed out. Try using a smaller sample size or narrowing the time range.',
           values: {
             index: this._indexPattern.title,
-            message: err.message,
+            message: err.error ?? err.message,
           },
         }),
       });
     } else {
       this._toastNotifications.addError(err, {
-        title: i18n.translate('xpack.dataVisualizer.index.errorLoadingDataMessage.', {
-          defaultMessage: 'Error loading data in index {index}. {message}',
+        title: i18n.translate('xpack.dataVisualizer.index.errorLoadingDataMessage', {
+          defaultMessage: 'Error loading data in index {index}. {message}.',
           values: {
             index: this._indexPattern.title,
-            message: err.message,
+            message: err.error ?? err.message,
           },
         }),
       });
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/error_utils.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/error_utils.ts
new file mode 100644
index 0000000000000..9bb36496a149e
--- /dev/null
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/error_utils.ts
@@ -0,0 +1,184 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { HttpFetchError } from 'kibana/public';
+import Boom from '@hapi/boom';
+import { isPopulatedObject } from '../../../../common/utils/object_utils';
+
+export interface WrappedError {
+  body: {
+    attributes: {
+      body: EsErrorBody;
+    };
+    message: Boom.Boom;
+  };
+  statusCode: number;
+}
+
+export interface EsErrorRootCause {
+  type: string;
+  reason: string;
+  caused_by?: EsErrorRootCause;
+  script?: string;
+}
+
+export interface EsErrorBody {
+  error: {
+    root_cause?: EsErrorRootCause[];
+    caused_by?: EsErrorRootCause;
+    type: string;
+    reason: string;
+  };
+  status: number;
+}
+
+export interface DVResponseError {
+  statusCode: number;
+  error: string;
+  message: string;
+  attributes?: {
+    body: EsErrorBody;
+  };
+}
+
+export interface ErrorMessage {
+  message: string;
+}
+
+export interface DVErrorObject {
+  causedBy?: string;
+  message: string;
+  statusCode?: number;
+  fullError?: EsErrorBody;
+}
+
+export interface DVHttpFetchError<T> extends HttpFetchError {
+  body: T;
+}
+
+export type ErrorType =
+  | WrappedError
+  | DVHttpFetchError<DVResponseError>
+  | EsErrorBody
+  | Boom.Boom
+  | string
+  | undefined;
+
+export function isEsErrorBody(error: any): error is EsErrorBody {
+  return error && error.error?.reason !== undefined;
+}
+
+export function isErrorString(error: any): error is string {
+  return typeof error === 'string';
+}
+
+export function isErrorMessage(error: any): error is ErrorMessage {
+  return error && error.message !== undefined && typeof error.message === 'string';
+}
+
+export function isDVResponseError(error: any): error is DVResponseError {
+  return typeof error.body === 'object' && 'message' in error.body;
+}
+
+export function isBoomError(error: any): error is Boom.Boom {
+  return error.isBoom === true;
+}
+
+export function isWrappedError(error: any): error is WrappedError {
+  return error && isBoomError(error.body?.message) === true;
+}
+
+export const extractErrorProperties = (error: ErrorType): DVErrorObject => {
+  // extract properties of the error object from within the response error
+  // coming from Kibana, Elasticsearch, and our own DV messages
+
+  // some responses contain raw es errors as part of a bulk response
+  // e.g. if some jobs fail the action in a bulk request
+
+  if (isEsErrorBody(error)) {
+    return {
+      message: error.error.reason,
+      statusCode: error.status,
+      fullError: error,
+    };
+  }
+
+  if (isErrorString(error)) {
+    return {
+      message: error,
+    };
+  }
+  if (isWrappedError(error)) {
+    return error.body.message?.output?.payload;
+  }
+
+  if (isBoomError(error)) {
+    return {
+      message: error.output.payload.message,
+      statusCode: error.output.payload.statusCode,
+    };
+  }
+
+  if (error?.body === undefined && !error?.message) {
+    return {
+      message: '',
+    };
+  }
+
+  if (typeof error.body === 'string') {
+    return {
+      message: error.body,
+    };
+  }
+
+  if (isDVResponseError(error)) {
+    if (
+      typeof error.body.attributes === 'object' &&
+      typeof error.body.attributes.body?.error?.reason === 'string'
+    ) {
+      const errObj: DVErrorObject = {
+        message: error.body.attributes.body.error.reason,
+        statusCode: error.body.statusCode,
+        fullError: error.body.attributes.body,
+      };
+      if (
+        typeof error.body.attributes.body.error.caused_by === 'object' &&
+        (typeof error.body.attributes.body.error.caused_by?.reason === 'string' ||
+          typeof error.body.attributes.body.error.caused_by?.caused_by?.reason === 'string')
+      ) {
+        errObj.causedBy =
+          error.body.attributes.body.error.caused_by?.caused_by?.reason ||
+          error.body.attributes.body.error.caused_by?.reason;
+      }
+      if (
+        Array.isArray(error.body.attributes.body.error.root_cause) &&
+        typeof error.body.attributes.body.error.root_cause[0] === 'object' &&
+        isPopulatedObject(error.body.attributes.body.error.root_cause[0], ['script'])
+      ) {
+        errObj.causedBy = error.body.attributes.body.error.root_cause[0].script;
+        errObj.message += `: '${error.body.attributes.body.error.root_cause[0].script}'`;
+      }
+      return errObj;
+    } else {
+      return {
+        message: error.body.message,
+        statusCode: error.body.statusCode,
+      };
+    }
+  }
+
+  if (isErrorMessage(error)) {
+    return {
+      message: error.message,
+    };
+  }
+
+  // If all else fail return an empty message instead of JSON.stringify
+  return {
+    message: '',
+  };
+};
diff --git a/x-pack/plugins/data_visualizer/server/models/data_visualizer/data_visualizer.ts b/x-pack/plugins/data_visualizer/server/models/data_visualizer/data_visualizer.ts
index 27c09c889deb7..155cf09ebb8db 100644
--- a/x-pack/plugins/data_visualizer/server/models/data_visualizer/data_visualizer.ts
+++ b/x-pack/plugins/data_visualizer/server/models/data_visualizer/data_visualizer.ts
@@ -31,6 +31,7 @@ import {
   getNumericFieldsStats,
   getStringFieldsStats,
 } from './get_fields_stats';
+import { wrapError } from '../../utils/error_wrapper';
 
 export class DataVisualizer {
   private _client: IScopedClusterClient;
@@ -60,6 +61,7 @@ export class DataVisualizer {
       aggregatableNotExistsFields: [] as FieldData[],
       nonAggregatableExistsFields: [] as FieldData[],
       nonAggregatableNotExistsFields: [] as FieldData[],
+      errors: [] as any[],
     };
 
     // To avoid checking for the existence of too many aggregatable fields in one request,
@@ -76,49 +78,61 @@ export class DataVisualizer {
 
     await Promise.all(
       batches.map(async (fields) => {
-        const batchStats = await this.checkAggregatableFieldsExist(
-          indexPatternTitle,
-          query,
-          fields,
-          samplerShardSize,
-          timeFieldName,
-          earliestMs,
-          latestMs,
-          undefined,
-          runtimeMappings
-        );
+        try {
+          const batchStats = await this.checkAggregatableFieldsExist(
+            indexPatternTitle,
+            query,
+            fields,
+            samplerShardSize,
+            timeFieldName,
+            earliestMs,
+            latestMs,
+            undefined,
+            runtimeMappings
+          );
 
-        // Total count will be returned with each batch of fields. Just overwrite.
-        stats.totalCount = batchStats.totalCount;
+          // Total count will be returned with each batch of fields. Just overwrite.
+          stats.totalCount = batchStats.totalCount;
 
-        // Add to the lists of fields which do and do not exist.
-        stats.aggregatableExistsFields.push(...batchStats.aggregatableExistsFields);
-        stats.aggregatableNotExistsFields.push(...batchStats.aggregatableNotExistsFields);
+          // Add to the lists of fields which do and do not exist.
+          stats.aggregatableExistsFields.push(...batchStats.aggregatableExistsFields);
+          stats.aggregatableNotExistsFields.push(...batchStats.aggregatableNotExistsFields);
+        } catch (e) {
+          // If index not found, no need to proceed with other batches
+          if (e.statusCode === 404) {
+            throw e;
+          }
+          stats.errors.push(wrapError(e));
+        }
       })
     );
 
     await Promise.all(
       nonAggregatableFields.map(async (field) => {
-        const existsInDocs = await this.checkNonAggregatableFieldExists(
-          indexPatternTitle,
-          query,
-          field,
-          timeFieldName,
-          earliestMs,
-          latestMs,
-          runtimeMappings
-        );
+        try {
+          const existsInDocs = await this.checkNonAggregatableFieldExists(
+            indexPatternTitle,
+            query,
+            field,
+            timeFieldName,
+            earliestMs,
+            latestMs,
+            runtimeMappings
+          );
 
-        const fieldData: FieldData = {
-          fieldName: field,
-          existsInDocs,
-          stats: {},
-        };
+          const fieldData: FieldData = {
+            fieldName: field,
+            existsInDocs,
+            stats: {},
+          };
 
-        if (existsInDocs === true) {
-          stats.nonAggregatableExistsFields.push(fieldData);
-        } else {
-          stats.nonAggregatableNotExistsFields.push(fieldData);
+          if (existsInDocs === true) {
+            stats.nonAggregatableExistsFields.push(fieldData);
+          } else {
+            stats.nonAggregatableNotExistsFields.push(fieldData);
+          }
+        } catch (e) {
+          stats.errors.push(wrapError(e));
         }
       })
     );
diff --git a/x-pack/plugins/data_visualizer/server/plugin.ts b/x-pack/plugins/data_visualizer/server/plugin.ts
index 4ae695b05b81f..9db580959b116 100644
--- a/x-pack/plugins/data_visualizer/server/plugin.ts
+++ b/x-pack/plugins/data_visualizer/server/plugin.ts
@@ -12,7 +12,7 @@ import { dataVisualizerRoutes } from './routes';
 export class DataVisualizerPlugin implements Plugin {
   constructor() {}
 
-  async setup(coreSetup: CoreSetup<StartDeps, unknown>, plugins: SetupDeps) {
+  setup(coreSetup: CoreSetup<StartDeps, unknown>, plugins: SetupDeps) {
     dataVisualizerRoutes(coreSetup);
   }
 
diff --git a/x-pack/plugins/enterprise_search/README.md b/x-pack/plugins/enterprise_search/README.md
index 0b067e25e32e8..96b0391bbc8da 100644
--- a/x-pack/plugins/enterprise_search/README.md
+++ b/x-pack/plugins/enterprise_search/README.md
@@ -2,16 +2,30 @@
 
 ## Overview
 
-This plugin's goal is to provide a Kibana user interface to the Enterprise Search solution's products (App Search and Workplace Search). In it's current MVP state, the plugin provides the following with the goal of gathering user feedback and raising product awareness:
+This plugin provides beta Kibana user interfaces for managing the Enterprise Search solution and its products, App Search and Workplace Search.
 
-- **App Search:** A basic engines overview with links into the product.
-- **Workplace Search:** A simple app overview with basic statistics, links to the sources, users (if standard auth), and product settings.
+> :warning: The Kibana interface for Enterprise Search is a beta feature. It is subject to change and is not covered by the same level of support as generally available features. This interface will become the sole management panel for Enterprise Search with the 8.0 release. Until then, the standalone Enterprise Search UI remains available and supported.
+
+### App Search
+
+<img src="./public/applications/enterprise_search/assets/app_search.png" width="400" height="255">
+
+Add rich, relevant search to your apps and websites. https://www.elastic.co/app-search/
+
+### Workplace Search
+
+<img src="./public/applications/enterprise_search/assets/workplace_search.png" width="400" height="255">
+
+Unify all your team's content into a personalized search experience. https://www.elastic.co/workplace-search/
 
 ## Development
 
 1. When developing locally, Enterprise Search should be running locally alongside Kibana on `localhost:3002`.
 2. Update `config/kibana.dev.yml` with `enterpriseSearch.host: 'http://localhost:3002'`
-3. For faster QA/development, run Enterprise Search on [elasticsearch-native auth](https://www.elastic.co/guide/en/app-search/current/security-and-users.html#app-search-self-managed-security-and-user-management-elasticsearch-native-realm) and log in as the `elastic` superuser on Kibana.
+
+Problems? If you're an Elastic Enterprise Search engineer, please reach out to @elastic/enterprise-search-frontend for questions or our in-depth Getting Started developer guide.
+
+Don't forget to read Kibana's [contributing documentation](https://github.com/elastic/kibana/#building-and-running-kibana-andor-contributing-code) and developer guides for more general info on the Kibana ecosystem.
 
 ### Kea
 
diff --git a/x-pack/plugins/enterprise_search/kibana.json b/x-pack/plugins/enterprise_search/kibana.json
index f8b4261114a22..723b24f951434 100644
--- a/x-pack/plugins/enterprise_search/kibana.json
+++ b/x-pack/plugins/enterprise_search/kibana.json
@@ -12,5 +12,5 @@
     "name": "Enterprise Search",
     "githubTeam": "enterprise-search-frontend"
   },
-  "description": "Adds dashboards for discovering and managing Enterprise Search products"
+  "description": "Adds dashboards for discovering and managing Enterprise Search products."
 }
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/__mocks__/content_sources.mock.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/__mocks__/content_sources.mock.ts
index 748dc6a7cbcf8..c599a13cc3119 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/__mocks__/content_sources.mock.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/__mocks__/content_sources.mock.ts
@@ -303,6 +303,7 @@ export const exampleResult = {
     titleField: 'otherTitle',
     subtitleField: 'otherSubtitle',
     urlField: 'myLink',
+    urlFieldIsLinkable: true,
     color: '#e3e3e3',
     descriptionField: 'about',
     typeField: 'otherType',
@@ -314,14 +315,18 @@ export const exampleResult = {
       { fieldName: 'dogs', label: 'Canines' },
     ],
   },
-  titleFieldHover: false,
-  urlFieldHover: false,
   exampleDocuments: [
     {
       myLink: 'http://foo',
       otherTitle: 'foo',
+      content_source_id: '60e85e7ea2564c265a88a4f0',
+      external_id: 'doc-60e85eb7a2564c937a88a4f3',
+      last_updated: '2021-07-09T14:35:35+00:00',
+      updated_at: '2021-07-09T14:35:35+00:00',
+      source: 'custom',
     },
   ],
+  schemaFields: {},
 };
 
 export const mostRecentIndexJob = {
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/account_header/account_header.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/account_header/account_header.tsx
index 1e6e8ec6c5e49..4c22a234e731c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/account_header/account_header.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/account_header/account_header.tsx
@@ -68,11 +68,11 @@ export const AccountHeader: React.FC = () => {
   return (
     <EuiHeader>
       <EuiHeaderSection grow={false}>
-        <EuiHeaderSectionItem>
+        <EuiHeaderSectionItem border="none">
           <EuiHeaderLogo iconType="logoWorkplaceSearch" />
           <EuiText>{WORKPLACE_SEARCH_TITLE}</EuiText>
         </EuiHeaderSectionItem>
-        <EuiHeaderSectionItem>
+        <EuiHeaderSectionItem border="none">
           <EuiHeaderLinks>
             <EuiButtonEmptyTo to={PERSONAL_SOURCES_PATH}>{ACCOUNT_NAV.SOURCES}</EuiButtonEmptyTo>
           </EuiHeaderLinks>
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/types.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/types.ts
index edc772b369558..e50b12f781947 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/types.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/types.ts
@@ -96,7 +96,7 @@ export interface ContentSource {
 export interface SourceContentItem {
   id: string;
   last_updated: string;
-  [key: string]: string;
+  [key: string]: string | CustomAPIFieldValue;
 }
 
 export interface ContentSourceDetails extends ContentSource {
@@ -186,8 +186,25 @@ export interface CustomSource {
   id: string;
 }
 
+// https://www.elastic.co/guide/en/workplace-search/current/workplace-search-custom-sources-api.html#_schema_data_types
+type CustomAPIString = string | string[];
+type CustomAPINumber = number | number[];
+type CustomAPIDate = string | string[];
+type CustomAPIGeolocation = string | string[] | number[] | number[][];
+
+export type CustomAPIFieldValue =
+  | CustomAPIString
+  | CustomAPINumber
+  | CustomAPIDate
+  | CustomAPIGeolocation;
+
 export interface Result {
-  [key: string]: string | string[];
+  content_source_id: string;
+  last_updated: string;
+  external_id: string;
+  updated_at: string;
+  source: string;
+  [key: string]: CustomAPIFieldValue;
 }
 
 export interface OptionValue {
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/get_as_local_datetime_string.test.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/get_as_local_datetime_string.test.ts
index 6475df7f4c399..36df182b99b85 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/get_as_local_datetime_string.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/get_as_local_datetime_string.test.ts
@@ -14,6 +14,12 @@ describe('getAsLocalDateTimeString', () => {
     expect(getAsLocalDateTimeString(date)).toEqual(new Date(Date.parse(date)).toLocaleString());
   });
 
+  it('returns null if passed value is not a string', () => {
+    const date = ['1', '2'];
+
+    expect(getAsLocalDateTimeString(date)).toEqual(null);
+  });
+
   it('returns null if string cannot be parsed as date', () => {
     const date = 'foo';
 
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/get_as_local_datetime_string.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/get_as_local_datetime_string.ts
index d5ceb50d4c9af..6350c4e4a4099 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/get_as_local_datetime_string.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/get_as_local_datetime_string.ts
@@ -5,7 +5,11 @@
  * 2.0.
  */
 
-export const getAsLocalDateTimeString = (str: string) => {
-  const dateValue = Date.parse(str);
+import { CustomAPIFieldValue } from '../types';
+
+export const getAsLocalDateTimeString = (maybeDate: CustomAPIFieldValue) => {
+  if (typeof maybeDate !== 'string') return null;
+
+  const dateValue = Date.parse(maybeDate);
   return dateValue ? new Date(dateValue).toLocaleString() : null;
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/mime_types.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/mime_types.ts
index f7664c90d461c..7a5020be5986e 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/mime_types.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/utils/mime_types.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { CustomAPIFieldValue } from '../types';
+
 const mimeTypes = {
   'application/iwork-keynote-sffkey': 'Keynote',
   'application/x-iwork-keynote-sffkey': 'Keynote',
@@ -51,4 +53,5 @@ const mimeTypes = {
   'video/quicktime': 'MOV',
 } as { [key: string]: string };
 
-export const mimeType = (type: string) => mimeTypes[type.toLowerCase()] || type;
+export const mimeType = (type: CustomAPIFieldValue) =>
+  mimeTypes[type.toString().toLowerCase()] || type;
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.test.tsx
index b30511f0a6d80..af94707aa3612 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.test.tsx
@@ -58,6 +58,13 @@ describe('AddSourceList', () => {
     expect(wrapper.find(AvailableSourcesList)).toHaveLength(1);
   });
 
+  it('does not render header when loading', () => {
+    setMockValues({ ...mockValues, dataLoading: true });
+    const wrapper = shallow(<AddSourceList />);
+
+    expect(wrapper.prop('pageHeader')).toBe(undefined);
+  });
+
   describe('layout', () => {
     it('renders the default workplace search layout when on an organization view', () => {
       setMockValues({ ...mockValues, isOrganization: true });
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.tsx
index a7a64194cb42f..165586dcc3903 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.tsx
@@ -104,7 +104,9 @@ export const AddSourceList: React.FC = () => {
     <Layout
       pageChrome={[NAV.SOURCES, NAV.ADD_SOURCE]}
       pageViewTelemetry="add_source"
-      pageHeader={{ pageTitle: PAGE_TITLE, description: PAGE_DESCRIPTION }}
+      pageHeader={
+        dataLoading ? undefined : { pageTitle: PAGE_TITLE, description: PAGE_DESCRIPTION }
+      }
       isLoading={dataLoading}
     >
       {!isOrganization && (
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.test.ts
index fcaa847c47f3e..09ba41f81d76a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.test.ts
@@ -20,8 +20,14 @@ jest.mock('../../../../app_logic', () => ({
 }));
 import { AppLogic } from '../../../../app_logic';
 
-import { ADD_GITHUB_PATH, SOURCES_PATH, getSourcesPath } from '../../../../routes';
+import {
+  ADD_GITHUB_PATH,
+  SOURCES_PATH,
+  PERSONAL_SOURCES_PATH,
+  getSourcesPath,
+} from '../../../../routes';
 import { CustomSource } from '../../../../types';
+import { PERSONAL_DASHBOARD_SOURCE_ERROR } from '../../constants';
 import { SourcesLogic } from '../../sources_logic';
 
 import {
@@ -36,7 +42,7 @@ describe('AddSourceLogic', () => {
   const { mount } = new LogicMounter(AddSourceLogic);
   const { http } = mockHttpValues;
   const { navigateToUrl } = mockKibanaValues;
-  const { clearFlashMessages, flashAPIErrors } = mockFlashMessageHelpers;
+  const { clearFlashMessages, flashAPIErrors, setErrorMessage } = mockFlashMessageHelpers;
 
   const defaultValues = {
     addSourceCurrentStep: AddSourceSteps.ConfigIntroStep,
@@ -353,6 +359,33 @@ describe('AddSourceLogic', () => {
         expect(navigateToUrl).toHaveBeenCalledWith(`${ADD_GITHUB_PATH}/configure${queryString}`);
       });
 
+      describe('Github error edge case', () => {
+        const getGithubQueryString = (context: 'organization' | 'account') =>
+          `?error=redirect_uri_mismatch&error_description=The+redirect_uri+MUST+match+the+registered+callback+URL+for+this+application.&error_uri=https%3A%2F%2Fdocs.github.com%2Fapps%2Fmanaging-oauth-apps%2Ftroubleshooting-authorization-request-errors%2F%23redirect-uri-mismatch&state=%7B%22action%22%3A%22create%22%2C%22context%22%3A%22${context}%22%2C%22service_type%22%3A%22github%22%2C%22csrf_token%22%3A%22TOKEN%3D%3D%22%2C%22index_permissions%22%3Afalse%7D`;
+
+        it('handles "organization" redirect and displays error', () => {
+          const githubQueryString = getGithubQueryString('organization');
+          AddSourceLogic.actions.saveSourceParams(githubQueryString);
+
+          expect(navigateToUrl).toHaveBeenCalledWith('/');
+          expect(setErrorMessage).toHaveBeenCalledWith(
+            'The redirect_uri MUST match the registered callback URL for this application.'
+          );
+        });
+
+        it('handles "account" redirect and displays error', () => {
+          const githubQueryString = getGithubQueryString('account');
+          AddSourceLogic.actions.saveSourceParams(githubQueryString);
+
+          expect(navigateToUrl).toHaveBeenCalledWith(PERSONAL_SOURCES_PATH);
+          expect(setErrorMessage).toHaveBeenCalledWith(
+            PERSONAL_DASHBOARD_SOURCE_ERROR(
+              'The redirect_uri MUST match the registered callback URL for this application.'
+            )
+          );
+        });
+      });
+
       it('handles error', async () => {
         http.get.mockReturnValue(Promise.reject('this is an error'));
 
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts
index 0bd37aed81c32..81e27f07293dc 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts
@@ -16,14 +16,21 @@ import {
   flashAPIErrors,
   setSuccessMessage,
   clearFlashMessages,
+  setErrorMessage,
 } from '../../../../../shared/flash_messages';
 import { HttpLogic } from '../../../../../shared/http';
 import { KibanaLogic } from '../../../../../shared/kibana';
 import { parseQueryParams } from '../../../../../shared/query_params';
 import { AppLogic } from '../../../../app_logic';
 import { CUSTOM_SERVICE_TYPE, WORKPLACE_SEARCH_URL_PREFIX } from '../../../../constants';
-import { SOURCES_PATH, ADD_GITHUB_PATH, getSourcesPath } from '../../../../routes';
+import {
+  SOURCES_PATH,
+  ADD_GITHUB_PATH,
+  PERSONAL_SOURCES_PATH,
+  getSourcesPath,
+} from '../../../../routes';
 import { CustomSource } from '../../../../types';
+import { PERSONAL_DASHBOARD_SOURCE_ERROR } from '../../constants';
 import { staticSourceData } from '../../source_data';
 import { SourcesLogic } from '../../sources_logic';
 
@@ -50,6 +57,8 @@ export interface OauthParams {
   state: string;
   session_state: string;
   oauth_verifier?: string;
+  error?: string;
+  error_description?: string;
 }
 
 export interface AddSourceActions {
@@ -501,6 +510,22 @@ export const AddSourceLogic = kea<MakeLogicType<AddSourceValues, AddSourceAction
       const state = JSON.parse(params.state);
       const isOrganization = state.context !== 'account';
 
+      /**
+        There is an extreme edge case where the user is trying to connect Github as source from ent-search,
+        after configuring it in Kibana. When this happens, Github redirects the user from ent-search to Kibana
+        with special error properties in the query params. In this case we need to redirect the user to the
+        app home page and display the error message, and not persist the other query params to the server.
+      */
+      if (params.error_description) {
+        navigateToUrl(isOrganization ? '/' : PERSONAL_SOURCES_PATH);
+        setErrorMessage(
+          isOrganization
+            ? params.error_description
+            : PERSONAL_DASHBOARD_SOURCE_ERROR(params.error_description)
+        );
+        return;
+      }
+
       try {
         const response = await http.get(route, { query });
         const {
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_result_detail_card.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_result_detail_card.tsx
index eef508b2e618f..8b0a72ac23e39 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_result_detail_card.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_result_detail_card.tsx
@@ -62,7 +62,7 @@ export const ExampleResultDetailCard: React.FC = () => {
       <div className="example-result-detail-card__content">
         {detailFields.length > 0 ? (
           detailFields.map(({ fieldName, label }, index) => {
-            const value = result[fieldName] as string;
+            const value = result[fieldName];
             const dateValue = getAsLocalDateTimeString(value);
 
             return (
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_search_result_group.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_search_result_group.tsx
index 549faf1676a54..3ca5b619c0366 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_search_result_group.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_search_result_group.tsx
@@ -117,7 +117,7 @@ export const ExampleSearchResultGroup: React.FC = () => {
                       data-test-subj="MediaTypeField"
                     >
                       <span className="example-search-result__tag-content">
-                        {mimeType(result[mediaTypeField] as string)}
+                        {mimeType(result[mediaTypeField])}
                       </span>
                     </div>
                   )}
@@ -135,8 +135,7 @@ export const ExampleSearchResultGroup: React.FC = () => {
                           by {result[updatedByField]}&nbsp;
                         </span>
                       )}
-                      {getAsLocalDateTimeString(result.last_updated as string) ||
-                        result.last_updated}
+                      {getAsLocalDateTimeString(result.last_updated) || result.last_updated}
                     </span>
                   </div>
                 </div>
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_standout_result.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_standout_result.tsx
index 46b8de6789467..b3ba4c6d50973 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_standout_result.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/example_standout_result.tsx
@@ -109,7 +109,7 @@ export const ExampleStandoutResult: React.FC = () => {
                 data-test-subj="MediaTypeField"
               >
                 <span className="example-search-result__tag-content">
-                  {mimeType(result[mediaTypeField] as string)}
+                  {mimeType(result[mediaTypeField])}
                 </span>
               </div>
             )}
@@ -127,7 +127,7 @@ export const ExampleStandoutResult: React.FC = () => {
                     by {result[updatedByField]}&nbsp;
                   </span>
                 )}
-                {getAsLocalDateTimeString(result.last_updated as string) || result.last_updated}
+                {getAsLocalDateTimeString(result.last_updated) || result.last_updated}
               </span>
             </div>
           </div>
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/subtitle_field.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/subtitle_field.test.tsx
index 76c28ae3d4060..7506c499dff31 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/subtitle_field.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/subtitle_field.test.tsx
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { exampleResult } from '../../../../__mocks__/content_sources.mock';
+
 import React from 'react';
 
 import { shallow } from 'enzyme';
@@ -12,7 +14,11 @@ import { shallow } from 'enzyme';
 import { SubtitleField } from './subtitle_field';
 
 describe('SubtitleField', () => {
-  const result = { foo: 'bar' };
+  const result = {
+    ...exampleResult.exampleDocuments[0],
+    foo: 'bar',
+  };
+
   it('renders', () => {
     const props = {
       result,
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/title_field.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/title_field.test.tsx
index 2ed4aa0b0fad1..e5681bc7e8619 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/title_field.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/title_field.test.tsx
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { exampleResult } from '../../../../__mocks__/content_sources.mock';
+
 import React from 'react';
 
 import { shallow } from 'enzyme';
@@ -12,7 +14,10 @@ import { shallow } from 'enzyme';
 import { TitleField } from './title_field';
 
 describe('TitleField', () => {
-  const result = { foo: 'bar' };
+  const result = {
+    ...exampleResult.exampleDocuments[0],
+    foo: 'bar',
+  };
   it('renders', () => {
     const props = {
       result,
@@ -26,7 +31,10 @@ describe('TitleField', () => {
 
   it('handles title when array', () => {
     const props = {
-      result: { foo: ['baz', 'bar'] },
+      result: {
+        ...exampleResult.exampleDocuments[0],
+        foo: ['baz', 'bar'],
+      },
       titleField: 'foo',
       titleFieldHover: false,
     };
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.tsx
index a0e3c28f20eb0..a97cc85cb822a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.tsx
@@ -137,7 +137,7 @@ export const SourceContent: React.FC = () => {
             <TruncatedContent tooltipType="title" content={url.toString()} length={MAX_LENGTH} />
           )}
           {urlFieldIsLinkable && (
-            <EuiLink target="_blank" href={url}>
+            <EuiLink target="_blank" href={url.toString()}>
               <TruncatedContent tooltipType="title" content={url.toString()} length={MAX_LENGTH} />
             </EuiLink>
           )}
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/constants.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/constants.ts
index 8e5123dbc7cce..d57afc6699c1a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/constants.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/constants.ts
@@ -470,3 +470,10 @@ export const PRIVATE_DASHBOARD_READ_ONLY_MODE_WARNING = i18n.translate(
       'Workplace Search is currently available for search only, due to regular maintenance. Contact your system administrator for more information.',
   }
 );
+
+export const PERSONAL_DASHBOARD_SOURCE_ERROR = (error: string) =>
+  i18n.translate('xpack.enterpriseSearch.workplaceSearch.personalDashboardSourceError', {
+    defaultMessage:
+      'Could not connect the source, reach out to your admin for help. Error message: {error}',
+    values: { error },
+  });
diff --git a/x-pack/plugins/file_upload/server/plugin.ts b/x-pack/plugins/file_upload/server/plugin.ts
index c729afec92f94..bd5eebe372a75 100644
--- a/x-pack/plugins/file_upload/server/plugin.ts
+++ b/x-pack/plugins/file_upload/server/plugin.ts
@@ -21,7 +21,7 @@ export class FileUploadPlugin implements Plugin {
     this._logger = initializerContext.logger.get();
   }
 
-  async setup(coreSetup: CoreSetup<StartDeps, unknown>, plugins: SetupDeps) {
+  setup(coreSetup: CoreSetup<StartDeps, unknown>, plugins: SetupDeps) {
     fileUploadRoutes(coreSetup, this._logger);
 
     setupCapabilities(coreSetup);
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx
index 47174561230ba..18f6a8b565ab9 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { memo, useState, useEffect } from 'react';
+import React, { memo, useState, useEffect, useCallback } from 'react';
 import { EuiPopover, EuiFilterButton, EuiFilterSelectItem } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
@@ -22,6 +22,9 @@ export const DatasetFilter: React.FunctionComponent<{
   const [isLoading, setIsLoading] = useState<boolean>(false);
   const [datasetValues, setDatasetValues] = useState<string[]>([AGENT_DATASET]);
 
+  const togglePopover = useCallback(() => setIsOpen((prevIsOpen) => !prevIsOpen), [setIsOpen]);
+  const closePopover = useCallback(() => setIsOpen(false), [setIsOpen]);
+
   useEffect(() => {
     const fetchValues = async () => {
       setIsLoading(true);
@@ -48,7 +51,7 @@ export const DatasetFilter: React.FunctionComponent<{
       button={
         <EuiFilterButton
           iconType="arrowDown"
-          onClick={() => setIsOpen(true)}
+          onClick={togglePopover}
           isSelected={isOpen}
           isLoading={isLoading}
           numFilters={datasetValues.length}
@@ -61,7 +64,7 @@ export const DatasetFilter: React.FunctionComponent<{
         </EuiFilterButton>
       }
       isOpen={isOpen}
-      closePopover={() => setIsOpen(false)}
+      closePopover={closePopover}
       panelPaddingSize="none"
     >
       {datasetValues.map((dataset) => (
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx
index 120f21fe68207..b423f3a8a57b3 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { memo, useState, useEffect } from 'react';
+import React, { memo, useState, useEffect, useCallback } from 'react';
 import { EuiPopover, EuiFilterButton, EuiFilterSelectItem } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
@@ -33,6 +33,9 @@ export const LogLevelFilter: React.FunctionComponent<{
   const [isLoading, setIsLoading] = useState<boolean>(false);
   const [levelValues, setLevelValues] = useState<string[]>([]);
 
+  const togglePopover = useCallback(() => setIsOpen((prevIsOpen) => !prevIsOpen), []);
+  const closePopover = useCallback(() => setIsOpen(false), []);
+
   useEffect(() => {
     const fetchValues = async () => {
       setIsLoading(true);
@@ -59,7 +62,7 @@ export const LogLevelFilter: React.FunctionComponent<{
       button={
         <EuiFilterButton
           iconType="arrowDown"
-          onClick={() => setIsOpen(true)}
+          onClick={togglePopover}
           isSelected={isOpen}
           isLoading={isLoading}
           numFilters={levelValues.length}
@@ -72,7 +75,7 @@ export const LogLevelFilter: React.FunctionComponent<{
         </EuiFilterButton>
       }
       isOpen={isOpen}
-      closePopover={() => setIsOpen(false)}
+      closePopover={closePopover}
       panelPaddingSize="none"
     >
       {levelValues.map((level) => (
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/components/fleet_server_cloud_instructions.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/components/fleet_server_cloud_instructions.tsx
index 3b9d297f37df2..88590ce3ce504 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/components/fleet_server_cloud_instructions.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/components/fleet_server_cloud_instructions.tsx
@@ -8,7 +8,6 @@
 import React, { useEffect } from 'react';
 import {
   EuiButton,
-  EuiPanel,
   EuiLink,
   EuiEmptyPrompt,
   EuiFlexItem,
@@ -39,62 +38,54 @@ export const CloudInstructions: React.FC<{ deploymentUrl: string }> = ({ deploym
 
   return (
     <>
-      <EuiPanel
-        paddingSize="none"
-        grow={false}
-        hasShadow={false}
-        hasBorder={true}
-        className="eui-textCenter"
-      >
-        <EuiEmptyPrompt
-          title={
-            <h2>
-              <FormattedMessage
-                id="xpack.fleet.fleetServerSetup.cloudSetupTitle"
-                defaultMessage="Enable APM & Fleet"
-              />
-            </h2>
-          }
-          body={
+      <EuiEmptyPrompt
+        title={
+          <h2>
             <FormattedMessage
-              id="xpack.fleet.fleetServerSetup.cloudSetupText"
-              defaultMessage="A Fleet Server is required before you can enroll agents with Fleet. You can add one to your deployment by enabling APM & Fleet. For more information see the {link}"
-              values={{
-                link: (
-                  <EuiLink
-                    href={docLinks.links.fleet.fleetServerAddFleetServer}
-                    target="_blank"
-                    external
-                  >
-                    <FormattedMessage
-                      id="xpack.fleet.settings.userGuideLink"
-                      defaultMessage="Fleet User Guide"
-                    />
-                  </EuiLink>
-                ),
-              }}
+              id="xpack.fleet.fleetServerSetup.cloudSetupTitle"
+              defaultMessage="Enable APM & Fleet"
             />
-          }
-          actions={
-            <>
-              <EuiButton
-                iconSide="right"
-                iconType="popout"
-                fill
-                isLoading={false}
-                type="submit"
-                href={`${deploymentUrl}/edit`}
-                target="_blank"
-              >
-                <FormattedMessage
-                  id="xpack.fleet.fleetServerSetup.cloudDeploymentLink"
-                  defaultMessage="Edit deployment"
-                />
-              </EuiButton>
-            </>
-          }
-        />
-      </EuiPanel>
+          </h2>
+        }
+        body={
+          <FormattedMessage
+            id="xpack.fleet.fleetServerSetup.cloudSetupText"
+            defaultMessage="A Fleet Server is required before you can enroll agents with Fleet. You can add one to your deployment by enabling APM & Fleet. For more information see the {link}"
+            values={{
+              link: (
+                <EuiLink
+                  href={docLinks.links.fleet.fleetServerAddFleetServer}
+                  target="_blank"
+                  external
+                >
+                  <FormattedMessage
+                    id="xpack.fleet.settings.userGuideLink"
+                    defaultMessage="Fleet User Guide"
+                  />
+                </EuiLink>
+              ),
+            }}
+          />
+        }
+        actions={
+          <>
+            <EuiButton
+              iconSide="right"
+              iconType="popout"
+              fill
+              isLoading={false}
+              type="submit"
+              href={`${deploymentUrl}/edit`}
+              target="_blank"
+            >
+              <FormattedMessage
+                id="xpack.fleet.fleetServerSetup.cloudDeploymentLink"
+                defaultMessage="Edit deployment"
+              />
+            </EuiButton>
+          </>
+        }
+      />
       <EuiSpacer size="m" />
       <EuiFlexItem>
         <EuiFlexGroup justifyContent="center" gutterSize="s">
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/components/fleet_server_on_prem_instructions.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/components/fleet_server_on_prem_instructions.tsx
index 0fc3821d2e3f7..1d43f90b80def 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/components/fleet_server_on_prem_instructions.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/components/fleet_server_on_prem_instructions.tsx
@@ -10,7 +10,6 @@ import {
   EuiButton,
   EuiFlexGroup,
   EuiFlexItem,
-  EuiPanel,
   EuiSpacer,
   EuiText,
   EuiLink,
@@ -737,9 +736,8 @@ export const OnPremInstructions: React.FC = () => {
   }, [notifications.toasts]);
 
   return (
-    <EuiPanel paddingSize="l" grow={false} hasShadow={false} hasBorder={true}>
-      <EuiSpacer size="s" />
-      <EuiText className="eui-textCenter">
+    <>
+      <EuiText>
         <h2>
           <FormattedMessage
             id="xpack.fleet.fleetServerSetup.setupTitle"
@@ -788,6 +786,6 @@ export const OnPremInstructions: React.FC = () => {
             : CompleteStep(),
         ]}
       />
-    </EuiPanel>
+    </>
   );
 };
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/es_requirements_page.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/es_requirements_page.tsx
index b4e6f1007536f..9c5ec12645c1d 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/es_requirements_page.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/es_requirements_page.tsx
@@ -72,7 +72,8 @@ export const MissingESRequirementsPage: React.FunctionComponent<{
           <EuiSpacer size="m" />
           <FormattedMessage
             id="xpack.fleet.setupPage.missingRequirementsElasticsearchTitle"
-            defaultMessage="In your Elasticsearch policy, enable:"
+            defaultMessage="In your Elasticsearch configuration ({esConfigFile}), enable:"
+            values={{ esConfigFile: <EuiCode>elasticsearch.yml</EuiCode> }}
           />
           <EuiSpacer size="l" />
           <RequirementItem isMissing={false}>
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/fleet_server_requirement_page.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/fleet_server_requirement_page.tsx
index c79263093abeb..28332961f37a2 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/fleet_server_requirement_page.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/fleet_server_requirement_page.tsx
@@ -21,7 +21,6 @@ const FlexItemWithMinWidth = styled(EuiFlexItem)`
 const ContentWrapper = styled(EuiFlexGroup)`
   height: 100%;
   margin: 0 auto;
-  max-width: 800px;
 `;
 
 export const FleetServerRequirementPage = () => {
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx
index 0b13fcc9c72be..fae88fcda4bc8 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx
@@ -137,7 +137,7 @@ export const AgentUnenrollAgentModal: React.FunctionComponent<Props> = ({
               <p>
                 <FormattedMessage
                   id="xpack.fleet.unenrollAgents.unenrollFleetServerDescription"
-                  defaultMessage="Unenrolling this agent will disconnect a Fleet Server and prevent agents from sendind data if no other Fleet Servers exist."
+                  defaultMessage="Unenrolling this agent will disconnect a Fleet Server and prevent agents from sending data if no other Fleet Servers exist."
                 />
               </p>
             </EuiCallOut>
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/markdown_renderers.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/markdown_renderers.tsx
index cbc2f7b5f7888..2cbdfe3671c4e 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/markdown_renderers.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/markdown_renderers.tsx
@@ -24,6 +24,12 @@ const REL_NOFOLLOW = 'nofollow';
 /** prevents the browser from sending the current address as referrer via the Referer HTTP header */
 const REL_NOREFERRER = 'noreferrer';
 
+// Maps deprecated code block languages to supported ones in prism.js
+const CODE_LANGUAGE_OVERRIDES: Record<string, string> = {
+  $json: 'json',
+  $yml: 'yml',
+};
+
 export const markdownRenderers = {
   root: ({ children }: { children: React.ReactNode[] }) => (
     <EuiText grow={true}>{children}</EuiText>
@@ -60,8 +66,17 @@ export const markdownRenderers = {
     </EuiLink>
   ),
   code: ({ language, value }: { language: string; value: string }) => {
-    // Old packages are using `$json`, which is not valid any more with the move to prism.js
-    const parsedLang = language === '$json' ? 'json' : language;
+    let parsedLang = language;
+
+    // Some integrations export code block content that includes language tags that have since
+    // been removed or deprecated in `prism.js`, the upstream depedency that handles syntax highlighting
+    // in EuiCodeBlock components
+    const languageOverride = CODE_LANGUAGE_OVERRIDES[language];
+
+    if (languageOverride) {
+      parsedLang = languageOverride;
+    }
+
     return (
       <EuiCodeBlock language={parsedLang} isCopyable>
         {value}
diff --git a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/agent_enrollment_flyout.test.mocks.ts b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/agent_enrollment_flyout.test.mocks.ts
index d2e7c4089e88b..5c292187982dc 100644
--- a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/agent_enrollment_flyout.test.mocks.ts
+++ b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/agent_enrollment_flyout.test.mocks.ts
@@ -11,6 +11,7 @@ jest.mock('../../hooks/use_request', () => {
     ...module,
     useGetSettings: jest.fn(),
     sendGetFleetStatus: jest.fn(),
+    sendGetOneAgentPolicy: jest.fn(),
   };
 });
 
diff --git a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/agent_enrollment_flyout.test.tsx b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/agent_enrollment_flyout.test.tsx
index f68b1b878c51c..18296134ee1a7 100644
--- a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/agent_enrollment_flyout.test.tsx
+++ b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/agent_enrollment_flyout.test.tsx
@@ -16,7 +16,7 @@ import { coreMock } from 'src/core/public/mocks';
 import { KibanaContextProvider } from '../../../../../../src/plugins/kibana_react/public';
 
 import type { AgentPolicy } from '../../../common';
-import { useGetSettings, sendGetFleetStatus } from '../../hooks/use_request';
+import { useGetSettings, sendGetFleetStatus, sendGetOneAgentPolicy } from '../../hooks/use_request';
 import { FleetStatusProvider, ConfigContext } from '../../hooks';
 
 import { useFleetServerInstructions } from '../../applications/fleet/sections/agents/agent_requirements_page/components';
@@ -79,6 +79,10 @@ describe('<AgentEnrollmentFlyout />', () => {
       data: { isReady: true },
     });
 
+    (sendGetOneAgentPolicy as jest.Mock).mockResolvedValue({
+      data: { item: { package_policies: [] } },
+    });
+
     (useFleetServerInstructions as jest.Mock).mockReturnValue({
       serviceToken: 'test',
       getServiceToken: jest.fn(),
diff --git a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/index.tsx b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/index.tsx
index 9b82b2a80b5e1..87911e5d6c2c7 100644
--- a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/index.tsx
+++ b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/index.tsx
@@ -22,7 +22,9 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 
-import { useGetSettings, useUrlModal } from '../../hooks';
+import { useGetSettings, useUrlModal, sendGetOneAgentPolicy, useFleetStatus } from '../../hooks';
+import { FLEET_SERVER_PACKAGE } from '../../constants';
+import type { PackagePolicy } from '../../types';
 
 import { ManagedInstructions } from './managed_instructions';
 import { StandaloneInstructions } from './standalone_instructions';
@@ -63,6 +65,30 @@ export const AgentEnrollmentFlyout: React.FunctionComponent<Props> = ({
     }
   }, [modal, lastModal, settings]);
 
+  const fleetStatus = useFleetStatus();
+  const [policyId, setSelectedPolicyId] = useState(agentPolicy?.id);
+  const [isFleetServerPolicySelected, setIsFleetServerPolicySelected] = useState<boolean>(false);
+
+  useEffect(() => {
+    async function checkPolicyIsFleetServer() {
+      if (policyId && setIsFleetServerPolicySelected) {
+        const agentPolicyRequest = await sendGetOneAgentPolicy(policyId);
+        if (
+          agentPolicyRequest.data?.item &&
+          (agentPolicyRequest.data.item.package_policies as PackagePolicy[]).some(
+            (packagePolicy) => packagePolicy.package?.name === FLEET_SERVER_PACKAGE
+          )
+        ) {
+          setIsFleetServerPolicySelected(true);
+        } else {
+          setIsFleetServerPolicySelected(false);
+        }
+      }
+    }
+
+    checkPolicyIsFleetServer();
+  }, [policyId]);
+
   const isLoadingInitialRequest = settings.isLoading && settings.isInitialRequest;
 
   return (
@@ -110,16 +136,23 @@ export const AgentEnrollmentFlyout: React.FunctionComponent<Props> = ({
 
       <EuiFlyoutBody
         banner={
-          !isLoadingInitialRequest && fleetServerHosts.length === 0 && mode === 'managed' ? (
+          fleetStatus.isReady &&
+          !isFleetServerPolicySelected &&
+          !isLoadingInitialRequest &&
+          fleetServerHosts.length === 0 &&
+          mode === 'managed' ? (
             <MissingFleetServerHostCallout />
           ) : undefined
         }
       >
-        {fleetServerHosts.length === 0 && mode === 'managed' ? null : mode === 'managed' ? (
+        {mode === 'managed' ? (
           <ManagedInstructions
+            settings={settings.data?.item}
+            setSelectedPolicyId={setSelectedPolicyId}
             agentPolicy={agentPolicy}
             agentPolicies={agentPolicies}
             viewDataStep={viewDataStep}
+            isFleetServerPolicySelected={isFleetServerPolicySelected}
           />
         ) : (
           <StandaloneInstructions agentPolicy={agentPolicy} agentPolicies={agentPolicies} />
diff --git a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/managed_instructions.tsx b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/managed_instructions.tsx
index 61f86335cd7f9..8054c48fbbaa8 100644
--- a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/managed_instructions.tsx
+++ b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/managed_instructions.tsx
@@ -11,7 +11,7 @@ import type { EuiContainedStepProps } from '@elastic/eui/src/components/steps/st
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
-import { useGetOneEnrollmentAPIKey, useGetSettings, useLink, useFleetStatus } from '../../hooks';
+import { useGetOneEnrollmentAPIKey, useLink, useFleetStatus } from '../../hooks';
 
 import { ManualInstructions } from '../../components/enrollment_instructions';
 import {
@@ -56,14 +56,19 @@ const FleetServerMissingRequirements = () => {
 };
 
 export const ManagedInstructions = React.memo<Props>(
-  ({ agentPolicy, agentPolicies, viewDataStep }) => {
+  ({
+    agentPolicy,
+    agentPolicies,
+    viewDataStep,
+    setSelectedPolicyId,
+    isFleetServerPolicySelected,
+    settings,
+  }) => {
     const fleetStatus = useFleetStatus();
 
     const [selectedApiKeyId, setSelectedAPIKeyId] = useState<string | undefined>();
-    const [isFleetServerPolicySelected, setIsFleetServerPolicySelected] = useState<boolean>(false);
 
     const apiKey = useGetOneEnrollmentAPIKey(selectedApiKeyId);
-    const settings = useGetSettings();
     const fleetServerInstructions = useFleetServerInstructions(apiKey?.data?.item?.policy_id);
 
     const fleetServerSteps = useMemo(() => {
@@ -88,7 +93,7 @@ export const ManagedInstructions = React.memo<Props>(
     }, [fleetServerInstructions]);
 
     const steps = useMemo(() => {
-      const fleetServerHosts = settings.data?.item?.fleet_server_hosts || [];
+      const fleetServerHosts = settings?.fleet_server_hosts || [];
       const baseSteps: EuiContainedStepProps[] = [
         DownloadStep(),
         !agentPolicy
@@ -96,7 +101,7 @@ export const ManagedInstructions = React.memo<Props>(
               agentPolicies,
               selectedApiKeyId,
               setSelectedAPIKeyId,
-              setIsFleetServerPolicySelected,
+              setSelectedPolicyId,
             })
           : AgentEnrollmentKeySelectionStep({ agentPolicy, selectedApiKeyId, setSelectedAPIKeyId }),
       ];
@@ -121,30 +126,39 @@ export const ManagedInstructions = React.memo<Props>(
     }, [
       agentPolicy,
       selectedApiKeyId,
+      setSelectedPolicyId,
       setSelectedAPIKeyId,
       agentPolicies,
       apiKey.data,
       fleetServerSteps,
       isFleetServerPolicySelected,
-      settings.data?.item?.fleet_server_hosts,
+      settings?.fleet_server_hosts,
       viewDataStep,
     ]);
 
+    if (fleetStatus.isReady && settings?.fleet_server_hosts.length === 0) {
+      return null;
+    }
+
+    if (fleetStatus.isReady) {
+      return (
+        <>
+          <EuiText>
+            <FormattedMessage
+              id="xpack.fleet.agentEnrollment.managedDescription"
+              defaultMessage="Enroll an Elastic Agent in Fleet to automatically deploy updates and centrally manage the agent."
+            />
+          </EuiText>
+          <EuiSpacer size="l" />
+          <EuiSteps steps={steps} />
+        </>
+      );
+    }
+
     return (
       <>
-        {fleetStatus.isReady ? (
-          <>
-            <EuiText>
-              <FormattedMessage
-                id="xpack.fleet.agentEnrollment.managedDescription"
-                defaultMessage="Enroll an Elastic Agent in Fleet to automatically deploy updates and centrally manage the agent."
-              />
-            </EuiText>
-            <EuiSpacer size="l" />
-            <EuiSteps steps={steps} />
-          </>
-        ) : fleetStatus.missingRequirements?.length === 1 &&
-          fleetStatus.missingRequirements[0] === 'fleet_server' ? (
+        {fleetStatus.missingRequirements?.length === 1 &&
+        fleetStatus.missingRequirements[0] === 'fleet_server' ? (
           <FleetServerMissingRequirements />
         ) : (
           <DefaultMissingRequirements />
diff --git a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps.tsx b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps.tsx
index 6cffa39628d92..1cfdc45fb7dba 100644
--- a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps.tsx
+++ b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps.tsx
@@ -11,9 +11,8 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import semver from 'semver';
 
-import type { AgentPolicy, PackagePolicy } from '../../types';
-import { sendGetOneAgentPolicy, useKibanaVersion } from '../../hooks';
-import { FLEET_SERVER_PACKAGE } from '../../constants';
+import type { AgentPolicy } from '../../types';
+import { useKibanaVersion } from '../../hooks';
 
 import { EnrollmentStepAgentPolicy } from './agent_policy_selection';
 import { AdvancedAgentAuthenticationSettings } from './advanced_agent_authentication_settings';
@@ -69,13 +68,11 @@ export const AgentPolicySelectionStep = ({
   selectedApiKeyId,
   setSelectedAPIKeyId,
   excludeFleetServer,
-  setIsFleetServerPolicySelected,
 }: {
   agentPolicies?: AgentPolicy[];
   setSelectedPolicyId?: (policyId?: string) => void;
   selectedApiKeyId?: string;
   setSelectedAPIKeyId?: (key?: string) => void;
-  setIsFleetServerPolicySelected?: (selected: boolean) => void;
   excludeFleetServer?: boolean;
 }) => {
   const regularAgentPolicies = useMemo(() => {
@@ -92,21 +89,8 @@ export const AgentPolicySelectionStep = ({
       if (setSelectedPolicyId) {
         setSelectedPolicyId(policyId);
       }
-      if (policyId && setIsFleetServerPolicySelected) {
-        const agentPolicyRequest = await sendGetOneAgentPolicy(policyId);
-        if (
-          agentPolicyRequest.data?.item &&
-          (agentPolicyRequest.data.item.package_policies as PackagePolicy[]).some(
-            (packagePolicy) => packagePolicy.package?.name === FLEET_SERVER_PACKAGE
-          )
-        ) {
-          setIsFleetServerPolicySelected(true);
-        } else {
-          setIsFleetServerPolicySelected(false);
-        }
-      }
     },
-    [setIsFleetServerPolicySelected, setSelectedPolicyId]
+    [setSelectedPolicyId]
   );
 
   return {
diff --git a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/types.ts b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/types.ts
index 9ee514c634655..282a5b243caed 100644
--- a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/types.ts
+++ b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/types.ts
@@ -7,7 +7,7 @@
 
 import type { EuiStepProps } from '@elastic/eui';
 
-import type { AgentPolicy } from '../../types';
+import type { AgentPolicy, Settings } from '../../types';
 
 export interface BaseProps {
   /**
@@ -27,4 +27,10 @@ export interface BaseProps {
    * in some way. This is an area for consumers to render a button and text explaining how data can be viewed.
    */
   viewDataStep?: EuiStepProps;
+
+  settings?: Settings;
+
+  setSelectedPolicyId?: (policyId?: string) => void;
+
+  isFleetServerPolicySelected?: boolean;
 }
diff --git a/x-pack/plugins/fleet/public/types/index.ts b/x-pack/plugins/fleet/public/types/index.ts
index f21552d68e77b..c91ec42d3e527 100644
--- a/x-pack/plugins/fleet/public/types/index.ts
+++ b/x-pack/plugins/fleet/public/types/index.ts
@@ -27,6 +27,7 @@ export {
   PackagePolicyPackage,
   Output,
   DataStream,
+  Settings,
   // API schema - misc setup, status
   GetFleetStatusResponse,
   // API schemas - Agent policy
diff --git a/x-pack/plugins/console_extensions/server/lib/spec_definitions/js/index.ts b/x-pack/plugins/infra/common/alerting/logs/log_threshold/index.ts
similarity index 82%
rename from x-pack/plugins/console_extensions/server/lib/spec_definitions/js/index.ts
rename to x-pack/plugins/infra/common/alerting/logs/log_threshold/index.ts
index ef5a474df32d5..3f4cbc82c405c 100644
--- a/x-pack/plugins/console_extensions/server/lib/spec_definitions/js/index.ts
+++ b/x-pack/plugins/infra/common/alerting/logs/log_threshold/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { processors } from './ingest';
+export * from './rule_data';
+export * from './types';
diff --git a/x-pack/plugins/infra/common/alerting/logs/log_threshold/rule_data.ts b/x-pack/plugins/infra/common/alerting/logs/log_threshold/rule_data.ts
new file mode 100644
index 0000000000000..dd60739289756
--- /dev/null
+++ b/x-pack/plugins/infra/common/alerting/logs/log_threshold/rule_data.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { jsonRt } from '@kbn/io-ts-utils/target/json_rt';
+import * as rt from 'io-ts';
+import { alertParamsRT as logThresholdAlertParamsRT } from './types';
+
+export const serializedParamsKey = 'serialized_params';
+
+export const logThresholdRuleDataNamespace = 'log_threshold_rule';
+export const logThresholdRuleDataSerializedParamsKey = `${logThresholdRuleDataNamespace}.${serializedParamsKey}` as const;
+
+export const logThresholdRuleDataRT = rt.type({
+  [logThresholdRuleDataSerializedParamsKey]: rt.array(jsonRt.pipe(logThresholdAlertParamsRT)),
+});
diff --git a/x-pack/plugins/infra/common/constants.ts b/x-pack/plugins/infra/common/constants.ts
index 9362293fce82f..1c3aa550f2f62 100644
--- a/x-pack/plugins/infra/common/constants.ts
+++ b/x-pack/plugins/infra/common/constants.ts
@@ -11,3 +11,8 @@ export const LOGS_INDEX_PATTERN = 'logs-*,filebeat-*,kibana_sample_data_logs*';
 export const TIMESTAMP_FIELD = '@timestamp';
 export const METRICS_APP = 'metrics';
 export const LOGS_APP = 'logs';
+
+export const METRICS_FEATURE_ID = 'infrastructure';
+export const LOGS_FEATURE_ID = 'logs';
+
+export type InfraFeatureId = typeof METRICS_FEATURE_ID | typeof LOGS_FEATURE_ID;
diff --git a/x-pack/plugins/infra/kibana.json b/x-pack/plugins/infra/kibana.json
index ec1b11c90f7a3..981036114282e 100644
--- a/x-pack/plugins/infra/kibana.json
+++ b/x-pack/plugins/infra/kibana.json
@@ -12,7 +12,8 @@
     "visTypeTimeseries",
     "alerting",
     "triggersActionsUi",
-    "observability"
+    "observability",
+    "ruleRegistry"
   ],
   "optionalPlugins": ["ml", "home", "embeddable"],
   "server": true,
diff --git a/x-pack/plugins/infra/public/alerting/common/components/metrics_alert_dropdown.tsx b/x-pack/plugins/infra/public/alerting/common/components/metrics_alert_dropdown.tsx
index cf84ea40d64cc..1f2998db4b43f 100644
--- a/x-pack/plugins/infra/public/alerting/common/components/metrics_alert_dropdown.tsx
+++ b/x-pack/plugins/infra/public/alerting/common/components/metrics_alert_dropdown.tsx
@@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n';
 import React, { useState, useCallback, useMemo } from 'react';
 import {
   EuiPopover,
-  EuiButtonEmpty,
+  EuiHeaderLink,
   EuiContextMenu,
   EuiContextMenuPanelDescriptor,
 } from '@elastic/eui';
@@ -134,8 +134,7 @@ export const MetricsAlertDropdown = () => {
         panelPaddingSize="none"
         anchorPosition="downLeft"
         button={
-          <EuiButtonEmpty
-            size="xs"
+          <EuiHeaderLink
             color="text"
             iconSide={'right'}
             iconType={'arrowDown'}
@@ -145,7 +144,7 @@ export const MetricsAlertDropdown = () => {
               id="xpack.infra.alerting.alertsButton"
               defaultMessage="Alerts and rules"
             />
-          </EuiButtonEmpty>
+          </EuiHeaderLink>
         }
         isOpen={popoverOpen}
         closePopover={closePopover}
diff --git a/x-pack/plugins/infra/public/alerting/log_threshold/components/alert_dropdown.tsx b/x-pack/plugins/infra/public/alerting/log_threshold/components/alert_dropdown.tsx
index f3481cab73360..302de15db9f5a 100644
--- a/x-pack/plugins/infra/public/alerting/log_threshold/components/alert_dropdown.tsx
+++ b/x-pack/plugins/infra/public/alerting/log_threshold/components/alert_dropdown.tsx
@@ -7,7 +7,7 @@
 
 import React, { useState, useCallback, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiPopover, EuiButtonEmpty, EuiContextMenuItem, EuiContextMenuPanel } from '@elastic/eui';
+import { EuiPopover, EuiContextMenuItem, EuiContextMenuPanel, EuiHeaderLink } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { AlertFlyout } from './alert_flyout';
 import { useLinkProps } from '../../../hooks/use_link_props';
@@ -83,8 +83,7 @@ export const AlertDropdown = () => {
       <EuiPopover
         panelPaddingSize="none"
         button={
-          <EuiButtonEmpty
-            size="xs"
+          <EuiHeaderLink
             color="text"
             iconSide={'right'}
             iconType={'arrowDown'}
@@ -94,7 +93,7 @@ export const AlertDropdown = () => {
               id="xpack.infra.alerting.logs.alertsButton"
               defaultMessage="Alerts and rules"
             />
-          </EuiButtonEmpty>
+          </EuiHeaderLink>
         }
         isOpen={popoverOpen}
         closePopover={closePopover}
diff --git a/x-pack/plugins/infra/public/alerting/log_threshold/index.ts b/x-pack/plugins/infra/public/alerting/log_threshold/index.ts
index 5bd64de2f3ac2..0f2746b446927 100644
--- a/x-pack/plugins/infra/public/alerting/log_threshold/index.ts
+++ b/x-pack/plugins/infra/public/alerting/log_threshold/index.ts
@@ -5,5 +5,5 @@
  * 2.0.
  */
 
-export { getAlertType } from './log_threshold_alert_type';
+export * from './log_threshold_alert_type';
 export { AlertDropdown } from './components/alert_dropdown';
diff --git a/x-pack/plugins/infra/public/alerting/log_threshold/log_threshold_alert_type.ts b/x-pack/plugins/infra/public/alerting/log_threshold/log_threshold_alert_type.ts
index 2c8a6a7ea286a..44097fd005cc7 100644
--- a/x-pack/plugins/infra/public/alerting/log_threshold/log_threshold_alert_type.ts
+++ b/x-pack/plugins/infra/public/alerting/log_threshold/log_threshold_alert_type.ts
@@ -7,14 +7,15 @@
 
 import { i18n } from '@kbn/i18n';
 import React from 'react';
-import { AlertTypeModel } from '../../../../triggers_actions_ui/public';
+import { ObservabilityRuleTypeModel } from '../../../../observability/public';
 import {
   LOG_DOCUMENT_COUNT_ALERT_TYPE_ID,
   PartialAlertParams,
 } from '../../../common/alerting/logs/log_threshold/types';
+import { formatReason } from './rule_data_formatters';
 import { validateExpression } from './validation';
 
-export function getAlertType(): AlertTypeModel<PartialAlertParams> {
+export function createLogThresholdAlertType(): ObservabilityRuleTypeModel<PartialAlertParams> {
   return {
     id: LOG_DOCUMENT_COUNT_ALERT_TYPE_ID,
     description: i18n.translate('xpack.infra.logs.alertFlyout.alertDescription', {
@@ -33,5 +34,6 @@ export function getAlertType(): AlertTypeModel<PartialAlertParams> {
       }
     ),
     requiresAppContext: false,
+    format: formatReason,
   };
 }
diff --git a/x-pack/plugins/infra/public/alerting/log_threshold/rule_data_formatters.ts b/x-pack/plugins/infra/public/alerting/log_threshold/rule_data_formatters.ts
new file mode 100644
index 0000000000000..6ca081ffbc5ef
--- /dev/null
+++ b/x-pack/plugins/infra/public/alerting/log_threshold/rule_data_formatters.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+import {
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+  ALERT_ID,
+  ALERT_START,
+} from '@kbn/rule-data-utils';
+import { modifyUrl } from '@kbn/std';
+import { fold } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/function';
+import { ObservabilityRuleTypeFormatter } from '../../../../observability/public';
+import {
+  ComparatorToi18nMap,
+  logThresholdRuleDataRT,
+  logThresholdRuleDataSerializedParamsKey,
+  ratioAlertParamsRT,
+} from '../../../common/alerting/logs/log_threshold';
+
+export const formatReason: ObservabilityRuleTypeFormatter = ({ fields }) => {
+  const reason = pipe(
+    logThresholdRuleDataRT.decode(fields),
+    fold(
+      () =>
+        i18n.translate('xpack.infra.logs.alerting.threshold.unknownReasonDescription', {
+          defaultMessage: 'unknown reason',
+        }),
+      (logThresholdRuleData) => {
+        const params = logThresholdRuleData[logThresholdRuleDataSerializedParamsKey][0];
+
+        const actualCount = fields[ALERT_EVALUATION_VALUE];
+        const groupName = fields[ALERT_ID];
+        const isGrouped = (params.groupBy?.length ?? 0) > 0;
+        const isRatio = ratioAlertParamsRT.is(params);
+        const thresholdCount = fields[ALERT_EVALUATION_THRESHOLD];
+        const translatedComparator = ComparatorToi18nMap[params.count.comparator];
+
+        if (isRatio) {
+          return i18n.translate('xpack.infra.logs.alerting.threshold.ratioAlertReasonDescription', {
+            defaultMessage:
+              '{isGrouped, select, true{{groupName}: } false{}}The log entries ratio is {actualCount} ({translatedComparator} {thresholdCount}).',
+            values: {
+              actualCount,
+              translatedComparator,
+              groupName,
+              isGrouped,
+              thresholdCount,
+            },
+          });
+        } else {
+          return i18n.translate('xpack.infra.logs.alerting.threshold.countAlertReasonDescription', {
+            defaultMessage:
+              '{isGrouped, select, true{{groupName}: } false{}}{actualCount, plural, one {{actualCount} log entry} other {{actualCount} log entries} } ({translatedComparator} {thresholdCount}) match the configured conditions.',
+            values: {
+              actualCount,
+              translatedComparator,
+              groupName,
+              isGrouped,
+              thresholdCount,
+            },
+          });
+        }
+      }
+    )
+  );
+
+  const alertStartDate = fields[ALERT_START];
+  const timestamp = alertStartDate != null ? new Date(alertStartDate).valueOf() : null;
+  const link = modifyUrl('/app/logs/link-to/default/logs', ({ query, ...otherUrlParts }) => ({
+    ...otherUrlParts,
+    query: {
+      ...query,
+      ...(timestamp != null ? { time: `${timestamp}` } : {}),
+    },
+  }));
+
+  return {
+    reason,
+    link, // TODO: refactor to URL generators
+  };
+};
diff --git a/x-pack/plugins/infra/public/pages/logs/page_content.tsx b/x-pack/plugins/infra/public/pages/logs/page_content.tsx
index 8175a95f6a064..d8b5667e60d04 100644
--- a/x-pack/plugins/infra/public/pages/logs/page_content.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/page_content.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { EuiFlexGroup, EuiFlexItem, EuiButtonEmpty } from '@elastic/eui';
+import { EuiHeaderLinks, EuiHeaderLink } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { useContext } from 'react';
 import { Route, Switch } from 'react-router-dom';
@@ -78,28 +78,19 @@ export const LogsPageContent: React.FunctionComponent = () => {
 
       {setHeaderActionMenu && (
         <HeaderMenuPortal setHeaderActionMenu={setHeaderActionMenu}>
-          <EuiFlexGroup gutterSize={'xs'} alignItems={'center'} responsive={false}>
-            <EuiFlexItem grow={false}>
-              <EuiButtonEmpty size={'xs'} color={'text'} {...settingsLinkProps}>
-                {settingsTabTitle}
-              </EuiButtonEmpty>
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <AlertDropdown />
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <EuiButtonEmpty
-                href={kibana.services?.application?.getUrlForApp(
-                  '/home#/tutorial_directory/logging'
-                )}
-                size="s"
-                color="primary"
-                iconType="indexOpen"
-              >
-                {ADD_DATA_LABEL}
-              </EuiButtonEmpty>
-            </EuiFlexItem>
-          </EuiFlexGroup>
+          <EuiHeaderLinks gutterSize="xs">
+            <EuiHeaderLink color={'text'} {...settingsLinkProps}>
+              {settingsTabTitle}
+            </EuiHeaderLink>
+            <AlertDropdown />
+            <EuiHeaderLink
+              href={kibana.services?.application?.getUrlForApp('/home#/tutorial_directory/logging')}
+              color="primary"
+              iconType="indexOpen"
+            >
+              {ADD_DATA_LABEL}
+            </EuiHeaderLink>
+          </EuiHeaderLinks>
         </HeaderMenuPortal>
       )}
 
diff --git a/x-pack/plugins/infra/public/pages/metrics/index.tsx b/x-pack/plugins/infra/public/pages/metrics/index.tsx
index 045fcb57ae943..d4845a4dd9e44 100644
--- a/x-pack/plugins/infra/public/pages/metrics/index.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/index.tsx
@@ -10,7 +10,7 @@ import { i18n } from '@kbn/i18n';
 import React, { useContext } from 'react';
 import { Route, RouteComponentProps, Switch } from 'react-router-dom';
 
-import { EuiErrorBoundary, EuiFlexItem, EuiFlexGroup, EuiButtonEmpty } from '@elastic/eui';
+import { EuiErrorBoundary, EuiHeaderLinks, EuiHeaderLink } from '@elastic/eui';
 import { IIndexPattern } from 'src/plugins/data/common';
 import { MetricsSourceConfigurationProperties } from '../../../common/metrics_sources';
 import { DocumentTitle } from '../../components/document_title';
@@ -86,31 +86,22 @@ export const InfrastructurePage = ({ match }: RouteComponentProps) => {
 
                   {setHeaderActionMenu && (
                     <HeaderMenuPortal setHeaderActionMenu={setHeaderActionMenu}>
-                      <EuiFlexGroup alignItems="center" gutterSize={'xs'} responsive={false}>
-                        <EuiFlexItem grow={false}>
-                          <EuiButtonEmpty size={'xs'} color={'text'} {...settingsLinkProps}>
-                            {settingsTabTitle}
-                          </EuiButtonEmpty>
-                        </EuiFlexItem>
-                        <EuiFlexItem grow={false}>
-                          <Route path={'/inventory'} component={AnomalyDetectionFlyout} />
-                        </EuiFlexItem>
-                        <EuiFlexItem grow={false}>
-                          <MetricsAlertDropdown />
-                        </EuiFlexItem>
-                        <EuiFlexItem grow={false}>
-                          <EuiButtonEmpty
-                            href={kibana.services?.application?.getUrlForApp(
-                              '/home#/tutorial_directory/metrics'
-                            )}
-                            size="s"
-                            color="primary"
-                            iconType="indexOpen"
-                          >
-                            {ADD_DATA_LABEL}
-                          </EuiButtonEmpty>
-                        </EuiFlexItem>
-                      </EuiFlexGroup>
+                      <EuiHeaderLinks gutterSize="xs">
+                        <EuiHeaderLink color={'text'} {...settingsLinkProps}>
+                          {settingsTabTitle}
+                        </EuiHeaderLink>
+                        <Route path={'/inventory'} component={AnomalyDetectionFlyout} />
+                        <MetricsAlertDropdown />
+                        <EuiHeaderLink
+                          href={kibana.services?.application?.getUrlForApp(
+                            '/home#/tutorial_directory/metrics'
+                          )}
+                          color="primary"
+                          iconType="indexOpen"
+                        >
+                          {ADD_DATA_LABEL}
+                        </EuiHeaderLink>
+                      </EuiHeaderLinks>
                     </HeaderMenuPortal>
                   )}
                   <Switch>
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/ml/anomaly_detection/anomaly_detection_flyout.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/ml/anomaly_detection/anomaly_detection_flyout.tsx
index d2cd4f87a5342..4e28fb4202bdc 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/ml/anomaly_detection/anomaly_detection_flyout.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/ml/anomaly_detection/anomaly_detection_flyout.tsx
@@ -6,7 +6,7 @@
  */
 
 import React, { useState, useCallback } from 'react';
-import { EuiButtonEmpty, EuiFlyout } from '@elastic/eui';
+import { EuiHeaderLink, EuiFlyout } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { FlyoutHome } from './flyout_home';
 import { JobSetupScreen } from './job_setup_screen';
@@ -50,8 +50,7 @@ export const AnomalyDetectionFlyout = () => {
 
   return (
     <>
-      <EuiButtonEmpty
-        size="xs"
+      <EuiHeaderLink
         color="text"
         iconSide={'left'}
         iconType={'inspect'}
@@ -62,7 +61,7 @@ export const AnomalyDetectionFlyout = () => {
           id="xpack.infra.ml.anomalyDetectionButton"
           defaultMessage="Anomaly detection"
         />
-      </EuiButtonEmpty>
+      </EuiHeaderLink>
       {showFlyout && (
         <MetricHostsModuleProvider
           indexPattern={source?.configuration.metricAlias ?? ''}
diff --git a/x-pack/plugins/infra/public/plugin.ts b/x-pack/plugins/infra/public/plugin.ts
index fd599aed5f890..d5951d9ec9915 100644
--- a/x-pack/plugins/infra/public/plugin.ts
+++ b/x-pack/plugins/infra/public/plugin.ts
@@ -10,21 +10,21 @@ import { AppMountParameters, PluginInitializerContext } from 'kibana/public';
 import { from } from 'rxjs';
 import { map } from 'rxjs/operators';
 import { DEFAULT_APP_CATEGORIES } from '../../../../src/core/public';
-import { createMetricThresholdAlertType } from './alerting/metric_threshold';
 import { createInventoryMetricAlertType } from './alerting/inventory';
-import { getAlertType as getLogsAlertType } from './alerting/log_threshold';
+import { createLogThresholdAlertType } from './alerting/log_threshold';
+import { createMetricThresholdAlertType } from './alerting/metric_threshold';
+import { LOG_STREAM_EMBEDDABLE } from './components/log_stream/log_stream_embeddable';
+import { LogStreamEmbeddableFactoryDefinition } from './components/log_stream/log_stream_embeddable_factory';
+import { createMetricsFetchData, createMetricsHasData } from './metrics_overview_fetchers';
 import { registerFeatures } from './register_feature';
 import {
-  InfraClientSetupDeps,
-  InfraClientStartDeps,
   InfraClientCoreSetup,
   InfraClientCoreStart,
   InfraClientPluginClass,
+  InfraClientSetupDeps,
+  InfraClientStartDeps,
 } from './types';
 import { getLogsHasDataFetcher, getLogsOverviewDataFetcher } from './utils/logs_overview_fetchers';
-import { createMetricsHasData, createMetricsFetchData } from './metrics_overview_fetchers';
-import { LOG_STREAM_EMBEDDABLE } from './components/log_stream/log_stream_embeddable';
-import { LogStreamEmbeddableFactoryDefinition } from './components/log_stream/log_stream_embeddable_factory';
 
 export class Plugin implements InfraClientPluginClass {
   constructor(_context: PluginInitializerContext) {}
@@ -35,7 +35,9 @@ export class Plugin implements InfraClientPluginClass {
     }
 
     pluginsSetup.triggersActionsUi.alertTypeRegistry.register(createInventoryMetricAlertType());
-    pluginsSetup.triggersActionsUi.alertTypeRegistry.register(getLogsAlertType());
+    pluginsSetup.observability.observabilityRuleTypeRegistry.register(
+      createLogThresholdAlertType()
+    );
     pluginsSetup.triggersActionsUi.alertTypeRegistry.register(createMetricThresholdAlertType());
 
     pluginsSetup.observability.dashboard.register({
diff --git a/x-pack/plugins/infra/server/features.ts b/x-pack/plugins/infra/server/features.ts
index 91f82e82b33cd..fe0570c4950f8 100644
--- a/x-pack/plugins/infra/server/features.ts
+++ b/x-pack/plugins/infra/server/features.ts
@@ -10,9 +10,10 @@ import { LOG_DOCUMENT_COUNT_ALERT_TYPE_ID } from '../common/alerting/logs/log_th
 import { METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID } from './lib/alerting/inventory_metric_threshold/types';
 import { METRIC_THRESHOLD_ALERT_TYPE_ID } from './lib/alerting/metric_threshold/types';
 import { DEFAULT_APP_CATEGORIES } from '../../../../src/core/server';
+import { LOGS_FEATURE_ID, METRICS_FEATURE_ID } from '../common/constants';
 
 export const METRICS_FEATURE = {
-  id: 'infrastructure',
+  id: METRICS_FEATURE_ID,
   name: i18n.translate('xpack.infra.featureRegistry.linkInfrastructureTitle', {
     defaultMessage: 'Metrics',
   }),
@@ -71,7 +72,7 @@ export const METRICS_FEATURE = {
 };
 
 export const LOGS_FEATURE = {
-  id: 'logs',
+  id: LOGS_FEATURE_ID,
   name: i18n.translate('xpack.infra.featureRegistry.linkLogsTitle', {
     defaultMessage: 'Logs',
   }),
diff --git a/x-pack/plugins/infra/server/lib/adapters/framework/adapter_types.ts b/x-pack/plugins/infra/server/lib/adapters/framework/adapter_types.ts
index 1657d41d0b793..0ec071b97d7cf 100644
--- a/x-pack/plugins/infra/server/lib/adapters/framework/adapter_types.ts
+++ b/x-pack/plugins/infra/server/lib/adapters/framework/adapter_types.ts
@@ -20,6 +20,7 @@ import { PluginSetupContract as FeaturesPluginSetup } from '../../../../../../pl
 import { SpacesPluginSetup } from '../../../../../../plugins/spaces/server';
 import { PluginSetupContract as AlertingPluginContract } from '../../../../../alerting/server';
 import { MlPluginSetup } from '../../../../../ml/server';
+import { RuleRegistryPluginSetupContract } from '../../../../../rule_registry/server';
 
 export interface InfraServerPluginSetupDeps {
   data: DataPluginSetup;
@@ -29,6 +30,7 @@ export interface InfraServerPluginSetupDeps {
   visTypeTimeseries: VisTypeTimeseriesSetup;
   features: FeaturesPluginSetup;
   alerting: AlertingPluginContract;
+  ruleRegistry: RuleRegistryPluginSetupContract;
   ml?: MlPluginSetup;
 }
 
diff --git a/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts
index f9d0b5575abfc..241931e610af0 100644
--- a/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts
@@ -5,59 +5,64 @@
  * 2.0.
  */
 
+import { estypes } from '@elastic/elasticsearch';
 import { i18n } from '@kbn/i18n';
+import { ALERT_EVALUATION_THRESHOLD, ALERT_EVALUATION_VALUE } from '@kbn/rule-data-utils';
 import { ElasticsearchClient } from 'kibana/server';
-import { estypes } from '@elastic/elasticsearch';
 import {
-  AlertExecutorOptions,
-  AlertServices,
+  ActionGroup,
+  ActionGroupIdsOf,
   AlertInstance,
-  AlertTypeParams,
-  AlertTypeState,
   AlertInstanceContext,
   AlertInstanceState,
-  ActionGroup,
-  ActionGroupIdsOf,
+  AlertTypeState,
 } from '../../../../../alerting/server';
 import {
+  logThresholdRuleDataRT,
+  logThresholdRuleDataSerializedParamsKey,
+} from '../../../../common/alerting/logs/log_threshold';
+import {
+  AlertParams,
+  alertParamsRT,
   AlertStates,
   Comparator,
-  AlertParams,
+  CountAlertParams,
+  CountCriteria,
   Criterion,
-  GroupedSearchQueryResponseRT,
-  UngroupedSearchQueryResponseRT,
-  UngroupedSearchQueryResponse,
+  getDenominator,
+  getNumerator,
   GroupedSearchQueryResponse,
-  alertParamsRT,
-  isRatioAlertParams,
+  GroupedSearchQueryResponseRT,
   hasGroupBy,
-  getNumerator,
-  getDenominator,
-  CountCriteria,
-  CountAlertParams,
-  RatioAlertParams,
-  isOptimizedGroupedSearchQueryResponse,
   isOptimizableGroupedThreshold,
+  isOptimizedGroupedSearchQueryResponse,
+  isRatioAlertParams,
+  RatioAlertParams,
+  UngroupedSearchQueryResponse,
+  UngroupedSearchQueryResponseRT,
 } from '../../../../common/alerting/logs/log_threshold/types';
-import { InfraBackendLibs } from '../../infra_types';
-import { getIntervalInSeconds } from '../../../utils/get_interval_in_seconds';
+import { resolveLogSourceConfiguration } from '../../../../common/log_sources';
 import { decodeOrThrow } from '../../../../common/runtime_types';
+import { getIntervalInSeconds } from '../../../utils/get_interval_in_seconds';
+import { InfraBackendLibs } from '../../infra_types';
 import { UNGROUPED_FACTORY_KEY } from '../common/utils';
-import { resolveLogSourceConfiguration } from '../../../../common/log_sources';
 
-type LogThresholdActionGroups = ActionGroupIdsOf<typeof FIRED_ACTIONS>;
-type LogThresholdAlertServices = AlertServices<
-  AlertInstanceState,
-  AlertInstanceContext,
-  LogThresholdActionGroups
->;
-type LogThresholdAlertExecutorOptions = AlertExecutorOptions<
-  AlertTypeParams,
-  AlertTypeState,
-  AlertInstanceState,
-  AlertInstanceContext,
+export type LogThresholdActionGroups = ActionGroupIdsOf<typeof FIRED_ACTIONS>;
+export type LogThresholdAlertTypeParams = AlertParams;
+export type LogThresholdAlertTypeState = AlertTypeState; // no specific state used
+export type LogThresholdAlertInstanceState = AlertInstanceState; // no specific state used
+export type LogThresholdAlertInstanceContext = AlertInstanceContext; // no specific instance context used
+
+type LogThresholdAlertInstance = AlertInstance<
+  LogThresholdAlertInstanceState,
+  LogThresholdAlertInstanceContext,
   LogThresholdActionGroups
 >;
+type LogThresholdAlertInstanceFactory = (
+  id: string,
+  threshold: number,
+  value: number
+) => LogThresholdAlertInstance;
 
 const COMPOSITE_GROUP_SIZE = 2000;
 
@@ -75,9 +80,26 @@ const checkValueAgainstComparatorMap: {
 // With forks for group_by vs ungrouped, and ratio vs non-ratio.
 
 export const createLogThresholdExecutor = (libs: InfraBackendLibs) =>
-  async function ({ services, params }: LogThresholdAlertExecutorOptions) {
-    const { alertInstanceFactory, savedObjectsClient, scopedClusterClient } = services;
+  libs.logsRules.createLifecycleRuleExecutor<
+    LogThresholdAlertTypeParams,
+    LogThresholdAlertTypeState,
+    LogThresholdAlertInstanceState,
+    LogThresholdAlertInstanceContext,
+    LogThresholdActionGroups
+  >(async ({ services, params }) => {
+    const { alertWithLifecycle, savedObjectsClient, scopedClusterClient } = services;
     const { sources } = libs;
+    const alertInstanceFactory: LogThresholdAlertInstanceFactory = (id, threshold, value) =>
+      alertWithLifecycle({
+        id,
+        fields: {
+          [ALERT_EVALUATION_THRESHOLD]: threshold,
+          [ALERT_EVALUATION_VALUE]: value,
+          ...logThresholdRuleDataRT.encode({
+            [logThresholdRuleDataSerializedParamsKey]: [params],
+          }),
+        },
+      });
 
     const sourceConfiguration = await sources.getSourceConfiguration(savedObjectsClient, 'default');
     const { indices, timestampField, runtimeMappings } = await resolveLogSourceConfiguration(
@@ -113,7 +135,7 @@ export const createLogThresholdExecutor = (libs: InfraBackendLibs) =>
     } catch (e) {
       throw new Error(e);
     }
-  };
+  });
 
 async function executeAlert(
   alertParams: CountAlertParams,
@@ -121,7 +143,7 @@ async function executeAlert(
   indexPattern: string,
   runtimeMappings: estypes.MappingRuntimeFields,
   esClient: ElasticsearchClient,
-  alertInstanceFactory: LogThresholdAlertServices['alertInstanceFactory']
+  alertInstanceFactory: LogThresholdAlertInstanceFactory
 ) {
   const query = getESQuery(alertParams, timestampField, indexPattern, runtimeMappings);
 
@@ -152,7 +174,7 @@ async function executeRatioAlert(
   indexPattern: string,
   runtimeMappings: estypes.MappingRuntimeFields,
   esClient: ElasticsearchClient,
-  alertInstanceFactory: LogThresholdAlertServices['alertInstanceFactory']
+  alertInstanceFactory: LogThresholdAlertInstanceFactory
 ) {
   // Ratio alert params are separated out into two standard sets of alert params
   const numeratorParams: AlertParams = {
@@ -214,14 +236,14 @@ const getESQuery = (
 export const processUngroupedResults = (
   results: UngroupedSearchQueryResponse,
   params: CountAlertParams,
-  alertInstanceFactory: LogThresholdAlertExecutorOptions['services']['alertInstanceFactory'],
+  alertInstanceFactory: LogThresholdAlertInstanceFactory,
   alertInstaceUpdater: AlertInstanceUpdater
 ) => {
   const { count, criteria } = params;
   const documentCount = results.hits.total.value;
 
   if (checkValueAgainstComparatorMap[count.comparator](documentCount, count.value)) {
-    const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY);
+    const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY, count.value, documentCount);
     alertInstaceUpdater(alertInstance, AlertStates.ALERT, [
       {
         actionGroup: FIRED_ACTIONS.id,
@@ -240,7 +262,7 @@ export const processUngroupedRatioResults = (
   numeratorResults: UngroupedSearchQueryResponse,
   denominatorResults: UngroupedSearchQueryResponse,
   params: RatioAlertParams,
-  alertInstanceFactory: LogThresholdAlertExecutorOptions['services']['alertInstanceFactory'],
+  alertInstanceFactory: LogThresholdAlertInstanceFactory,
   alertInstaceUpdater: AlertInstanceUpdater
 ) => {
   const { count, criteria } = params;
@@ -250,7 +272,7 @@ export const processUngroupedRatioResults = (
   const ratio = getRatio(numeratorCount, denominatorCount);
 
   if (ratio !== undefined && checkValueAgainstComparatorMap[count.comparator](ratio, count.value)) {
-    const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY);
+    const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY, count.value, ratio);
     alertInstaceUpdater(alertInstance, AlertStates.ALERT, [
       {
         actionGroup: FIRED_ACTIONS.id,
@@ -308,7 +330,7 @@ const getReducedGroupByResults = (
 export const processGroupByResults = (
   results: GroupedSearchQueryResponse['aggregations']['groups']['buckets'],
   params: CountAlertParams,
-  alertInstanceFactory: LogThresholdAlertExecutorOptions['services']['alertInstanceFactory'],
+  alertInstanceFactory: LogThresholdAlertInstanceFactory,
   alertInstaceUpdater: AlertInstanceUpdater
 ) => {
   const { count, criteria } = params;
@@ -319,7 +341,7 @@ export const processGroupByResults = (
     const documentCount = group.documentCount;
 
     if (checkValueAgainstComparatorMap[count.comparator](documentCount, count.value)) {
-      const alertInstance = alertInstanceFactory(group.name);
+      const alertInstance = alertInstanceFactory(group.name, count.value, documentCount);
       alertInstaceUpdater(alertInstance, AlertStates.ALERT, [
         {
           actionGroup: FIRED_ACTIONS.id,
@@ -339,7 +361,7 @@ export const processGroupByRatioResults = (
   numeratorResults: GroupedSearchQueryResponse['aggregations']['groups']['buckets'],
   denominatorResults: GroupedSearchQueryResponse['aggregations']['groups']['buckets'],
   params: RatioAlertParams,
-  alertInstanceFactory: LogThresholdAlertExecutorOptions['services']['alertInstanceFactory'],
+  alertInstanceFactory: LogThresholdAlertInstanceFactory,
   alertInstaceUpdater: AlertInstanceUpdater
 ) => {
   const { count, criteria } = params;
@@ -360,7 +382,7 @@ export const processGroupByRatioResults = (
       ratio !== undefined &&
       checkValueAgainstComparatorMap[count.comparator](ratio, count.value)
     ) {
-      const alertInstance = alertInstanceFactory(numeratorGroup.name);
+      const alertInstance = alertInstanceFactory(numeratorGroup.name, count.value, ratio);
       alertInstaceUpdater(alertInstance, AlertStates.ALERT, [
         {
           actionGroup: FIRED_ACTIONS.id,
diff --git a/x-pack/plugins/infra/server/lib/alerting/log_threshold/register_log_threshold_alert_type.ts b/x-pack/plugins/infra/server/lib/alerting/log_threshold/register_log_threshold_alert_type.ts
index 62d92d0487ff7..3d0bac3dd2bf5 100644
--- a/x-pack/plugins/infra/server/lib/alerting/log_threshold/register_log_threshold_alert_type.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/log_threshold/register_log_threshold_alert_type.ts
@@ -6,14 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import {
-  PluginSetupContract,
-  AlertTypeParams,
-  AlertTypeState,
-  AlertInstanceContext,
-  AlertInstanceState,
-  ActionGroupIdsOf,
-} from '../../../../../alerting/server';
+import { PluginSetupContract } from '../../../../../alerting/server';
 import { createLogThresholdExecutor, FIRED_ACTIONS } from './log_threshold_executor';
 import {
   LOG_DOCUMENT_COUNT_ALERT_TYPE_ID,
@@ -88,13 +81,7 @@ export async function registerLogThresholdAlertType(
     );
   }
 
-  alertingPlugin.registerType<
-    AlertTypeParams,
-    AlertTypeState,
-    AlertInstanceState,
-    AlertInstanceContext,
-    ActionGroupIdsOf<typeof FIRED_ACTIONS>
-  >({
+  alertingPlugin.registerType({
     id: LOG_DOCUMENT_COUNT_ALERT_TYPE_ID,
     name: i18n.translate('xpack.infra.logs.alertName', {
       defaultMessage: 'Log threshold',
diff --git a/x-pack/plugins/infra/server/lib/infra_types.ts b/x-pack/plugins/infra/server/lib/infra_types.ts
index 0c57ff2e05847..332a2e499977b 100644
--- a/x-pack/plugins/infra/server/lib/infra_types.ts
+++ b/x-pack/plugins/infra/server/lib/infra_types.ts
@@ -5,15 +5,16 @@
  * 2.0.
  */
 
+import { handleEsError } from '../../../../../src/plugins/es_ui_shared/server';
+import { InfraConfig } from '../plugin';
+import { GetLogQueryFields } from '../services/log_queries/get_log_query_fields';
+import { RulesServiceSetup } from '../services/rules';
+import { KibanaFramework } from './adapters/framework/kibana_framework_adapter';
 import { InfraFieldsDomain } from './domains/fields_domain';
 import { InfraLogEntriesDomain } from './domains/log_entries_domain';
 import { InfraMetricsDomain } from './domains/metrics_domain';
 import { InfraSources } from './sources';
 import { InfraSourceStatus } from './source_status';
-import { InfraConfig } from '../plugin';
-import { KibanaFramework } from './adapters/framework/kibana_framework_adapter';
-import { GetLogQueryFields } from '../services/log_queries/get_log_query_fields';
-import { handleEsError } from '../../../../../src/plugins/es_ui_shared/server';
 
 export interface InfraDomainLibs {
   fields: InfraFieldsDomain;
@@ -28,4 +29,6 @@ export interface InfraBackendLibs extends InfraDomainLibs {
   sourceStatus: InfraSourceStatus;
   getLogQueryFields: GetLogQueryFields;
   handleEsError: typeof handleEsError;
+  logsRules: RulesServiceSetup;
+  metricsRules: RulesServiceSetup;
 }
diff --git a/x-pack/plugins/infra/server/plugin.ts b/x-pack/plugins/infra/server/plugin.ts
index 7c5666049bd60..de445affc178e 100644
--- a/x-pack/plugins/infra/server/plugin.ts
+++ b/x-pack/plugins/infra/server/plugin.ts
@@ -8,7 +8,9 @@
 import { Server } from '@hapi/hapi';
 import { schema, TypeOf } from '@kbn/config-schema';
 import { i18n } from '@kbn/i18n';
+import { Logger } from '@kbn/logging';
 import { CoreSetup, PluginInitializerContext, Plugin } from 'src/core/server';
+import { LOGS_FEATURE_ID, METRICS_FEATURE_ID } from '../common/constants';
 import { InfraStaticSourceConfiguration } from '../common/source_configuration/source_configuration';
 import { inventoryViewSavedObjectType } from '../common/saved_objects/inventory_view';
 import { metricsExplorerViewSavedObjectType } from '../common/saved_objects/metrics_explorer_view';
@@ -32,6 +34,7 @@ import { InfraPluginRequestHandlerContext } from './types';
 import { UsageCollector } from './usage/usage_collector';
 import { createGetLogQueryFields } from './services/log_queries/get_log_query_fields';
 import { handleEsError } from '../../../../src/plugins/es_ui_shared/server';
+import { RulesService } from './services/rules';
 
 export const config = {
   schema: schema.object({
@@ -82,9 +85,25 @@ export interface InfraPluginSetup {
 export class InfraServerPlugin implements Plugin<InfraPluginSetup> {
   public config: InfraConfig;
   public libs: InfraBackendLibs | undefined;
+  public logger: Logger;
+
+  private logsRules: RulesService;
+  private metricsRules: RulesService;
 
   constructor(context: PluginInitializerContext) {
     this.config = context.config.get<InfraConfig>();
+    this.logger = context.logger.get();
+
+    this.logsRules = new RulesService(
+      LOGS_FEATURE_ID,
+      'observability.logs',
+      this.logger.get('logsRules')
+    );
+    this.metricsRules = new RulesService(
+      METRICS_FEATURE_ID,
+      'observability.metrics',
+      this.logger.get('metricsRules')
+    );
   }
 
   setup(core: CoreSetup<InfraServerPluginStartDeps>, plugins: InfraServerPluginSetupDeps) {
@@ -126,6 +145,8 @@ export class InfraServerPlugin implements Plugin<InfraPluginSetup> {
       ...domainLibs,
       getLogQueryFields: createGetLogQueryFields(sources, framework),
       handleEsError,
+      logsRules: this.logsRules.setup(core, plugins),
+      metricsRules: this.metricsRules.setup(core, plugins),
     };
 
     plugins.features.registerKibanaFeature(METRICS_FEATURE);
diff --git a/x-pack/plugins/infra/server/services/rules/index.ts b/x-pack/plugins/infra/server/services/rules/index.ts
new file mode 100644
index 0000000000000..eaa3d0da493e5
--- /dev/null
+++ b/x-pack/plugins/infra/server/services/rules/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './rules_service';
+export * from './types';
diff --git a/x-pack/plugins/infra/server/services/rules/rule_data_client.ts b/x-pack/plugins/infra/server/services/rules/rule_data_client.ts
new file mode 100644
index 0000000000000..d693be40f10d0
--- /dev/null
+++ b/x-pack/plugins/infra/server/services/rules/rule_data_client.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { once } from 'lodash';
+import { CoreSetup, Logger } from 'src/core/server';
+import { TECHNICAL_COMPONENT_TEMPLATE_NAME } from '../../../../rule_registry/common/assets';
+import { RuleRegistryPluginSetupContract } from '../../../../rule_registry/server';
+import { logThresholdRuleDataNamespace } from '../../../common/alerting/logs/log_threshold';
+import type { InfraFeatureId } from '../../../common/constants';
+import { RuleRegistrationContext, RulesServiceStartDeps } from './types';
+
+export const createRuleDataClient = ({
+  ownerFeatureId,
+  registrationContext,
+  getStartServices,
+  logger,
+  ruleDataService,
+}: {
+  ownerFeatureId: InfraFeatureId;
+  registrationContext: RuleRegistrationContext;
+  getStartServices: CoreSetup<RulesServiceStartDeps>['getStartServices'];
+  logger: Logger;
+  ruleDataService: RuleRegistryPluginSetupContract['ruleDataService'];
+}) => {
+  const initializeRuleDataTemplates = once(async () => {
+    const componentTemplateName = ruleDataService.getFullAssetName(
+      `${registrationContext}-mappings`
+    );
+
+    const indexNamePattern = ruleDataService.getFullAssetName(`${registrationContext}*`);
+
+    if (!ruleDataService.isWriteEnabled()) {
+      return;
+    }
+
+    await ruleDataService.createOrUpdateComponentTemplate({
+      name: componentTemplateName,
+      body: {
+        template: {
+          settings: {
+            number_of_shards: 1,
+          },
+          mappings: {
+            properties: {
+              [logThresholdRuleDataNamespace]: {
+                properties: {
+                  serialized_params: {
+                    type: 'keyword',
+                    index: false,
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    await ruleDataService.createOrUpdateIndexTemplate({
+      name: ruleDataService.getFullAssetName(registrationContext),
+      body: {
+        index_patterns: [indexNamePattern],
+        composed_of: [
+          ruleDataService.getFullAssetName(TECHNICAL_COMPONENT_TEMPLATE_NAME),
+          componentTemplateName,
+        ],
+      },
+    });
+
+    await ruleDataService.updateIndexMappingsMatchingPattern(indexNamePattern);
+  });
+
+  // initialize eagerly
+  const initializeRuleDataTemplatesPromise = initializeRuleDataTemplates().catch((err) => {
+    logger.error(err);
+  });
+
+  return ruleDataService.getRuleDataClient(
+    ownerFeatureId,
+    ruleDataService.getFullAssetName(registrationContext),
+    () => initializeRuleDataTemplatesPromise
+  );
+};
diff --git a/x-pack/plugins/infra/server/services/rules/rules_service.ts b/x-pack/plugins/infra/server/services/rules/rules_service.ts
new file mode 100644
index 0000000000000..9341fc59d75b8
--- /dev/null
+++ b/x-pack/plugins/infra/server/services/rules/rules_service.ts
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CoreSetup, Logger } from 'src/core/server';
+import { createLifecycleExecutor } from '../../../../rule_registry/server';
+import { InfraFeatureId } from '../../../common/constants';
+import { createRuleDataClient } from './rule_data_client';
+import {
+  RuleRegistrationContext,
+  RulesServiceSetup,
+  RulesServiceSetupDeps,
+  RulesServiceStart,
+  RulesServiceStartDeps,
+} from './types';
+
+export class RulesService {
+  constructor(
+    public readonly ownerFeatureId: InfraFeatureId,
+    public readonly registrationContext: RuleRegistrationContext,
+    private readonly logger: Logger
+  ) {}
+
+  public setup(
+    core: CoreSetup<RulesServiceStartDeps>,
+    setupDeps: RulesServiceSetupDeps
+  ): RulesServiceSetup {
+    const ruleDataClient = createRuleDataClient({
+      getStartServices: core.getStartServices,
+      logger: this.logger,
+      ownerFeatureId: this.ownerFeatureId,
+      registrationContext: this.registrationContext,
+      ruleDataService: setupDeps.ruleRegistry.ruleDataService,
+    });
+
+    const createLifecycleRuleExecutor = createLifecycleExecutor(this.logger, ruleDataClient);
+
+    return {
+      createLifecycleRuleExecutor,
+      ruleDataClient,
+    };
+  }
+
+  public start(_startDeps: RulesServiceStartDeps): RulesServiceStart {
+    return {};
+  }
+}
diff --git a/x-pack/plugins/infra/server/services/rules/types.ts b/x-pack/plugins/infra/server/services/rules/types.ts
new file mode 100644
index 0000000000000..b67b79ee5d3c2
--- /dev/null
+++ b/x-pack/plugins/infra/server/services/rules/types.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { PluginSetupContract as AlertingPluginSetup } from '../../../../alerting/server';
+import {
+  createLifecycleExecutor,
+  RuleDataClient,
+  RuleRegistryPluginSetupContract,
+} from '../../../../rule_registry/server';
+
+type LifecycleRuleExecutorCreator = ReturnType<typeof createLifecycleExecutor>;
+
+export interface RulesServiceSetupDeps {
+  alerting: AlertingPluginSetup;
+  ruleRegistry: RuleRegistryPluginSetupContract;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface RulesServiceStartDeps {}
+
+export interface RulesServiceSetup {
+  createLifecycleRuleExecutor: LifecycleRuleExecutorCreator;
+  ruleDataClient: RuleDataClient;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface RulesServiceStart {}
+
+export type RuleRegistrationContext = 'observability.logs' | 'observability.metrics';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/network_direction.test.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/network_direction.test.tsx
new file mode 100644
index 0000000000000..7a4c55d6f5e02
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/network_direction.test.tsx
@@ -0,0 +1,180 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { act } from 'react-dom/test-utils';
+import { setup, SetupResult, getProcessorValue } from './processor.helpers';
+
+// Default parameter values automatically added to the network direction processor when saved
+const defaultNetworkDirectionParameters = {
+  if: undefined,
+  tag: undefined,
+  source_ip: undefined,
+  description: undefined,
+  target_field: undefined,
+  ignore_missing: undefined,
+  ignore_failure: undefined,
+  destination_ip: undefined,
+  internal_networks: undefined,
+  internal_networks_field: undefined,
+};
+
+const NETWORK_DIRECTION_TYPE = 'network_direction';
+
+describe('Processor: Network Direction', () => {
+  let onUpdate: jest.Mock;
+  let testBed: SetupResult;
+
+  beforeAll(() => {
+    jest.useFakeTimers();
+  });
+
+  afterAll(() => {
+    jest.useRealTimers();
+  });
+
+  beforeEach(async () => {
+    onUpdate = jest.fn();
+
+    await act(async () => {
+      testBed = await setup({
+        value: {
+          processors: [],
+        },
+        onFlyoutOpen: jest.fn(),
+        onUpdate,
+      });
+    });
+
+    testBed.component.update();
+
+    // Open flyout to add new processor
+    testBed.actions.addProcessor();
+    // Add type (the other fields are not visible until a type is selected)
+    await testBed.actions.addProcessorType(NETWORK_DIRECTION_TYPE);
+  });
+
+  test('prevents form submission if internal_network field is not provided', async () => {
+    const {
+      actions: { saveNewProcessor },
+      form,
+    } = testBed;
+
+    // Click submit button with only the type defined
+    await saveNewProcessor();
+
+    // Expect form error as "field" is required parameter
+    expect(form.getErrorsMessages()).toEqual(['A field value is required.']);
+  });
+
+  test('saves with default parameter values', async () => {
+    const {
+      actions: { saveNewProcessor },
+      find,
+      component,
+    } = testBed;
+
+    // Add "networkDirectionField" value (required)
+    await act(async () => {
+      find('networkDirectionField.input').simulate('change', [{ label: 'loopback' }]);
+    });
+    component.update();
+
+    // Save the field
+    await saveNewProcessor();
+
+    const processors = getProcessorValue(onUpdate, NETWORK_DIRECTION_TYPE);
+    expect(processors[0][NETWORK_DIRECTION_TYPE]).toEqual({
+      ...defaultNetworkDirectionParameters,
+      internal_networks: ['loopback'],
+    });
+  });
+
+  test('allows to set internal_networks_field', async () => {
+    const {
+      actions: { saveNewProcessor },
+      form,
+      find,
+    } = testBed;
+
+    find('toggleCustomField').simulate('click');
+
+    form.setInputValue('networkDirectionField.input', 'internal_networks_field');
+
+    // Save the field with new changes
+    await saveNewProcessor();
+
+    const processors = getProcessorValue(onUpdate, NETWORK_DIRECTION_TYPE);
+    expect(processors[0][NETWORK_DIRECTION_TYPE]).toEqual({
+      ...defaultNetworkDirectionParameters,
+      internal_networks_field: 'internal_networks_field',
+    });
+  });
+
+  test('allows to set just internal_networks_field or internal_networks', async () => {
+    const {
+      actions: { saveNewProcessor },
+      form,
+      find,
+      component,
+    } = testBed;
+
+    // Set internal_networks field
+    await act(async () => {
+      find('networkDirectionField.input').simulate('change', [{ label: 'loopback' }]);
+    });
+    component.update();
+
+    // Toggle to internal_networks_field and set a random value
+    find('toggleCustomField').simulate('click');
+    form.setInputValue('networkDirectionField.input', 'internal_networks_field');
+
+    // Save the field with new changes
+    await saveNewProcessor();
+
+    const processors = getProcessorValue(onUpdate, NETWORK_DIRECTION_TYPE);
+    expect(processors[0][NETWORK_DIRECTION_TYPE]).toEqual({
+      ...defaultNetworkDirectionParameters,
+      internal_networks_field: 'internal_networks_field',
+    });
+  });
+
+  test('allows optional parameters to be set', async () => {
+    const {
+      actions: { saveNewProcessor },
+      form,
+      find,
+      component,
+    } = testBed;
+
+    // Add "networkDirectionField" value (required)
+    await act(async () => {
+      find('networkDirectionField.input').simulate('change', [{ label: 'loopback' }]);
+    });
+    component.update();
+
+    // Set optional parameteres
+    form.toggleEuiSwitch('ignoreMissingSwitch.input');
+    form.toggleEuiSwitch('ignoreFailureSwitch.input');
+    form.setInputValue('sourceIpField.input', 'source.ip');
+    form.setInputValue('targetField.input', 'target_field');
+    form.setInputValue('destinationIpField.input', 'destination.ip');
+
+    // Save the field with new changes
+    await saveNewProcessor();
+
+    const processors = getProcessorValue(onUpdate, NETWORK_DIRECTION_TYPE);
+    expect(processors[0][NETWORK_DIRECTION_TYPE]).toEqual({
+      ...defaultNetworkDirectionParameters,
+      ignore_failure: true,
+      ignore_missing: false,
+      source_ip: 'source.ip',
+      target_field: 'target_field',
+      destination_ip: 'destination.ip',
+      internal_networks: ['loopback'],
+    });
+  });
+});
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/processor.helpers.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/processor.helpers.tsx
index 24e1ddce008ea..e4024e4ec67f4 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/processor.helpers.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/processor.helpers.tsx
@@ -171,6 +171,10 @@ type TestSubject =
   | 'regexFileField.input'
   | 'valueFieldInput'
   | 'mediaTypeSelectorField'
+  | 'networkDirectionField.input'
+  | 'sourceIpField.input'
+  | 'destinationIpField.input'
+  | 'toggleCustomField'
   | 'ignoreEmptyField.input'
   | 'overrideField.input'
   | 'fieldsValueField.input'
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/index.ts
index 5e3e5f82478bd..f5eb1ab3ec59b 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/index.ts
@@ -28,6 +28,7 @@ export { Join } from './join';
 export { Json } from './json';
 export { Kv } from './kv';
 export { Lowercase } from './lowercase';
+export { NetworkDirection } from './network_direction';
 export { Pipeline } from './pipeline';
 export { RegisteredDomain } from './registered_domain';
 export { Remove } from './remove';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/network_direction.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/network_direction.tsx
new file mode 100644
index 0000000000000..2026a77bc6566
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/network_direction.tsx
@@ -0,0 +1,242 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FunctionComponent, useState, useCallback, useMemo } from 'react';
+import { i18n } from '@kbn/i18n';
+import { isEmpty } from 'lodash';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiButtonEmpty, EuiCode } from '@elastic/eui';
+
+import {
+  FIELD_TYPES,
+  UseField,
+  useFormContext,
+  Field,
+  FieldHook,
+  FieldConfig,
+  SerializerFunc,
+} from '../../../../../../shared_imports';
+import { FieldsConfig, from, to } from './shared';
+import { TargetField } from './common_fields/target_field';
+import { IgnoreMissingField } from './common_fields/ignore_missing_field';
+
+interface InternalNetworkTypes {
+  internal_networks: string[];
+  internal_networks_field: string;
+}
+
+type InternalNetworkFields = {
+  [K in keyof InternalNetworkTypes]: FieldHook<InternalNetworkTypes[K]>;
+};
+
+const internalNetworkValues: string[] = [
+  'loopback',
+  'unicast',
+  'global_unicast',
+  'multicast',
+  'interface_local_multicast',
+  'link_local_unicast',
+  'link_local_multicast',
+  'link_local_multicast',
+  'private',
+  'public',
+  'unspecified',
+];
+
+const fieldsConfig: FieldsConfig = {
+  /* Optional fields config */
+  source_ip: {
+    type: FIELD_TYPES.TEXT,
+    serializer: from.emptyStringToUndefined,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.networkDirection.sourceIpLabel', {
+      defaultMessage: 'Source IP (optional)',
+    }),
+    helpText: (
+      <FormattedMessage
+        id="xpack.ingestPipelines.pipelineEditor.networkDirection.sourceIpHelpText"
+        defaultMessage="Field containing the source IP address. Defaults to {defaultField}."
+        values={{
+          defaultField: <EuiCode>{'source.ip'}</EuiCode>,
+        }}
+      />
+    ),
+  },
+  destination_ip: {
+    type: FIELD_TYPES.TEXT,
+    serializer: from.emptyStringToUndefined,
+    label: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.networkDirection.destinationIpLabel',
+      {
+        defaultMessage: 'Destination IP (optional)',
+      }
+    ),
+    helpText: (
+      <FormattedMessage
+        id="xpack.ingestPipelines.pipelineEditor.networkDirection.destionationIpHelpText"
+        defaultMessage="Field containing the destination IP address. Defaults to {defaultField}."
+        values={{
+          defaultField: <EuiCode>{'destination.ip'}</EuiCode>,
+        }}
+      />
+    ),
+  },
+};
+
+const getInternalNetworkConfig: (
+  toggleCustom: () => void
+) => Record<
+  keyof InternalNetworkFields,
+  {
+    path: string;
+    config?: FieldConfig<any>;
+    euiFieldProps?: Record<string, any>;
+    labelAppend: JSX.Element;
+  }
+> = (toggleCustom: () => void) => ({
+  internal_networks: {
+    path: 'fields.internal_networks',
+    euiFieldProps: {
+      noSuggestions: false,
+      options: internalNetworkValues.map((label) => ({ label })),
+    },
+    config: {
+      type: FIELD_TYPES.COMBO_BOX,
+      deserializer: to.arrayOfStrings,
+      serializer: from.optionalArrayOfStrings,
+      fieldsToValidateOnChange: ['fields.internal_networks', 'fields.internal_networks_field'],
+      validations: [
+        {
+          validator: ({ value, path, formData }) => {
+            if (isEmpty(value) && isEmpty(formData['fields.internal_networks_field'])) {
+              return { path, message: 'A field value is required.' };
+            }
+          },
+        },
+      ],
+      label: i18n.translate(
+        'xpack.ingestPipelines.pipelineEditor.networkDirection.internalNetworksLabel',
+        {
+          defaultMessage: 'Internal networks',
+        }
+      ),
+      helpText: (
+        <FormattedMessage
+          id="xpack.ingestPipelines.pipelineEditor.networkDirection.internalNetworksHelpText"
+          defaultMessage="List of internal networks."
+        />
+      ),
+    },
+    labelAppend: (
+      <EuiButtonEmpty size="xs" onClick={toggleCustom} data-test-subj="toggleCustomField">
+        {i18n.translate('xpack.ingestPipelines.pipelineEditor.internalNetworkCustomLabel', {
+          defaultMessage: 'Use custom field',
+        })}
+      </EuiButtonEmpty>
+    ),
+    key: 'preset',
+  },
+  internal_networks_field: {
+    path: 'fields.internal_networks_field',
+    config: {
+      type: FIELD_TYPES.TEXT,
+      serializer: from.emptyStringToUndefined,
+      fieldsToValidateOnChange: ['fields.internal_networks', 'fields.internal_networks_field'],
+      validations: [
+        {
+          validator: ({ value, path, formData }) => {
+            if (isEmpty(value) && isEmpty(formData['fields.internal_networks'])) {
+              return { path, message: 'A field value is required.' };
+            }
+          },
+        },
+      ],
+      label: i18n.translate(
+        'xpack.ingestPipelines.pipelineEditor.networkDirection.internalNetworksFieldLabel',
+        {
+          defaultMessage: 'Internal networks field',
+        }
+      ),
+      helpText: (
+        <FormattedMessage
+          id="xpack.ingestPipelines.pipelineEditor.networkDirection.internalNetworksFieldHelpText"
+          defaultMessage="Field stating where to read the {field} configuration from."
+          values={{
+            field: <EuiCode>{'internal_networks'}</EuiCode>,
+          }}
+        />
+      ),
+    },
+    labelAppend: (
+      <EuiButtonEmpty size="xs" onClick={toggleCustom} data-test-subj="toggleCustomField">
+        {i18n.translate('xpack.ingestPipelines.pipelineEditor.internalNetworkPredefinedLabel', {
+          defaultMessage: 'Use preset field',
+        })}
+      </EuiButtonEmpty>
+    ),
+    key: 'custom',
+  },
+});
+
+export const NetworkDirection: FunctionComponent = () => {
+  const { getFieldDefaultValue } = useFormContext();
+  const isInternalNetowrksFieldDefined =
+    getFieldDefaultValue('fields.internal_networks_field') !== undefined;
+  const [isCustom, setIsCustom] = useState<boolean>(isInternalNetowrksFieldDefined);
+
+  const toggleCustom = useCallback(() => {
+    setIsCustom((prev) => !prev);
+  }, []);
+
+  const internalNetworkFieldProps = useMemo(
+    () =>
+      isCustom
+        ? getInternalNetworkConfig(toggleCustom).internal_networks_field
+        : getInternalNetworkConfig(toggleCustom).internal_networks,
+    [isCustom, toggleCustom]
+  );
+
+  return (
+    <>
+      <UseField
+        config={fieldsConfig.source_ip}
+        component={Field}
+        path="fields.source_ip"
+        data-test-subj="sourceIpField"
+      />
+
+      <UseField
+        config={fieldsConfig.destination_ip}
+        component={Field}
+        path="fields.destination_ip"
+        data-test-subj="destinationIpField"
+      />
+
+      <TargetField
+        helpText={
+          <FormattedMessage
+            id="xpack.ingestPipelines.pipelineEditor.networkDirection.targetFieldHelpText"
+            defaultMessage="Output field. Defaults to {field}."
+            values={{
+              field: <EuiCode>{'network.direction'}</EuiCode>,
+            }}
+          />
+        }
+      />
+
+      <UseField
+        {...internalNetworkFieldProps}
+        component={Field}
+        data-test-subj="networkDirectionField"
+      />
+
+      <IgnoreMissingField
+        defaultValue={true}
+        serializer={from.undefinedIfValue(true) as SerializerFunc<boolean>}
+      />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/shared/map_processor_type_to_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/shared/map_processor_type_to_form.tsx
index 983fb0ea67bb0..e6ca465bf1a02 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/shared/map_processor_type_to_form.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/shared/map_processor_type_to_form.tsx
@@ -34,6 +34,7 @@ import {
   Json,
   Kv,
   Lowercase,
+  NetworkDirection,
   Pipeline,
   RegisteredDomain,
   Remove,
@@ -517,6 +518,23 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
         },
       }),
   },
+  network_direction: {
+    FieldsComponent: NetworkDirection,
+    docLinkPath: '/network-direction-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.networkDirection', {
+      defaultMessage: 'Network Direction',
+    }),
+    typeDescription: i18n.translate(
+      'xpack.ingestPipelines.processors.description.networkDirection',
+      {
+        defaultMessage: 'Calculates the network direction given a source IP address.',
+      }
+    ),
+    getDefaultDescription: () =>
+      i18n.translate('xpack.ingestPipelines.processors.defaultDescription.networkDirection', {
+        defaultMessage: 'Calculates the network direction given a source IP address.',
+      }),
+  },
   pipeline: {
     FieldsComponent: Pipeline,
     docLinkPath: '/pipeline-processor.html',
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/context/processors_context.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/context/processors_context.tsx
index 0c43297e811d3..ddf996de7805c 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/context/processors_context.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/context/processors_context.tsx
@@ -151,7 +151,13 @@ export const PipelineProcessorsContextProvider: FunctionComponent<Props> = ({
           break;
         case 'managingProcessor':
           // These are the option names we get back from our UI
-          const knownOptionNames = Object.keys(processorTypeAndOptions.options);
+          const knownOptionNames = [
+            ...Object.keys(processorTypeAndOptions.options),
+            // We manually add fields that we **don't** want to be treated as "unknownOptions"
+            'internal_networks',
+            'internal_networks_field',
+          ];
+
           // The processor that we are updating may have options configured the UI does not know about
           const unknownOptions = omit(mode.arg.processor.options, knownOptionNames);
           // In order to keep the options we don't get back from our UI, we merge the known and unknown options
diff --git a/x-pack/plugins/ingest_pipelines/public/shared_imports.ts b/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
index 8ed57221a1395..29be11430bf64 100644
--- a/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
+++ b/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
@@ -43,6 +43,7 @@ export {
   ArrayItem,
   FormHook,
   useFormContext,
+  UseMultiFields,
   FormDataProvider,
   OnFormUpdateArg,
   FieldConfig,
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/formula.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/formula.test.tsx
index 19d91c1006cf0..936f1e477057d 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/formula.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/formula.test.tsx
@@ -35,7 +35,7 @@ const operationDefinitionMap: Record<string, GenericOperationDefinition> = {
     }),
   } as unknown) as GenericOperationDefinition,
   terms: { input: 'field' } as GenericOperationDefinition,
-  sum: { input: 'field' } as GenericOperationDefinition,
+  sum: { input: 'field', filterable: true } as GenericOperationDefinition,
   last_value: { input: 'field' } as GenericOperationDefinition,
   max: { input: 'field' } as GenericOperationDefinition,
   count: ({
@@ -928,6 +928,63 @@ invalid: "
       ).toEqual(['The operation average does not accept any parameter']);
     });
 
+    it('returns an error if first argument type is passed multiple times', () => {
+      const formulas = [
+        'average(bytes, bytes)',
+        "sum(bytes, kql='category.keyword: *', bytes)",
+        'moving_average(average(bytes), average(bytes))',
+        "moving_average(average(bytes), kql='category.keyword: *', average(bytes))",
+        'moving_average(average(bytes, bytes), count())',
+        'moving_average(moving_average(average(bytes, bytes), count(), count()))',
+      ];
+      for (const formula of formulas) {
+        expect(
+          formulaOperation.getErrorMessage!(
+            getNewLayerWithFormula(formula),
+            'col1',
+            indexPattern,
+            operationDefinitionMap
+          )
+        ).toEqual(
+          expect.arrayContaining([
+            expect.stringMatching(
+              /The operation (moving_average|average|sum) in the Formula requires a single (field|metric), found:/
+            ),
+          ])
+        );
+      }
+    });
+
+    it('returns an error if a function received an argument of the wrong argument type in any position', () => {
+      const formulas = [
+        'average(bytes, count())',
+        "sum(bytes, kql='category.keyword: *', count(), count())",
+        'average(bytes, bytes + 1)',
+        'average(count(), bytes)',
+        'moving_average(average(bytes), bytes)',
+        'moving_average(bytes, bytes)',
+        'moving_average(average(bytes), window=7, bytes)',
+        'moving_average(window=7, bytes)',
+        "moving_average(kql='category.keyword: *', bytes)",
+      ];
+      for (const formula of formulas) {
+        expect(
+          formulaOperation.getErrorMessage!(
+            getNewLayerWithFormula(formula),
+            'col1',
+            indexPattern,
+            operationDefinitionMap
+          )
+        ).toEqual(
+          expect.arrayContaining([
+            expect.stringMatching(
+              /The operation (moving_average|average|sum) in the Formula does not support (metric|field) parameters, found:/
+            ),
+          ])
+        );
+      }
+    });
+
     it('returns an error if the parameter passed to an operation is of the wrong type', () => {
       expect(
         formulaOperation.getErrorMessage!(
@@ -1087,6 +1144,14 @@ invalid: "
           )
         ).toEqual([`The first argument for ${fn} should be a field name. Found no field`]);
       }
+      expect(
+        formulaOperation.getErrorMessage!(
+          getNewLayerWithFormula(`sum(kql='category.keyword: *')`),
+          'col1',
+          indexPattern,
+          operationDefinitionMap
+        )
+      ).toEqual([`The first argument for sum should be a field name. Found category.keyword: *`]);
     });
 
     it("returns a clear error when there's a missing function for a fullReference operation", () => {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/util.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/util.ts
index 445df21a6067e..6d0a585db048f 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/util.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/util.ts
@@ -455,7 +455,7 @@ Example: Calculate area based on side length
   },
 };
 
-export function isMathNode(node: TinymathAST) {
+export function isMathNode(node: TinymathAST | string) {
   return isObject(node) && node.type === 'function' && tinymathFunctions[node.name];
 }
 
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/validation.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/validation.ts
index 5b7a9beaa4e32..d65ef5ada8b37 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/validation.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/validation.ts
@@ -7,7 +7,7 @@
 
 import { isObject, partition } from 'lodash';
 import { i18n } from '@kbn/i18n';
-import { parse, TinymathLocation } from '@kbn/tinymath';
+import { parse, TinymathLocation, TinymathVariable } from '@kbn/tinymath';
 import type { TinymathAST, TinymathFunction, TinymathNamedArgument } from '@kbn/tinymath';
 import { esKuery, esQuery } from '../../../../../../../../src/plugins/data/public';
 import {
@@ -63,6 +63,19 @@ interface ValidationErrors {
     message: string;
     type: {};
   };
+  tooManyFirstArguments: {
+    message: string;
+    type: {
+      operation: string;
+      type: string;
+      text: string;
+      supported?: number;
+    };
+  };
+  wrongArgument: {
+    message: string;
+    type: { operation: string; text: string; type: string };
+  };
 }
 
 type ErrorTypes = keyof ValidationErrors;
@@ -276,6 +289,25 @@ function getMessageFromId<K extends ErrorTypes>({
         defaultMessage: 'Use only one of kql= or lucene=, not both',
       });
       break;
+    case 'tooManyFirstArguments':
+      message = i18n.translate('xpack.lens.indexPattern.formulaOperationTooManyFirstArguments', {
+        defaultMessage:
+          'The operation {operation} in the Formula requires a {supported, plural, one {single} other {supported}} {type}, found: {text}',
+        values: {
+          operation: out.operation,
+          text: out.text,
+          type: out.type,
+          supported: out.supported || 1,
+        },
+      });
+      break;
+    case 'wrongArgument':
+      message = i18n.translate('xpack.lens.indexPattern.formulaOperationwrongArgument', {
+        defaultMessage:
+          'The operation {operation} in the Formula does not support {type} parameters, found: {text}',
+        values: { operation: out.operation, text: out.text, type: out.type },
+      });
+      break;
     // case 'mathRequiresFunction':
     //   message = i18n.translate('xpack.lens.indexPattern.formulaMathRequiresFunctionLabel', {
     //     defaultMessage; 'The function {name} requires an Elasticsearch function',
@@ -531,14 +563,16 @@ function runFullASTValidation(
     } else {
       if (nodeOperation.input === 'field') {
         if (shouldHaveFieldArgument(node)) {
-          if (!isFirstArgumentValidType(firstArg, 'variable')) {
+          if (!isArgumentValidType(firstArg, 'variable')) {
             if (isMathNode(firstArg)) {
               errors.push(
                 getMessageFromId({
                   messageId: 'wrongFirstArgument',
                   values: {
                     operation: node.name,
-                    type: 'field',
+                    type: i18n.translate('xpack.lens.indexPattern.formulaFieldValue', {
+                      defaultMessage: 'field',
+                    }),
                     argument: `math operation`,
                   },
                   locations: node.location ? [node.location] : [],
@@ -550,7 +584,9 @@ function runFullASTValidation(
                   messageId: 'wrongFirstArgument',
                   values: {
                     operation: node.name,
-                    type: 'field',
+                    type: i18n.translate('xpack.lens.indexPattern.formulaFieldValue', {
+                      defaultMessage: 'field',
+                    }),
                     argument:
                       getValueOrName(firstArg) ||
                       i18n.translate('xpack.lens.indexPattern.formulaNoFieldForOperation', {
@@ -561,6 +597,25 @@ function runFullASTValidation(
                 })
               );
             }
+          } else {
+            // If the first argument is valid proceed with the other arguments validation
+            const fieldErrors = validateFieldArguments(node, variables, {
+              isFieldOperation: true,
+              firstArg,
+            });
+            if (fieldErrors.length) {
+              errors.push(...fieldErrors);
+            }
+          }
+          const functionErrors = validateFunctionArguments(node, functions, 0, {
+            isFieldOperation: true,
+            type: i18n.translate('xpack.lens.indexPattern.formulaFieldValue', {
+              defaultMessage: 'field',
+            }),
+            firstArgValidation: false,
+          });
+          if (functionErrors.length) {
+            errors.push(...functionErrors);
           }
         } else {
           // Named arguments only
@@ -602,16 +657,20 @@ function runFullASTValidation(
       if (nodeOperation.input === 'fullReference') {
         // What about fn(7 + 1)? We may want to allow that
         // In general this should be handled down the Esaggs route rather than here
-        if (
-          !isFirstArgumentValidType(firstArg, 'function') ||
-          (isMathNode(firstArg) && validateMathNodes(firstArg, missingVariablesSet).length)
-        ) {
+        const isFirstArgumentNotValid = Boolean(
+          !isArgumentValidType(firstArg, 'function') ||
+            (isMathNode(firstArg) && validateMathNodes(firstArg, missingVariablesSet).length)
+        );
+        // First field has a special handling
+        if (isFirstArgumentNotValid) {
           errors.push(
             getMessageFromId({
               messageId: 'wrongFirstArgument',
               values: {
                 operation: node.name,
-                type: 'operation',
+                type: i18n.translate('xpack.lens.indexPattern.formulaOperationValue', {
+                  defaultMessage: 'operation',
+                }),
                 argument:
                   getValueOrName(firstArg) ||
                   i18n.translate('xpack.lens.indexPattern.formulaNoOperation', {
@@ -622,6 +681,21 @@ function runFullASTValidation(
             })
           );
         }
+        // Check for multiple function passed
+        const requiredFunctions = nodeOperation.requiredReferences
+          ? nodeOperation.requiredReferences.length
+          : 1;
+        const functionErrors = validateFunctionArguments(node, functions, requiredFunctions, {
+          isFieldOperation: false,
+          firstArgValidation: isFirstArgumentNotValid,
+          type: i18n.translate('xpack.lens.indexPattern.formulaMetricValue', {
+            defaultMessage: 'metric',
+          }),
+        });
+        if (functionErrors.length) {
+          errors.push(...functionErrors);
+        }
+
         if (!canHaveParams(nodeOperation) && namedArguments.length) {
           errors.push(
             getMessageFromId({
@@ -633,6 +707,14 @@ function runFullASTValidation(
             })
           );
         } else {
+          // check for fields passed at any position
+          const fieldErrors = validateFieldArguments(node, variables, {
+            isFieldOperation: false,
+            firstArg,
+          });
+          if (fieldErrors.length) {
+            errors.push(...fieldErrors);
+          }
           const argumentsErrors = validateNameArguments(
             node,
             nodeOperation,
@@ -736,7 +818,7 @@ export function hasFunctionFieldArgument(type: string) {
   return !['count'].includes(type);
 }
 
-export function isFirstArgumentValidType(arg: TinymathAST, type: TinymathNodeTypes['type']) {
+export function isArgumentValidType(arg: TinymathAST | string, type: TinymathNodeTypes['type']) {
   return isObject(arg) && arg.type === type;
 }
 
@@ -812,3 +894,109 @@ export function validateMathNodes(root: TinymathAST, missingVariableSet: Set<str
   });
   return errors;
 }
+
+function validateFieldArguments(
+  node: TinymathFunction,
+  variables: Array<string | number | TinymathVariable>,
+  { isFieldOperation, firstArg }: { isFieldOperation: boolean; firstArg: TinymathAST }
+) {
+  const fields = variables.filter(
+    (arg) => isArgumentValidType(arg, 'variable') && !isMathNode(arg)
+  );
+  const errors = [];
+  if (isFieldOperation && (fields.length > 1 || (fields.length === 1 && fields[0] !== firstArg))) {
+    errors.push(
+      getMessageFromId({
+        messageId: 'tooManyFirstArguments',
+        values: {
+          operation: node.name,
+          type: i18n.translate('xpack.lens.indexPattern.formulaFieldValue', {
+            defaultMessage: 'field',
+          }),
+          supported: 1,
+          text: (fields as TinymathVariable[]).map(({ text }) => text).join(', '),
+        },
+        locations: node.location ? [node.location] : [],
+      })
+    );
+  }
+  if (!isFieldOperation && fields.length) {
+    errors.push(
+      getMessageFromId({
+        messageId: 'wrongArgument',
+        values: {
+          operation: node.name,
+          text: (fields as TinymathVariable[]).map(({ text }) => text).join(', '),
+          type: i18n.translate('xpack.lens.indexPattern.formulaFieldValue', {
+            defaultMessage: 'field',
+          }),
+        },
+        locations: node.location ? [node.location] : [],
+      })
+    );
+  }
+  return errors;
+}
+
+function validateFunctionArguments(
+  node: TinymathFunction,
+  functions: TinymathFunction[],
+  requiredFunctions: number = 0,
+  {
+    isFieldOperation,
+    firstArgValidation,
+    type,
+  }: { isFieldOperation: boolean; firstArgValidation: boolean; type: string }
+) {
+  const errors = [];
+  // For math operation let the native operation run its own validation
+  const [esOperations, mathOperations] = partition(functions, (arg) => !isMathNode(arg));
+  if (esOperations.length > requiredFunctions) {
+    if (isFieldOperation) {
+      errors.push(
+        getMessageFromId({
+          messageId: 'wrongArgument',
+          values: {
+            operation: node.name,
+            text: (esOperations as TinymathFunction[]).map(({ text }) => text).join(', '),
+            type: i18n.translate('xpack.lens.indexPattern.formulaMetricValue', {
+              defaultMessage: 'metric',
+            }),
+          },
+          locations: node.location ? [node.location] : [],
+        })
+      );
+    } else {
+      errors.push(
+        getMessageFromId({
+          messageId: 'tooManyFirstArguments',
+          values: {
+            operation: node.name,
+            type,
+            supported: requiredFunctions,
+            text: (esOperations as TinymathFunction[]).map(({ text }) => text).join(', '),
+          },
+          locations: node.location ? [node.location] : [],
+        })
+      );
+    }
+  }
+  // full reference operation have another way to handle math operations
+  if (
+    isFieldOperation &&
+    ((!firstArgValidation && mathOperations.length) || mathOperations.length > 1)
+  ) {
+    errors.push(
+      getMessageFromId({
+        messageId: 'wrongArgument',
+        values: {
+          operation: node.name,
+          type,
+          text: (mathOperations as TinymathFunction[]).map(({ text }) => text).join(', '),
+        },
+        locations: node.location ? [node.location] : [],
+      })
+    );
+  }
+  return errors;
+}
diff --git a/x-pack/plugins/lens/server/routes/field_stats.ts b/x-pack/plugins/lens/server/routes/field_stats.ts
index 12d3ef3f4a95e..7103e395eabdc 100644
--- a/x-pack/plugins/lens/server/routes/field_stats.ts
+++ b/x-pack/plugins/lens/server/routes/field_stats.ts
@@ -8,7 +8,7 @@ import { errors, estypes } from '@elastic/elasticsearch';
 import DateMath from '@elastic/datemath';
 import { schema } from '@kbn/config-schema';
 import { CoreSetup } from 'src/core/server';
-import { IFieldType } from 'src/plugins/data/common';
+import type { IndexPatternField } from 'src/plugins/data/common';
 import { SavedObjectNotFound } from '../../../../../src/plugins/kibana_utils/common';
 import { ESSearchResponse } from '../../../../../src/core/types/elasticsearch';
 import { FieldStatsResponse, BASE_API_URL } from '../../common';
@@ -79,6 +79,14 @@ export async function initFieldsRoute(setup: CoreSetup<PluginStartContract>) {
           },
         };
 
+        const runtimeMappings = indexPattern.fields
+          .filter((f) => f.runtimeField)
+          .reduce((acc, f) => {
+            if (!f.runtimeField) return acc;
+            acc[f.name] = f.runtimeField;
+            return acc;
+          }, {} as Record<string, estypes.MappingRuntimeField>);
+
         const search = async (aggs: Record<string, estypes.AggregationsAggregationContainer>) => {
           const { body: result } = await requestClient.search({
             index: indexPattern.title,
@@ -86,7 +94,7 @@ export async function initFieldsRoute(setup: CoreSetup<PluginStartContract>) {
             body: {
               query,
               aggs,
-              runtime_mappings: field.runtimeField ? { [fieldName]: field.runtimeField } : {},
+              runtime_mappings: runtimeMappings,
             },
             size: 0,
           });
@@ -138,7 +146,7 @@ export async function getNumberHistogram(
   aggSearchWithBody: (
     aggs: Record<string, estypes.AggregationsAggregationContainer>
   ) => Promise<unknown>,
-  field: IFieldType,
+  field: IndexPatternField,
   useTopHits = true
 ): Promise<FieldStatsResponse> {
   const fieldRef = getFieldRef(field);
@@ -247,7 +255,7 @@ export async function getNumberHistogram(
 
 export async function getStringSamples(
   aggSearchWithBody: (aggs: Record<string, estypes.AggregationsAggregationContainer>) => unknown,
-  field: IFieldType,
+  field: IndexPatternField,
   size = 10
 ): Promise<FieldStatsResponse> {
   const fieldRef = getFieldRef(field);
@@ -287,7 +295,7 @@ export async function getStringSamples(
 // This one is not sampled so that it returns the full date range
 export async function getDateHistogram(
   aggSearchWithBody: (aggs: Record<string, estypes.AggregationsAggregationContainer>) => unknown,
-  field: IFieldType,
+  field: IndexPatternField,
   range: { fromDate: string; toDate: string }
 ): Promise<FieldStatsResponse> {
   const fromDate = DateMath.parse(range.fromDate);
@@ -329,7 +337,7 @@ export async function getDateHistogram(
   };
 }
 
-function getFieldRef(field: IFieldType) {
+function getFieldRef(field: IndexPatternField) {
   return field.scripted
     ? {
         script: {
diff --git a/x-pack/plugins/lists/public/exceptions/components/autocomplete/field.tsx b/x-pack/plugins/lists/public/exceptions/components/autocomplete/field.tsx
index b3a5e36f12e40..47527914e71ff 100644
--- a/x-pack/plugins/lists/public/exceptions/components/autocomplete/field.tsx
+++ b/x-pack/plugins/lists/public/exceptions/components/autocomplete/field.tsx
@@ -28,6 +28,13 @@ interface OperatorProps {
   selectedField: IFieldType | undefined;
 }
 
+/**
+ * There is a copy within:
+ * x-pack/plugins/security_solution/public/common/components/autocomplete/field.tsx
+ *
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
+ * NOTE: This has deviated from the copy and will have to be reconciled.
+ */
 export const FieldComponent: React.FC<OperatorProps> = ({
   fieldInputWidth,
   fieldTypeFilter = [],
diff --git a/x-pack/plugins/lists/public/exceptions/components/autocomplete/field_value_match.tsx b/x-pack/plugins/lists/public/exceptions/components/autocomplete/field_value_match.tsx
index c1776280842c6..8dbe8f223ae5b 100644
--- a/x-pack/plugins/lists/public/exceptions/components/autocomplete/field_value_match.tsx
+++ b/x-pack/plugins/lists/public/exceptions/components/autocomplete/field_value_match.tsx
@@ -47,6 +47,11 @@ interface AutocompleteFieldMatchProps {
   onError?: (arg: boolean) => void;
 }
 
+/**
+ * There is a copy of this within:
+ * x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
+ */
 export const AutocompleteFieldMatchComponent: React.FC<AutocompleteFieldMatchProps> = ({
   placeholder,
   rowLabel,
diff --git a/x-pack/plugins/lists/public/exceptions/components/autocomplete/helpers.ts b/x-pack/plugins/lists/public/exceptions/components/autocomplete/helpers.ts
index 965214815eedf..975416e272227 100644
--- a/x-pack/plugins/lists/public/exceptions/components/autocomplete/helpers.ts
+++ b/x-pack/plugins/lists/public/exceptions/components/autocomplete/helpers.ts
@@ -10,6 +10,7 @@ import { EuiComboBoxOptionOption } from '@elastic/eui';
 import type { ListSchema, Type } from '@kbn/securitysolution-io-ts-list-types';
 import {
   EXCEPTION_OPERATORS,
+  OperatorOption,
   doesNotExistOperator,
   existsOperator,
   isNotOperator,
@@ -18,7 +19,7 @@ import {
 
 import { IFieldType } from '../../../../../../../src/plugins/data/common';
 
-import { GetGenericComboBoxPropsReturn, OperatorOption } from './types';
+import { GetGenericComboBoxPropsReturn } from './types';
 import * as i18n from './translations';
 
 /**
@@ -72,6 +73,10 @@ export const checkEmptyValue = (
 
 /**
  * Very basic validation for values
+ * There is a copy within:
+ * x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts
+ *
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
  *
  * @param param the value being checked
  * @param field the selected field
@@ -109,7 +114,10 @@ export const paramIsValid = (
 
 /**
  * Determines the options, selected values and option labels for EUI combo box
+ * There is a copy within:
+ * x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts
  *
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
  * @param options options user can select from
  * @param selectedOptions user selection if any
  * @param getLabel helper function to know which property to use for labels
diff --git a/x-pack/plugins/lists/public/exceptions/components/autocomplete/hooks/use_field_value_autocomplete.ts b/x-pack/plugins/lists/public/exceptions/components/autocomplete/hooks/use_field_value_autocomplete.ts
index 674bb5e5537d9..63d3925d6d64d 100644
--- a/x-pack/plugins/lists/public/exceptions/components/autocomplete/hooks/use_field_value_autocomplete.ts
+++ b/x-pack/plugins/lists/public/exceptions/components/autocomplete/hooks/use_field_value_autocomplete.ts
@@ -33,7 +33,10 @@ export interface UseFieldValueAutocompleteProps {
 }
 /**
  * Hook for using the field value autocomplete service
+ * There is a copy within:
+ * x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts
  *
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
  */
 export const useFieldValueAutocomplete = ({
   selectedField,
diff --git a/x-pack/plugins/lists/public/exceptions/components/autocomplete/operator.tsx b/x-pack/plugins/lists/public/exceptions/components/autocomplete/operator.tsx
index 7fc221c5a097c..0d2fe5bd664be 100644
--- a/x-pack/plugins/lists/public/exceptions/components/autocomplete/operator.tsx
+++ b/x-pack/plugins/lists/public/exceptions/components/autocomplete/operator.tsx
@@ -7,11 +7,12 @@
 
 import React, { useCallback, useMemo } from 'react';
 import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
+import { OperatorOption } from '@kbn/securitysolution-list-utils';
 
 import { IFieldType } from '../../../../../../../src/plugins/data/common';
 
 import { getGenericComboBoxProps, getOperators } from './helpers';
-import { GetGenericComboBoxPropsReturn, OperatorOption } from './types';
+import { GetGenericComboBoxPropsReturn } from './types';
 
 const AS_PLAIN_TEXT = { asPlainText: true };
 
diff --git a/x-pack/plugins/lists/public/exceptions/components/autocomplete/types.ts b/x-pack/plugins/lists/public/exceptions/components/autocomplete/types.ts
index 76d5b7758007b..07f1903fb70e1 100644
--- a/x-pack/plugins/lists/public/exceptions/components/autocomplete/types.ts
+++ b/x-pack/plugins/lists/public/exceptions/components/autocomplete/types.ts
@@ -6,20 +6,9 @@
  */
 
 import { EuiComboBoxOptionOption } from '@elastic/eui';
-import type {
-  ListOperatorEnum as OperatorEnum,
-  ListOperatorTypeEnum as OperatorTypeEnum,
-} from '@kbn/securitysolution-io-ts-list-types';
 
 export interface GetGenericComboBoxPropsReturn {
   comboOptions: EuiComboBoxOptionOption[];
   labels: string[];
   selectedComboOptions: EuiComboBoxOptionOption[];
 }
-
-export interface OperatorOption {
-  message: string;
-  value: string;
-  operator: OperatorEnum;
-  type: OperatorTypeEnum;
-}
diff --git a/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.tsx b/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.tsx
index 7daef8467dd1a..c54da89766d76 100644
--- a/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.tsx
+++ b/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.tsx
@@ -18,6 +18,7 @@ import {
   BuilderEntry,
   EXCEPTION_OPERATORS_ONLY_LISTS,
   FormattedBuilderEntry,
+  OperatorOption,
   getEntryOnFieldChange,
   getEntryOnListChange,
   getEntryOnMatchAnyChange,
@@ -32,7 +33,6 @@ import { IFieldType, IIndexPattern } from '../../../../../../../src/plugins/data
 import { HttpStart } from '../../../../../../../src/core/public';
 import { FieldComponent } from '../autocomplete/field';
 import { OperatorComponent } from '../autocomplete/operator';
-import { OperatorOption } from '../autocomplete/types';
 import { AutocompleteFieldExistsComponent } from '../autocomplete/field_value_exists';
 import { AutocompleteFieldMatchComponent } from '../autocomplete/field_value_match';
 import { AutocompleteFieldMatchAnyComponent } from '../autocomplete/field_value_match_any';
diff --git a/x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts b/x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts
index 212db40f3168c..afeac2d1bf4de 100644
--- a/x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts
+++ b/x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts
@@ -24,6 +24,7 @@ import {
   EmptyEntry,
   ExceptionsBuilderExceptionItem,
   FormattedBuilderEntry,
+  OperatorOption,
   doesNotExistOperator,
   existsOperator,
   filterExceptionItems,
@@ -64,7 +65,6 @@ import { getEntryNestedMock } from '../../../../common/schemas/types/entry_neste
 import { getEntryMatchMock } from '../../../../common/schemas/types/entry_match.mock';
 import { getEntryMatchAnyMock } from '../../../../common/schemas/types/entry_match_any.mock';
 import { getListResponseMock } from '../../../../common/schemas/response/list_schema.mock';
-import { OperatorOption } from '../autocomplete/types';
 import { getEntryListMock } from '../../../../common/schemas/types/entry_list.mock';
 
 // TODO: ALL THESE TESTS SHOULD BE MOVED TO @kbn/securitysolution-list-utils for its helper. The only reason why they're here is due to missing other packages we hae to create or missing things from kbn packages such as mocks from kibana core
diff --git a/x-pack/plugins/maps/public/actions/data_request_actions.ts b/x-pack/plugins/maps/public/actions/data_request_actions.ts
index 47350474eef04..50df95a52c4d4 100644
--- a/x-pack/plugins/maps/public/actions/data_request_actions.ts
+++ b/x-pack/plugins/maps/public/actions/data_request_actions.ts
@@ -55,6 +55,7 @@ export type DataRequestContext = {
   startLoading(dataId: string, requestToken: symbol, requestMeta?: DataMeta): void;
   stopLoading(dataId: string, requestToken: symbol, data: object, resultsMeta?: DataMeta): void;
   onLoadError(dataId: string, requestToken: symbol, errorMessage: string): void;
+  onJoinError(errorMessage: string): void;
   updateSourceData(newData: unknown): void;
   isRequestStillActive(dataId: string, requestToken: symbol): boolean;
   registerCancelCallback(requestToken: symbol, callback: () => void): void;
@@ -121,6 +122,8 @@ function getDataRequestContext(
       dispatch(endDataLoad(layerId, dataId, requestToken, data, meta)),
     onLoadError: (dataId: string, requestToken: symbol, errorMessage: string) =>
       dispatch(onDataLoadError(layerId, dataId, requestToken, errorMessage)),
+    onJoinError: (errorMessage: string) =>
+      dispatch(setLayerDataLoadErrorStatus(layerId, errorMessage)),
     updateSourceData: (newData: object) => {
       dispatch(updateSourceDataRequest(layerId, newData));
     },
@@ -193,13 +196,11 @@ export function syncDataForLayerId(layerId: string | null) {
 }
 
 function setLayerDataLoadErrorStatus(layerId: string, errorMessage: string | null) {
-  return (dispatch: Dispatch) => {
-    dispatch({
-      type: SET_LAYER_ERROR_STATUS,
-      isInErrorState: errorMessage !== null,
-      layerId,
-      errorMessage,
-    });
+  return {
+    type: SET_LAYER_ERROR_STATUS,
+    isInErrorState: errorMessage !== null,
+    layerId,
+    errorMessage,
   };
 }
 
diff --git a/x-pack/plugins/maps/public/classes/joins/inner_join.ts b/x-pack/plugins/maps/public/classes/joins/inner_join.ts
index 988690233d484..9f6fec576e9e2 100644
--- a/x-pack/plugins/maps/public/classes/joins/inner_join.ts
+++ b/x-pack/plugins/maps/public/classes/joins/inner_join.ts
@@ -118,17 +118,23 @@ export class InnerJoin {
       });
     }
 
-    const joinKey = feature.properties[this._leftField.getName()];
-    const coercedKey =
-      typeof joinKey === 'undefined' || joinKey === null ? null : joinKey.toString();
-    if (coercedKey !== null && propertiesMap.has(coercedKey)) {
-      Object.assign(feature.properties, propertiesMap.get(coercedKey));
+    const joinKey = this.getJoinKey(feature);
+    if (joinKey !== null && propertiesMap.has(joinKey)) {
+      Object.assign(feature.properties, propertiesMap.get(joinKey));
       return true;
     } else {
       return false;
     }
   }
 
+  getJoinKey(feature: Feature): string | null {
+    const joinKey =
+      feature.properties && this._leftField
+        ? feature.properties[this._leftField.getName()]
+        : undefined;
+    return joinKey === undefined || joinKey === null ? null : joinKey.toString();
+  }
+
   getRightJoinSource(): ITermJoinSource {
     if (!this._rightSource) {
       throw new Error('Cannot get rightSource from InnerJoin with incomplete config');
diff --git a/x-pack/plugins/maps/public/classes/layers/__fixtures__/mock_sync_context.ts b/x-pack/plugins/maps/public/classes/layers/__fixtures__/mock_sync_context.ts
index dd1367605376d..16aca6760c4d5 100644
--- a/x-pack/plugins/maps/public/classes/layers/__fixtures__/mock_sync_context.ts
+++ b/x-pack/plugins/maps/public/classes/layers/__fixtures__/mock_sync_context.ts
@@ -16,6 +16,7 @@ export class MockSyncContext implements DataRequestContext {
   registerCancelCallback: (requestToken: symbol, callback: () => void) => void;
   startLoading: (dataId: string, requestToken: symbol, meta: DataMeta) => void;
   stopLoading: (dataId: string, requestToken: symbol, data: object, meta: DataMeta) => void;
+  onJoinError: (errorMessage: string) => void;
   updateSourceData: (newData: unknown) => void;
   forceRefresh: boolean;
 
@@ -38,6 +39,7 @@ export class MockSyncContext implements DataRequestContext {
     this.registerCancelCallback = sinon.spy();
     this.startLoading = sinon.spy();
     this.stopLoading = sinon.spy();
+    this.onJoinError = sinon.spy();
     this.updateSourceData = sinon.spy();
     this.forceRefresh = false;
   }
diff --git a/x-pack/plugins/maps/public/classes/layers/file_upload_wizard/wizard.tsx b/x-pack/plugins/maps/public/classes/layers/file_upload_wizard/wizard.tsx
index 024c2308df6c6..87747d915af4a 100644
--- a/x-pack/plugins/maps/public/classes/layers/file_upload_wizard/wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/file_upload_wizard/wizard.tsx
@@ -106,7 +106,7 @@ export class ClientFileCreateSourceEditor extends Component<RenderWizardArgument
         ? i18n.translate('xpack.maps.fileUpload.trimmedResultsMsg', {
             defaultMessage: `Results limited to {numFeatures} features, {previewCoverage}% of file.`,
             values: {
-              numFeatures: geojsonFile.features.length,
+              numFeatures: geojsonFile.features.length.toLocaleString(),
               previewCoverage,
             },
           })
diff --git a/x-pack/plugins/maps/public/classes/layers/load_layer_wizards.ts b/x-pack/plugins/maps/public/classes/layers/load_layer_wizards.ts
index 3c86c57343a06..928c6a5362c66 100644
--- a/x-pack/plugins/maps/public/classes/layers/load_layer_wizards.ts
+++ b/x-pack/plugins/maps/public/classes/layers/load_layer_wizards.ts
@@ -38,7 +38,6 @@ export function registerLayerWizards() {
 
   // Registration order determines display order
   registerLayerWizard(uploadLayerWizardConfig);
-  registerLayerWizard(newVectorLayerWizardConfig);
   registerLayerWizard(esDocumentsLayerWizardConfig);
   // @ts-ignore
   registerLayerWizard(choroplethLayerWizardConfig);
@@ -51,6 +50,7 @@ export function registerLayerWizards() {
   registerLayerWizard(point2PointLayerWizardConfig);
   // @ts-ignore
   registerLayerWizard(emsBoundariesLayerWizardConfig);
+  registerLayerWizard(newVectorLayerWizardConfig);
   // @ts-ignore
   registerLayerWizard(emsBaseMapLayerWizardConfig);
   // @ts-ignore
diff --git a/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/create_layer_descriptor.test.ts b/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/create_layer_descriptor.test.ts
index 1ac2690d6bada..74ab35e6cb360 100644
--- a/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/create_layer_descriptor.test.ts
+++ b/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/create_layer_descriptor.test.ts
@@ -54,7 +54,7 @@ describe('createLayerDescriptor', () => {
             applyGlobalTime: true,
             id: '12345',
             indexPatternId: 'apm_static_index_pattern_id',
-            indexPatternTitle: 'apm-*',
+            indexPatternTitle: 'traces-apm*,logs-apm*,metrics-apm*,apm-*',
             metrics: [
               {
                 field: 'transaction.duration.us',
diff --git a/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/create_layer_descriptor.ts b/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/create_layer_descriptor.ts
index adf6f1d7f270d..0b57afb38d585 100644
--- a/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/create_layer_descriptor.ts
+++ b/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/create_layer_descriptor.ts
@@ -39,7 +39,7 @@ import { getDefaultDynamicProperties } from '../../../styles/vector/vector_style
 
 // redefining APM constant to avoid making maps app depend on APM plugin
 export const APM_INDEX_PATTERN_ID = 'apm_static_index_pattern_id';
-export const APM_INDEX_PATTERN_TITLE = 'apm-*';
+export const APM_INDEX_PATTERN_TITLE = 'traces-apm*,logs-apm*,metrics-apm*,apm-*';
 
 const defaultDynamicProperties = getDefaultDynamicProperties();
 
diff --git a/x-pack/plugins/maps/public/classes/layers/solution_layers/security/create_layer_descriptors.test.ts b/x-pack/plugins/maps/public/classes/layers/solution_layers/security/create_layer_descriptors.test.ts
index 9c6e72fc11d3a..a3a3e8b20f678 100644
--- a/x-pack/plugins/maps/public/classes/layers/solution_layers/security/create_layer_descriptors.test.ts
+++ b/x-pack/plugins/maps/public/classes/layers/solution_layers/security/create_layer_descriptors.test.ts
@@ -706,4 +706,343 @@ describe('createLayerDescriptor', () => {
       },
     ]);
   });
+
+  test('apm data stream', () => {
+    expect(createSecurityLayerDescriptors('id', 'traces-apm-opbean-node')).toEqual([
+      {
+        __dataRequests: [],
+        alpha: 0.75,
+        id: '12345',
+        includeInFitToBounds: true,
+        joins: [],
+        label: 'traces-apm-opbean-node | Source Point',
+        maxZoom: 24,
+        minZoom: 0,
+        sourceDescriptor: {
+          applyGlobalQuery: true,
+          applyGlobalTime: true,
+          filterByMapBounds: true,
+          geoField: 'client.geo.location',
+          id: '12345',
+          indexPatternId: 'id',
+          scalingType: 'TOP_HITS',
+          sortField: '',
+          sortOrder: 'desc',
+          tooltipProperties: [
+            'host.name',
+            'client.ip',
+            'client.domain',
+            'client.geo.country_iso_code',
+            'client.as.organization.name',
+          ],
+          topHitsSize: 1,
+          topHitsSplitField: 'client.ip',
+          type: 'ES_SEARCH',
+        },
+        style: {
+          isTimeAware: true,
+          properties: {
+            fillColor: {
+              options: {
+                color: '#6092C0',
+              },
+              type: 'STATIC',
+            },
+            icon: {
+              options: {
+                value: 'home',
+              },
+              type: 'STATIC',
+            },
+            iconOrientation: {
+              options: {
+                orientation: 0,
+              },
+              type: 'STATIC',
+            },
+            iconSize: {
+              options: {
+                size: 8,
+              },
+              type: 'STATIC',
+            },
+            labelBorderColor: {
+              options: {
+                color: '#FFFFFF',
+              },
+              type: 'STATIC',
+            },
+            labelBorderSize: {
+              options: {
+                size: 'SMALL',
+              },
+            },
+            labelColor: {
+              options: {
+                color: '#000000',
+              },
+              type: 'STATIC',
+            },
+            labelSize: {
+              options: {
+                size: 14,
+              },
+              type: 'STATIC',
+            },
+            labelText: {
+              options: {
+                value: '',
+              },
+              type: 'STATIC',
+            },
+            lineColor: {
+              options: {
+                color: '#FFFFFF',
+              },
+              type: 'STATIC',
+            },
+            lineWidth: {
+              options: {
+                size: 2,
+              },
+              type: 'STATIC',
+            },
+            symbolizeAs: {
+              options: {
+                value: 'icon',
+              },
+            },
+          },
+          type: 'VECTOR',
+        },
+        type: 'VECTOR',
+        visible: true,
+      },
+      {
+        __dataRequests: [],
+        alpha: 0.75,
+        id: '12345',
+        includeInFitToBounds: true,
+        joins: [],
+        label: 'traces-apm-opbean-node | Destination point',
+        maxZoom: 24,
+        minZoom: 0,
+        sourceDescriptor: {
+          applyGlobalQuery: true,
+          applyGlobalTime: true,
+          filterByMapBounds: true,
+          geoField: 'server.geo.location',
+          id: '12345',
+          indexPatternId: 'id',
+          scalingType: 'TOP_HITS',
+          sortField: '',
+          sortOrder: 'desc',
+          tooltipProperties: [
+            'host.name',
+            'server.ip',
+            'server.domain',
+            'server.geo.country_iso_code',
+            'server.as.organization.name',
+          ],
+          topHitsSize: 1,
+          topHitsSplitField: 'server.ip',
+          type: 'ES_SEARCH',
+        },
+        style: {
+          isTimeAware: true,
+          properties: {
+            fillColor: {
+              options: {
+                color: '#D36086',
+              },
+              type: 'STATIC',
+            },
+            icon: {
+              options: {
+                value: 'marker',
+              },
+              type: 'STATIC',
+            },
+            iconOrientation: {
+              options: {
+                orientation: 0,
+              },
+              type: 'STATIC',
+            },
+            iconSize: {
+              options: {
+                size: 8,
+              },
+              type: 'STATIC',
+            },
+            labelBorderColor: {
+              options: {
+                color: '#FFFFFF',
+              },
+              type: 'STATIC',
+            },
+            labelBorderSize: {
+              options: {
+                size: 'SMALL',
+              },
+            },
+            labelColor: {
+              options: {
+                color: '#000000',
+              },
+              type: 'STATIC',
+            },
+            labelSize: {
+              options: {
+                size: 14,
+              },
+              type: 'STATIC',
+            },
+            labelText: {
+              options: {
+                value: '',
+              },
+              type: 'STATIC',
+            },
+            lineColor: {
+              options: {
+                color: '#FFFFFF',
+              },
+              type: 'STATIC',
+            },
+            lineWidth: {
+              options: {
+                size: 2,
+              },
+              type: 'STATIC',
+            },
+            symbolizeAs: {
+              options: {
+                value: 'icon',
+              },
+            },
+          },
+          type: 'VECTOR',
+        },
+        type: 'VECTOR',
+        visible: true,
+      },
+      {
+        __dataRequests: [],
+        alpha: 0.75,
+        id: '12345',
+        includeInFitToBounds: true,
+        joins: [],
+        label: 'traces-apm-opbean-node | Line',
+        maxZoom: 24,
+        minZoom: 0,
+        sourceDescriptor: {
+          applyGlobalQuery: true,
+          applyGlobalTime: true,
+          destGeoField: 'server.geo.location',
+          id: '12345',
+          indexPatternId: 'id',
+          metrics: [
+            {
+              field: 'client.bytes',
+              type: 'sum',
+            },
+            {
+              field: 'server.bytes',
+              type: 'sum',
+            },
+          ],
+          sourceGeoField: 'client.geo.location',
+          type: 'ES_PEW_PEW',
+        },
+        style: {
+          isTimeAware: true,
+          properties: {
+            fillColor: {
+              options: {
+                color: '#54B399',
+              },
+              type: 'STATIC',
+            },
+            icon: {
+              options: {
+                value: 'marker',
+              },
+              type: 'STATIC',
+            },
+            iconOrientation: {
+              options: {
+                orientation: 0,
+              },
+              type: 'STATIC',
+            },
+            iconSize: {
+              options: {
+                size: 6,
+              },
+              type: 'STATIC',
+            },
+            labelBorderColor: {
+              options: {
+                color: '#FFFFFF',
+              },
+              type: 'STATIC',
+            },
+            labelBorderSize: {
+              options: {
+                size: 'SMALL',
+              },
+            },
+            labelColor: {
+              options: {
+                color: '#000000',
+              },
+              type: 'STATIC',
+            },
+            labelSize: {
+              options: {
+                size: 14,
+              },
+              type: 'STATIC',
+            },
+            labelText: {
+              options: {
+                value: '',
+              },
+              type: 'STATIC',
+            },
+            lineColor: {
+              options: {
+                color: '#6092C0',
+              },
+              type: 'STATIC',
+            },
+            lineWidth: {
+              options: {
+                field: {
+                  name: 'doc_count',
+                  origin: 'source',
+                },
+                fieldMetaOptions: {
+                  isEnabled: true,
+                  sigma: 3,
+                },
+                maxSize: 8,
+                minSize: 1,
+              },
+              type: 'DYNAMIC',
+            },
+            symbolizeAs: {
+              options: {
+                value: 'circle',
+              },
+            },
+          },
+          type: 'VECTOR',
+        },
+        type: 'VECTOR',
+        visible: true,
+      },
+    ]);
+  });
 });
diff --git a/x-pack/plugins/maps/public/classes/layers/solution_layers/security/create_layer_descriptors.ts b/x-pack/plugins/maps/public/classes/layers/solution_layers/security/create_layer_descriptors.ts
index b2283196a41dd..8a40ba63bed0d 100644
--- a/x-pack/plugins/maps/public/classes/layers/solution_layers/security/create_layer_descriptors.ts
+++ b/x-pack/plugins/maps/public/classes/layers/solution_layers/security/create_layer_descriptors.ts
@@ -35,7 +35,11 @@ const defaultDynamicProperties = getDefaultDynamicProperties();
 const euiVisColorPalette = euiPaletteColorBlind();
 
 function isApmIndex(indexPatternTitle: string) {
-  return minimatch(indexPatternTitle, APM_INDEX_PATTERN_TITLE);
+  return APM_INDEX_PATTERN_TITLE.split(',')
+    .map((pattern) => {
+      return minimatch(indexPatternTitle, pattern);
+    })
+    .some(Boolean);
 }
 
 function getSourceField(indexPatternTitle: string) {
diff --git a/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.tsx b/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.tsx
index 880a47d0981cb..6277411fa053a 100644
--- a/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.tsx
@@ -95,13 +95,13 @@ export class TiledVectorLayer extends VectorLayer {
         ? i18n.translate('xpack.maps.tiles.resultsTrimmedMsg', {
             defaultMessage: `Results limited to {count} documents.`,
             values: {
-              count: totalFeaturesCount,
+              count: totalFeaturesCount.toLocaleString(),
             },
           })
         : i18n.translate('xpack.maps.tiles.resultsCompleteMsg', {
             defaultMessage: `Found {count} documents.`,
             values: {
-              count: totalFeaturesCount,
+              count: totalFeaturesCount.toLocaleString(),
             },
           }),
       areResultsTrimmed: isIncomplete,
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/perform_inner_joins.test.ts b/x-pack/plugins/maps/public/classes/layers/vector_layer/perform_inner_joins.test.ts
new file mode 100644
index 0000000000000..aad1b693be79b
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/perform_inner_joins.test.ts
@@ -0,0 +1,285 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import sinon from 'sinon';
+import _ from 'lodash';
+import { FeatureCollection } from 'geojson';
+import { ESTermSourceDescriptor } from '../../../../common/descriptor_types';
+import {
+  AGG_TYPE,
+  FEATURE_VISIBLE_PROPERTY_NAME,
+  SOURCE_TYPES,
+} from '../../../../common/constants';
+import { performInnerJoins } from './perform_inner_joins';
+import { InnerJoin } from '../../joins/inner_join';
+import { IVectorSource } from '../../sources/vector_source';
+import { IField } from '../../fields/field';
+
+const LEFT_FIELD = 'leftKey';
+const COUNT_PROPERTY_NAME = '__kbnjoin__count__d3625663-5b34-4d50-a784-0d743f676a0c';
+const featureCollection = {
+  type: 'FeatureCollection',
+  features: [
+    {
+      type: 'Feature',
+      properties: {
+        [FEATURE_VISIBLE_PROPERTY_NAME]: false,
+        [LEFT_FIELD]: 'alpha',
+      },
+      geometry: {
+        type: 'Point',
+        coordinates: [-112, 46],
+      },
+    },
+    {
+      type: 'Feature',
+      properties: {
+        [COUNT_PROPERTY_NAME]: 20,
+        [FEATURE_VISIBLE_PROPERTY_NAME]: true,
+        [LEFT_FIELD]: 'bravo',
+      },
+      geometry: {
+        type: 'Point',
+        coordinates: [-100, 40],
+      },
+    },
+  ],
+};
+
+const joinDescriptor = {
+  leftField: LEFT_FIELD,
+  right: {
+    applyGlobalQuery: true,
+    applyGlobalTime: true,
+    id: 'd3625663-5b34-4d50-a784-0d743f676a0c',
+    indexPatternId: 'myIndexPattern',
+    metrics: [
+      {
+        type: AGG_TYPE.COUNT,
+      },
+    ],
+    term: 'rightKey',
+    type: SOURCE_TYPES.ES_TERM_SOURCE,
+  } as ESTermSourceDescriptor,
+};
+const mockVectorSource = ({
+  getInspectorAdapters: () => {
+    return undefined;
+  },
+  createField: () => {
+    return {
+      getName: () => {
+        return LEFT_FIELD;
+      },
+    } as IField;
+  },
+} as unknown) as IVectorSource;
+const innerJoin = new InnerJoin(joinDescriptor, mockVectorSource);
+const propertiesMap = new Map<string, Record<string | number, unknown>>();
+propertiesMap.set('alpha', { [COUNT_PROPERTY_NAME]: 1 });
+
+test('should skip join when no state has changed', () => {
+  const updateSourceData = sinon.spy();
+  const onJoinError = sinon.spy();
+
+  performInnerJoins(
+    {
+      refreshed: false,
+      featureCollection: _.cloneDeep(featureCollection) as FeatureCollection,
+    },
+    [
+      {
+        dataHasChanged: false,
+        join: innerJoin,
+      },
+    ],
+    updateSourceData,
+    onJoinError
+  );
+
+  expect(updateSourceData.notCalled);
+  expect(onJoinError.notCalled);
+});
+
+test('should perform join when features change', () => {
+  const updateSourceData = sinon.spy();
+  const onJoinError = sinon.spy();
+
+  performInnerJoins(
+    {
+      refreshed: true,
+      featureCollection: _.cloneDeep(featureCollection) as FeatureCollection,
+    },
+    [
+      {
+        dataHasChanged: false,
+        join: innerJoin,
+      },
+    ],
+    updateSourceData,
+    onJoinError
+  );
+
+  expect(updateSourceData.calledOnce);
+  expect(onJoinError.notCalled);
+});
+
+test('should perform join when join state changes', () => {
+  const updateSourceData = sinon.spy();
+  const onJoinError = sinon.spy();
+
+  performInnerJoins(
+    {
+      refreshed: false,
+      featureCollection: _.cloneDeep(featureCollection) as FeatureCollection,
+    },
+    [
+      {
+        dataHasChanged: true,
+        join: innerJoin,
+      },
+    ],
+    updateSourceData,
+    onJoinError
+  );
+
+  expect(updateSourceData.calledOnce);
+  expect(onJoinError.notCalled);
+});
+
+test('should call updateSourceData with feature collection with updated feature visibility and join properties', () => {
+  const updateSourceData = sinon.spy();
+  const onJoinError = sinon.spy();
+
+  performInnerJoins(
+    {
+      refreshed: true,
+      featureCollection: _.cloneDeep(featureCollection) as FeatureCollection,
+    },
+    [
+      {
+        dataHasChanged: false,
+        join: innerJoin,
+        propertiesMap,
+      },
+    ],
+    updateSourceData,
+    onJoinError
+  );
+
+  const firstCallArgs = updateSourceData.args[0];
+  const updateSourceDataFeatureCollection = firstCallArgs[0];
+  expect(updateSourceDataFeatureCollection).toEqual({
+    type: 'FeatureCollection',
+    features: [
+      {
+        type: 'Feature',
+        properties: {
+          [COUNT_PROPERTY_NAME]: 1,
+          [FEATURE_VISIBLE_PROPERTY_NAME]: true,
+          [LEFT_FIELD]: 'alpha',
+        },
+        geometry: {
+          type: 'Point',
+          coordinates: [-112, 46],
+        },
+      },
+      {
+        type: 'Feature',
+        properties: {
+          [FEATURE_VISIBLE_PROPERTY_NAME]: false,
+          [LEFT_FIELD]: 'bravo',
+        },
+        geometry: {
+          type: 'Point',
+          coordinates: [-100, 40],
+        },
+      },
+    ],
+  });
+  expect(onJoinError.notCalled);
+});
+
+test('should call updateSourceData when no results returned from terms aggregation', () => {
+  const updateSourceData = sinon.spy();
+  const onJoinError = sinon.spy();
+
+  performInnerJoins(
+    {
+      refreshed: false,
+      featureCollection: _.cloneDeep(featureCollection) as FeatureCollection,
+    },
+    [
+      {
+        dataHasChanged: true,
+        join: innerJoin,
+      },
+    ],
+    updateSourceData,
+    onJoinError
+  );
+
+  const firstCallArgs = updateSourceData.args[0];
+  const updateSourceDataFeatureCollection = firstCallArgs[0];
+  expect(updateSourceDataFeatureCollection).toEqual({
+    type: 'FeatureCollection',
+    features: [
+      {
+        type: 'Feature',
+        properties: {
+          [FEATURE_VISIBLE_PROPERTY_NAME]: false,
+          [LEFT_FIELD]: 'alpha',
+        },
+        geometry: {
+          type: 'Point',
+          coordinates: [-112, 46],
+        },
+      },
+      {
+        type: 'Feature',
+        properties: {
+          [COUNT_PROPERTY_NAME]: 20,
+          [FEATURE_VISIBLE_PROPERTY_NAME]: false,
+          [LEFT_FIELD]: 'bravo',
+        },
+        geometry: {
+          type: 'Point',
+          coordinates: [-100, 40],
+        },
+      },
+    ],
+  });
+  expect(onJoinError.notCalled);
+});
+
+test('should call onJoinError when there are no matching features', () => {
+  const updateSourceData = sinon.spy();
+  const onJoinError = sinon.spy();
+
+  // instead of returning military alphabet like "alpha" or "bravo", mismatched key returns numbers, like '1'
+  const propertiesMapFromMismatchedKey = new Map<string, Record<string | number, unknown>>();
+  propertiesMapFromMismatchedKey.set('1', { [COUNT_PROPERTY_NAME]: 1 });
+
+  performInnerJoins(
+    {
+      refreshed: false,
+      featureCollection: _.cloneDeep(featureCollection) as FeatureCollection,
+    },
+    [
+      {
+        dataHasChanged: true,
+        join: innerJoin,
+        propertiesMap: propertiesMapFromMismatchedKey,
+      },
+    ],
+    updateSourceData,
+    onJoinError
+  );
+
+  expect(updateSourceData.notCalled);
+  expect(onJoinError.calledOnce);
+});
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/perform_inner_joins.ts b/x-pack/plugins/maps/public/classes/layers/vector_layer/perform_inner_joins.ts
new file mode 100644
index 0000000000000..23c6527d3e818
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/perform_inner_joins.ts
@@ -0,0 +1,134 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FeatureCollection } from 'geojson';
+import { i18n } from '@kbn/i18n';
+import { FEATURE_VISIBLE_PROPERTY_NAME } from '../../../../common/constants';
+import { DataRequestContext } from '../../../actions';
+import { InnerJoin } from '../../joins/inner_join';
+import { PropertiesMap } from '../../../../common/elasticsearch_util';
+
+interface SourceResult {
+  refreshed: boolean;
+  featureCollection: FeatureCollection;
+}
+
+export interface JoinState {
+  dataHasChanged: boolean;
+  join: InnerJoin;
+  propertiesMap?: PropertiesMap;
+}
+
+export function performInnerJoins(
+  sourceResult: SourceResult,
+  joinStates: JoinState[],
+  updateSourceData: DataRequestContext['updateSourceData'],
+  onJoinError: DataRequestContext['onJoinError']
+) {
+  // should update the store if
+  // -- source result was refreshed
+  // -- any of the join configurations changed (joinState changed)
+  // -- visibility of any of the features has changed
+
+  let shouldUpdateStore =
+    sourceResult.refreshed || joinStates.some((joinState) => joinState.dataHasChanged);
+
+  if (!shouldUpdateStore) {
+    return;
+  }
+
+  const joinStatuses = joinStates.map((joinState) => {
+    return {
+      joinedWithAtLeastOneFeature: false,
+      keys: [] as string[],
+      joinState,
+    };
+  });
+
+  for (let i = 0; i < sourceResult.featureCollection.features.length; i++) {
+    const feature = sourceResult.featureCollection.features[i];
+    if (!feature.properties) {
+      feature.properties = {};
+    }
+    const oldVisbility = feature.properties[FEATURE_VISIBLE_PROPERTY_NAME];
+    let isFeatureVisible = true;
+    for (let j = 0; j < joinStates.length; j++) {
+      const joinState = joinStates[j];
+      const innerJoin = joinState.join;
+      const joinStatus = joinStatuses[j];
+      const joinKey = innerJoin.getJoinKey(feature);
+      if (joinKey !== null) {
+        joinStatus.keys.push(joinKey);
+      }
+      const canJoinOnCurrent = joinState.propertiesMap
+        ? innerJoin.joinPropertiesToFeature(feature, joinState.propertiesMap)
+        : false;
+      if (canJoinOnCurrent && !joinStatus.joinedWithAtLeastOneFeature) {
+        joinStatus.joinedWithAtLeastOneFeature = true;
+      }
+      isFeatureVisible = isFeatureVisible && canJoinOnCurrent;
+    }
+
+    if (oldVisbility !== isFeatureVisible) {
+      shouldUpdateStore = true;
+    }
+
+    feature.properties[FEATURE_VISIBLE_PROPERTY_NAME] = isFeatureVisible;
+  }
+
+  if (shouldUpdateStore) {
+    updateSourceData({ ...sourceResult.featureCollection });
+  }
+
+  const joinStatusesWithoutAnyMatches = joinStatuses.filter((joinStatus) => {
+    return (
+      !joinStatus.joinedWithAtLeastOneFeature && joinStatus.joinState.propertiesMap !== undefined
+    );
+  });
+
+  if (joinStatusesWithoutAnyMatches.length) {
+    function prettyPrintArray(array: unknown[]) {
+      return array.length <= 5
+        ? array.join(',')
+        : array.slice(0, 5).join(',') +
+            i18n.translate('xpack.maps.vectorLayer.joinError.firstTenMsg', {
+              defaultMessage: ` (5 of {total})`,
+              values: { total: array.length },
+            });
+    }
+
+    const joinStatus = joinStatusesWithoutAnyMatches[0];
+    const leftFieldName = joinStatus.joinState.join.getLeftField().getName();
+    const reason =
+      joinStatus.keys.length === 0
+        ? i18n.translate('xpack.maps.vectorLayer.joinError.noLeftFieldValuesMsg', {
+            defaultMessage: `Left field: '{leftFieldName}', does not provide any values.`,
+            values: { leftFieldName },
+          })
+        : i18n.translate('xpack.maps.vectorLayer.joinError.noMatchesMsg', {
+            defaultMessage: `Left field does not match right field. Left field: '{leftFieldName}' has values { leftFieldValues }. Right field: '{rightFieldName}' has values: { rightFieldValues }.`,
+            values: {
+              leftFieldName,
+              leftFieldValues: prettyPrintArray(joinStatus.keys),
+              rightFieldName: joinStatus.joinState.join
+                .getRightJoinSource()
+                .getTermField()
+                .getName(),
+              rightFieldValues: prettyPrintArray(
+                Array.from(joinStatus.joinState.propertiesMap!.keys())
+              ),
+            },
+          });
+
+    onJoinError(
+      i18n.translate('xpack.maps.vectorLayer.joinErrorMsg', {
+        defaultMessage: `Unable to perform term join. {reason}`,
+        values: { reason },
+      })
+    );
+  }
+}
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx b/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx
index 959064b3daab2..74a0ea1e63882 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx
@@ -69,17 +69,7 @@ import { IESSource } from '../../sources/es_source';
 import { PropertiesMap } from '../../../../common/elasticsearch_util';
 import { ITermJoinSource } from '../../sources/term_join_source';
 import { addGeoJsonMbSource, getVectorSourceBounds, syncVectorSource } from './utils';
-
-interface SourceResult {
-  refreshed: boolean;
-  featureCollection?: FeatureCollection;
-}
-
-interface JoinState {
-  dataHasChanged: boolean;
-  join: InnerJoin;
-  propertiesMap?: PropertiesMap;
-}
+import { JoinState, performInnerJoins } from './perform_inner_joins';
 
 export interface VectorLayerArguments {
   source: IVectorSource;
@@ -435,51 +425,6 @@ export class VectorLayer extends AbstractLayer implements IVectorLayer {
     };
   }
 
-  _performInnerJoins(
-    sourceResult: SourceResult,
-    joinStates: JoinState[],
-    updateSourceData: DataRequestContext['updateSourceData']
-  ) {
-    // should update the store if
-    // -- source result was refreshed
-    // -- any of the join configurations changed (joinState changed)
-    // -- visibility of any of the features has changed
-
-    let shouldUpdateStore =
-      sourceResult.refreshed || joinStates.some((joinState) => joinState.dataHasChanged);
-
-    if (!shouldUpdateStore) {
-      return;
-    }
-
-    for (let i = 0; i < sourceResult.featureCollection!.features.length; i++) {
-      const feature = sourceResult.featureCollection!.features[i];
-      if (!feature.properties) {
-        feature.properties = {};
-      }
-      const oldVisbility = feature.properties[FEATURE_VISIBLE_PROPERTY_NAME];
-      let isFeatureVisible = true;
-      for (let j = 0; j < joinStates.length; j++) {
-        const joinState = joinStates[j];
-        const innerJoin = joinState.join;
-        const canJoinOnCurrent = joinState.propertiesMap
-          ? innerJoin.joinPropertiesToFeature(feature, joinState.propertiesMap)
-          : false;
-        isFeatureVisible = isFeatureVisible && canJoinOnCurrent;
-      }
-
-      if (oldVisbility !== isFeatureVisible) {
-        shouldUpdateStore = true;
-      }
-
-      feature.properties[FEATURE_VISIBLE_PROPERTY_NAME] = isFeatureVisible;
-    }
-
-    if (shouldUpdateStore) {
-      updateSourceData({ ...sourceResult.featureCollection });
-    }
-  }
-
   async _syncSourceStyleMeta(
     syncContext: DataRequestContext,
     source: IVectorSource,
@@ -714,7 +659,12 @@ export class VectorLayer extends AbstractLayer implements IVectorLayer {
       }
 
       const joinStates = await this._syncJoins(syncContext, style);
-      this._performInnerJoins(sourceResult, joinStates, syncContext.updateSourceData);
+      performInnerJoins(
+        sourceResult,
+        joinStates,
+        syncContext.updateSourceData,
+        syncContext.onJoinError
+      );
     } catch (error) {
       if (!(error instanceof DataRequestAbortError)) {
         throw error;
diff --git a/x-pack/plugins/maps/public/classes/sources/es_geo_line_source/es_geo_line_source.test.ts b/x-pack/plugins/maps/public/classes/sources/es_geo_line_source/es_geo_line_source.test.ts
index 6d3171312eaec..0c15afff6b051 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_geo_line_source/es_geo_line_source.test.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_geo_line_source/es_geo_line_source.test.ts
@@ -51,7 +51,7 @@ describe('getSourceTooltipContent', () => {
       sourceDataRequest
     );
     expect(areResultsTrimmed).toBe(true);
-    expect(tooltipContent).toBe('Results limited to first 1000 tracks of ~5000.');
+    expect(tooltipContent).toBe('Results limited to first 1,000 tracks of ~5,000.');
   });
 
   it('Should show results trimmed icon and message when tracks are trimmed', () => {
@@ -90,7 +90,7 @@ describe('getSourceTooltipContent', () => {
     );
     expect(areResultsTrimmed).toBe(true);
     expect(tooltipContent).toBe(
-      'Results limited to first 1000 tracks of ~5000. 10 of 1000 tracks are incomplete.'
+      'Results limited to first 1,000 tracks of ~5,000. 10 of 1,000 tracks are incomplete.'
     );
   });
 });
diff --git a/x-pack/plugins/maps/public/classes/sources/es_geo_line_source/es_geo_line_source.tsx b/x-pack/plugins/maps/public/classes/sources/es_geo_line_source/es_geo_line_source.tsx
index 460c1228e50a8..82be83dad43f7 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_geo_line_source/es_geo_line_source.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_geo_line_source/es_geo_line_source.tsx
@@ -326,21 +326,21 @@ export class ESGeoLineSource extends AbstractESAggSource {
       ? i18n.translate('xpack.maps.esGeoLine.areEntitiesTrimmedMsg', {
           defaultMessage: `Results limited to first {entityCount} tracks of ~{totalEntities}.`,
           values: {
-            entityCount: meta.entityCount,
-            totalEntities: meta.totalEntities,
+            entityCount: meta.entityCount.toLocaleString(),
+            totalEntities: meta.totalEntities.toLocaleString(),
           },
         })
       : i18n.translate('xpack.maps.esGeoLine.tracksCountMsg', {
           defaultMessage: `Found {entityCount} tracks.`,
-          values: { entityCount: meta.entityCount },
+          values: { entityCount: meta.entityCount.toLocaleString() },
         });
     const tracksTrimmedMsg =
       meta.numTrimmedTracks > 0
         ? i18n.translate('xpack.maps.esGeoLine.tracksTrimmedMsg', {
             defaultMessage: `{numTrimmedTracks} of {entityCount} tracks are incomplete.`,
             values: {
-              entityCount: meta.entityCount,
-              numTrimmedTracks: meta.numTrimmedTracks,
+              entityCount: meta.entityCount.toLocaleString(),
+              numTrimmedTracks: meta.numTrimmedTracks.toLocaleString(),
             },
           })
         : undefined;
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx
index 343c366b548f6..55eed588b8840 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx
@@ -620,17 +620,17 @@ export class ESSearchSource extends AbstractESSource implements ITiledSingleLaye
         ? i18n.translate('xpack.maps.esSearch.topHitsResultsTrimmedMsg', {
             defaultMessage: `Results limited to first {entityCount} entities of ~{totalEntities}.`,
             values: {
-              entityCount: meta.entityCount,
-              totalEntities: meta.totalEntities,
+              entityCount: meta.entityCount?.toLocaleString(),
+              totalEntities: meta.totalEntities?.toLocaleString(),
             },
           })
         : i18n.translate('xpack.maps.esSearch.topHitsEntitiesCountMsg', {
             defaultMessage: `Found {entityCount} entities.`,
-            values: { entityCount: meta.entityCount },
+            values: { entityCount: meta.entityCount?.toLocaleString() },
           });
       const docsPerEntityMsg = i18n.translate('xpack.maps.esSearch.topHitsSizeMsg', {
         defaultMessage: `Showing top {topHitsSize} documents per entity.`,
-        values: { topHitsSize: this._descriptor.topHitsSize },
+        values: { topHitsSize: this._descriptor.topHitsSize?.toLocaleString() },
       });
 
       return {
@@ -645,7 +645,7 @@ export class ESSearchSource extends AbstractESSource implements ITiledSingleLaye
       return {
         tooltipContent: i18n.translate('xpack.maps.esSearch.resultsTrimmedMsg', {
           defaultMessage: `Results limited to first {count} documents.`,
-          values: { count: meta.resultsCount },
+          values: { count: meta.resultsCount?.toLocaleString() },
         }),
         areResultsTrimmed: true,
       };
@@ -654,7 +654,7 @@ export class ESSearchSource extends AbstractESSource implements ITiledSingleLaye
     return {
       tooltipContent: i18n.translate('xpack.maps.esSearch.featureCountMsg', {
         defaultMessage: `Found {count} documents.`,
-        values: { count: meta.resultsCount },
+        values: { count: meta.resultsCount?.toLocaleString() },
       }),
       areResultsTrimmed: false,
     };
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/util/__snapshots__/scaling_form.test.tsx.snap b/x-pack/plugins/maps/public/classes/sources/es_search_source/util/__snapshots__/scaling_form.test.tsx.snap
index 03f2594f287ea..99ce13ce326d6 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/util/__snapshots__/scaling_form.test.tsx.snap
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/util/__snapshots__/scaling_form.test.tsx.snap
@@ -28,7 +28,7 @@ exports[`scaling form should disable clusters option when clustering is not supp
       <EuiRadio
         checked={true}
         id="LIMIT"
-        label="Limit results to 10000."
+        label="Limit results to 10,000"
         onChange={[Function]}
       />
       <EuiToolTip
@@ -40,7 +40,7 @@ exports[`scaling form should disable clusters option when clustering is not supp
           checked={false}
           disabled={true}
           id="CLUSTERS"
-          label="Show clusters when results exceed 10000."
+          label="Show clusters when results exceed 10,000"
           onChange={[Function]}
         />
       </EuiToolTip>
@@ -114,14 +114,14 @@ exports[`scaling form should render 1`] = `
       <EuiRadio
         checked={true}
         id="LIMIT"
-        label="Limit results to 10000."
+        label="Limit results to 10,000"
         onChange={[Function]}
       />
       <EuiRadio
         checked={false}
         disabled={false}
         id="CLUSTERS"
-        label="Show clusters when results exceed 10000."
+        label="Show clusters when results exceed 10,000"
         onChange={[Function]}
       />
       <EuiToolTip
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/util/scaling_form.tsx b/x-pack/plugins/maps/public/classes/sources/es_search_source/util/scaling_form.tsx
index beb26c3b99feb..2d202e934cea9 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/util/scaling_form.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/util/scaling_form.tsx
@@ -38,12 +38,12 @@ interface Props {
 }
 
 interface State {
-  maxResultWindow: number;
+  maxResultWindow: string;
 }
 
 export class ScalingForm extends Component<Props, State> {
   state = {
-    maxResultWindow: DEFAULT_MAX_RESULT_WINDOW,
+    maxResultWindow: DEFAULT_MAX_RESULT_WINDOW.toLocaleString(),
   };
   _isMounted = false;
 
@@ -61,7 +61,7 @@ export class ScalingForm extends Component<Props, State> {
       const indexPattern = await getIndexPatternService().get(this.props.indexPatternId);
       const { maxResultWindow } = await loadIndexSettings(indexPattern!.title);
       if (this._isMounted) {
-        this.setState({ maxResultWindow });
+        this.setState({ maxResultWindow: maxResultWindow.toLocaleString() });
       }
     } catch (err) {
       return;
@@ -90,7 +90,7 @@ export class ScalingForm extends Component<Props, State> {
       <EuiRadio
         id={SCALING_TYPES.CLUSTERS}
         label={i18n.translate('xpack.maps.source.esSearch.clusterScalingLabel', {
-          defaultMessage: 'Show clusters when results exceed {maxResultWindow}.',
+          defaultMessage: 'Show clusters when results exceed {maxResultWindow}',
           values: { maxResultWindow: this.state.maxResultWindow },
         })}
         checked={this.props.scalingType === SCALING_TYPES.CLUSTERS}
@@ -170,7 +170,7 @@ export class ScalingForm extends Component<Props, State> {
             <EuiRadio
               id={SCALING_TYPES.LIMIT}
               label={i18n.translate('xpack.maps.source.esSearch.limitScalingLabel', {
-                defaultMessage: 'Limit results to {maxResultWindow}.',
+                defaultMessage: 'Limit results to {maxResultWindow}',
                 values: { maxResultWindow: this.state.maxResultWindow },
               })}
               checked={this.props.scalingType === SCALING_TYPES.LIMIT}
diff --git a/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/__snapshots__/toc_entry_actions_popover.test.tsx.snap b/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/__snapshots__/toc_entry_actions_popover.test.tsx.snap
index 5d1fc8e28f993..c7db60ae59ef9 100644
--- a/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/__snapshots__/toc_entry_actions_popover.test.tsx.snap
+++ b/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/__snapshots__/toc_entry_actions_popover.test.tsx.snap
@@ -535,6 +535,17 @@ exports[`TOCEntryActionsPopover should not show edit actions in read only mode 1
               "onClick": [Function],
               "toolTipContent": null,
             },
+            Object {
+              "data-test-subj": "layerSettingsButton",
+              "disabled": false,
+              "icon": <EuiIcon
+                size="m"
+                type="pencil"
+              />,
+              "name": "Edit layer settings",
+              "onClick": [Function],
+              "toolTipContent": null,
+            },
           ],
           "title": "Layer actions",
         },
diff --git a/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx b/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx
index 83b4d2c2a756b..2a3186f00d7ce 100644
--- a/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx
+++ b/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx
@@ -158,6 +158,17 @@ export class TOCEntryActionsPopover extends Component<Props, State> {
         },
       },
     ];
+    actionItems.push({
+      disabled: this.props.isEditButtonDisabled,
+      name: EDIT_LAYER_SETTINGS_LABEL,
+      icon: <EuiIcon type="pencil" size="m" />,
+      'data-test-subj': 'layerSettingsButton',
+      toolTipContent: null,
+      onClick: () => {
+        this._closePopover();
+        this.props.openLayerSettings();
+      },
+    });
 
     if (!this.props.isReadOnly) {
       if (this.state.supportsFeatureEditing) {
@@ -186,17 +197,6 @@ export class TOCEntryActionsPopover extends Component<Props, State> {
           },
         });
       }
-      actionItems.push({
-        disabled: this.props.isEditButtonDisabled,
-        name: EDIT_LAYER_SETTINGS_LABEL,
-        icon: <EuiIcon type="pencil" size="m" />,
-        'data-test-subj': 'layerSettingsButton',
-        toolTipContent: null,
-        onClick: () => {
-          this._closePopover();
-          this.props.openLayerSettings();
-        },
-      });
       actionItems.push({
         name: i18n.translate('xpack.maps.layerTocActions.cloneLayerTitle', {
           defaultMessage: 'Clone layer',
diff --git a/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_button/toc_entry_button.tsx b/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_button/toc_entry_button.tsx
index 41c2992c77d88..ffad34454bb61 100644
--- a/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_button/toc_entry_button.tsx
+++ b/x-pack/plugins/maps/public/connected_components/right_side_controls/layer_control/layer_toc/toc_entry/toc_entry_button/toc_entry_button.tsx
@@ -116,7 +116,7 @@ export class TOCEntryButton extends Component<Props, State> {
         footnotes.push({
           icon: <EuiIcon color="subdued" type="filter" size="s" />,
           message: i18n.translate('xpack.maps.layer.isUsingSearchMsg', {
-            defaultMessage: 'Results narrowed by search bar',
+            defaultMessage: 'Results narrowed by query and filters',
           }),
         });
       }
diff --git a/x-pack/plugins/ml/common/constants/messages.test.ts b/x-pack/plugins/ml/common/constants/messages.test.ts
index 1141eea2c176d..59fc50757b674 100644
--- a/x-pack/plugins/ml/common/constants/messages.test.ts
+++ b/x-pack/plugins/ml/common/constants/messages.test.ts
@@ -35,7 +35,7 @@ describe('Constants: Messages parseMessages()', () => {
         status: 'success',
         text: 'Presence of detector functions validated in all detectors.',
         url:
-          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/create-jobs.html#detectors',
+          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/ml-ad-finding-anomalies.html#ml-ad-detectors',
       },
       {
         bucketSpan: '15m',
@@ -44,7 +44,7 @@ describe('Constants: Messages parseMessages()', () => {
         status: 'success',
         text: 'Format of "15m" is valid and passed validation checks.',
         url:
-          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/create-jobs.html#bucket-span',
+          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/ml-ad-finding-anomalies.html#ml-ad-bucket-span',
       },
       {
         heading: 'Time range',
@@ -58,7 +58,7 @@ describe('Constants: Messages parseMessages()', () => {
         status: 'success',
         text: 'Valid and within the estimated model memory limit.',
         url:
-          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/create-jobs.html#model-memory-limits',
+          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/ml-ad-finding-anomalies.html#ml-ad-model-memory-limits',
       },
     ]);
   });
@@ -79,7 +79,7 @@ describe('Constants: Messages parseMessages()', () => {
         status: 'success',
         text: 'Presence of detector functions validated in all detectors.',
         url:
-          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/create-jobs.html#detectors',
+          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/ml-ad-finding-anomalies.html#ml-ad-detectors',
       },
       {
         bucketSpan: '15m',
@@ -116,7 +116,7 @@ describe('Constants: Messages parseMessages()', () => {
         status: 'success',
         text: 'Presence of detector functions validated in all detectors.',
         url:
-          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/create-jobs.html#detectors',
+          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/ml-ad-finding-anomalies.html#ml-ad-detectors',
       },
       {
         id: 'cardinality_model_plot_high',
@@ -131,7 +131,7 @@ describe('Constants: Messages parseMessages()', () => {
         text:
           'Cardinality of partition_field "order_id" is above 1000 and might result in high memory usage.',
         url:
-          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/create-jobs.html#cardinality',
+          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/ml-ad-finding-anomalies.html#ml-ad-cardinality',
       },
       {
         heading: 'Bucket span',
@@ -140,7 +140,7 @@ describe('Constants: Messages parseMessages()', () => {
         text:
           'Bucket span is 1 day or more. Be aware that days are considered as UTC days, not local days.',
         url:
-          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/create-jobs.html#bucket-span',
+          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/ml-ad-finding-anomalies.html#ml-ad-bucket-span',
       },
       {
         bucketSpanCompareFactor: 25,
@@ -156,7 +156,7 @@ describe('Constants: Messages parseMessages()', () => {
         status: 'success',
         text: 'Influencer configuration passed the validation checks.',
         url:
-          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/ml-influencers.html',
+          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/ml-ad-finding-anomalies.html#ml-ad-influencers',
       },
       {
         id: 'half_estimated_mml_greater_than_mml',
@@ -165,7 +165,7 @@ describe('Constants: Messages parseMessages()', () => {
         text:
           'The specified model memory limit is less than half of the estimated model memory limit and will likely hit the hard limit.',
         url:
-          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/create-jobs.html#model-memory-limits',
+          'https://www.elastic.co/guide/en/machine-learning/mocked-test-branch/ml-ad-finding-anomalies.html#ml-ad-model-memory-limits',
       },
       {
         id: 'missing_summary_count_field_name',
diff --git a/x-pack/plugins/ml/common/types/anomalies.ts b/x-pack/plugins/ml/common/types/anomalies.ts
index e84035aa50c8f..2bf717067f712 100644
--- a/x-pack/plugins/ml/common/types/anomalies.ts
+++ b/x-pack/plugins/ml/common/types/anomalies.ts
@@ -12,6 +12,8 @@ export interface Influencer {
   influencer_field_values: string[];
 }
 
+export type MLAnomalyDoc = AnomalyRecordDoc;
+
 export interface AnomalyRecordDoc {
   [key: string]: any;
   job_id: string;
diff --git a/x-pack/plugins/ml/public/application/components/help_popover/help_popover.tsx b/x-pack/plugins/ml/public/application/components/help_popover/help_popover.tsx
index 8cd6a3fbd1138..95c66d58dbb75 100644
--- a/x-pack/plugins/ml/public/application/components/help_popover/help_popover.tsx
+++ b/x-pack/plugins/ml/public/application/components/help_popover/help_popover.tsx
@@ -6,6 +6,7 @@
  */
 
 import React, { ReactNode } from 'react';
+import { i18n } from '@kbn/i18n';
 import {
   EuiButtonIcon,
   EuiLinkButtonProps,
@@ -22,6 +23,9 @@ export const HelpPopoverButton = ({ onClick }: { onClick: EuiLinkButtonProps['on
       className="mlHelpPopover__buttonIcon"
       size="s"
       iconType="help"
+      aria-label={i18n.translate('xpack.ml.helpPopover.ariaLabel', {
+        defaultMessage: 'Help',
+      })}
       onClick={onClick}
     />
   );
diff --git a/x-pack/plugins/ml/public/application/components/model_snapshots/revert_model_snapshot_flyout/revert_model_snapshot_flyout.tsx b/x-pack/plugins/ml/public/application/components/model_snapshots/revert_model_snapshot_flyout/revert_model_snapshot_flyout.tsx
index 6dd4e6c14589b..f282b2fde2b3a 100644
--- a/x-pack/plugins/ml/public/application/components/model_snapshots/revert_model_snapshot_flyout/revert_model_snapshot_flyout.tsx
+++ b/x-pack/plugins/ml/public/application/components/model_snapshots/revert_model_snapshot_flyout/revert_model_snapshot_flyout.tsx
@@ -42,6 +42,7 @@ import { Anomaly } from '../../../jobs/new_job/common/results_loader/results_loa
 import { parseInterval } from '../../../../../common/util/parse_interval';
 import { CreateCalendar, CalendarEvent } from './create_calendar';
 import { timeFormatter } from '../../../../../common/util/date_utils';
+import { toastNotificationServiceProvider } from '../../../services/toast_notification_service';
 
 interface Props {
   snapshot: ModelSnapshot;
@@ -139,6 +140,10 @@ export const RevertModelSnapshotFlyout: FC<Props> = ({
             })
           );
           refresh();
+        })
+        .catch((error) => {
+          const { displayErrorToast } = toastNotificationServiceProvider(toasts);
+          displayErrorToast(error);
         });
       hideRevertModal();
       closeFlyout();
diff --git a/x-pack/plugins/ml/public/application/explorer/actions/load_explorer_data.ts b/x-pack/plugins/ml/public/application/explorer/actions/load_explorer_data.ts
index 621ce44204730..45afab0cce4fd 100644
--- a/x-pack/plugins/ml/public/application/explorer/actions/load_explorer_data.ts
+++ b/x-pack/plugins/ml/public/application/explorer/actions/load_explorer_data.ts
@@ -223,7 +223,9 @@ const loadExplorerDataProvider = (
               swimlaneLimit,
               viewByPerPage,
               viewByFromPage,
-              swimlaneContainerWidth
+              swimlaneContainerWidth,
+              selectionInfluencers,
+              influencersFilterQuery
             )
           : Promise.resolve([]),
     }).pipe(
diff --git a/x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx b/x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx
index 6f5ae5e17590a..57e051e1b8417 100644
--- a/x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx
+++ b/x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx
@@ -95,7 +95,6 @@ function getInitSearchInputState({
 
 interface ExplorerQueryBarProps {
   filterActive: boolean;
-  filterIconTriggeredQuery: string;
   filterPlaceHolder: string;
   indexPattern: IIndexPattern;
   queryString?: string;
@@ -104,7 +103,6 @@ interface ExplorerQueryBarProps {
 
 export const ExplorerQueryBar: FC<ExplorerQueryBarProps> = ({
   filterActive,
-  filterIconTriggeredQuery,
   filterPlaceHolder,
   indexPattern,
   queryString,
@@ -116,14 +114,12 @@ export const ExplorerQueryBar: FC<ExplorerQueryBarProps> = ({
   );
   const [errorMessage, setErrorMessage] = useState<ErrorMessage | undefined>(undefined);
 
-  useEffect(() => {
-    if (filterIconTriggeredQuery !== undefined) {
-      setSearchInput({
-        language: searchInput.language,
-        query: filterIconTriggeredQuery,
-      });
-    }
-  }, [filterIconTriggeredQuery]);
+  useEffect(
+    function updateSearchInputFromFilter() {
+      setSearchInput(getInitSearchInputState({ filterActive, queryString }));
+    },
+    [filterActive, queryString]
+  );
 
   const searchChangeHandler = (query: Query) => {
     if (searchInput.language !== query.language) {
@@ -131,6 +127,7 @@ export const ExplorerQueryBar: FC<ExplorerQueryBarProps> = ({
     }
     setSearchInput(query);
   };
+
   const applyInfluencersFilterQuery = (query: Query) => {
     try {
       const { clearSettings, settings } = getKqlQueryValues({
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer.js b/x-pack/plugins/ml/public/application/explorer/explorer.js
index 31058b62af7fe..81474c212d265 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer.js
+++ b/x-pack/plugins/ml/public/application/explorer/explorer.js
@@ -86,7 +86,6 @@ const ExplorerPage = ({
   filterPlaceHolder,
   indexPattern,
   queryString,
-  filterIconTriggeredQuery,
   updateLanguage,
 }) => (
   <div data-test-subj="mlPageAnomalyExplorer">
@@ -121,7 +120,6 @@ const ExplorerPage = ({
                       filterPlaceHolder={filterPlaceHolder}
                       indexPattern={indexPattern}
                       queryString={queryString}
-                      filterIconTriggeredQuery={filterIconTriggeredQuery}
                       updateLanguage={updateLanguage}
                     />
                   </div>
@@ -151,7 +149,7 @@ export class ExplorerUI extends React.Component {
     selectedJobsRunning: PropTypes.bool.isRequired,
   };
 
-  state = { filterIconTriggeredQuery: undefined, language: DEFAULT_QUERY_LANG };
+  state = { language: DEFAULT_QUERY_LANG };
   htmlIdGen = htmlIdGenerator();
 
   componentDidMount() {
@@ -200,8 +198,6 @@ export class ExplorerUI extends React.Component {
       }
     }
 
-    this.setState({ filterIconTriggeredQuery: `${newQueryString}` });
-
     try {
       const { clearSettings, settings } = getKqlQueryValues({
         inputString: `${newQueryString}`,
@@ -327,7 +323,6 @@ export class ExplorerUI extends React.Component {
         influencers={influencers}
         filterActive={filterActive}
         filterPlaceHolder={filterPlaceHolder}
-        filterIconTriggeredQuery={this.state.filterIconTriggeredQuery}
         indexPattern={indexPattern}
         queryString={queryString}
         updateLanguage={this.updateLanguage}
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer_utils.d.ts b/x-pack/plugins/ml/public/application/explorer/explorer_utils.d.ts
index ebab308b86027..e8abe9e45c09a 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer_utils.d.ts
+++ b/x-pack/plugins/ml/public/application/explorer/explorer_utils.d.ts
@@ -181,15 +181,6 @@ declare interface LoadOverallDataResponse {
   overallSwimlaneData: OverallSwimlaneData;
 }
 
-export declare const loadViewByTopFieldValuesForSelectedTime: (
-  earliestMs: number,
-  latestMs: number,
-  selectedJobs: ExplorerJob[],
-  viewBySwimlaneFieldName: string,
-  swimlaneLimit: number,
-  noInfluencersConfigured: boolean
-) => Promise<any>;
-
 export declare interface FilterData {
   influencersFilterQuery: InfluencersFilterQuery;
   filterActive: boolean;
diff --git a/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx b/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx
index 82f8a90fafb7d..86ec2014c8339 100644
--- a/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx
+++ b/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx
@@ -411,7 +411,7 @@ export const SwimlaneContainer: FC<SwimlaneProps> = ({
           >
             <>
               <div>
-                <div style={{ height: `${containerHeight}px` }}>
+                <div style={{ height: `${containerHeight}px`, position: 'relative' }}>
                   {showSwimlane && !isLoading && (
                     <Chart className={'mlSwimLaneContainer'}>
                       <Settings
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/searches.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/searches.ts
index e6e6b5305b1f8..65c0d30414eed 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/searches.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/searches.ts
@@ -74,6 +74,7 @@ export function getScoresByRecord(
                             timestamp: {
                               gte: earliestMs,
                               lte: latestMs,
+                              // @ts-ignore
                               format: 'epoch_millis',
                             },
                           },
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts
index 67673901494c7..88ed17cba0003 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts
@@ -6,7 +6,7 @@
  */
 
 import { useContext, useState } from 'react';
-
+import { i18n } from '@kbn/i18n';
 import { JobCreatorContext } from '../../../job_creator_context';
 import { EVENT_RATE_FIELD_ID } from '../../../../../../../../../common/types/fields';
 import { BucketSpanEstimatorData } from '../../../../../../../../../common/types/job_service';
@@ -76,10 +76,16 @@ export function useEstimateBucketSpan() {
 
   async function estimateBucketSpan() {
     setStatus(ESTIMATE_STATUS.RUNNING);
-    const { name, error, message } = await ml.estimateBucketSpan(data);
+    const { name, error, message: text } = await ml.estimateBucketSpan(data);
     setStatus(ESTIMATE_STATUS.NOT_RUNNING);
     if (error === true) {
-      getToastNotificationService().displayErrorToast(message);
+      const title = i18n.translate(
+        'xpack.ml.newJob.wizard.pickFieldsStep.bucketSpanEstimator.errorTitle',
+        {
+          defaultMessage: 'Bucket span could not be estimated',
+        }
+      );
+      getToastNotificationService().displayWarningToast({ title, text });
     } else {
       jobCreator.bucketSpan = name;
       jobCreatorUpdate();
diff --git a/x-pack/plugins/ml/public/application/management/jobs_list/components/insufficient_license_page.tsx b/x-pack/plugins/ml/public/application/management/jobs_list/components/insufficient_license_page.tsx
index 6d0c3639d939c..7fcac0ad6992a 100644
--- a/x-pack/plugins/ml/public/application/management/jobs_list/components/insufficient_license_page.tsx
+++ b/x-pack/plugins/ml/public/application/management/jobs_list/components/insufficient_license_page.tsx
@@ -30,7 +30,7 @@ export const InsufficientLicensePage: FC<Props> = ({ basePath }) => (
           <h2>
             <FormattedMessage
               id="xpack.ml.management.jobsList.insufficientLicenseLabel"
-              defaultMessage="Insufficient license"
+              defaultMessage="Upgrade for subscription features"
             />
           </h2>
         }
@@ -38,13 +38,13 @@ export const InsufficientLicensePage: FC<Props> = ({ basePath }) => (
           <p>
             <FormattedMessage
               id="xpack.ml.management.jobsList.insufficientLicenseDescription"
-              defaultMessage="Machine Learning is available only with trial, platinum or enterprise licenses. Please {link} to use Machine Learning features."
+              defaultMessage="To use these machine learning features, you must {link}."
               values={{
                 link: (
                   <EuiLink href={`${basePath.get()}/app/management/stack/license_management/home`}>
                     <FormattedMessage
                       id="xpack.ml.management.jobsList.insufficientLicenseDescription.link"
-                      defaultMessage="upgrade your license or start a trial"
+                      defaultMessage="start a trial or upgrade your subscription"
                     />
                   </EuiLink>
                 ),
diff --git a/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx b/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
index a0a81f77b7b08..f645a0753f8c2 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
@@ -127,7 +127,7 @@ const ExplorerUrlStateManager: FC<ExplorerUrlStateManagerProps> = ({ jobsWithTim
         to: globalState.time.to,
       });
     }
-  }, [globalState?.time?.from, globalState?.time?.to]);
+  }, [lastRefresh, globalState?.time?.from, globalState?.time?.to]);
 
   const getJobsWithStoppedPartitions = useCallback(async (selectedJobIds: string[]) => {
     try {
diff --git a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
index ef669a7703c1f..6eb4386276753 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
@@ -142,10 +142,10 @@ export const TimeSeriesExplorerUrlStateManager: FC<TimeSeriesExplorerUrlStateMan
       // Only if both min/max bounds are valid moment times set the bounds.
       // An invalid string restored from globalState might return `undefined`.
       if (timefilterBounds?.min !== undefined && timefilterBounds?.max !== undefined) {
-        setBounds(timefilter.getBounds());
+        setBounds(timefilterBounds);
       }
     }
-  }, [globalState?.time?.from, globalState?.time?.to]);
+  }, [lastRefresh, globalState?.time?.from, globalState?.time?.to]);
 
   const selectedJobIds = globalState?.ml?.jobIds;
   // Sort selectedJobIds so we can be sure comparison works when stringifying.
@@ -309,7 +309,7 @@ export const TimeSeriesExplorerUrlStateManager: FC<TimeSeriesExplorerUrlStateMan
           );
         });
     }
-  }, [selectedForecastId]);
+  }, [boundsMinMs, boundsMaxMs, selectedJob, selectedForecastId, autoZoomDuration]);
 
   const [tableInterval] = useTableInterval();
   const [tableSeverity] = useTableSeverity();
diff --git a/x-pack/plugins/ml/public/application/services/anomaly_timeline_service.ts b/x-pack/plugins/ml/public/application/services/anomaly_timeline_service.ts
index e11eb4048c374..6f2b5417eff5f 100644
--- a/x-pack/plugins/ml/public/application/services/anomaly_timeline_service.ts
+++ b/x-pack/plugins/ml/public/application/services/anomaly_timeline_service.ts
@@ -25,6 +25,8 @@ import {
 } from '../explorer/explorer_utils';
 import { OVERALL_LABEL, VIEW_BY_JOB_LABEL } from '../explorer/explorer_constants';
 import { MlResultsService } from './results_service';
+import { EntityField } from '../../../common/util/anomaly_utils';
+import { InfluencersFilterQuery } from '../../../common/types/es_client';
 
 /**
  * Service for retrieving anomaly swim lanes data.
@@ -241,7 +243,9 @@ export class AnomalyTimelineService {
     swimlaneLimit: number,
     perPage: number,
     fromPage: number,
-    swimlaneContainerWidth: number
+    swimlaneContainerWidth: number,
+    selectionInfluencers: EntityField[],
+    influencersFilterQuery: InfluencersFilterQuery
   ) {
     const selectedJobIds = selectedJobs.map((d) => d.id);
 
@@ -254,7 +258,9 @@ export class AnomalyTimelineService {
         latestMs,
         swimlaneLimit,
         perPage,
-        fromPage
+        fromPage,
+        selectionInfluencers,
+        influencersFilterQuery
       );
       if (resp.influencers[viewBySwimlaneFieldName] === undefined) {
         return [];
@@ -276,6 +282,8 @@ export class AnomalyTimelineService {
         earliestMs,
         latestMs,
         this.getSwimlaneBucketInterval(selectedJobs, swimlaneContainerWidth).asMilliseconds(),
+        perPage,
+        fromPage,
         swimlaneLimit
       );
       return Object.keys(resp.results);
diff --git a/x-pack/plugins/ml/public/application/services/ml_api_service/results.ts b/x-pack/plugins/ml/public/application/services/ml_api_service/results.ts
index 25ef36782207f..a9f6dbb45f6e3 100644
--- a/x-pack/plugins/ml/public/application/services/ml_api_service/results.ts
+++ b/x-pack/plugins/ml/public/application/services/ml_api_service/results.ts
@@ -16,6 +16,11 @@ import { JobId } from '../../../../common/types/anomaly_detection_jobs';
 import { JOB_ID, PARTITION_FIELD_VALUE } from '../../../../common/constants/anomalies';
 import { PartitionFieldsDefinition } from '../results_service/result_service_rx';
 import { PartitionFieldsConfig } from '../../../../common/types/storage';
+import {
+  ESSearchRequest,
+  ESSearchResponse,
+} from '../../../../../../../src/core/types/elasticsearch';
+import { MLAnomalyDoc } from '../../../../common/types/anomalies';
 
 export const resultsApiProvider = (httpService: HttpService) => ({
   getAnomaliesTableData(
@@ -112,18 +117,18 @@ export const resultsApiProvider = (httpService: HttpService) => ({
     });
   },
 
-  anomalySearch(query: any, jobIds: string[]) {
+  anomalySearch(query: ESSearchRequest, jobIds: string[]) {
     const body = JSON.stringify({ query, jobIds });
-    return httpService.http<any>({
+    return httpService.http<ESSearchResponse<MLAnomalyDoc>>({
       path: `${basePath()}/results/anomaly_search`,
       method: 'POST',
       body,
     });
   },
 
-  anomalySearch$(query: any, jobIds: string[]) {
+  anomalySearch$(query: ESSearchRequest, jobIds: string[]) {
     const body = JSON.stringify({ query, jobIds });
-    return httpService.http$<any>({
+    return httpService.http$<ESSearchResponse<MLAnomalyDoc>>({
       path: `${basePath()}/results/anomaly_search`,
       method: 'POST',
       body,
diff --git a/x-pack/plugins/ml/public/application/services/results_service/results_service.d.ts b/x-pack/plugins/ml/public/application/services/results_service/results_service.d.ts
index ea07d32bfff1d..1848b13cb5a1f 100644
--- a/x-pack/plugins/ml/public/application/services/results_service/results_service.d.ts
+++ b/x-pack/plugins/ml/public/application/services/results_service/results_service.d.ts
@@ -23,7 +23,8 @@ export function resultsServiceProvider(
     intervalMs: number,
     perPage?: number,
     fromPage?: number,
-    swimLaneSeverity?: number
+    swimLaneSeverity?: number,
+    influencersFilterQuery?: InfluencersFilterQuery
   ): Promise<any>;
   getTopInfluencers(
     selectedJobIds: string[],
@@ -32,7 +33,7 @@ export function resultsServiceProvider(
     maxFieldValues: number,
     perPage?: number,
     fromPage?: number,
-    influencers?: any[],
+    influencers?: EntityField[],
     influencersFilterQuery?: InfluencersFilterQuery
   ): Promise<any>;
   getTopInfluencerValues(): Promise<any>;
diff --git a/x-pack/plugins/ml/server/models/job_service/model_snapshots.ts b/x-pack/plugins/ml/server/models/job_service/model_snapshots.ts
index 6cb5f67149fb6..56221f9a72c89 100644
--- a/x-pack/plugins/ml/server/models/job_service/model_snapshots.ts
+++ b/x-pack/plugins/ml/server/models/job_service/model_snapshots.ts
@@ -85,7 +85,6 @@ export function modelSnapshotProvider(client: IScopedClusterClient, mlClient: Ml
           ),
           events: calendarEvents.map((s) => ({
             calendar_id: calendarId,
-            event_id: '',
             description: s.description,
             start_time: `${s.start}`,
             end_time: `${s.end}`,
diff --git a/x-pack/plugins/observability/public/components/app/fleet_panel/index.tsx b/x-pack/plugins/observability/public/components/app/fleet_panel/index.tsx
index fce1cde38f587..b6db8b2308b78 100644
--- a/x-pack/plugins/observability/public/components/app/fleet_panel/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/fleet_panel/index.tsx
@@ -16,9 +16,6 @@ export function FleetPanel() {
   return (
     <EuiCard
       paddingSize="l"
-      betaBadgeLabel={i18n.translate('xpack.observability.fleet.beta', {
-        defaultMessage: 'Beta',
-      })}
       description={
         <EuiTextColor color="subdued">
           {i18n.translate('xpack.observability.fleet.text', {
@@ -30,7 +27,7 @@ export function FleetPanel() {
       footer={
         <EuiLink href={core.http.basePath.prepend('/app/fleet#/')}>
           {i18n.translate('xpack.observability.fleet.button', {
-            defaultMessage: 'Try Fleet Beta',
+            defaultMessage: 'Try Fleet',
           })}
         </EuiLink>
       }
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_storage.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_storage.test.tsx
new file mode 100644
index 0000000000000..c32acc47abd1b
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_storage.test.tsx
@@ -0,0 +1,131 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useEffect } from 'react';
+
+import { UrlStorageContextProvider, useSeriesStorage } from './use_series_storage';
+import { render } from '@testing-library/react';
+
+const mockSingleSeries = {
+  'performance-distribution': {
+    reportType: 'data-distribution',
+    dataType: 'ux',
+    breakdown: 'user_agent.name',
+    time: { from: 'now-15m', to: 'now' },
+  },
+};
+
+const mockMultipleSeries = {
+  'performance-distribution': {
+    reportType: 'data-distribution',
+    dataType: 'ux',
+    breakdown: 'user_agent.name',
+    time: { from: 'now-15m', to: 'now' },
+  },
+  'kpi-over-time': {
+    reportType: 'kpi-over-time',
+    dataType: 'synthetics',
+    breakdown: 'user_agent.name',
+    time: { from: 'now-15m', to: 'now' },
+  },
+};
+
+describe('userSeries', function () {
+  function setupTestComponent(seriesData: any) {
+    const setData = jest.fn();
+    function TestComponent() {
+      const data = useSeriesStorage();
+
+      useEffect(() => {
+        setData(data);
+      }, [data]);
+
+      return <span>Test</span>;
+    }
+
+    render(
+      <UrlStorageContextProvider
+        storage={{ get: jest.fn().mockReturnValue(seriesData), set: jest.fn() }}
+      >
+        <TestComponent />
+      </UrlStorageContextProvider>
+    );
+
+    return setData;
+  }
+  it('should return expected result when there is one series', function () {
+    const setData = setupTestComponent(mockSingleSeries);
+
+    expect(setData).toHaveBeenCalledTimes(2);
+    expect(setData).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        allSeries: {
+          'performance-distribution': {
+            breakdown: 'user_agent.name',
+            dataType: 'ux',
+            reportType: 'data-distribution',
+            time: { from: 'now-15m', to: 'now' },
+          },
+        },
+        allSeriesIds: ['performance-distribution'],
+        firstSeries: {
+          breakdown: 'user_agent.name',
+          dataType: 'ux',
+          reportType: 'data-distribution',
+          time: { from: 'now-15m', to: 'now' },
+        },
+        firstSeriesId: 'performance-distribution',
+      })
+    );
+  });
+
+  it('should return expected result when there are multiple series series', function () {
+    const setData = setupTestComponent(mockMultipleSeries);
+
+    expect(setData).toHaveBeenCalledTimes(2);
+    expect(setData).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        allSeries: {
+          'performance-distribution': {
+            breakdown: 'user_agent.name',
+            dataType: 'ux',
+            reportType: 'data-distribution',
+            time: { from: 'now-15m', to: 'now' },
+          },
+          'kpi-over-time': {
+            reportType: 'kpi-over-time',
+            dataType: 'synthetics',
+            breakdown: 'user_agent.name',
+            time: { from: 'now-15m', to: 'now' },
+          },
+        },
+        allSeriesIds: ['performance-distribution', 'kpi-over-time'],
+        firstSeries: {
+          breakdown: 'user_agent.name',
+          dataType: 'ux',
+          reportType: 'data-distribution',
+          time: { from: 'now-15m', to: 'now' },
+        },
+        firstSeriesId: 'performance-distribution',
+      })
+    );
+  });
+
+  it('should return expected result when there are no series', function () {
+    const setData = setupTestComponent({});
+
+    expect(setData).toHaveBeenCalledTimes(2);
+    expect(setData).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        allSeries: {},
+        allSeriesIds: [],
+        firstSeries: undefined,
+        firstSeriesId: undefined,
+      })
+    );
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_storage.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_storage.tsx
index 0add5a19a95cc..a47a124d14b4d 100644
--- a/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_storage.tsx
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_storage.tsx
@@ -67,7 +67,7 @@ export function UrlStorageContextProvider({
 
     setAllSeries(allSeriesN);
     setFirstSeriesId(allSeriesIds?.[0]);
-    setFirstSeries(allSeriesN?.[0]);
+    setFirstSeries(allSeriesN?.[allSeriesIds?.[0]]);
     (storage as IKbnUrlStateStorage).set(allSeriesKey, allShortSeries);
   }, [allShortSeries, storage]);
 
diff --git a/x-pack/plugins/observability/public/index.ts b/x-pack/plugins/observability/public/index.ts
index 0561eab08fb45..6bafe465fd024 100644
--- a/x-pack/plugins/observability/public/index.ts
+++ b/x-pack/plugins/observability/public/index.ts
@@ -68,5 +68,9 @@ export { createExploratoryViewUrl } from './components/shared/exploratory_view/c
 export { FilterValueLabel } from './components/shared/filter_value_label/filter_value_label';
 export type { SeriesUrl } from './components/shared/exploratory_view/types';
 
-export type { ObservabilityRuleTypeRegistry } from './rules/create_observability_rule_type_registry';
+export type {
+  ObservabilityRuleTypeFormatter,
+  ObservabilityRuleTypeModel,
+  ObservabilityRuleTypeRegistry,
+} from './rules/create_observability_rule_type_registry';
 export { createObservabilityRuleTypeRegistryMock } from './rules/observability_rule_type_registry_mock';
diff --git a/x-pack/plugins/observability/public/rules/create_observability_rule_type_registry.ts b/x-pack/plugins/observability/public/rules/create_observability_rule_type_registry.ts
index 35f2dc18c2f22..d6f8c08359888 100644
--- a/x-pack/plugins/observability/public/rules/create_observability_rule_type_registry.ts
+++ b/x-pack/plugins/observability/public/rules/create_observability_rule_type_registry.ts
@@ -5,19 +5,29 @@
  * 2.0.
  */
 
-import { AlertTypeModel, AlertTypeRegistryContract } from '../../../triggers_actions_ui/public';
+import {
+  AlertTypeModel,
+  AlertTypeParams,
+  AlertTypeRegistryContract,
+} from '../../../triggers_actions_ui/public';
 import { ParsedTechnicalFields } from '../../../rule_registry/common/parse_technical_fields';
 import { AsDuration, AsPercent } from '../../common/utils/formatters';
 
-export type Formatter = (options: {
+export type ObservabilityRuleTypeFormatter = (options: {
   fields: ParsedTechnicalFields & Record<string, any>;
   formatters: { asDuration: AsDuration; asPercent: AsPercent };
 }) => { reason: string; link: string };
 
+export interface ObservabilityRuleTypeModel<Params extends AlertTypeParams = AlertTypeParams>
+  extends AlertTypeModel<Params> {
+  format: ObservabilityRuleTypeFormatter;
+}
+
 export function createObservabilityRuleTypeRegistry(alertTypeRegistry: AlertTypeRegistryContract) {
-  const formatters: Array<{ typeId: string; fn: Formatter }> = [];
+  const formatters: Array<{ typeId: string; fn: ObservabilityRuleTypeFormatter }> = [];
+
   return {
-    register: (type: AlertTypeModel<any> & { format: Formatter }) => {
+    register: (type: ObservabilityRuleTypeModel<any>) => {
       const { format, ...rest } = type;
       formatters.push({ typeId: type.id, fn: format });
       alertTypeRegistry.register(rest);
diff --git a/x-pack/plugins/observability/server/plugin.ts b/x-pack/plugins/observability/server/plugin.ts
index 3e8f511eb1153..868e234fcb2a1 100644
--- a/x-pack/plugins/observability/server/plugin.ts
+++ b/x-pack/plugins/observability/server/plugin.ts
@@ -38,47 +38,49 @@ export class ObservabilityPlugin implements Plugin<ObservabilityPluginSetup> {
   }
 
   public setup(core: CoreSetup, plugins: PluginSetup) {
-    plugins.features.registerKibanaFeature({
-      id: casesFeatureId,
-      name: i18n.translate('xpack.observability.featureRegistry.linkObservabilityTitle', {
-        defaultMessage: 'Cases',
-      }),
-      order: 1100,
-      category: DEFAULT_APP_CATEGORIES.observability,
-      app: [casesFeatureId, 'kibana'],
-      catalogue: [observabilityFeatureId],
-      cases: [observabilityFeatureId],
-      privileges: {
-        all: {
-          app: [casesFeatureId, 'kibana'],
-          catalogue: [observabilityFeatureId],
-          cases: {
-            all: [observabilityFeatureId],
-          },
-          api: [],
-          savedObject: {
-            all: [],
-            read: [],
-          },
-          ui: ['crud_cases', 'read_cases'], // uiCapabilities[casesFeatureId].crud_cases or read_cases
-        },
-        read: {
-          app: [casesFeatureId, 'kibana'],
-          catalogue: [observabilityFeatureId],
-          cases: {
-            read: [observabilityFeatureId],
+    const config = this.initContext.config.get<ObservabilityConfig>();
+
+    if (config.unsafe.cases.enabled) {
+      plugins.features.registerKibanaFeature({
+        id: casesFeatureId,
+        name: i18n.translate('xpack.observability.featureRegistry.linkObservabilityTitle', {
+          defaultMessage: 'Cases',
+        }),
+        order: 1100,
+        category: DEFAULT_APP_CATEGORIES.observability,
+        app: [casesFeatureId, 'kibana'],
+        catalogue: [observabilityFeatureId],
+        cases: [observabilityFeatureId],
+        privileges: {
+          all: {
+            app: [casesFeatureId, 'kibana'],
+            catalogue: [observabilityFeatureId],
+            cases: {
+              all: [observabilityFeatureId],
+            },
+            api: [],
+            savedObject: {
+              all: [],
+              read: [],
+            },
+            ui: ['crud_cases', 'read_cases'], // uiCapabilities[casesFeatureId].crud_cases or read_cases
           },
-          api: [],
-          savedObject: {
-            all: [],
-            read: [],
+          read: {
+            app: [casesFeatureId, 'kibana'],
+            catalogue: [observabilityFeatureId],
+            cases: {
+              read: [observabilityFeatureId],
+            },
+            api: [],
+            savedObject: {
+              all: [],
+              read: [],
+            },
+            ui: ['read_cases'], // uiCapabilities[uiCapabilities[casesFeatureId]].read_cases
           },
-          ui: ['read_cases'], // uiCapabilities[uiCapabilities[casesFeatureId]].read_cases
         },
-      },
-    });
-
-    const config = this.initContext.config.get<ObservabilityConfig>();
+      });
+    }
 
     let annotationsApiPromise: Promise<AnnotationsAPI> | undefined;
 
diff --git a/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx b/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx
index d3b0e38a5e033..bf4c97d63d74c 100644
--- a/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx
+++ b/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx
@@ -8,15 +8,13 @@
 /* eslint-disable @typescript-eslint/no-unused-vars */
 
 import { i18n } from '@kbn/i18n';
-import { EuiLink, EuiInMemoryTable, EuiCodeBlock } from '@elastic/eui';
+import { EuiInMemoryTable, EuiCodeBlock } from '@elastic/eui';
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
 
-import { PLUGIN_ID } from '../../../fleet/common';
-import { pagePathGetters } from '../../../fleet/public';
+import { AgentIdToName } from '../agents/agent_id_to_name';
 import { useActionResults } from './use_action_results';
 import { useAllResults } from '../results/use_all_results';
 import { Direction } from '../../common/search_strategy';
-import { useKibana } from '../common/lib/kibana';
 
 interface ActionResultsSummaryProps {
   actionId: string;
@@ -35,7 +33,6 @@ const ActionResultsSummaryComponent: React.FC<ActionResultsSummaryProps> = ({
   expirationDate,
   agentIds,
 }) => {
-  const getUrlForApp = useKibana().services.application.getUrlForApp;
   // @ts-expect-error update types
   const [pageIndex, setPageIndex] = useState(0);
   // @ts-expect-error update types
@@ -70,20 +67,7 @@ const ActionResultsSummaryComponent: React.FC<ActionResultsSummaryProps> = ({
     isLive,
   });
 
-  const renderAgentIdColumn = useCallback(
-    (agentId) => (
-      <EuiLink
-        className="eui-textTruncate"
-        href={getUrlForApp(PLUGIN_ID, {
-          path: `#` + pagePathGetters.agent_details({ agentId })[1],
-        })}
-        target="_blank"
-      >
-        {agentId}
-      </EuiLink>
-    ),
-    [getUrlForApp]
-  );
+  const renderAgentIdColumn = useCallback((agentId) => <AgentIdToName agentId={agentId} />, []);
 
   const renderRowsColumn = useCallback(
     (_, item) => {
diff --git a/x-pack/plugins/osquery/public/actions/actions_table.tsx b/x-pack/plugins/osquery/public/actions/actions_table.tsx
index 0ee928ad8aa14..045c1f67b070d 100644
--- a/x-pack/plugins/osquery/public/actions/actions_table.tsx
+++ b/x-pack/plugins/osquery/public/actions/actions_table.tsx
@@ -9,6 +9,7 @@ import { isArray } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { EuiBasicTable, EuiButtonIcon, EuiCodeBlock, formatDate } from '@elastic/eui';
 import React, { useState, useCallback, useMemo } from 'react';
+import { useHistory } from 'react-router-dom';
 
 import { useAllActions } from './use_all_actions';
 import { Direction } from '../../common/search_strategy';
@@ -27,6 +28,7 @@ const ActionTableResultsButton = React.memo<ActionTableResultsButtonProps>(({ ac
 ActionTableResultsButton.displayName = 'ActionTableResultsButton';
 
 const ActionsTableComponent = () => {
+  const { push } = useHistory();
   const [pageIndex, setPageIndex] = useState(0);
   const [pageSize, setPageSize] = useState(20);
 
@@ -67,6 +69,16 @@ const ActionsTableComponent = () => {
     []
   );
 
+  const handlePlayClick = useCallback(
+    (item) =>
+      push('/live_queries/new', {
+        form: {
+          query: item._source?.data?.query,
+        },
+      }),
+    [push]
+  );
+
   const columns = useMemo(
     () => [
       {
@@ -106,6 +118,11 @@ const ActionsTableComponent = () => {
           defaultMessage: 'View details',
         }),
         actions: [
+          {
+            type: 'icon',
+            icon: 'play',
+            onClick: handlePlayClick,
+          },
           {
             render: renderActionsColumn,
           },
@@ -113,6 +130,7 @@ const ActionsTableComponent = () => {
       },
     ],
     [
+      handlePlayClick,
       renderActionsColumn,
       renderAgentsColumn,
       renderCreatedByColumn,
@@ -135,6 +153,7 @@ const ActionsTableComponent = () => {
     <EuiBasicTable
       // eslint-disable-next-line react-perf/jsx-no-new-array-as-prop
       items={actionsData?.actions ?? []}
+      // @ts-expect-error update types
       columns={columns}
       pagination={pagination}
       onChange={onTableChange}
diff --git a/x-pack/plugins/osquery/public/agents/agent_id_to_name.tsx b/x-pack/plugins/osquery/public/agents/agent_id_to_name.tsx
new file mode 100644
index 0000000000000..6db21c028ece8
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agents/agent_id_to_name.tsx
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiLink } from '@elastic/eui';
+import React from 'react';
+
+import { useAgentDetails } from './use_agent_details';
+import { PLUGIN_ID } from '../../../fleet/common';
+import { pagePathGetters } from '../../../fleet/public';
+import { useKibana } from '../common/lib/kibana';
+
+interface AgentIdToNameProps {
+  agentId: string;
+}
+
+const AgentIdToNameComponent: React.FC<AgentIdToNameProps> = ({ agentId }) => {
+  const getUrlForApp = useKibana().services.application.getUrlForApp;
+  const { data } = useAgentDetails({ agentId });
+
+  return (
+    <EuiLink
+      className="eui-textTruncate"
+      href={getUrlForApp(PLUGIN_ID, {
+        path: `#` + pagePathGetters.agent_details({ agentId })[1],
+      })}
+      target="_blank"
+    >
+      {data?.item.local_metadata.host.name ?? agentId}
+    </EuiLink>
+  );
+};
+
+export const AgentIdToName = React.memo(AgentIdToNameComponent);
diff --git a/x-pack/plugins/osquery/public/agents/agents_table.tsx b/x-pack/plugins/osquery/public/agents/agents_table.tsx
index 7e8f49c051614..53e2ce1d53420 100644
--- a/x-pack/plugins/osquery/public/agents/agents_table.tsx
+++ b/x-pack/plugins/osquery/public/agents/agents_table.tsx
@@ -21,7 +21,12 @@ import {
   generateAgentSelection,
 } from './helpers';
 
-import { SELECT_AGENT_LABEL, generateSelectedAgentsMessage } from './translations';
+import {
+  SELECT_AGENT_LABEL,
+  generateSelectedAgentsMessage,
+  ALL_AGENTS_LABEL,
+  AGENT_POLICY_LABEL,
+} from './translations';
 
 import {
   AGENT_GROUP_KEY,
@@ -72,8 +77,17 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
 
   useEffect(() => {
     if (agentSelection && !defaultValueInitialized.current && options.length) {
-      if (agentSelection.policiesSelected) {
-        const policyOptions = find(['label', 'Policy'], options);
+      if (agentSelection.allAgentsSelected) {
+        const allAgentsOptions = find(['label', ALL_AGENTS_LABEL], options);
+
+        if (allAgentsOptions?.options) {
+          setSelectedOptions(allAgentsOptions.options);
+          defaultValueInitialized.current = true;
+        }
+      }
+
+      if (agentSelection.policiesSelected.length) {
+        const policyOptions = find(['label', AGENT_POLICY_LABEL], options);
 
         if (policyOptions) {
           const defaultOptions = policyOptions.options?.filter((option) =>
@@ -82,12 +96,12 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
 
           if (defaultOptions?.length) {
             setSelectedOptions(defaultOptions);
+            defaultValueInitialized.current = true;
           }
-          defaultValueInitialized.current = true;
         }
       }
     }
-  }, [agentSelection, options]);
+  }, [agentSelection, options, selectedOptions]);
 
   useEffect(() => {
     // update the groups when groups or agents have changed
diff --git a/x-pack/plugins/osquery/public/agents/use_agent_details.ts b/x-pack/plugins/osquery/public/agents/use_agent_details.ts
new file mode 100644
index 0000000000000..1a0663812dec3
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agents/use_agent_details.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { useQuery } from 'react-query';
+
+import { GetOneAgentResponse, agentRouteService } from '../../../fleet/common';
+import { useErrorToast } from '../common/hooks/use_error_toast';
+import { useKibana } from '../common/lib/kibana';
+
+interface UseAgentDetails {
+  agentId: string;
+}
+
+export const useAgentDetails = ({ agentId }: UseAgentDetails) => {
+  const { http } = useKibana().services;
+  const setErrorToast = useErrorToast();
+  return useQuery<GetOneAgentResponse>(
+    ['agentDetails', agentId],
+    () => http.get(agentRouteService.getInfoPath(agentId)),
+    {
+      enabled: agentId.length > 0,
+      onSuccess: () => setErrorToast(),
+      onError: (error) =>
+        setErrorToast(error as Error, {
+          title: i18n.translate('xpack.osquery.agentDetails.fetchError', {
+            defaultMessage: 'Error while fetching agent details',
+          }),
+        }),
+    }
+  );
+};
diff --git a/x-pack/plugins/osquery/public/agents/use_all_agents.ts b/x-pack/plugins/osquery/public/agents/use_all_agents.ts
index 30ba4d2f57907..cda15cc805437 100644
--- a/x-pack/plugins/osquery/public/agents/use_all_agents.ts
+++ b/x-pack/plugins/osquery/public/agents/use_all_agents.ts
@@ -38,7 +38,7 @@ export const useAllAgents = (
       let kuery = `last_checkin_status: online and (${policyFragment})`;
 
       if (searchValue) {
-        kuery += `and (local_metadata.host.hostname:*${searchValue}* or local_metadata.elastic.agent.id:*${searchValue}*)`;
+        kuery += ` and (local_metadata.host.hostname:*${searchValue}* or local_metadata.elastic.agent.id:*${searchValue}*)`;
       }
 
       return http.get(agentRouteService.getListPath(), {
diff --git a/x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx b/x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx
index 9f0b5acd8994a..070339bb58af2 100644
--- a/x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx
+++ b/x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx
@@ -6,12 +6,15 @@
  */
 
 import { EuiFormRow, EuiSpacer } from '@elastic/eui';
-import React, { useCallback } from 'react';
+import React, { useCallback, useRef } from 'react';
 
 import { OsquerySchemaLink } from '../../components/osquery_schema_link';
 import { FieldHook } from '../../shared_imports';
 import { OsqueryEditor } from '../../editor';
-import { SavedQueriesDropdown } from '../../saved_queries/saved_queries_dropdown';
+import {
+  SavedQueriesDropdown,
+  SavedQueriesDropdownRef,
+} from '../../saved_queries/saved_queries_dropdown';
 
 interface LiveQueryQueryFieldProps {
   disabled?: boolean;
@@ -21,16 +24,18 @@ interface LiveQueryQueryFieldProps {
 const LiveQueryQueryFieldComponent: React.FC<LiveQueryQueryFieldProps> = ({ disabled, field }) => {
   const { value, setValue, errors } = field;
   const error = errors[0]?.message;
+  const savedQueriesDropdownRef = useRef<SavedQueriesDropdownRef>(null);
 
   const handleSavedQueryChange = useCallback(
     (savedQuery) => {
-      setValue(savedQuery.query);
+      setValue(savedQuery?.query ?? '');
     },
     [setValue]
   );
 
   const handleEditorChange = useCallback(
     (newValue) => {
+      savedQueriesDropdownRef.current?.clearSelection();
       setValue(newValue);
     },
     [setValue]
@@ -39,7 +44,11 @@ const LiveQueryQueryFieldComponent: React.FC<LiveQueryQueryFieldProps> = ({ disa
   return (
     <EuiFormRow isInvalid={typeof error === 'string'} error={error} fullWidth>
       <>
-        <SavedQueriesDropdown disabled={disabled} onChange={handleSavedQueryChange} />
+        <SavedQueriesDropdown
+          ref={savedQueriesDropdownRef}
+          disabled={disabled}
+          onChange={handleSavedQueryChange}
+        />
         <EuiSpacer />
         <EuiFormRow fullWidth labelAppend={<OsquerySchemaLink />}>
           <OsqueryEditor defaultValue={value} disabled={disabled} onChange={handleEditorChange} />
diff --git a/x-pack/plugins/osquery/public/routes/live_queries/new/index.tsx b/x-pack/plugins/osquery/public/routes/live_queries/new/index.tsx
index 9967eb97cddf2..40614c1f3e1b8 100644
--- a/x-pack/plugins/osquery/public/routes/live_queries/new/index.tsx
+++ b/x-pack/plugins/osquery/public/routes/live_queries/new/index.tsx
@@ -8,7 +8,7 @@
 import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { useMemo } from 'react';
-import { useLocation } from 'react-router-dom';
+import { useHistory, useLocation } from 'react-router-dom';
 import qs from 'query-string';
 
 import { WithHeaderLayout } from '../../../components/layouts';
@@ -19,12 +19,18 @@ import { BetaBadge, BetaBadgeRowWrapper } from '../../../components/beta_badge';
 
 const NewLiveQueryPageComponent = () => {
   useBreadcrumbs('live_query_new');
+  const { replace } = useHistory();
   const location = useLocation();
   const liveQueryListProps = useRouterNavigate('live_queries');
 
   const formDefaultValue = useMemo(() => {
     const queryParams = qs.parse(location.search);
 
+    if (location.state?.form.query) {
+      replace({ state: null });
+      return { query: location.state?.form.query };
+    }
+
     if (queryParams?.agentPolicyId) {
       return {
         agentSelection: {
@@ -37,7 +43,7 @@ const NewLiveQueryPageComponent = () => {
     }
 
     return undefined;
-  }, [location.search]);
+  }, [location.search, location.state, replace]);
 
   const LeftColumn = useMemo(
     () => (
diff --git a/x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx b/x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx
index 7e8e8e543dfab..8738c06d06597 100644
--- a/x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx
+++ b/x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx
@@ -16,6 +16,7 @@ import {
 import React, { useCallback, useMemo, useState } from 'react';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { useHistory } from 'react-router-dom';
 
 import { SavedObject } from 'kibana/public';
 import { WithHeaderLayout } from '../../../components/layouts';
@@ -51,6 +52,7 @@ const EditButton = React.memo(EditButtonComponent);
 
 const SavedQueriesPageComponent = () => {
   useBreadcrumbs('saved_queries');
+  const { push } = useHistory();
   const newQueryLinkProps = useRouterNavigate('saved_queries/new');
   const [pageIndex, setPageIndex] = useState(0);
   const [pageSize, setPageSize] = useState(10);
@@ -59,21 +61,15 @@ const SavedQueriesPageComponent = () => {
 
   const { data } = useSavedQueries({ isLive: true });
 
-  // const handlePlayClick = useCallback(
-  //   (item) =>
-  //     push({
-  //       search: qs.stringify({
-  //         tab: 'live_query',
-  //       }),
-  //       state: {
-  //         query: {
-  //           id: item.id,
-  //           query: item.attributes.query,
-  //         },
-  //       },
-  //     }),
-  //   [push]
-  // );
+  const handlePlayClick = useCallback(
+    (item) =>
+      push('/live_queries/new', {
+        form: {
+          savedQueryId: item.id,
+        },
+      }),
+    [push]
+  );
 
   const renderEditAction = useCallback(
     (item: SavedObject<{ name: string }>) => (
@@ -96,45 +92,53 @@ const SavedQueriesPageComponent = () => {
     () => [
       {
         field: 'attributes.id',
-        name: 'Query ID',
+        name: i18n.translate('xpack.osquery.savedQueries.table.queryIdColumnTitle', {
+          defaultMessage: 'Query ID',
+        }),
         sortable: true,
         truncateText: true,
       },
       {
         field: 'attributes.description',
-        name: 'Description',
+        name: i18n.translate('xpack.osquery.savedQueries.table.descriptionColumnTitle', {
+          defaultMessage: 'Description',
+        }),
         sortable: true,
         truncateText: true,
       },
       {
         field: 'attributes.created_by',
-        name: 'Created by',
+        name: i18n.translate('xpack.osquery.savedQueries.table.createdByColumnTitle', {
+          defaultMessage: 'Created by',
+        }),
         sortable: true,
         truncateText: true,
       },
       {
         field: 'attributes.updated_at',
-        name: 'Last updated at',
+        name: i18n.translate('xpack.osquery.savedQueries.table.updatedAtColumnTitle', {
+          defaultMessage: 'Last updated at',
+        }),
         sortable: (item: SavedObject<{ updated_at: string }>) =>
           item.attributes.updated_at ? Date.parse(item.attributes.updated_at) : 0,
         truncateText: true,
         render: renderUpdatedAt,
       },
       {
-        name: 'Actions',
+        name: i18n.translate('xpack.osquery.savedQueries.table.actionsColumnTitle', {
+          defaultMessage: 'Actions',
+        }),
         actions: [
-          // {
-          //   name: 'Live query',
-          //   description: 'Run live query',
-          //   type: 'icon',
-          //   icon: 'play',
-          //   onClick: handlePlayClick,
-          // },
+          {
+            type: 'icon',
+            icon: 'play',
+            onClick: handlePlayClick,
+          },
           { render: renderEditAction },
         ],
       },
     ],
-    [renderEditAction, renderUpdatedAt]
+    [handlePlayClick, renderEditAction, renderUpdatedAt]
   );
 
   const onTableChange = useCallback(({ page = {}, sort = {} }) => {
diff --git a/x-pack/plugins/osquery/public/saved_queries/saved_queries_dropdown.tsx b/x-pack/plugins/osquery/public/saved_queries/saved_queries_dropdown.tsx
index e30954a695b2d..fc7cee2fc804c 100644
--- a/x-pack/plugins/osquery/public/saved_queries/saved_queries_dropdown.tsx
+++ b/x-pack/plugins/osquery/public/saved_queries/saved_queries_dropdown.tsx
@@ -6,45 +6,83 @@
  */
 
 import { find } from 'lodash/fp';
-import { EuiCodeBlock, EuiFormRow, EuiComboBox, EuiText } from '@elastic/eui';
-import React, { useCallback, useState } from 'react';
+import { EuiCodeBlock, EuiFormRow, EuiComboBox, EuiTextColor } from '@elastic/eui';
+import React, {
+  forwardRef,
+  useCallback,
+  useEffect,
+  useImperativeHandle,
+  useMemo,
+  useState,
+} from 'react';
 import { SimpleSavedObject } from 'kibana/public';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { useHistory, useLocation } from 'react-router-dom';
+import styled from 'styled-components';
 
 import { useSavedQueries } from './use_saved_queries';
 
+export interface SavedQueriesDropdownRef {
+  clearSelection: () => void;
+}
+
+const TextTruncate = styled.div`
+  overflow: hidden;
+  text-overflow: ellipsis;
+`;
+
+const StyledEuiCodeBlock = styled(EuiCodeBlock)`
+  .euiCodeBlock__line {
+    white-space: nowrap;
+  }
+`;
+
 interface SavedQueriesDropdownProps {
   disabled?: boolean;
   onChange: (
-    value: SimpleSavedObject<{
-      id: string;
-      description?: string | undefined;
-      query: string;
-    }>['attributes']
+    value:
+      | SimpleSavedObject<{
+          id: string;
+          description?: string | undefined;
+          query: string;
+        }>['attributes']
+      | null
   ) => void;
 }
 
-const SavedQueriesDropdownComponent: React.FC<SavedQueriesDropdownProps> = ({
-  disabled,
-  onChange,
-}) => {
+const SavedQueriesDropdownComponent = forwardRef<
+  SavedQueriesDropdownRef,
+  SavedQueriesDropdownProps
+>(({ disabled, onChange }, ref) => {
+  const { replace } = useHistory();
+  const location = useLocation();
   const [selectedOptions, setSelectedOptions] = useState([]);
 
   const { data } = useSavedQueries({});
 
-  const queryOptions =
-    data?.savedObjects?.map((savedQuery) => ({
-      label: savedQuery.attributes.id ?? '',
-      value: {
-        id: savedQuery.attributes.id,
-        description: savedQuery.attributes.description,
-        query: savedQuery.attributes.query,
-      },
-    })) ?? [];
+  const queryOptions = useMemo(
+    () =>
+      data?.savedObjects?.map((savedQuery) => ({
+        label: savedQuery.attributes.id ?? '',
+        value: {
+          savedObjectId: savedQuery.id,
+          id: savedQuery.attributes.id,
+          description: savedQuery.attributes.description,
+          query: savedQuery.attributes.query,
+        },
+      })) ?? [],
+    [data?.savedObjects]
+  );
 
   const handleSavedQueryChange = useCallback(
     (newSelectedOptions) => {
+      if (!newSelectedOptions.length) {
+        onChange(null);
+        setSelectedOptions(newSelectedOptions);
+        return;
+      }
+
       const selectedSavedQuery = find(
         ['attributes.id', newSelectedOptions[0].value.id],
         data?.savedObjects
@@ -62,17 +100,41 @@ const SavedQueriesDropdownComponent: React.FC<SavedQueriesDropdownProps> = ({
     ({ value }) => (
       <>
         <strong>{value.id}</strong>
-        <EuiText size="s" color="subdued">
-          <p className="euiTextColor--subdued">{value.description}</p>
-        </EuiText>
-        <EuiCodeBlock language="sql" fontSize="m" paddingSize="s">
-          {value.query}
-        </EuiCodeBlock>
+        <TextTruncate>
+          <EuiTextColor color="subdued">{value.description}</EuiTextColor>
+        </TextTruncate>
+        <StyledEuiCodeBlock language="sql" fontSize="m" paddingSize="s">
+          {value.query.split('\n').join(' ')}
+        </StyledEuiCodeBlock>
       </>
     ),
     []
   );
 
+  const clearSelection = useCallback(() => setSelectedOptions([]), []);
+
+  useEffect(() => {
+    const savedQueryId = location.state?.form?.savedQueryId;
+
+    if (savedQueryId) {
+      const savedQueryOption = find(['value.savedObjectId', savedQueryId], queryOptions);
+
+      if (savedQueryOption) {
+        handleSavedQueryChange([savedQueryOption]);
+      }
+
+      replace({ state: null });
+    }
+  }, [handleSavedQueryChange, replace, location.state, queryOptions]);
+
+  useImperativeHandle(
+    ref,
+    () => ({
+      clearSelection,
+    }),
+    [clearSelection]
+  );
+
   return (
     <EuiFormRow
       label={
@@ -95,10 +157,10 @@ const SavedQueriesDropdownComponent: React.FC<SavedQueriesDropdownProps> = ({
         selectedOptions={selectedOptions}
         onChange={handleSavedQueryChange}
         renderOption={renderOption}
-        rowHeight={90}
+        rowHeight={110}
       />
     </EuiFormRow>
   );
-};
+});
 
 export const SavedQueriesDropdown = React.memo(SavedQueriesDropdownComponent);
diff --git a/x-pack/plugins/osquery/public/saved_queries/use_update_saved_query.ts b/x-pack/plugins/osquery/public/saved_queries/use_update_saved_query.ts
index 1260413676a4e..6f4aa51710811 100644
--- a/x-pack/plugins/osquery/public/saved_queries/use_update_saved_query.ts
+++ b/x-pack/plugins/osquery/public/saved_queries/use_update_saved_query.ts
@@ -56,7 +56,7 @@ export const useUpdateSavedQuery = ({ savedQueryId }: UseUpdateSavedQueryProps)
           i18n.translate('xpack.osquery.editSavedQuery.successToastMessageText', {
             defaultMessage: 'Successfully updated "{savedQueryName}" query',
             values: {
-              savedQueryName: payload.attributes?.name ?? '',
+              savedQueryName: payload.attributes?.id ?? '',
             },
           })
         );
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/queries/query_flyout.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/queries/query_flyout.tsx
index 32547bc5dd2d0..95a31efeaf135 100644
--- a/x-pack/plugins/osquery/public/scheduled_query_groups/queries/query_flyout.tsx
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/queries/query_flyout.tsx
@@ -71,10 +71,14 @@ const QueryFlyoutComponent: React.FC<QueryFlyoutProps> = ({
     [integrationPackageVersion]
   );
 
-  const { submit, setFieldValue } = form;
+  const { submit, setFieldValue, reset } = form;
 
   const handleSetQueryValue = useCallback(
     (savedQuery) => {
+      if (!savedQuery) {
+        return reset();
+      }
+
       setFieldValue('id', savedQuery.id);
       setFieldValue('query', savedQuery.query);
 
@@ -94,7 +98,7 @@ const QueryFlyoutComponent: React.FC<QueryFlyoutProps> = ({
         setFieldValue('version', [savedQuery.version]);
       }
     },
-    [isFieldSupported, setFieldValue]
+    [isFieldSupported, setFieldValue, reset]
   );
 
   return (
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/scheduled_query_group_queries_table.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/scheduled_query_group_queries_table.tsx
index 36d15587086f2..01acf2dc0d826 100644
--- a/x-pack/plugins/osquery/public/scheduled_query_groups/scheduled_query_group_queries_table.tsx
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/scheduled_query_group_queries_table.tsx
@@ -258,7 +258,7 @@ const ViewResultsInDiscoverActionComponent: React.FC<ViewResultsInDiscoverAction
               }
             : {
                 to: 'now',
-                from: 'now-15m',
+                from: 'now-1d',
                 mode: 'relative',
               },
       });
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts
index 63b1b207f02e3..55bec687d3e2c 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import type { estypes } from '@elastic/elasticsearch';
+
 import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common';
 import { AgentsRequestOptions } from '../../../../../../common/search_strategy';
 // import { createQueryFilterClauses } from '../../../../../../common/utils/build_query';
@@ -24,10 +26,23 @@ export const buildActionsQuery = ({
     body: {
       // query: { bool: { filter } },
       query: {
-        term: {
-          type: {
-            value: 'INPUT_ACTION',
-          },
+        bool: {
+          must: [
+            {
+              term: {
+                type: {
+                  value: 'INPUT_ACTION',
+                },
+              },
+            },
+            {
+              term: {
+                input_type: {
+                  value: 'osquery',
+                },
+              },
+            },
+          ] as estypes.QueryDslQueryContainer[],
         },
       },
       from: cursorStart,
diff --git a/x-pack/plugins/reporting/public/management/ilm_policy_link.tsx b/x-pack/plugins/reporting/public/management/ilm_policy_link.tsx
index 3945ec5be9fa7..a40f167de5bc3 100644
--- a/x-pack/plugins/reporting/public/management/ilm_policy_link.tsx
+++ b/x-pack/plugins/reporting/public/management/ilm_policy_link.tsx
@@ -21,7 +21,7 @@ interface Props {
 
 const i18nTexts = {
   buttonLabel: i18n.translate('xpack.reporting.listing.reports.ilmPolicyLinkText', {
-    defaultMessage: 'Edit ILM policy',
+    defaultMessage: 'Edit reporting ILM policy',
   }),
 };
 
diff --git a/x-pack/plugins/reporting/public/management/migrate_ilm_policy_callout/ilm_policy_migration_needed_callout.tsx b/x-pack/plugins/reporting/public/management/migrate_ilm_policy_callout/ilm_policy_migration_needed_callout.tsx
index 5bb3ac524e130..e96cb842d55cf 100644
--- a/x-pack/plugins/reporting/public/management/migrate_ilm_policy_callout/ilm_policy_migration_needed_callout.tsx
+++ b/x-pack/plugins/reporting/public/management/migrate_ilm_policy_callout/ilm_policy_migration_needed_callout.tsx
@@ -19,12 +19,12 @@ import { useInternalApiClient } from '../../lib/reporting_api_client';
 
 const i18nTexts = {
   title: i18n.translate('xpack.reporting.listing.ilmPolicyCallout.migrationNeededTitle', {
-    defaultMessage: 'Migrate reporting indices',
+    defaultMessage: 'Apply new lifecycle policy for reports',
   }),
   description: (
     <FormattedMessage
       id="xpack.reporting.listing.ilmPolicyCallout.migrationNeededDescription"
-      defaultMessage="Reporting indices are not managed by the same ILM policy. This can lead to unexpected results for the lifecycle of reports stored in Elasticsearch indices. Reporting indices should all be managed by the {ilmPolicyName} policy."
+      defaultMessage="To ensure your reports are managed consistently, all reporting indices should use the {ilmPolicyName} policy."
       values={{
         ilmPolicyName: <EuiCode>{ILM_POLICY_NAME}</EuiCode>,
       }}
@@ -33,7 +33,10 @@ const i18nTexts = {
   buttonLabel: i18n.translate(
     'xpack.reporting.listing.ilmPolicyCallout.migrateIndicesButtonLabel',
     {
-      defaultMessage: 'Migrate indices',
+      defaultMessage: 'Apply {ilmPolicyName} policy',
+      values: {
+        ilmPolicyName: ILM_POLICY_NAME,
+      },
     }
   ),
   migrateErrorTitle: i18n.translate(
@@ -45,7 +48,7 @@ const i18nTexts = {
   migrateSuccessTitle: i18n.translate(
     'xpack.reporting.listing.ilmPolicyCallout.migrateIndicesSuccessTitle',
     {
-      defaultMessage: 'Successfully migrated reporting indices',
+      defaultMessage: 'Reporting policy active for all reporting indices',
     }
   ),
 };
diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index b6fd6b9a605c0..19ea85b056bed 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -15,6 +15,11 @@ export { RuleDataClient } from './rule_data_client';
 export { IRuleDataClient } from './rule_data_client/types';
 export { getRuleExecutorData, RuleExecutorData } from './utils/get_rule_executor_data';
 export { createLifecycleRuleTypeFactory } from './utils/create_lifecycle_rule_type_factory';
+export {
+  LifecycleRuleExecutor,
+  LifecycleAlertServices,
+  createLifecycleExecutor,
+} from './utils/create_lifecycle_executor';
 export { createPersistenceRuleTypeFactory } from './utils/create_persistence_rule_type_factory';
 
 export const plugin = (initContext: PluginInitializerContext) =>
diff --git a/x-pack/plugins/rule_registry/server/types.ts b/x-pack/plugins/rule_registry/server/types.ts
index f8bd1940b10a8..051789b1896bb 100644
--- a/x-pack/plugins/rule_registry/server/types.ts
+++ b/x-pack/plugins/rule_registry/server/types.ts
@@ -12,7 +12,7 @@ import {
   AlertTypeParams,
   AlertTypeState,
 } from '../../alerting/common';
-import { AlertType } from '../../alerting/server';
+import { AlertExecutorOptions, AlertServices, AlertType } from '../../alerting/server';
 import { AlertsClient } from './alert_data_client/alerts_client';
 
 type SimpleAlertType<
@@ -41,6 +41,20 @@ export type AlertTypeWithExecutor<
   executor: AlertTypeExecutor<TParams, TAlertInstanceContext, TServices>;
 };
 
+export type AlertExecutorOptionsWithExtraServices<
+  Params extends AlertTypeParams = never,
+  State extends AlertTypeState = never,
+  InstanceState extends AlertInstanceState = never,
+  InstanceContext extends AlertInstanceContext = never,
+  ActionGroupIds extends string = never,
+  TExtraServices extends {} = never
+> = Omit<
+  AlertExecutorOptions<Params, State, InstanceState, InstanceContext, ActionGroupIds>,
+  'services'
+> & {
+  services: AlertServices<InstanceState, InstanceContext, ActionGroupIds> & TExtraServices;
+};
+
 /**
  * @public
  */
diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts
new file mode 100644
index 0000000000000..06c2cc8ff005d
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts
@@ -0,0 +1,330 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Logger } from '@kbn/logging';
+import { getOrElse } from 'fp-ts/lib/Either';
+import * as rt from 'io-ts';
+import { Mutable } from 'utility-types';
+import { v4 } from 'uuid';
+import {
+  AlertExecutorOptions,
+  AlertInstance,
+  AlertInstanceContext,
+  AlertInstanceState,
+  AlertTypeParams,
+  AlertTypeState,
+} from '../../../alerting/server';
+import { ParsedTechnicalFields, parseTechnicalFields } from '../../common/parse_technical_fields';
+import {
+  ALERT_DURATION,
+  ALERT_END,
+  ALERT_ID,
+  ALERT_START,
+  ALERT_STATUS,
+  ALERT_UUID,
+  EVENT_ACTION,
+  EVENT_KIND,
+  OWNER,
+  RULE_UUID,
+  TIMESTAMP,
+} from '../../common/technical_rule_data_field_names';
+import { RuleDataClient } from '../rule_data_client';
+import { AlertExecutorOptionsWithExtraServices } from '../types';
+import { getRuleData } from './get_rule_executor_data';
+
+type LifecycleAlertService<
+  InstanceState extends AlertInstanceState = never,
+  InstanceContext extends AlertInstanceContext = never,
+  ActionGroupIds extends string = never
+> = (alert: {
+  id: string;
+  fields: Record<string, unknown>;
+}) => AlertInstance<InstanceState, InstanceContext, ActionGroupIds>;
+
+export interface LifecycleAlertServices<
+  InstanceState extends AlertInstanceState = never,
+  InstanceContext extends AlertInstanceContext = never,
+  ActionGroupIds extends string = never
+> {
+  alertWithLifecycle: LifecycleAlertService<InstanceState, InstanceContext, ActionGroupIds>;
+}
+
+export type LifecycleRuleExecutor<
+  Params extends AlertTypeParams = never,
+  State extends AlertTypeState = never,
+  InstanceState extends AlertInstanceState = never,
+  InstanceContext extends AlertInstanceContext = never,
+  ActionGroupIds extends string = never
+> = (
+  options: AlertExecutorOptionsWithExtraServices<
+    Params,
+    State,
+    InstanceState,
+    InstanceContext,
+    ActionGroupIds,
+    LifecycleAlertServices<InstanceState, InstanceContext, ActionGroupIds>
+  >
+) => Promise<State | void>;
+
+const trackedAlertStateRt = rt.type({
+  alertId: rt.string,
+  alertUuid: rt.string,
+  started: rt.string,
+});
+
+export type TrackedLifecycleAlertState = rt.TypeOf<typeof trackedAlertStateRt>;
+
+const alertTypeStateRt = <State extends AlertTypeState>() =>
+  rt.record(rt.string, rt.unknown) as rt.Type<State, State, unknown>;
+
+const wrappedStateRt = <State extends AlertTypeState>() =>
+  rt.type({
+    wrapped: alertTypeStateRt<State>(),
+    trackedAlerts: rt.record(rt.string, trackedAlertStateRt),
+  });
+
+/**
+ * This is redefined instead of derived from above `wrappedStateRt` because
+ * there's no easy way to instantiate generic values such as the runtime type
+ * factory function.
+ */
+export type WrappedLifecycleRuleState<State extends AlertTypeState> = AlertTypeState & {
+  wrapped: State | void;
+  trackedAlerts: Record<string, TrackedLifecycleAlertState>;
+};
+
+export const createLifecycleExecutor = (logger: Logger, ruleDataClient: RuleDataClient) => <
+  Params extends AlertTypeParams = never,
+  State extends AlertTypeState = never,
+  InstanceState extends AlertInstanceState = never,
+  InstanceContext extends AlertInstanceContext = never,
+  ActionGroupIds extends string = never
+>(
+  wrappedExecutor: LifecycleRuleExecutor<
+    Params,
+    State,
+    InstanceState,
+    InstanceContext,
+    ActionGroupIds
+  >
+) => async (
+  options: AlertExecutorOptions<
+    Params,
+    WrappedLifecycleRuleState<State>,
+    InstanceState,
+    InstanceContext,
+    ActionGroupIds
+  >
+): Promise<WrappedLifecycleRuleState<State>> => {
+  const {
+    rule,
+    services: { alertInstanceFactory },
+    state: previousState,
+  } = options;
+
+  const ruleExecutorData = getRuleData(options);
+
+  const state = getOrElse(
+    (): WrappedLifecycleRuleState<State> => ({
+      wrapped: previousState as State,
+      trackedAlerts: {},
+    })
+  )(wrappedStateRt<State>().decode(previousState));
+
+  const currentAlerts: Record<string, { [ALERT_ID]: string }> = {};
+
+  const timestamp = options.startedAt.toISOString();
+
+  const lifecycleAlertServices: LifecycleAlertServices<
+    InstanceState,
+    InstanceContext,
+    ActionGroupIds
+  > = {
+    alertWithLifecycle: ({ id, fields }) => {
+      currentAlerts[id] = {
+        ...fields,
+        [ALERT_ID]: id,
+      };
+      return alertInstanceFactory(id);
+    },
+  };
+
+  const nextWrappedState = await wrappedExecutor({
+    ...options,
+    state: state.wrapped != null ? state.wrapped : ({} as State),
+    services: {
+      ...options.services,
+      ...lifecycleAlertServices,
+    },
+  });
+
+  const currentAlertIds = Object.keys(currentAlerts);
+  const trackedAlertIds = Object.keys(state.trackedAlerts);
+  const newAlertIds = currentAlertIds.filter((alertId) => !trackedAlertIds.includes(alertId));
+
+  const allAlertIds = [...new Set(currentAlertIds.concat(trackedAlertIds))];
+
+  const trackedAlertStatesOfRecovered = Object.values(state.trackedAlerts).filter(
+    (trackedAlertState) => !currentAlerts[trackedAlertState.alertId]
+  );
+
+  logger.debug(
+    `Tracking ${allAlertIds.length} alerts (${newAlertIds.length} new, ${trackedAlertStatesOfRecovered.length} recovered)`
+  );
+
+  const alertsDataMap: Record<
+    string,
+    {
+      [ALERT_ID]: string;
+    }
+  > = {
+    ...currentAlerts,
+  };
+
+  if (trackedAlertStatesOfRecovered.length) {
+    const { hits } = await ruleDataClient.getReader().search({
+      body: {
+        query: {
+          bool: {
+            filter: [
+              {
+                term: {
+                  [RULE_UUID]: ruleExecutorData[RULE_UUID],
+                },
+              },
+              {
+                terms: {
+                  [ALERT_UUID]: trackedAlertStatesOfRecovered.map(
+                    (trackedAlertState) => trackedAlertState.alertUuid
+                  ),
+                },
+              },
+            ],
+          },
+        },
+        size: trackedAlertStatesOfRecovered.length,
+        collapse: {
+          field: ALERT_UUID,
+        },
+        _source: false,
+        fields: [{ field: '*', include_unmapped: true }],
+        sort: {
+          [TIMESTAMP]: 'desc' as const,
+        },
+      },
+      allow_no_indices: true,
+    });
+
+    hits.hits.forEach((hit) => {
+      const fields = parseTechnicalFields(hit.fields);
+      const alertId = fields[ALERT_ID]!;
+      alertsDataMap[alertId] = {
+        ...fields,
+        [ALERT_ID]: alertId,
+      };
+    });
+  }
+
+  const eventsToIndex = allAlertIds.map((alertId) => {
+    const alertData = alertsDataMap[alertId];
+
+    if (!alertData) {
+      logger.warn(`Could not find alert data for ${alertId}`);
+    }
+
+    const event: Mutable<ParsedTechnicalFields> = {
+      ...alertData,
+      ...ruleExecutorData,
+      [TIMESTAMP]: timestamp,
+      [EVENT_KIND]: 'event',
+      [OWNER]: rule.consumer,
+      [ALERT_ID]: alertId,
+    };
+
+    const isNew = !state.trackedAlerts[alertId];
+    const isRecovered = !currentAlerts[alertId];
+    const isActiveButNotNew = !isNew && !isRecovered;
+    const isActive = !isRecovered;
+
+    const { alertUuid, started } = state.trackedAlerts[alertId] ?? {
+      alertUuid: v4(),
+      started: timestamp,
+    };
+
+    event[ALERT_START] = started;
+    event[ALERT_UUID] = alertUuid;
+
+    if (isNew) {
+      event[EVENT_ACTION] = 'open';
+    }
+
+    if (isRecovered) {
+      event[ALERT_END] = timestamp;
+      event[EVENT_ACTION] = 'close';
+      event[ALERT_STATUS] = 'closed';
+    }
+
+    if (isActiveButNotNew) {
+      event[EVENT_ACTION] = 'active';
+    }
+
+    if (isActive) {
+      event[ALERT_STATUS] = 'open';
+    }
+
+    event[ALERT_DURATION] =
+      (options.startedAt.getTime() - new Date(event[ALERT_START]!).getTime()) * 1000;
+
+    return event;
+  });
+
+  if (eventsToIndex.length) {
+    const alertEvents: Map<string, ParsedTechnicalFields> = new Map();
+
+    for (const event of eventsToIndex) {
+      const uuid = event[ALERT_UUID]!;
+      let storedEvent = alertEvents.get(uuid);
+      if (!storedEvent) {
+        storedEvent = event;
+      }
+      alertEvents.set(uuid, {
+        ...storedEvent,
+        [EVENT_KIND]: 'signal',
+      });
+    }
+    logger.debug(`Preparing to index ${eventsToIndex.length} alerts.`);
+
+    if (ruleDataClient.isWriteEnabled()) {
+      await ruleDataClient.getWriter().bulk({
+        body: eventsToIndex
+          .flatMap((event) => [{ index: {} }, event])
+          .concat(
+            Array.from(alertEvents.values()).flatMap((event) => [
+              { index: { _id: event[ALERT_UUID]! } },
+              event,
+            ])
+          ),
+      });
+    }
+  }
+
+  const nextTrackedAlerts = Object.fromEntries(
+    eventsToIndex
+      .filter((event) => event[ALERT_STATUS] !== 'closed')
+      .map((event) => {
+        const alertId = event[ALERT_ID]!;
+        const alertUuid = event[ALERT_UUID]!;
+        const started = new Date(event[ALERT_START]!).toISOString();
+        return [alertId, { alertId, alertUuid, started }];
+      })
+  );
+
+  return {
+    wrapped: nextWrappedState ?? ({} as State),
+    trackedAlerts: ruleDataClient.isWriteEnabled() ? nextTrackedAlerts : {},
+  };
+};
diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type.test.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type.test.ts
index a37ba9ef56636..3e7fbbe5cbc59 100644
--- a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type.test.ts
+++ b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type.test.ts
@@ -38,11 +38,11 @@ function createRule() {
       });
       nextAlerts = [];
     },
-    id: 'test_type',
+    id: 'ruleTypeId',
     minimumLicenseRequired: 'basic',
     isExportable: true,
-    name: 'Test type',
-    producer: 'test',
+    name: 'ruleTypeName',
+    producer: 'producer',
     actionVariables: {
       context: [],
       params: [],
@@ -195,11 +195,11 @@ describe('createLifecycleRuleTypeFactory', () => {
               "kibana.rac.alert.duration.us": 0,
               "kibana.rac.alert.id": "opbeans-java",
               "kibana.rac.alert.owner": "consumer",
-              "kibana.rac.alert.producer": "test",
+              "kibana.rac.alert.producer": "producer",
               "kibana.rac.alert.start": "2021-06-16T09:01:00.000Z",
               "kibana.rac.alert.status": "open",
-              "rule.category": "Test type",
-              "rule.id": "test_type",
+              "rule.category": "ruleTypeName",
+              "rule.id": "ruleTypeId",
               "rule.name": "name",
               "rule.uuid": "alertId",
               "service.name": "opbeans-java",
@@ -214,11 +214,11 @@ describe('createLifecycleRuleTypeFactory', () => {
               "kibana.rac.alert.duration.us": 0,
               "kibana.rac.alert.id": "opbeans-node",
               "kibana.rac.alert.owner": "consumer",
-              "kibana.rac.alert.producer": "test",
+              "kibana.rac.alert.producer": "producer",
               "kibana.rac.alert.start": "2021-06-16T09:01:00.000Z",
               "kibana.rac.alert.status": "open",
-              "rule.category": "Test type",
-              "rule.id": "test_type",
+              "rule.category": "ruleTypeName",
+              "rule.id": "ruleTypeId",
               "rule.name": "name",
               "rule.uuid": "alertId",
               "service.name": "opbeans-node",
@@ -233,11 +233,11 @@ describe('createLifecycleRuleTypeFactory', () => {
               "kibana.rac.alert.duration.us": 0,
               "kibana.rac.alert.id": "opbeans-java",
               "kibana.rac.alert.owner": "consumer",
-              "kibana.rac.alert.producer": "test",
+              "kibana.rac.alert.producer": "producer",
               "kibana.rac.alert.start": "2021-06-16T09:01:00.000Z",
               "kibana.rac.alert.status": "open",
-              "rule.category": "Test type",
-              "rule.id": "test_type",
+              "rule.category": "ruleTypeName",
+              "rule.id": "ruleTypeId",
               "rule.name": "name",
               "rule.uuid": "alertId",
               "service.name": "opbeans-java",
@@ -252,11 +252,11 @@ describe('createLifecycleRuleTypeFactory', () => {
               "kibana.rac.alert.duration.us": 0,
               "kibana.rac.alert.id": "opbeans-node",
               "kibana.rac.alert.owner": "consumer",
-              "kibana.rac.alert.producer": "test",
+              "kibana.rac.alert.producer": "producer",
               "kibana.rac.alert.start": "2021-06-16T09:01:00.000Z",
               "kibana.rac.alert.status": "open",
-              "rule.category": "Test type",
-              "rule.id": "test_type",
+              "rule.category": "ruleTypeName",
+              "rule.id": "ruleTypeId",
               "rule.name": "name",
               "rule.uuid": "alertId",
               "service.name": "opbeans-node",
diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts
index 34045a2a905f8..cf1be1bd32013 100644
--- a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts
+++ b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts
@@ -5,51 +5,26 @@
  * 2.0.
  */
 import { Logger } from '@kbn/logging';
-import { isLeft } from 'fp-ts/lib/Either';
-import * as t from 'io-ts';
-import { Mutable } from 'utility-types';
-import v4 from 'uuid/v4';
-import { AlertInstance } from '../../../alerting/server';
 import { RuleDataClient } from '..';
 import {
   AlertInstanceContext,
   AlertInstanceState,
   AlertTypeParams,
+  AlertTypeState,
 } from '../../../alerting/common';
-import {
-  ALERT_DURATION,
-  ALERT_END,
-  ALERT_ID,
-  ALERT_START,
-  ALERT_STATUS,
-  ALERT_UUID,
-  EVENT_ACTION,
-  EVENT_KIND,
-  OWNER,
-  RULE_UUID,
-  TIMESTAMP,
-} from '../../common/technical_rule_data_field_names';
+import { AlertInstance } from '../../../alerting/server';
 import { AlertTypeWithExecutor } from '../types';
-import { ParsedTechnicalFields, parseTechnicalFields } from '../../common/parse_technical_fields';
-import { getRuleExecutorData } from './get_rule_executor_data';
+import { createLifecycleExecutor } from './create_lifecycle_executor';
 
 export type LifecycleAlertService<TAlertInstanceContext extends Record<string, unknown>> = (alert: {
   id: string;
   fields: Record<string, unknown>;
 }) => AlertInstance<AlertInstanceState, TAlertInstanceContext, string>;
 
-const trackedAlertStateRt = t.type({
-  alertId: t.string,
-  alertUuid: t.string,
-  started: t.string,
-});
-
-const wrappedStateRt = t.type({
-  wrapped: t.record(t.string, t.unknown),
-  trackedAlerts: t.record(t.string, trackedAlertStateRt),
-});
-
-type CreateLifecycleRuleTypeFactory = (options: {
+export const createLifecycleRuleTypeFactory = ({
+  logger,
+  ruleDataClient,
+}: {
   ruleDataClient: RuleDataClient;
   logger: Logger;
 }) => <
@@ -58,216 +33,17 @@ type CreateLifecycleRuleTypeFactory = (options: {
   TServices extends { alertWithLifecycle: LifecycleAlertService<TAlertInstanceContext> }
 >(
   type: AlertTypeWithExecutor<TParams, TAlertInstanceContext, TServices>
-) => AlertTypeWithExecutor<TParams, TAlertInstanceContext, any>;
-
-export const createLifecycleRuleTypeFactory: CreateLifecycleRuleTypeFactory = ({
-  logger,
-  ruleDataClient,
-}) => (type) => {
+): AlertTypeWithExecutor<TParams, TAlertInstanceContext, any> => {
+  const createBoundLifecycleExecutor = createLifecycleExecutor(logger, ruleDataClient);
+  const executor = createBoundLifecycleExecutor<
+    TParams,
+    AlertTypeState,
+    AlertInstanceState,
+    TAlertInstanceContext,
+    string
+  >(type.executor as any);
   return {
     ...type,
-    executor: async (options) => {
-      const {
-        services: { alertInstanceFactory },
-        state: previousState,
-        rule,
-      } = options;
-
-      const ruleExecutorData = getRuleExecutorData(type, options);
-
-      const decodedState = wrappedStateRt.decode(previousState);
-
-      const state = isLeft(decodedState)
-        ? {
-            wrapped: previousState,
-            trackedAlerts: {},
-          }
-        : decodedState.right;
-
-      const currentAlerts: Record<string, { [ALERT_ID]: string }> = {};
-
-      const timestamp = options.startedAt.toISOString();
-
-      const nextWrappedState = await type.executor({
-        ...options,
-        state: state.wrapped,
-        services: {
-          ...options.services,
-          alertWithLifecycle: ({ id, fields }) => {
-            currentAlerts[id] = {
-              ...fields,
-              [ALERT_ID]: id,
-            };
-            return alertInstanceFactory(id);
-          },
-        },
-      });
-
-      const currentAlertIds = Object.keys(currentAlerts);
-      const trackedAlertIds = Object.keys(state.trackedAlerts);
-      const newAlertIds = currentAlertIds.filter((alertId) => !trackedAlertIds.includes(alertId));
-
-      const allAlertIds = [...new Set(currentAlertIds.concat(trackedAlertIds))];
-
-      const trackedAlertStatesOfRecovered = Object.values(state.trackedAlerts).filter(
-        (trackedAlertState) => !currentAlerts[trackedAlertState.alertId]
-      );
-
-      logger.debug(
-        `Tracking ${allAlertIds.length} alerts (${newAlertIds.length} new, ${trackedAlertStatesOfRecovered.length} recovered)`
-      );
-
-      const alertsDataMap: Record<
-        string,
-        {
-          [ALERT_ID]: string;
-        }
-      > = {
-        ...currentAlerts,
-      };
-
-      if (trackedAlertStatesOfRecovered.length) {
-        const { hits } = await ruleDataClient.getReader().search({
-          body: {
-            query: {
-              bool: {
-                filter: [
-                  {
-                    term: {
-                      [RULE_UUID]: ruleExecutorData[RULE_UUID],
-                    },
-                  },
-                  {
-                    terms: {
-                      [ALERT_UUID]: trackedAlertStatesOfRecovered.map(
-                        (trackedAlertState) => trackedAlertState.alertUuid
-                      ),
-                    },
-                  },
-                ],
-              },
-            },
-            size: trackedAlertStatesOfRecovered.length,
-            collapse: {
-              field: ALERT_UUID,
-            },
-            _source: false,
-            fields: [{ field: '*', include_unmapped: true }],
-            sort: {
-              [TIMESTAMP]: 'desc' as const,
-            },
-          },
-          allow_no_indices: true,
-        });
-
-        hits.hits.forEach((hit) => {
-          const fields = parseTechnicalFields(hit.fields);
-          const alertId = fields[ALERT_ID]!;
-          alertsDataMap[alertId] = {
-            ...fields,
-            [ALERT_ID]: alertId,
-          };
-        });
-      }
-
-      const eventsToIndex = allAlertIds.map((alertId) => {
-        const alertData = alertsDataMap[alertId];
-
-        if (!alertData) {
-          logger.warn(`Could not find alert data for ${alertId}`);
-        }
-
-        const event: Mutable<ParsedTechnicalFields> = {
-          ...alertData,
-          ...ruleExecutorData,
-          [TIMESTAMP]: timestamp,
-          [EVENT_KIND]: 'event',
-          [OWNER]: rule.consumer,
-          [ALERT_ID]: alertId,
-        };
-
-        const isNew = !state.trackedAlerts[alertId];
-        const isRecovered = !currentAlerts[alertId];
-        const isActiveButNotNew = !isNew && !isRecovered;
-        const isActive = !isRecovered;
-
-        const { alertUuid, started } = state.trackedAlerts[alertId] ?? {
-          alertUuid: v4(),
-          started: timestamp,
-        };
-
-        event[ALERT_START] = started;
-        event[ALERT_UUID] = alertUuid;
-
-        if (isNew) {
-          event[EVENT_ACTION] = 'open';
-        }
-
-        if (isRecovered) {
-          event[ALERT_END] = timestamp;
-          event[EVENT_ACTION] = 'close';
-          event[ALERT_STATUS] = 'closed';
-        }
-
-        if (isActiveButNotNew) {
-          event[EVENT_ACTION] = 'active';
-        }
-
-        if (isActive) {
-          event[ALERT_STATUS] = 'open';
-        }
-
-        event[ALERT_DURATION] =
-          (options.startedAt.getTime() - new Date(event[ALERT_START]!).getTime()) * 1000;
-
-        return event;
-      });
-
-      if (eventsToIndex.length) {
-        const alertEvents: Map<string, ParsedTechnicalFields> = new Map();
-
-        for (const event of eventsToIndex) {
-          const uuid = event[ALERT_UUID]!;
-          let storedEvent = alertEvents.get(uuid);
-          if (!storedEvent) {
-            storedEvent = event;
-          }
-          alertEvents.set(uuid, {
-            ...storedEvent,
-            [EVENT_KIND]: 'signal',
-          });
-        }
-        logger.debug(`Preparing to index ${eventsToIndex.length} alerts.`);
-
-        if (ruleDataClient.isWriteEnabled()) {
-          await ruleDataClient.getWriter().bulk({
-            body: eventsToIndex
-              .flatMap((event) => [{ index: {} }, event])
-              .concat(
-                Array.from(alertEvents.values()).flatMap((event) => [
-                  { index: { _id: event[ALERT_UUID]! } },
-                  event,
-                ])
-              ),
-          });
-        }
-      }
-
-      const nextTrackedAlerts = Object.fromEntries(
-        eventsToIndex
-          .filter((event) => event[ALERT_STATUS] !== 'closed')
-          .map((event) => {
-            const alertId = event[ALERT_ID]!;
-            const alertUuid = event[ALERT_UUID]!;
-            const started = new Date(event[ALERT_START]!).toISOString();
-            return [alertId, { alertId, alertUuid, started }];
-          })
-      );
-
-      return {
-        wrapped: nextWrappedState ?? {},
-        trackedAlerts: ruleDataClient.isWriteEnabled() ? nextTrackedAlerts : {},
-      };
-    },
+    executor: executor as any,
   };
 };
diff --git a/x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts b/x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts
index 1ea640add7b48..7cb02428322a6 100644
--- a/x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts
+++ b/x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { AlertExecutorOptions } from '../../../alerting/server';
 import {
   PRODUCER,
   RULE_CATEGORY,
@@ -37,3 +38,14 @@ export function getRuleExecutorData(
     [PRODUCER]: type.producer,
   };
 }
+
+export function getRuleData(options: AlertExecutorOptions<any, any, any, any, any>) {
+  return {
+    [RULE_ID]: options.rule.ruleTypeId,
+    [RULE_UUID]: options.alertId,
+    [RULE_CATEGORY]: options.rule.ruleTypeName,
+    [RULE_NAME]: options.rule.name,
+    [TAGS]: options.tags,
+    [PRODUCER]: options.rule.producer,
+  };
+}
diff --git a/x-pack/plugins/rule_registry/server/utils/rbac.ts b/x-pack/plugins/rule_registry/server/utils/rbac.ts
index 812dbb8408812..e07c4394be2f1 100644
--- a/x-pack/plugins/rule_registry/server/utils/rbac.ts
+++ b/x-pack/plugins/rule_registry/server/utils/rbac.ts
@@ -9,9 +9,14 @@
  * registering a new instance of the rule data client
  * in a new plugin will require updating the below data structure
  * to include the index name where the alerts as data will be written to.
+ *
+ * This doesn't work in combination with the `xpack.ruleRegistry.index`
+ * setting, with which the user can change the index prefix.
  */
 export const mapConsumerToIndexName = {
   apm: '.alerts-observability-apm',
+  logs: '.alerts-observability.logs',
+  infrastructure: '.alerts-observability.metrics',
   observability: '.alerts-observability',
   siem: ['.alerts-security.alerts', '.siem-signals'],
 };
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index abfcb4014a79f..27d4a5c9fd399 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -110,6 +110,7 @@ export const APP_EVENT_FILTERS_PATH = `${APP_PATH}${EVENT_FILTERS_PATH}`;
 /** The comma-delimited list of Elasticsearch indices from which the SIEM app collects events */
 export const DEFAULT_INDEX_PATTERN = [
   'apm-*-transaction*',
+  'traces-apm*',
   'auditbeat-*',
   'endgame-*',
   'filebeat-*',
diff --git a/x-pack/plugins/security_solution/common/cti/constants.ts b/x-pack/plugins/security_solution/common/cti/constants.ts
index 631a13df1ecb1..7b22e9036f566 100644
--- a/x-pack/plugins/security_solution/common/cti/constants.ts
+++ b/x-pack/plugins/security_solution/common/cti/constants.ts
@@ -65,9 +65,9 @@ export const CTI_DEFAULT_SOURCES = [
   'Abuse Malware',
   'AlienVault OTX',
   'Anomali',
-  'Anomali ThreatStream',
   'Malware Bazaar',
   'MISP',
+  'Recorded Future',
 ];
 
 export const DEFAULT_CTI_SOURCE_INDEX = ['filebeat-*'];
diff --git a/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.test.ts b/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.test.ts
index 7de082e778a07..b38886296e74d 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.test.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.test.ts
@@ -1150,7 +1150,7 @@ describe('get_filter', () => {
             },
             {
               field: '@timestamp',
-              format: 'epoch_millis',
+              format: 'strict_date_optional_time',
             },
           ],
         },
@@ -1195,9 +1195,13 @@ describe('get_filter', () => {
               field: '*',
               include_unmapped: true,
             },
+            {
+              field: 'event.ingested',
+              format: 'strict_date_optional_time',
+            },
             {
               field: '@timestamp',
-              format: 'epoch_millis',
+              format: 'strict_date_optional_time',
             },
           ],
         },
@@ -1289,7 +1293,7 @@ describe('get_filter', () => {
             },
             {
               field: '@timestamp',
-              format: 'epoch_millis',
+              format: 'strict_date_optional_time',
             },
           ],
         },
diff --git a/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts b/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts
index 86e66577abd45..1e7bcb0002dad 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts
@@ -79,6 +79,15 @@ export const buildEqlSearchRequest = (
   eventCategoryOverride: string | undefined
 ): EqlSearchRequest => {
   const timestamp = timestampOverride ?? '@timestamp';
+
+  const defaultTimeFields = ['@timestamp'];
+  const timestamps =
+    timestampOverride != null ? [timestampOverride, ...defaultTimeFields] : defaultTimeFields;
+  const docFields = timestamps.map((tstamp) => ({
+    field: tstamp,
+    format: 'strict_date_optional_time',
+  }));
+
   // Assume that `indices.query.bool.max_clause_count` is at least 1024 (the default value),
   // allowing us to make 1024-item chunks of exception list items.
   // Discussion at https://issues.apache.org/jira/browse/LUCENE-4835 indicates that 1024 is a
@@ -126,14 +135,7 @@ export const buildEqlSearchRequest = (
           field: '*',
           include_unmapped: true,
         },
-        {
-          field: '@timestamp',
-          // BUG: We have to format @timestamp until this bug is fixed with epoch_millis
-          // https://github.com/elastic/elasticsearch/issues/74582
-          // TODO: Remove epoch and use the same techniques from x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.ts
-          // where we format both the timestamp and any overrides as ISO8601
-          format: 'epoch_millis',
-        },
+        ...docFields,
       ],
     },
   };
diff --git a/x-pack/plugins/security_solution/common/ecs/file/index.ts b/x-pack/plugins/security_solution/common/ecs/file/index.ts
index 5e409b1095cf5..0c9dde20011f4 100644
--- a/x-pack/plugins/security_solution/common/ecs/file/index.ts
+++ b/x-pack/plugins/security_solution/common/ecs/file/index.ts
@@ -14,9 +14,42 @@ export interface CodeSignature {
   subject_name: string[];
   trusted: string[];
 }
+
+export interface Token {
+  integrity_level_name: string;
+}
+
+export interface MemoryPe {
+  imphash?: string;
+}
+
+export interface StartAddressDetails {
+  allocation_base?: number;
+  allocation_protection?: string;
+  allocation_size?: number;
+  allocation_type?: string;
+  bytes_address?: number;
+  bytes_allocation_offset?: number;
+  bytes_compressed?: string;
+  bytes_compressed_present?: string;
+  mapped_path?: string;
+  mapped_pe_detected?: boolean;
+  memory_pe_detected?: boolean;
+  region_base?: number;
+  region_protection?: string;
+  region_size?: number;
+  region_state?: string;
+  strings?: string;
+  memory_pe?: MemoryPe;
+}
+
 export interface Ext {
   code_signature?: CodeSignature[] | CodeSignature;
   original?: Original;
+  token?: Token;
+  start_address_allocation_offset?: number;
+  start_address_bytes_disasm_hash?: string;
+  start_address_details?: StartAddressDetails;
 }
 export interface Hash {
   md5?: string[];
diff --git a/x-pack/plugins/security_solution/common/ecs/index.ts b/x-pack/plugins/security_solution/common/ecs/index.ts
index 8054b3c8521db..610a2fd1f6e9e 100644
--- a/x-pack/plugins/security_solution/common/ecs/index.ts
+++ b/x-pack/plugins/security_solution/common/ecs/index.ts
@@ -30,6 +30,8 @@ import { ProcessEcs } from './process';
 import { SystemEcs } from './system';
 import { ThreatEcs } from './threat';
 import { Ransomware } from './ransomware';
+import { MemoryProtection } from './memory_protection';
+import { Target } from './target_type';
 
 export interface Ecs {
   _id: string;
@@ -63,4 +65,7 @@ export interface Ecs {
   // This should be temporary
   eql?: { parentId: string; sequenceNumber: string };
   Ransomware?: Ransomware;
+  // eslint-disable-next-line @typescript-eslint/naming-convention
+  Memory_protection?: MemoryProtection;
+  Target?: Target;
 }
diff --git a/x-pack/plugins/security_solution/common/ecs/memory_protection/index.ts b/x-pack/plugins/security_solution/common/ecs/memory_protection/index.ts
new file mode 100644
index 0000000000000..8115fc0dcd26e
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/ecs/memory_protection/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+export interface MemoryProtection {
+  cross_session?: boolean;
+  feature?: string;
+  parent_to_child?: boolean;
+  self_injection?: boolean;
+  unique_key_v1?: string;
+}
diff --git a/x-pack/plugins/security_solution/common/ecs/process/index.ts b/x-pack/plugins/security_solution/common/ecs/process/index.ts
index 820ecc5560e6c..0eb2400466e64 100644
--- a/x-pack/plugins/security_solution/common/ecs/process/index.ts
+++ b/x-pack/plugins/security_solution/common/ecs/process/index.ts
@@ -37,4 +37,5 @@ export interface ProcessParentData {
 export interface Thread {
   id?: number[];
   start?: string[];
+  Ext?: Ext;
 }
diff --git a/x-pack/plugins/security_solution/common/ecs/target_type/index.ts b/x-pack/plugins/security_solution/common/ecs/target_type/index.ts
new file mode 100644
index 0000000000000..3c19b51173a04
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/ecs/target_type/index.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ProcessEcs } from '../process';
+
+export interface Target {
+  process: ProcessEcs;
+}
diff --git a/x-pack/plugins/security_solution/common/endpoint/generate_data.ts b/x-pack/plugins/security_solution/common/endpoint/generate_data.ts
index 876cb3866c614..255ab8f0a598c 100644
--- a/x-pack/plugins/security_solution/common/endpoint/generate_data.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/generate_data.ts
@@ -7,6 +7,7 @@
 
 import uuid from 'uuid';
 import seedrandom from 'seedrandom';
+import { assertNever } from '@kbn/std';
 import {
   AlertEvent,
   DataStream,
@@ -387,6 +388,12 @@ const eventsDefaultDataStream = {
   namespace: 'default',
 };
 
+enum AlertTypes {
+  MALWARE = 'MALWARE',
+  MEMORY_SIGNATURE = 'MEMORY_SIGNATURE',
+  MEMORY_SHELLCODE = 'MEMORY_SHELLCODE',
+}
+
 const alertsDefaultDataStream = {
   type: 'logs',
   dataset: 'endpoint.alerts',
@@ -509,16 +516,15 @@ export class EndpointDocGenerator extends BaseDataGenerator {
       data_stream: metadataDataStream,
     };
   }
-
   /**
-   * Creates an alert from the simulated host represented by this EndpointDocGenerator
+   * Creates a malware alert from the simulated host represented by this EndpointDocGenerator
    * @param ts - Timestamp to put in the event
    * @param entityID - entityID of the originating process
    * @param parentEntityID - optional entityID of the parent process, if it exists
    * @param ancestry - an array of ancestors for the generated alert
    * @param alertsDataStream the values to populate the data_stream fields when generating alert documents
    */
-  public generateAlert({
+  public generateMalwareAlert({
     ts = new Date().getTime(),
     entityID = this.randomString(10),
     parentEntityID,
@@ -619,37 +625,198 @@ export class EndpointDocGenerator extends BaseDataGenerator {
           },
         },
       },
-      dll: [
-        {
-          pe: {
-            architecture: 'x64',
+      dll: this.getAlertsDefaultDll(),
+    };
+  }
+
+  /**
+   * Creates a memory alert from the simulated host represented by this EndpointDocGenerator
+   * @param ts - Timestamp to put in the event
+   * @param entityID - entityID of the originating process
+   * @param parentEntityID - optional entityID of the parent process, if it exists
+   * @param ancestry - an array of ancestors for the generated alert
+   * @param alertsDataStream the values to populate the data_stream fields when generating alert documents
+   */
+  public generateMemoryAlert({
+    ts = new Date().getTime(),
+    entityID = this.randomString(10),
+    parentEntityID,
+    ancestry = [],
+    alertsDataStream = alertsDefaultDataStream,
+    alertType,
+  }: {
+    ts?: number;
+    entityID?: string;
+    parentEntityID?: string;
+    ancestry?: string[];
+    alertsDataStream?: DataStream;
+    alertType?: AlertTypes;
+  } = {}): AlertEvent {
+    const processName = this.randomProcessName();
+    const isShellcode = alertType === AlertTypes.MEMORY_SHELLCODE;
+    const newAlert: AlertEvent = {
+      ...this.commonInfo,
+      data_stream: alertsDataStream,
+      '@timestamp': ts,
+      ecs: {
+        version: '1.6.0',
+      },
+      // disabling naming-convention to accommodate external field
+      // eslint-disable-next-line @typescript-eslint/naming-convention
+      Memory_protection: {
+        feature: isShellcode ? 'shellcode_thread' : 'signature',
+        self_injection: true,
+      },
+      event: {
+        action: 'start',
+        kind: 'alert',
+        category: 'malware',
+        code: isShellcode ? 'malicious_thread' : 'memory_signature',
+        id: this.seededUUIDv4(),
+        dataset: 'endpoint',
+        module: 'endpoint',
+        type: 'info',
+        sequence: this.sequence++,
+      },
+      file: {},
+      process: {
+        pid: 2,
+        name: processName,
+        start: ts,
+        uptime: 0,
+        entity_id: entityID,
+        executable: `C:/fake/${processName}`,
+        parent: parentEntityID ? { entity_id: parentEntityID, pid: 1 } : undefined,
+        hash: {
+          md5: 'fake md5',
+          sha1: 'fake sha1',
+          sha256: 'fake sha256',
+        },
+        Ext: {
+          ancestry,
+          code_signature: [
+            {
+              trusted: false,
+              subject_name: 'bad signer',
+            },
+          ],
+          user: 'SYSTEM',
+          token: {
+            integrity_level_name: 'high',
           },
-          code_signature: {
-            subject_name: 'Cybereason Inc',
-            trusted: true,
+          malware_signature: {
+            all_names: 'Windows.Trojan.FakeAgent',
+            identifier: 'diagnostic-malware-signature-v1-fake',
           },
+        },
+      },
+      dll: this.getAlertsDefaultDll(),
+    };
 
-          hash: {
-            md5: '1f2d082566b0fc5f2c238a5180db7451',
-            sha1: 'ca85243c0af6a6471bdaa560685c51eefd6dbc0d',
-            sha256: '8ad40c90a611d36eb8f9eb24fa04f7dbca713db383ff55a03aa0f382e92061a2',
+    // shellcode_thread memory alert have an additional process field
+    if (isShellcode) {
+      newAlert.Target = {
+        process: {
+          thread: {
+            Ext: {
+              start_address_allocation_offset: 0,
+              start_address_bytes_disasm_hash: 'a disam hash',
+              start_address_details: {
+                allocation_type: 'PRIVATE',
+                allocation_size: 4000,
+                region_size: 4000,
+                region_protection: 'RWX',
+                memory_pe: {
+                  imphash: 'a hash',
+                },
+              },
+            },
           },
+        },
+      };
+    }
+    return newAlert;
+  }
+  /**
+   * Creates an alert from the simulated host represented by this EndpointDocGenerator
+   * @param ts - Timestamp to put in the event
+   * @param entityID - entityID of the originating process
+   * @param parentEntityID - optional entityID of the parent process, if it exists
+   * @param ancestry - an array of ancestors for the generated alert
+   * @param alertsDataStream the values to populate the data_stream fields when generating alert documents
+   */
+  public generateAlert({
+    ts = new Date().getTime(),
+    entityID = this.randomString(10),
+    parentEntityID,
+    ancestry = [],
+    alertsDataStream = alertsDefaultDataStream,
+  }: {
+    ts?: number;
+    entityID?: string;
+    parentEntityID?: string;
+    ancestry?: string[];
+    alertsDataStream?: DataStream;
+  } = {}): AlertEvent {
+    const alertType = this.randomChoice(Object.values(AlertTypes));
+    switch (alertType) {
+      case AlertTypes.MALWARE:
+        return this.generateMalwareAlert({
+          ts,
+          entityID,
+          parentEntityID,
+          ancestry,
+          alertsDataStream,
+        });
+      case AlertTypes.MEMORY_SIGNATURE:
+      case AlertTypes.MEMORY_SHELLCODE:
+        return this.generateMemoryAlert({
+          ts,
+          entityID,
+          parentEntityID,
+          ancestry,
+          alertsDataStream,
+          alertType,
+        });
+      default:
+        return assertNever(alertType);
+    }
+  }
 
-          path: 'C:\\Program Files\\Cybereason ActiveProbe\\AmSvc.exe',
-          Ext: {
-            compile_time: 1534424710,
-            mapped_address: 5362483200,
-            mapped_size: 0,
-            malware_classification: {
-              identifier: 'Whitelisted',
-              score: 0,
-              threshold: 0,
-              version: '3.0.0',
-            },
+  /**
+   * Returns the default DLLs used in alerts
+   */
+  private getAlertsDefaultDll() {
+    return [
+      {
+        pe: {
+          architecture: 'x64',
+        },
+        code_signature: {
+          subject_name: 'Cybereason Inc',
+          trusted: true,
+        },
+
+        hash: {
+          md5: '1f2d082566b0fc5f2c238a5180db7451',
+          sha1: 'ca85243c0af6a6471bdaa560685c51eefd6dbc0d',
+          sha256: '8ad40c90a611d36eb8f9eb24fa04f7dbca713db383ff55a03aa0f382e92061a2',
+        },
+
+        path: 'C:\\Program Files\\Cybereason ActiveProbe\\AmSvc.exe',
+        Ext: {
+          compile_time: 1534424710,
+          mapped_address: 5362483200,
+          mapped_size: 0,
+          malware_classification: {
+            identifier: 'Whitelisted',
+            score: 0,
+            threshold: 0,
+            version: '3.0.0',
           },
         },
-      ],
-    };
+      },
+    ];
   }
 
   /**
diff --git a/x-pack/plugins/security_solution/common/endpoint/types/index.ts b/x-pack/plugins/security_solution/common/endpoint/types/index.ts
index cf8c33d38f8fa..076eb51a5fdc5 100644
--- a/x-pack/plugins/security_solution/common/endpoint/types/index.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/types/index.ts
@@ -295,6 +295,31 @@ export type AlertEvent = Partial<{
       }>;
     }>;
   }>;
+  // disabling naming-convention to accommodate external field
+  // eslint-disable-next-line @typescript-eslint/naming-convention
+  Memory_protection: Partial<{
+    feature: ECSField<string>;
+    self_injection: ECSField<boolean>;
+  }>;
+  Target: Partial<{
+    process: Partial<{
+      thread: Partial<{
+        Ext: Partial<{
+          start_address_allocation_offset: ECSField<number>;
+          start_address_bytes_disasm_hash: ECSField<string>;
+          start_address_details: Partial<{
+            allocation_type: ECSField<string>;
+            allocation_size: ECSField<number>;
+            region_size: ECSField<number>;
+            region_protection: ECSField<string>;
+            memory_pe: Partial<{
+              imphash: ECSField<string>;
+            }>;
+          }>;
+        }>;
+      }>;
+    }>;
+  }>;
   process: Partial<{
     command_line: ECSField<string>;
     ppid: ECSField<number>;
@@ -328,6 +353,10 @@ export type AlertEvent = Partial<{
         >;
       }>;
       user: ECSField<string>;
+      malware_signature: Partial<{
+        all_names: ECSField<string>;
+        identifier: ECSField<string>;
+      }>;
     }>;
   }>;
   file: Partial<{
@@ -400,6 +429,11 @@ export enum HostStatus {
    * Host is inactive as indicated by its checkin status during the last checkin window
    */
   INACTIVE = 'inactive',
+
+  /**
+   * Host is unenrolled
+   */
+  UNENROLLED = 'unenrolled',
 }
 
 export type PolicyInfo = Immutable<{
diff --git a/x-pack/plugins/security_solution/cypress/ccs_integration/detection_alerts/alerts_details.spec.ts b/x-pack/plugins/security_solution/cypress/ccs_integration/detection_alerts/alerts_details.spec.ts
index f87399a666904..229bbcce87696 100644
--- a/x-pack/plugins/security_solution/cypress/ccs_integration/detection_alerts/alerts_details.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/ccs_integration/detection_alerts/alerts_details.spec.ts
@@ -18,7 +18,7 @@ import { cleanKibana } from '../../tasks/common';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import { esArchiverCCSLoad, esArchiverCCSUnload } from '../../tasks/es_archiver';
 
-import { unmappedCCSRule } from '../../objects/rule';
+import { getUnmappedCCSRule } from '../../objects/rule';
 
 import { ALERTS_URL } from '../../urls/navigation';
 
@@ -29,7 +29,7 @@ describe('Alert details with unmapped fields', () => {
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
     waitForAlertsIndexToBeCreated();
-    createCustomRuleActivated(unmappedCCSRule);
+    createCustomRuleActivated(getUnmappedCCSRule());
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
     expandFirstAlert();
diff --git a/x-pack/plugins/security_solution/cypress/integration/cases/attach_timeline.spec.ts b/x-pack/plugins/security_solution/cypress/integration/cases/attach_timeline.spec.ts
index 29105ce1582cf..e94f7d00f0b37 100644
--- a/x-pack/plugins/security_solution/cypress/integration/cases/attach_timeline.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/cases/attach_timeline.spec.ts
@@ -13,8 +13,8 @@ import {
   selectCase,
 } from '../../tasks/timeline';
 import { DESCRIPTION_INPUT, ADD_COMMENT_INPUT } from '../../screens/create_new_case';
-import { case1 } from '../../objects/case';
-import { timeline } from '../../objects/timeline';
+import { getCase1 } from '../../objects/case';
+import { getTimeline } from '../../objects/timeline';
 import { createTimeline } from '../../tasks/api_calls/timelines';
 import { cleanKibana } from '../../tasks/common';
 import { createCase } from '../../tasks/api_calls/cases';
@@ -23,7 +23,7 @@ describe('attach timeline to case', () => {
   context('without cases created', () => {
     beforeEach(() => {
       cleanKibana();
-      createTimeline(timeline).then((response) => {
+      createTimeline(getTimeline()).then((response) => {
         cy.wrap(response.body.data.persistTimeline.timeline).as('myTimeline');
       });
     });
@@ -57,10 +57,10 @@ describe('attach timeline to case', () => {
   context('with cases created', () => {
     before(() => {
       cleanKibana();
-      createTimeline(timeline).then((response) =>
+      createTimeline(getTimeline()).then((response) =>
         cy.wrap(response.body.data.persistTimeline.timeline.savedObjectId).as('timelineId')
       );
-      createCase(case1).then((response) => cy.wrap(response.body.id).as('caseId'));
+      createCase(getCase1()).then((response) => cy.wrap(response.body.id).as('caseId'));
     });
 
     it('attach timeline to an existing case', function () {
@@ -71,7 +71,9 @@ describe('attach timeline to case', () => {
       cy.location('origin').then((origin) => {
         cy.get(ADD_COMMENT_INPUT).should(
           'have.text',
-          `[${timeline.title}](${origin}/app/security/timelines?timeline=(id:%27${this.timelineId}%27,isOpen:!t))`
+          `[${getTimeline().title}](${origin}/app/security/timelines?timeline=(id:%27${
+            this.timelineId
+          }%27,isOpen:!t))`
         );
       });
     });
diff --git a/x-pack/plugins/security_solution/cypress/integration/cases/connector_options.spec.ts b/x-pack/plugins/security_solution/cypress/integration/cases/connector_options.spec.ts
index 95b555c2acae6..0959f999a4b53 100644
--- a/x-pack/plugins/security_solution/cypress/integration/cases/connector_options.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/cases/connector_options.spec.ts
@@ -7,13 +7,13 @@
 
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import {
-  case1,
-  connectorIds,
-  mockConnectorsResponse,
-  executeResponses,
-  ibmResilientConnectorOptions,
-  jiraConnectorOptions,
-  serviceNowConnectorOpions,
+  getCase1,
+  getConnectorIds,
+  getMockConnectorsResponse,
+  getExecuteResponses,
+  getIbmResilientConnectorOptions,
+  getJiraConnectorOptions,
+  getServiceNowConnectorOptions,
 } from '../../objects/case';
 import {
   createCase,
@@ -30,26 +30,26 @@ import { cleanKibana } from '../../tasks/common';
 describe('Cases connector incident fields', () => {
   beforeEach(() => {
     cleanKibana();
-    cy.intercept('GET', '/api/cases/configure/connectors/_find', mockConnectorsResponse);
-    cy.intercept('POST', `/api/actions/action/${connectorIds.sn}/_execute`, (req) => {
+    cy.intercept('GET', '/api/cases/configure/connectors/_find', getMockConnectorsResponse());
+    cy.intercept('POST', `/api/actions/action/${getConnectorIds().sn}/_execute`, (req) => {
       const response =
         req.body.params.subAction === 'getChoices'
-          ? executeResponses.servicenow.choices
+          ? getExecuteResponses().servicenow.choices
           : { status: 'ok', data: [] };
       req.reply(response);
     });
-    cy.intercept('POST', `/api/actions/action/${connectorIds.jira}/_execute`, (req) => {
+    cy.intercept('POST', `/api/actions/action/${getConnectorIds().jira}/_execute`, (req) => {
       const response =
         req.body.params.subAction === 'issueTypes'
-          ? executeResponses.jira.issueTypes
-          : executeResponses.jira.fieldsByIssueType;
+          ? getExecuteResponses().jira.issueTypes
+          : getExecuteResponses().jira.fieldsByIssueType;
       req.reply(response);
     });
-    cy.intercept('POST', `/api/actions/action/${connectorIds.resilient}/_execute`, (req) => {
+    cy.intercept('POST', `/api/actions/action/${getConnectorIds().resilient}/_execute`, (req) => {
       const response =
         req.body.params.subAction === 'incidentTypes'
-          ? executeResponses.resilient.incidentTypes
-          : executeResponses.resilient.severity;
+          ? getExecuteResponses().resilient.incidentTypes
+          : getExecuteResponses().resilient.severity;
       req.reply(response);
     });
   });
@@ -57,19 +57,19 @@ describe('Cases connector incident fields', () => {
   it('Correct incident fields show when connector is changed', () => {
     loginAndWaitForPageWithoutDateRange(CASES_URL);
     goToCreateNewCase();
-    fillCasesMandatoryfields(case1);
-    fillJiraConnectorOptions(jiraConnectorOptions);
-    fillServiceNowConnectorOptions(serviceNowConnectorOpions);
-    fillIbmResilientConnectorOptions(ibmResilientConnectorOptions);
+    fillCasesMandatoryfields(getCase1());
+    fillJiraConnectorOptions(getJiraConnectorOptions());
+    fillServiceNowConnectorOptions(getServiceNowConnectorOptions());
+    fillIbmResilientConnectorOptions(getIbmResilientConnectorOptions());
     createCase();
 
-    cy.get(CONNECTOR_TITLE).should('have.text', ibmResilientConnectorOptions.title);
+    cy.get(CONNECTOR_TITLE).should('have.text', getIbmResilientConnectorOptions().title);
     cy.get(CONNECTOR_CARD_DETAILS).should(
       'have.text',
       `${
-        ibmResilientConnectorOptions.title
-      }Incident Types: ${ibmResilientConnectorOptions.incidentTypes.join(', ')}Severity: ${
-        ibmResilientConnectorOptions.severity
+        getIbmResilientConnectorOptions().title
+      }Incident Types: ${getIbmResilientConnectorOptions().incidentTypes.join(', ')}Severity: ${
+        getIbmResilientConnectorOptions().severity
       }`
     );
   });
diff --git a/x-pack/plugins/security_solution/cypress/integration/cases/connectors.spec.ts b/x-pack/plugins/security_solution/cypress/integration/cases/connectors.spec.ts
index 9e55067ce4ed4..aa1bd7a5db5cc 100644
--- a/x-pack/plugins/security_solution/cypress/integration/cases/connectors.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/cases/connectors.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { serviceNowConnector } from '../../objects/case';
+import { getServiceNowConnector } from '../../objects/case';
 
 import { SERVICE_NOW_MAPPING, TOASTER } from '../../screens/configure_cases';
 
@@ -77,7 +77,7 @@ describe('Cases connectors', () => {
     loginAndWaitForPageWithoutDateRange(CASES_URL);
     goToEditExternalConnection();
     openAddNewConnectorOption();
-    addServiceNowConnector(serviceNowConnector);
+    addServiceNowConnector(getServiceNowConnector());
 
     cy.wait('@createConnector').then(({ response }) => {
       cy.wrap(response!.statusCode).should('eql', 200);
diff --git a/x-pack/plugins/security_solution/cypress/integration/cases/creation.spec.ts b/x-pack/plugins/security_solution/cypress/integration/cases/creation.spec.ts
index c568aaae664a0..9e3b775156cab 100644
--- a/x-pack/plugins/security_solution/cypress/integration/cases/creation.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/cases/creation.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { case1 } from '../../objects/case';
+import { getCase1, TestCase } from '../../objects/case';
 
 import {
   ALL_CASES_CLOSED_CASES_STATS,
@@ -55,12 +55,12 @@ import { CASES_URL } from '../../urls/navigation';
 describe('Cases', () => {
   beforeEach(() => {
     cleanKibana();
-    createTimeline(case1.timeline).then((response) =>
+    createTimeline(getCase1().timeline).then((response) =>
       cy
         .wrap({
-          ...case1,
+          ...getCase1(),
           timeline: {
-            ...case1.timeline,
+            ...getCase1().timeline,
             id: response.body.data.persistTimeline.timeline.savedObjectId,
           },
         })
@@ -86,7 +86,7 @@ describe('Cases', () => {
     cy.get(ALL_CASES_TAGS_COUNT).should('have.text', 'Tags2');
     cy.get(ALL_CASES_NAME).should('have.text', this.mycase.name);
     cy.get(ALL_CASES_REPORTER).should('have.text', this.mycase.reporter);
-    (this.mycase as typeof case1).tags.forEach((tag, index) => {
+    (this.mycase as TestCase).tags.forEach((tag, index) => {
       cy.get(ALL_CASES_TAGS(index)).should('have.text', tag);
     });
     cy.get(ALL_CASES_COMMENTS_COUNT).should('have.text', '0');
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
index d9ca43339d412..825cc7f8081e5 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
@@ -18,7 +18,7 @@ import { cleanKibana } from '../../tasks/common';
 import { esArchiverLoad } from '../../tasks/es_archiver';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 
-import { unmappedRule } from '../../objects/rule';
+import { getUnmappedRule } from '../../objects/rule';
 
 import { ALERTS_URL } from '../../urls/navigation';
 
@@ -29,7 +29,7 @@ describe('Alert details with unmapped fields', () => {
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
     waitForAlertsIndexToBeCreated();
-    createCustomRuleActivated(unmappedRule);
+    createCustomRuleActivated(getUnmappedRule());
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
     expandFirstAlert();
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_detection_callouts_index_outdated.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_detection_callouts_index_outdated.spec.ts
index fb0b96c977e32..eaed80c484f60 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_detection_callouts_index_outdated.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_detection_callouts_index_outdated.spec.ts
@@ -7,7 +7,7 @@
 
 import { ROLES } from '../../../common/test';
 import { DETECTIONS_RULE_MANAGEMENT_URL, ALERTS_URL } from '../../urls/navigation';
-import { newRule } from '../../objects/rule';
+import { getNewRule } from '../../objects/rule';
 import { PAGE_TITLE } from '../../screens/common/page';
 
 import {
@@ -77,7 +77,7 @@ describe('Detections > Need Admin Callouts indicating an admin is needed to migr
 
       context('On Rule Details page', () => {
         beforeEach(() => {
-          createCustomRule(newRule);
+          createCustomRule(getNewRule());
           loadPageAsPlatformEngineerUser(DETECTIONS_RULE_MANAGEMENT_URL);
           waitForPageTitleToBeShown();
           goToRuleDetails();
@@ -127,7 +127,7 @@ describe('Detections > Need Admin Callouts indicating an admin is needed to migr
 
       context('On Rule Details page', () => {
         beforeEach(() => {
-          createCustomRule(newRule);
+          createCustomRule(getNewRule());
           loadPageAsPlatformEngineerUser(DETECTIONS_RULE_MANAGEMENT_URL);
           waitForPageTitleToBeShown();
           goToRuleDetails();
@@ -177,7 +177,7 @@ describe('Detections > Need Admin Callouts indicating an admin is needed to migr
 
       context('On Rule Details page', () => {
         beforeEach(() => {
-          createCustomRule(newRule);
+          createCustomRule(getNewRule());
           loadPageAsPlatformEngineerUser(DETECTIONS_RULE_MANAGEMENT_URL);
           waitForPageTitleToBeShown();
           goToRuleDetails();
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/attach_to_case.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/attach_to_case.spec.ts
index 6cc5d2443e784..e052d1a3272ac 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/attach_to_case.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/attach_to_case.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { newRule } from '../../objects/rule';
+import { getNewRule } from '../../objects/rule';
 import { ROLES } from '../../../common/test';
 
 import { waitForAlertsIndexToBeCreated, waitForAlertsPanelToBeLoaded } from '../../tasks/alerts';
@@ -30,7 +30,7 @@ describe('Alerts timeline', () => {
     loginAndWaitForPage(ALERTS_URL, ROLES.platform_engineer);
     waitForAlertsPanelToBeLoaded();
     waitForAlertsIndexToBeCreated();
-    createCustomRuleActivated(newRule);
+    createCustomRuleActivated(getNewRule());
     refreshPage();
     waitForAlertsToPopulate(500);
 
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/closing.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/closing.spec.ts
index 6ae23733d6434..038bc30c90c1e 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/closing.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/closing.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { newRule } from '../../objects/rule';
+import { getNewRule } from '../../objects/rule';
 import {
   ALERTS,
   ALERTS_COUNT,
@@ -39,7 +39,7 @@ describe('Closing alerts', () => {
     loginAndWaitForPage(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
     waitForAlertsIndexToBeCreated();
-    createCustomRuleActivated(newRule, '1', '100m', 100);
+    createCustomRuleActivated(getNewRule(), '1', '100m', 100);
     refreshPage();
     waitForAlertsToPopulate(100);
     deleteCustomRule();
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
index b03daf74ce247..522e25590994f 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { newThreatIndicatorRule } from '../../objects/rule';
+import { getNewThreatIndicatorRule } from '../../objects/rule';
 import { cleanKibana, reload } from '../../tasks/common';
 import { esArchiverLoad, esArchiverUnload } from '../../tasks/es_archiver';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
@@ -39,7 +39,7 @@ describe('CTI Enrichment', () => {
     esArchiverLoad('suspicious_source_event');
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     goToManageAlertsDetectionRules();
-    createCustomIndicatorRule(newThreatIndicatorRule);
+    createCustomIndicatorRule(getNewThreatIndicatorRule());
     reload();
   });
 
@@ -56,9 +56,9 @@ describe('CTI Enrichment', () => {
 
   it('Displays enrichment matched.* fields on the timeline', () => {
     const expectedFields = {
-      'threat.indicator.matched.atomic': newThreatIndicatorRule.atomic,
+      'threat.indicator.matched.atomic': getNewThreatIndicatorRule().atomic,
       'threat.indicator.matched.type': 'indicator_match_rule',
-      'threat.indicator.matched.field': newThreatIndicatorRule.indicatorMappingField,
+      'threat.indicator.matched.field': getNewThreatIndicatorRule().indicatorMappingField,
     };
     const fields = Object.keys(expectedFields) as Array<keyof typeof expectedFields>;
 
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/in_progress.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/in_progress.spec.ts
index cb8694d5c35af..890f8a064aa9e 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/in_progress.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/in_progress.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { newRule } from '../../objects/rule';
+import { getNewRule } from '../../objects/rule';
 import {
   ALERTS,
   ALERTS_COUNT,
@@ -36,7 +36,7 @@ describe('Marking alerts as in-progress', () => {
     loginAndWaitForPage(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
     waitForAlertsIndexToBeCreated();
-    createCustomRuleActivated(newRule);
+    createCustomRuleActivated(getNewRule());
     refreshPage();
     waitForAlertsToPopulate(500);
   });
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/investigate_in_timeline.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/investigate_in_timeline.spec.ts
index 115118b6762d9..01a06b3d59266 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/investigate_in_timeline.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/investigate_in_timeline.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { newRule } from '../../objects/rule';
+import { getNewRule } from '../../objects/rule';
 import { PROVIDER_BADGE } from '../../screens/timeline';
 
 import {
@@ -27,7 +27,7 @@ describe('Alerts timeline', () => {
     loginAndWaitForPage(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
     waitForAlertsIndexToBeCreated();
-    createCustomRuleActivated(newRule);
+    createCustomRuleActivated(getNewRule());
     refreshPage();
     waitForAlertsToPopulate(500);
   });
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/missing_privileges_callout.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/missing_privileges_callout.spec.ts
index 20a863e742efd..0db30179284e0 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/missing_privileges_callout.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/missing_privileges_callout.spec.ts
@@ -7,7 +7,7 @@
 
 import { ROLES } from '../../../common/test';
 import { DETECTIONS_RULE_MANAGEMENT_URL, ALERTS_URL } from '../../urls/navigation';
-import { newRule } from '../../objects/rule';
+import { getNewRule } from '../../objects/rule';
 import { PAGE_TITLE } from '../../screens/common/page';
 
 import {
@@ -95,7 +95,7 @@ describe('Detections > Callouts', () => {
 
     context('On Rule Details page', () => {
       beforeEach(() => {
-        createCustomRule(newRule);
+        createCustomRule(getNewRule());
         loadPageAsReadOnlyUser(DETECTIONS_RULE_MANAGEMENT_URL);
         waitForPageTitleToBeShown();
         goToRuleDetails();
@@ -145,7 +145,7 @@ describe('Detections > Callouts', () => {
 
     context('On Rule Details page', () => {
       beforeEach(() => {
-        createCustomRule(newRule);
+        createCustomRule(getNewRule());
         loadPageAsPlatformEngineer(DETECTIONS_RULE_MANAGEMENT_URL);
         waitForPageTitleToBeShown();
         goToRuleDetails();
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/opening.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/opening.spec.ts
index 6cbc82b93f446..4f78bdac84789 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/opening.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/opening.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { newRule } from '../../objects/rule';
+import { getNewRule } from '../../objects/rule';
 import {
   ALERTS_COUNT,
   SELECTED_ALERTS,
@@ -37,7 +37,7 @@ describe('Opening alerts', () => {
     loginAndWaitForPage(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
     waitForAlertsIndexToBeCreated();
-    createCustomRuleActivated(newRule);
+    createCustomRuleActivated(getNewRule());
     refreshPage();
     waitForAlertsToPopulate(500);
     selectNumberOfAlerts(5);
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/custom_query_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/custom_query_rule.spec.ts
index 218b1f7745d94..e30cde4989284 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/custom_query_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/custom_query_rule.spec.ts
@@ -7,11 +7,11 @@
 
 import { formatMitreAttackDescription } from '../../helpers/rules';
 import {
-  newRule,
-  existingRule,
-  indexPatterns,
-  editedRule,
-  newOverrideRule,
+  getNewRule,
+  getExistingRule,
+  getIndexPatterns,
+  getEditedRule,
+  getNewOverrideRule,
 } from '../../objects/rule';
 import {
   ALERT_RULE_METHOD,
@@ -120,19 +120,19 @@ import { activatesRule } from '../../tasks/rule_details';
 import { ALERTS_URL } from '../../urls/navigation';
 
 describe('Custom detection rules creation', () => {
-  const expectedUrls = newRule.referenceUrls.join('');
-  const expectedFalsePositives = newRule.falsePositivesExamples.join('');
-  const expectedTags = newRule.tags.join('');
-  const expectedMitre = formatMitreAttackDescription(newRule.mitre);
+  const expectedUrls = getNewRule().referenceUrls.join('');
+  const expectedFalsePositives = getNewRule().falsePositivesExamples.join('');
+  const expectedTags = getNewRule().tags.join('');
+  const expectedMitre = formatMitreAttackDescription(getNewRule().mitre);
   const expectedNumberOfRules = 1;
 
   beforeEach(() => {
     cleanKibana();
-    createTimeline(newRule.timeline).then((response) => {
+    createTimeline(getNewRule().timeline).then((response) => {
       cy.wrap({
-        ...newRule,
+        ...getNewRule(),
         timeline: {
-          ...newRule.timeline,
+          ...getNewRule().timeline,
           id: response.body.data.persistTimeline.timeline.savedObjectId,
         },
       }).as('rule');
@@ -201,7 +201,7 @@ describe('Custom detection rules creation', () => {
     cy.get(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
     cy.get(ABOUT_INVESTIGATION_NOTES).should('have.text', INVESTIGATION_NOTES_MARKDOWN);
     cy.get(DEFINITION_DETAILS).within(() => {
-      getDetails(INDEX_PATTERNS_DETAILS).should('have.text', indexPatterns.join(''));
+      getDetails(INDEX_PATTERNS_DETAILS).should('have.text', getIndexPatterns().join(''));
       getDetails(CUSTOM_QUERY_DETAILS).should('have.text', this.rule.customQuery);
       getDetails(RULE_TYPE_DETAILS).should('have.text', 'Query');
       getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');
@@ -209,11 +209,11 @@ describe('Custom detection rules creation', () => {
     cy.get(SCHEDULE_DETAILS).within(() => {
       getDetails(RUNS_EVERY_DETAILS).should(
         'have.text',
-        `${newRule.runsEvery.interval}${newRule.runsEvery.type}`
+        `${getNewRule().runsEvery.interval}${getNewRule().runsEvery.type}`
       );
       getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should(
         'have.text',
-        `${newRule.lookBack.interval}${newRule.lookBack.type}`
+        `${getNewRule().lookBack.interval}${getNewRule().lookBack.type}`
       );
     });
 
@@ -236,9 +236,9 @@ describe('Custom detection rules deletion and edition', () => {
       loginAndWaitForPageWithoutDateRange(ALERTS_URL);
       goToManageAlertsDetectionRules();
       waitForAlertsIndexToBeCreated();
-      createCustomRuleActivated(newRule, 'rule1');
-      createCustomRuleActivated(newOverrideRule, 'rule2');
-      createCustomRuleActivated(existingRule, 'rule3');
+      createCustomRuleActivated(getNewRule(), 'rule1');
+      createCustomRuleActivated(getNewOverrideRule(), 'rule2');
+      createCustomRuleActivated(getExistingRule(), 'rule3');
       reload();
     });
 
@@ -303,16 +303,18 @@ describe('Custom detection rules deletion and edition', () => {
   });
 
   context('Edition', () => {
-    const expectedEditedtags = editedRule.tags.join('');
+    const expectedEditedtags = getEditedRule().tags.join('');
     const expectedEditedIndexPatterns =
-      editedRule.index && editedRule.index.length ? editedRule.index : indexPatterns;
+      getEditedRule().index && getEditedRule().index.length
+        ? getEditedRule().index
+        : getIndexPatterns();
 
     beforeEach(() => {
       cleanKibana();
       loginAndWaitForPageWithoutDateRange(ALERTS_URL);
       goToManageAlertsDetectionRules();
       waitForAlertsIndexToBeCreated();
-      createCustomRuleActivated(existingRule, 'rule1');
+      createCustomRuleActivated(getExistingRule(), 'rule1');
       reload();
     });
 
@@ -326,7 +328,7 @@ describe('Custom detection rules deletion and edition', () => {
       cy.wait('@fetchRuleDetails').then(({ response }) => {
         cy.wrap(response!.statusCode).should('eql', 200);
 
-        cy.wrap(response!.body.max_signals).should('eql', existingRule.maxSignals);
+        cy.wrap(response!.body.max_signals).should('eql', getExistingRule().maxSignals);
         cy.wrap(response!.body.enabled).should('eql', false);
       });
     });
@@ -336,25 +338,25 @@ describe('Custom detection rules deletion and edition', () => {
       waitForKibana();
 
       // expect define step to populate
-      cy.get(CUSTOM_QUERY_INPUT).should('have.value', existingRule.customQuery);
-      if (existingRule.index && existingRule.index.length > 0) {
-        cy.get(DEFINE_INDEX_INPUT).should('have.text', existingRule.index.join(''));
+      cy.get(CUSTOM_QUERY_INPUT).should('have.value', getExistingRule().customQuery);
+      if (getExistingRule().index && getExistingRule().index.length > 0) {
+        cy.get(DEFINE_INDEX_INPUT).should('have.text', getExistingRule().index.join(''));
       }
 
       goToAboutStepTab();
 
       // expect about step to populate
-      cy.get(RULE_NAME_INPUT).invoke('val').should('eql', existingRule.name);
-      cy.get(RULE_DESCRIPTION_INPUT).should('have.text', existingRule.description);
-      cy.get(TAGS_FIELD).should('have.text', existingRule.tags.join(''));
-      cy.get(SEVERITY_DROPDOWN).should('have.text', existingRule.severity);
-      cy.get(DEFAULT_RISK_SCORE_INPUT).invoke('val').should('eql', existingRule.riskScore);
+      cy.get(RULE_NAME_INPUT).invoke('val').should('eql', getExistingRule().name);
+      cy.get(RULE_DESCRIPTION_INPUT).should('have.text', getExistingRule().description);
+      cy.get(TAGS_FIELD).should('have.text', getExistingRule().tags.join(''));
+      cy.get(SEVERITY_DROPDOWN).should('have.text', getExistingRule().severity);
+      cy.get(DEFAULT_RISK_SCORE_INPUT).invoke('val').should('eql', getExistingRule().riskScore);
 
       goToScheduleStepTab();
 
       // expect schedule step to populate
-      const intervalParts =
-        existingRule.interval && existingRule.interval.match(/[0-9]+|[a-zA-Z]+/g);
+      const interval = getExistingRule().interval;
+      const intervalParts = interval != null && interval.match(/[0-9]+|[a-zA-Z]+/g);
       if (intervalParts) {
         const [amount, unit] = intervalParts;
         cy.get(SCHEDULE_INTERVAL_AMOUNT_INPUT).invoke('val').should('eql', amount);
@@ -380,7 +382,7 @@ describe('Custom detection rules deletion and edition', () => {
 
       goToAboutStepTab();
       cy.get(TAGS_CLEAR_BUTTON).click({ force: true });
-      fillAboutRule(editedRule);
+      fillAboutRule(getEditedRule());
 
       cy.intercept('GET', '/api/detection_engine/rules?id').as('getRule');
 
@@ -389,30 +391,30 @@ describe('Custom detection rules deletion and edition', () => {
       cy.wait('@getRule').then(({ response }) => {
         cy.wrap(response!.statusCode).should('eql', 200);
         // ensure that editing rule does not modify max_signals
-        cy.wrap(response!.body.max_signals).should('eql', existingRule.maxSignals);
+        cy.wrap(response!.body.max_signals).should('eql', getExistingRule().maxSignals);
       });
 
-      cy.get(RULE_NAME_HEADER).should('contain', `${editedRule.name}`);
-      cy.get(ABOUT_RULE_DESCRIPTION).should('have.text', editedRule.description);
+      cy.get(RULE_NAME_HEADER).should('contain', `${getEditedRule().name}`);
+      cy.get(ABOUT_RULE_DESCRIPTION).should('have.text', getEditedRule().description);
       cy.get(ABOUT_DETAILS).within(() => {
-        getDetails(SEVERITY_DETAILS).should('have.text', editedRule.severity);
-        getDetails(RISK_SCORE_DETAILS).should('have.text', editedRule.riskScore);
+        getDetails(SEVERITY_DETAILS).should('have.text', getEditedRule().severity);
+        getDetails(RISK_SCORE_DETAILS).should('have.text', getEditedRule().riskScore);
         getDetails(TAGS_DETAILS).should('have.text', expectedEditedtags);
       });
       cy.get(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
-      cy.get(ABOUT_INVESTIGATION_NOTES).should('have.text', editedRule.note);
+      cy.get(ABOUT_INVESTIGATION_NOTES).should('have.text', getEditedRule().note);
       cy.get(DEFINITION_DETAILS).within(() => {
         getDetails(INDEX_PATTERNS_DETAILS).should(
           'have.text',
           expectedEditedIndexPatterns.join('')
         );
-        getDetails(CUSTOM_QUERY_DETAILS).should('have.text', editedRule.customQuery);
+        getDetails(CUSTOM_QUERY_DETAILS).should('have.text', getEditedRule().customQuery);
         getDetails(RULE_TYPE_DETAILS).should('have.text', 'Query');
         getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');
       });
-      if (editedRule.interval) {
+      if (getEditedRule().interval) {
         cy.get(SCHEDULE_DETAILS).within(() => {
-          getDetails(RUNS_EVERY_DETAILS).should('have.text', editedRule.interval);
+          getDetails(RUNS_EVERY_DETAILS).should('have.text', getEditedRule().interval);
         });
       }
     });
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/event_correlation_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/event_correlation_rule.spec.ts
index 337e2a8ec5033..677a9b5546494 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/event_correlation_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/event_correlation_rule.spec.ts
@@ -6,7 +6,7 @@
  */
 
 import { formatMitreAttackDescription } from '../../helpers/rules';
-import { eqlRule, eqlSequenceRule, indexPatterns } from '../../objects/rule';
+import { getEqlRule, getEqlSequenceRule, getIndexPatterns } from '../../objects/rule';
 
 import {
   ALERT_RULE_METHOD,
@@ -78,20 +78,20 @@ import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import { ALERTS_URL } from '../../urls/navigation';
 
 describe('Detection rules, EQL', () => {
-  const expectedUrls = eqlRule.referenceUrls.join('');
-  const expectedFalsePositives = eqlRule.falsePositivesExamples.join('');
-  const expectedTags = eqlRule.tags.join('');
-  const expectedMitre = formatMitreAttackDescription(eqlRule.mitre);
+  const expectedUrls = getEqlRule().referenceUrls.join('');
+  const expectedFalsePositives = getEqlRule().falsePositivesExamples.join('');
+  const expectedTags = getEqlRule().tags.join('');
+  const expectedMitre = formatMitreAttackDescription(getEqlRule().mitre);
   const expectedNumberOfRules = 1;
   const expectedNumberOfAlerts = 7;
 
   beforeEach(() => {
     cleanKibana();
-    createTimeline(eqlRule.timeline).then((response) => {
+    createTimeline(getEqlRule().timeline).then((response) => {
       cy.wrap({
-        ...eqlRule,
+        ...getEqlRule(),
         timeline: {
-          ...eqlRule.timeline,
+          ...getEqlRule().timeline,
           id: response.body.data.persistTimeline.timeline.savedObjectId,
         },
       }).as('rule');
@@ -148,7 +148,7 @@ describe('Detection rules, EQL', () => {
     cy.get(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
     cy.get(ABOUT_INVESTIGATION_NOTES).should('have.text', INVESTIGATION_NOTES_MARKDOWN);
     cy.get(DEFINITION_DETAILS).within(() => {
-      getDetails(INDEX_PATTERNS_DETAILS).should('have.text', indexPatterns.join(''));
+      getDetails(INDEX_PATTERNS_DETAILS).should('have.text', getIndexPatterns().join(''));
       getDetails(CUSTOM_QUERY_DETAILS).should('have.text', this.rule.customQuery);
       getDetails(RULE_TYPE_DETAILS).should('have.text', 'Event Correlation');
       getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');
@@ -182,11 +182,11 @@ describe('Detection rules, sequence EQL', () => {
 
   beforeEach(() => {
     cleanKibana();
-    createTimeline(eqlSequenceRule.timeline).then((response) => {
+    createTimeline(getEqlSequenceRule().timeline).then((response) => {
       cy.wrap({
-        ...eqlSequenceRule,
+        ...getEqlSequenceRule(),
         timeline: {
-          ...eqlSequenceRule.timeline,
+          ...getEqlSequenceRule().timeline,
           id: response.body.data.persistTimeline.timeline.savedObjectId,
         },
       }).as('rule');
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/export_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/export_rule.spec.ts
index 1de636010f967..03086810a8435 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/export_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/export_rule.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { expectedExportedRule, newRule } from '../../objects/rule';
+import { expectedExportedRule, getNewRule } from '../../objects/rule';
 import {
   goToManageAlertsDetectionRules,
   waitForAlertsIndexToBeCreated,
@@ -28,7 +28,7 @@ describe('Export rules', () => {
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
     waitForAlertsIndexToBeCreated();
-    createCustomRule(newRule).as('ruleResponse');
+    createCustomRule(getNewRule()).as('ruleResponse');
   });
 
   it('Exports a custom rule', function () {
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts
index e1268c52f75d4..07b40df53e2d5 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts
@@ -6,7 +6,7 @@
  */
 
 import { formatMitreAttackDescription } from '../../helpers/rules';
-import { indexPatterns, newThreatIndicatorRule } from '../../objects/rule';
+import { getIndexPatterns, getNewThreatIndicatorRule } from '../../objects/rule';
 
 import {
   ALERT_RULE_METHOD,
@@ -109,10 +109,10 @@ import { ALERTS_URL, RULE_CREATION } from '../../urls/navigation';
 
 describe('indicator match', () => {
   describe('Detection rules, Indicator Match', () => {
-    const expectedUrls = newThreatIndicatorRule.referenceUrls.join('');
-    const expectedFalsePositives = newThreatIndicatorRule.falsePositivesExamples.join('');
-    const expectedTags = newThreatIndicatorRule.tags.join('');
-    const expectedMitre = formatMitreAttackDescription(newThreatIndicatorRule.mitre);
+    const expectedUrls = getNewThreatIndicatorRule().referenceUrls.join('');
+    const expectedFalsePositives = getNewThreatIndicatorRule().falsePositivesExamples.join('');
+    const expectedTags = getNewThreatIndicatorRule().tags.join('');
+    const expectedMitre = formatMitreAttackDescription(getNewThreatIndicatorRule().mitre);
     const expectedNumberOfRules = 1;
     const expectedNumberOfAlerts = 1;
 
@@ -134,12 +134,12 @@ describe('indicator match', () => {
 
       describe('Index patterns', () => {
         it('Contains a predefined index pattern', () => {
-          getIndicatorIndex().should('have.text', indexPatterns.join(''));
+          getIndicatorIndex().should('have.text', getIndexPatterns().join(''));
         });
 
         it('Does NOT show invalidation text on initial page load if indicator index pattern is filled out', () => {
           getIndicatorIndicatorIndex().type(
-            `${newThreatIndicatorRule.indicatorIndexPattern}{enter}`
+            `${getNewThreatIndicatorRule().indicatorIndexPattern}{enter}`
           );
           getDefineContinueButton().click();
           getIndexPatternInvalidationText().should('not.exist');
@@ -148,7 +148,7 @@ describe('indicator match', () => {
         it('Shows invalidation text when you try to continue without filling it out', () => {
           getIndexPatternClearButton().click();
           getIndicatorIndicatorIndex().type(
-            `${newThreatIndicatorRule.indicatorIndexPattern}{enter}`
+            `${getNewThreatIndicatorRule().indicatorIndexPattern}{enter}`
           );
           getDefineContinueButton().click();
           getIndexPatternInvalidationText().should('exist');
@@ -195,8 +195,8 @@ describe('indicator match', () => {
       describe('Indicator mapping', () => {
         beforeEach(() => {
           fillIndexAndIndicatorIndexPattern(
-            newThreatIndicatorRule.index,
-            newThreatIndicatorRule.indicatorIndexPattern
+            getNewThreatIndicatorRule().index,
+            getNewThreatIndicatorRule().indicatorIndexPattern
           );
         });
 
@@ -221,8 +221,8 @@ describe('indicator match', () => {
 
         it('Does NOT show invalidation text when there is a valid "index field" and a valid "indicator index field"', () => {
           fillIndicatorMatchRow({
-            indexField: newThreatIndicatorRule.indicatorMappingField,
-            indicatorIndexField: newThreatIndicatorRule.indicatorIndexField,
+            indexField: getNewThreatIndicatorRule().indicatorMappingField,
+            indicatorIndexField: getNewThreatIndicatorRule().indicatorIndexField,
           });
           getDefineContinueButton().click();
           getIndicatorInvalidationText().should('not.exist');
@@ -231,7 +231,7 @@ describe('indicator match', () => {
         it('Shows invalidation text when there is an invalid "index field" and a valid "indicator index field"', () => {
           fillIndicatorMatchRow({
             indexField: 'non-existent-value',
-            indicatorIndexField: newThreatIndicatorRule.indicatorIndexField,
+            indicatorIndexField: getNewThreatIndicatorRule().indicatorIndexField,
             validColumns: 'indicatorField',
           });
           getDefineContinueButton().click();
@@ -240,7 +240,7 @@ describe('indicator match', () => {
 
         it('Shows invalidation text when there is a valid "index field" and an invalid "indicator index field"', () => {
           fillIndicatorMatchRow({
-            indexField: newThreatIndicatorRule.indicatorMappingField,
+            indexField: getNewThreatIndicatorRule().indicatorMappingField,
             indicatorIndexField: 'non-existent-value',
             validColumns: 'indexField',
           });
@@ -250,21 +250,21 @@ describe('indicator match', () => {
 
         it('Deletes the first row when you have two rows. Both rows valid rows of "index fields" and valid "indicator index fields". The second row should become the first row', () => {
           fillIndicatorMatchRow({
-            indexField: newThreatIndicatorRule.indicatorMappingField,
-            indicatorIndexField: newThreatIndicatorRule.indicatorIndexField,
+            indexField: getNewThreatIndicatorRule().indicatorMappingField,
+            indicatorIndexField: getNewThreatIndicatorRule().indicatorIndexField,
           });
           getIndicatorAndButton().click();
           fillIndicatorMatchRow({
             rowNumber: 2,
             indexField: 'agent.name',
-            indicatorIndexField: newThreatIndicatorRule.indicatorIndexField,
+            indicatorIndexField: getNewThreatIndicatorRule().indicatorIndexField,
             validColumns: 'indicatorField',
           });
           getIndicatorDeleteButton().click();
           getIndicatorIndexComboField().should('have.text', 'agent.name');
           getIndicatorMappingComboField().should(
             'have.text',
-            newThreatIndicatorRule.indicatorIndexField
+            getNewThreatIndicatorRule().indicatorIndexField
           );
           getIndicatorIndexComboField(2).should('not.exist');
           getIndicatorMappingComboField(2).should('not.exist');
@@ -272,14 +272,14 @@ describe('indicator match', () => {
 
         it('Deletes the first row when you have two rows. Both rows have valid "index fields" and invalid "indicator index fields". The second row should become the first row', () => {
           fillIndicatorMatchRow({
-            indexField: newThreatIndicatorRule.indicatorMappingField,
+            indexField: getNewThreatIndicatorRule().indicatorMappingField,
             indicatorIndexField: 'non-existent-value',
             validColumns: 'indexField',
           });
           getIndicatorAndButton().click();
           fillIndicatorMatchRow({
             rowNumber: 2,
-            indexField: newThreatIndicatorRule.indicatorMappingField,
+            indexField: getNewThreatIndicatorRule().indicatorMappingField,
             indicatorIndexField: 'second-non-existent-value',
             validColumns: 'indexField',
           });
@@ -292,14 +292,14 @@ describe('indicator match', () => {
         it('Deletes the first row when you have two rows. Both rows have valid "indicator index fields" and invalid "index fields". The second row should become the first row', () => {
           fillIndicatorMatchRow({
             indexField: 'non-existent-value',
-            indicatorIndexField: newThreatIndicatorRule.indicatorIndexField,
+            indicatorIndexField: getNewThreatIndicatorRule().indicatorIndexField,
             validColumns: 'indicatorField',
           });
           getIndicatorAndButton().click();
           fillIndicatorMatchRow({
             rowNumber: 2,
             indexField: 'second-non-existent-value',
-            indicatorIndexField: newThreatIndicatorRule.indicatorIndexField,
+            indicatorIndexField: getNewThreatIndicatorRule().indicatorIndexField,
             validColumns: 'indicatorField',
           });
           getIndicatorDeleteButton().click();
@@ -310,8 +310,8 @@ describe('indicator match', () => {
 
         it('Deletes the first row of data but not the UI elements and the text defaults back to the placeholder of Search', () => {
           fillIndicatorMatchRow({
-            indexField: newThreatIndicatorRule.indicatorMappingField,
-            indicatorIndexField: newThreatIndicatorRule.indicatorIndexField,
+            indexField: getNewThreatIndicatorRule().indicatorMappingField,
+            indicatorIndexField: getNewThreatIndicatorRule().indicatorIndexField,
           });
           getIndicatorDeleteButton().click();
           getIndicatorIndexComboField().should('text', 'Search');
@@ -322,8 +322,8 @@ describe('indicator match', () => {
 
         it('Deletes the second row when you have three rows. The first row is valid data, the second row is invalid data, and the third row is valid data. Third row should shift up correctly', () => {
           fillIndicatorMatchRow({
-            indexField: newThreatIndicatorRule.indicatorMappingField,
-            indicatorIndexField: newThreatIndicatorRule.indicatorIndexField,
+            indexField: getNewThreatIndicatorRule().indicatorMappingField,
+            indicatorIndexField: getNewThreatIndicatorRule().indicatorIndexField,
           });
           getIndicatorAndButton().click();
           fillIndicatorMatchRow({
@@ -335,25 +335,25 @@ describe('indicator match', () => {
           getIndicatorAndButton().click();
           fillIndicatorMatchRow({
             rowNumber: 3,
-            indexField: newThreatIndicatorRule.indicatorMappingField,
-            indicatorIndexField: newThreatIndicatorRule.indicatorIndexField,
+            indexField: getNewThreatIndicatorRule().indicatorMappingField,
+            indicatorIndexField: getNewThreatIndicatorRule().indicatorIndexField,
           });
           getIndicatorDeleteButton(2).click();
           getIndicatorIndexComboField(1).should(
             'text',
-            newThreatIndicatorRule.indicatorMappingField
+            getNewThreatIndicatorRule().indicatorMappingField
           );
           getIndicatorMappingComboField(1).should(
             'text',
-            newThreatIndicatorRule.indicatorIndexField
+            getNewThreatIndicatorRule().indicatorIndexField
           );
           getIndicatorIndexComboField(2).should(
             'text',
-            newThreatIndicatorRule.indicatorMappingField
+            getNewThreatIndicatorRule().indicatorMappingField
           );
           getIndicatorMappingComboField(2).should(
             'text',
-            newThreatIndicatorRule.indicatorIndexField
+            getNewThreatIndicatorRule().indicatorIndexField
           );
           getIndicatorIndexComboField(3).should('not.exist');
           getIndicatorMappingComboField(3).should('not.exist');
@@ -368,17 +368,17 @@ describe('indicator match', () => {
           getIndicatorOrButton().click();
           fillIndicatorMatchRow({
             rowNumber: 2,
-            indexField: newThreatIndicatorRule.indicatorMappingField,
-            indicatorIndexField: newThreatIndicatorRule.indicatorIndexField,
+            indexField: getNewThreatIndicatorRule().indicatorMappingField,
+            indicatorIndexField: getNewThreatIndicatorRule().indicatorIndexField,
           });
           getIndicatorDeleteButton().click();
           getIndicatorIndexComboField().should(
             'text',
-            newThreatIndicatorRule.indicatorMappingField
+            getNewThreatIndicatorRule().indicatorMappingField
           );
           getIndicatorMappingComboField().should(
             'text',
-            newThreatIndicatorRule.indicatorIndexField
+            getNewThreatIndicatorRule().indicatorIndexField
           );
           getIndicatorIndexComboField(2).should('not.exist');
           getIndicatorMappingComboField(2).should('not.exist');
@@ -399,9 +399,9 @@ describe('indicator match', () => {
         waitForRulesTableToBeLoaded();
         goToCreateNewRule();
         selectIndicatorMatchType();
-        fillDefineIndicatorMatchRuleAndContinue(newThreatIndicatorRule);
-        fillAboutRuleAndContinue(newThreatIndicatorRule);
-        fillScheduleRuleAndContinue(newThreatIndicatorRule);
+        fillDefineIndicatorMatchRuleAndContinue(getNewThreatIndicatorRule());
+        fillAboutRuleAndContinue(getNewThreatIndicatorRule());
+        fillScheduleRuleAndContinue(getNewThreatIndicatorRule());
         createAndActivateRule();
 
         cy.get(CUSTOM_RULES_BTN).should('have.text', 'Custom rules (1)');
@@ -417,18 +417,18 @@ describe('indicator match', () => {
         cy.get(RULES_TABLE).then(($table) => {
           cy.wrap($table.find(RULES_ROW).length).should('eql', 1);
         });
-        cy.get(RULE_NAME).should('have.text', newThreatIndicatorRule.name);
-        cy.get(RISK_SCORE).should('have.text', newThreatIndicatorRule.riskScore);
-        cy.get(SEVERITY).should('have.text', newThreatIndicatorRule.severity);
+        cy.get(RULE_NAME).should('have.text', getNewThreatIndicatorRule().name);
+        cy.get(RISK_SCORE).should('have.text', getNewThreatIndicatorRule().riskScore);
+        cy.get(SEVERITY).should('have.text', getNewThreatIndicatorRule().severity);
         cy.get(RULE_SWITCH).should('have.attr', 'aria-checked', 'true');
 
         goToRuleDetails();
 
-        cy.get(RULE_NAME_HEADER).should('contain', `${newThreatIndicatorRule.name}`);
-        cy.get(ABOUT_RULE_DESCRIPTION).should('have.text', newThreatIndicatorRule.description);
+        cy.get(RULE_NAME_HEADER).should('contain', `${getNewThreatIndicatorRule().name}`);
+        cy.get(ABOUT_RULE_DESCRIPTION).should('have.text', getNewThreatIndicatorRule().description);
         cy.get(ABOUT_DETAILS).within(() => {
-          getDetails(SEVERITY_DETAILS).should('have.text', newThreatIndicatorRule.severity);
-          getDetails(RISK_SCORE_DETAILS).should('have.text', newThreatIndicatorRule.riskScore);
+          getDetails(SEVERITY_DETAILS).should('have.text', getNewThreatIndicatorRule().severity);
+          getDetails(RISK_SCORE_DETAILS).should('have.text', getNewThreatIndicatorRule().riskScore);
           getDetails(REFERENCE_URLS_DETAILS).should((details) => {
             expect(removeExternalLinkText(details.text())).equal(expectedUrls);
           });
@@ -444,18 +444,20 @@ describe('indicator match', () => {
         cy.get(DEFINITION_DETAILS).within(() => {
           getDetails(INDEX_PATTERNS_DETAILS).should(
             'have.text',
-            newThreatIndicatorRule.index.join('')
+            getNewThreatIndicatorRule().index.join('')
           );
           getDetails(CUSTOM_QUERY_DETAILS).should('have.text', '*:*');
           getDetails(RULE_TYPE_DETAILS).should('have.text', 'Indicator Match');
           getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');
           getDetails(INDICATOR_INDEX_PATTERNS).should(
             'have.text',
-            newThreatIndicatorRule.indicatorIndexPattern.join('')
+            getNewThreatIndicatorRule().indicatorIndexPattern.join('')
           );
           getDetails(INDICATOR_MAPPING).should(
             'have.text',
-            `${newThreatIndicatorRule.indicatorMappingField} MATCHES ${newThreatIndicatorRule.indicatorIndexField}`
+            `${getNewThreatIndicatorRule().indicatorMappingField} MATCHES ${
+              getNewThreatIndicatorRule().indicatorIndexField
+            }`
           );
           getDetails(INDICATOR_INDEX_QUERY).should('have.text', '*:*');
         });
@@ -463,11 +465,15 @@ describe('indicator match', () => {
         cy.get(SCHEDULE_DETAILS).within(() => {
           getDetails(RUNS_EVERY_DETAILS).should(
             'have.text',
-            `${newThreatIndicatorRule.runsEvery.interval}${newThreatIndicatorRule.runsEvery.type}`
+            `${getNewThreatIndicatorRule().runsEvery.interval}${
+              getNewThreatIndicatorRule().runsEvery.type
+            }`
           );
           getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should(
             'have.text',
-            `${newThreatIndicatorRule.lookBack.interval}${newThreatIndicatorRule.lookBack.type}`
+            `${getNewThreatIndicatorRule().lookBack.interval}${
+              getNewThreatIndicatorRule().lookBack.type
+            }`
           );
         });
 
@@ -475,13 +481,15 @@ describe('indicator match', () => {
         waitForAlertsToPopulate();
 
         cy.get(NUMBER_OF_ALERTS).should('have.text', expectedNumberOfAlerts);
-        cy.get(ALERT_RULE_NAME).first().should('have.text', newThreatIndicatorRule.name);
+        cy.get(ALERT_RULE_NAME).first().should('have.text', getNewThreatIndicatorRule().name);
         cy.get(ALERT_RULE_VERSION).first().should('have.text', '1');
         cy.get(ALERT_RULE_METHOD).first().should('have.text', 'threat_match');
         cy.get(ALERT_RULE_SEVERITY)
           .first()
-          .should('have.text', newThreatIndicatorRule.severity.toLowerCase());
-        cy.get(ALERT_RULE_RISK_SCORE).first().should('have.text', newThreatIndicatorRule.riskScore);
+          .should('have.text', getNewThreatIndicatorRule().severity.toLowerCase());
+        cy.get(ALERT_RULE_RISK_SCORE)
+          .first()
+          .should('have.text', getNewThreatIndicatorRule().riskScore);
       });
 
       it('Investigate alert in timeline', () => {
@@ -492,7 +500,7 @@ describe('indicator match', () => {
         loadPrepackagedTimelineTemplates();
 
         goToManageAlertsDetectionRules();
-        createCustomIndicatorRule(newThreatIndicatorRule);
+        createCustomIndicatorRule(getNewThreatIndicatorRule());
 
         reload();
         goToRuleDetails();
@@ -502,13 +510,25 @@ describe('indicator match', () => {
         cy.get(PROVIDER_BADGE).should('have.length', 3);
         cy.get(PROVIDER_BADGE).should(
           'have.text',
-          `threat.indicator.matched.atomic: "${newThreatIndicatorRule.atomic}"threat.indicator.matched.type: "indicator_match_rule"threat.indicator.matched.field: "${newThreatIndicatorRule.indicatorMappingField}"`
+          `threat.indicator.matched.atomic: "${
+            getNewThreatIndicatorRule().atomic
+          }"threat.indicator.matched.type: "indicator_match_rule"threat.indicator.matched.field: "${
+            getNewThreatIndicatorRule().indicatorMappingField
+          }"`
         );
 
         cy.readFile(threatIndicatorPath).then((threatIndicator) => {
           cy.get(INDICATOR_MATCH_ROW_RENDER).should(
             'have.text',
-            `threat.indicator.matched.field${newThreatIndicatorRule.indicatorMappingField}${accessibilityText}matched${newThreatIndicatorRule.indicatorMappingField}${newThreatIndicatorRule.atomic}${accessibilityText}threat.indicator.matched.typeindicator_match_rule${accessibilityText}fromthreat.indicator.event.dataset${threatIndicator.value.source.event.dataset}${accessibilityText}:threat.indicator.event.reference${threatIndicator.value.source.event.reference}(opens in a new tab or window)${accessibilityText}`
+            `threat.indicator.matched.field${
+              getNewThreatIndicatorRule().indicatorMappingField
+            }${accessibilityText}matched${getNewThreatIndicatorRule().indicatorMappingField}${
+              getNewThreatIndicatorRule().atomic
+            }${accessibilityText}threat.indicator.matched.typeindicator_match_rule${accessibilityText}fromthreat.indicator.event.dataset${
+              threatIndicator.value.source.event.dataset
+            }${accessibilityText}:threat.indicator.event.reference${
+              threatIndicator.value.source.event.reference
+            }(opens in a new tab or window)${accessibilityText}`
           );
         });
       });
@@ -519,7 +539,7 @@ describe('indicator match', () => {
         cleanKibana();
         loginAndWaitForPageWithoutDateRange(ALERTS_URL);
         goToManageAlertsDetectionRules();
-        createCustomIndicatorRule(newThreatIndicatorRule);
+        createCustomIndicatorRule(getNewThreatIndicatorRule());
         reload();
       });
 
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/links.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/links.spec.ts
index fdc4bce677f74..85eb68a6cdfa9 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/links.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/links.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { newRule } from '../../objects/rule';
+import { getNewRule } from '../../objects/rule';
 import { RULES_MONIROTING_TABLE, RULE_NAME } from '../../screens/alerts_detection_rules';
 import { goToManageAlertsDetectionRules, waitForAlertsIndexToBeCreated } from '../../tasks/alerts';
 import { createCustomRuleActivated } from '../../tasks/api_calls/rules';
@@ -19,7 +19,7 @@ describe('Rules talbes links', () => {
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     goToManageAlertsDetectionRules();
     waitForAlertsIndexToBeCreated();
-    createCustomRuleActivated(newRule, 'rule1');
+    createCustomRuleActivated(getNewRule(), 'rule1');
 
     reload();
   });
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/machine_learning_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/machine_learning_rule.spec.ts
index 2d869b314b67c..e66f8f55be986 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/machine_learning_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/machine_learning_rule.spec.ts
@@ -6,7 +6,7 @@
  */
 
 import { formatMitreAttackDescription } from '../../helpers/rules';
-import { machineLearningRule } from '../../objects/rule';
+import { getMachineLearningRule } from '../../objects/rule';
 
 import {
   CUSTOM_RULES_BTN,
@@ -65,10 +65,10 @@ import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import { ALERTS_URL } from '../../urls/navigation';
 
 describe('Detection rules, machine learning', () => {
-  const expectedUrls = machineLearningRule.referenceUrls.join('');
-  const expectedFalsePositives = machineLearningRule.falsePositivesExamples.join('');
-  const expectedTags = machineLearningRule.tags.join('');
-  const expectedMitre = formatMitreAttackDescription(machineLearningRule.mitre);
+  const expectedUrls = getMachineLearningRule().referenceUrls.join('');
+  const expectedFalsePositives = getMachineLearningRule().falsePositivesExamples.join('');
+  const expectedTags = getMachineLearningRule().tags.join('');
+  const expectedMitre = formatMitreAttackDescription(getMachineLearningRule().mitre);
   const expectedNumberOfRules = 1;
 
   beforeEach(() => {
@@ -83,9 +83,9 @@ describe('Detection rules, machine learning', () => {
     waitForRulesTableToBeLoaded();
     goToCreateNewRule();
     selectMachineLearningRuleType();
-    fillDefineMachineLearningRuleAndContinue(machineLearningRule);
-    fillAboutRuleAndContinue(machineLearningRule);
-    fillScheduleRuleAndContinue(machineLearningRule);
+    fillDefineMachineLearningRuleAndContinue(getMachineLearningRule());
+    fillAboutRuleAndContinue(getMachineLearningRule());
+    fillScheduleRuleAndContinue(getMachineLearningRule());
     createAndActivateRule();
 
     cy.get(CUSTOM_RULES_BTN).should('have.text', 'Custom rules (1)');
@@ -101,18 +101,18 @@ describe('Detection rules, machine learning', () => {
     cy.get(RULES_TABLE).then(($table) => {
       cy.wrap($table.find(RULES_ROW).length).should('eql', 1);
     });
-    cy.get(RULE_NAME).should('have.text', machineLearningRule.name);
-    cy.get(RISK_SCORE).should('have.text', machineLearningRule.riskScore);
-    cy.get(SEVERITY).should('have.text', machineLearningRule.severity);
+    cy.get(RULE_NAME).should('have.text', getMachineLearningRule().name);
+    cy.get(RISK_SCORE).should('have.text', getMachineLearningRule().riskScore);
+    cy.get(SEVERITY).should('have.text', getMachineLearningRule().severity);
     cy.get(RULE_SWITCH).should('have.attr', 'aria-checked', 'true');
 
     goToRuleDetails();
 
-    cy.get(RULE_NAME_HEADER).should('contain', `${machineLearningRule.name}`);
-    cy.get(ABOUT_RULE_DESCRIPTION).should('have.text', machineLearningRule.description);
+    cy.get(RULE_NAME_HEADER).should('contain', `${getMachineLearningRule().name}`);
+    cy.get(ABOUT_RULE_DESCRIPTION).should('have.text', getMachineLearningRule().description);
     cy.get(ABOUT_DETAILS).within(() => {
-      getDetails(SEVERITY_DETAILS).should('have.text', machineLearningRule.severity);
-      getDetails(RISK_SCORE_DETAILS).should('have.text', machineLearningRule.riskScore);
+      getDetails(SEVERITY_DETAILS).should('have.text', getMachineLearningRule().severity);
+      getDetails(RISK_SCORE_DETAILS).should('have.text', getMachineLearningRule().riskScore);
       getDetails(REFERENCE_URLS_DETAILS).should((details) => {
         expect(removeExternalLinkText(details.text())).equal(expectedUrls);
       });
@@ -125,11 +125,11 @@ describe('Detection rules, machine learning', () => {
     cy.get(DEFINITION_DETAILS).within(() => {
       getDetails(ANOMALY_SCORE_DETAILS).should(
         'have.text',
-        machineLearningRule.anomalyScoreThreshold
+        getMachineLearningRule().anomalyScoreThreshold
       );
       getDetails(RULE_TYPE_DETAILS).should('have.text', 'Machine Learning');
       getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');
-      machineLearningRule.machineLearningJobs.forEach((machineLearningJob, jobIndex) => {
+      getMachineLearningRule().machineLearningJobs.forEach((machineLearningJob, jobIndex) => {
         cy.get(MACHINE_LEARNING_JOB_STATUS).eq(jobIndex).should('have.text', 'Stopped');
         cy.get(MACHINE_LEARNING_JOB_ID).eq(jobIndex).should('have.text', machineLearningJob);
       });
@@ -137,11 +137,11 @@ describe('Detection rules, machine learning', () => {
     cy.get(SCHEDULE_DETAILS).within(() => {
       getDetails(RUNS_EVERY_DETAILS).should(
         'have.text',
-        `${machineLearningRule.runsEvery.interval}${machineLearningRule.runsEvery.type}`
+        `${getMachineLearningRule().runsEvery.interval}${getMachineLearningRule().runsEvery.type}`
       );
       getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should(
         'have.text',
-        `${machineLearningRule.lookBack.interval}${machineLearningRule.lookBack.type}`
+        `${getMachineLearningRule().lookBack.interval}${getMachineLearningRule().lookBack.type}`
       );
     });
   });
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/override.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/override.spec.ts
index a791cc293c1f0..24a56dd563e17 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/override.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/override.spec.ts
@@ -7,9 +7,9 @@
 
 import { formatMitreAttackDescription } from '../../helpers/rules';
 import {
-  indexPatterns,
-  newOverrideRule,
-  severitiesOverride,
+  getIndexPatterns,
+  getNewOverrideRule,
+  getSeveritiesOverride,
   OverrideRule,
 } from '../../objects/rule';
 
@@ -89,18 +89,18 @@ import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import { ALERTS_URL } from '../../urls/navigation';
 
 describe('Detection rules, override', () => {
-  const expectedUrls = newOverrideRule.referenceUrls.join('');
-  const expectedFalsePositives = newOverrideRule.falsePositivesExamples.join('');
-  const expectedTags = newOverrideRule.tags.join('');
-  const expectedMitre = formatMitreAttackDescription(newOverrideRule.mitre);
+  const expectedUrls = getNewOverrideRule().referenceUrls.join('');
+  const expectedFalsePositives = getNewOverrideRule().falsePositivesExamples.join('');
+  const expectedTags = getNewOverrideRule().tags.join('');
+  const expectedMitre = formatMitreAttackDescription(getNewOverrideRule().mitre);
 
   beforeEach(() => {
     cleanKibana();
-    createTimeline(newOverrideRule.timeline).then((response) => {
+    createTimeline(getNewOverrideRule().timeline).then((response) => {
       cy.wrap({
-        ...newOverrideRule,
+        ...getNewOverrideRule(),
         timeline: {
-          ...newOverrideRule.timeline,
+          ...getNewOverrideRule().timeline,
           id: response.body.data.persistTimeline.timeline.savedObjectId,
         },
       }).as('rule');
@@ -167,7 +167,7 @@ describe('Detection rules, override', () => {
               .eq(severityOverrideIndex + i)
               .should(
                 'have.text',
-                `${severity.sourceField}:${severity.sourceValue}${severitiesOverride[i]}`
+                `${severity.sourceField}:${severity.sourceValue}${getSeveritiesOverride()[i]}`
               );
           });
         });
@@ -175,7 +175,7 @@ describe('Detection rules, override', () => {
     cy.get(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
     cy.get(ABOUT_INVESTIGATION_NOTES).should('have.text', INVESTIGATION_NOTES_MARKDOWN);
     cy.get(DEFINITION_DETAILS).within(() => {
-      getDetails(INDEX_PATTERNS_DETAILS).should('have.text', indexPatterns.join(''));
+      getDetails(INDEX_PATTERNS_DETAILS).should('have.text', getIndexPatterns().join(''));
       getDetails(CUSTOM_QUERY_DETAILS).should('have.text', this.rule.customQuery);
       getDetails(RULE_TYPE_DETAILS).should('have.text', 'Query');
       getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts
index 7d42ea533a9ae..ef3d3a82d40bd 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts
@@ -39,7 +39,12 @@ import { DEFAULT_RULE_REFRESH_INTERVAL_VALUE } from '../../../common/constants';
 import { ALERTS_URL } from '../../urls/navigation';
 import { createCustomRule } from '../../tasks/api_calls/rules';
 import { cleanKibana } from '../../tasks/common';
-import { existingRule, newOverrideRule, newRule, newThresholdRule } from '../../objects/rule';
+import {
+  getExistingRule,
+  getNewOverrideRule,
+  getNewRule,
+  getNewThresholdRule,
+} from '../../objects/rule';
 
 describe('Alerts detection rules', () => {
   beforeEach(() => {
@@ -47,10 +52,10 @@ describe('Alerts detection rules', () => {
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
     waitForAlertsIndexToBeCreated();
-    createCustomRule(newRule, '1');
-    createCustomRule(existingRule, '2');
-    createCustomRule(newOverrideRule, '3');
-    createCustomRule(newThresholdRule, '4');
+    createCustomRule(getNewRule(), '1');
+    createCustomRule(getExistingRule(), '2');
+    createCustomRule(getNewOverrideRule(), '3');
+    createCustomRule(getNewThresholdRule(), '4');
   });
 
   it('Sorts by activated rules', () => {
@@ -90,8 +95,8 @@ describe('Alerts detection rules', () => {
   });
 
   it('Pagination updates page number and results', () => {
-    createCustomRule({ ...newRule, name: 'Test a rule' }, '5');
-    createCustomRule({ ...newRule, name: 'Not same as first rule' }, '6');
+    createCustomRule({ ...getNewRule(), name: 'Test a rule' }, '5');
+    createCustomRule({ ...getNewRule(), name: 'Not same as first rule' }, '6');
 
     goToManageAlertsDetectionRules();
     waitForRulesTableToBeLoaded();
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/threshold_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/threshold_rule.spec.ts
index ce00c9b40aead..dba12fb4ab95c 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/threshold_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/threshold_rule.spec.ts
@@ -6,7 +6,12 @@
  */
 
 import { formatMitreAttackDescription } from '../../helpers/rules';
-import { indexPatterns, newRule, newThresholdRule, ThresholdRule } from '../../objects/rule';
+import {
+  getIndexPatterns,
+  getNewRule,
+  getNewThresholdRule,
+  ThresholdRule,
+} from '../../objects/rule';
 
 import {
   ALERT_RULE_METHOD,
@@ -84,16 +89,16 @@ import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import { ALERTS_URL } from '../../urls/navigation';
 
 describe('Detection rules, threshold', () => {
-  const expectedUrls = newThresholdRule.referenceUrls.join('');
-  const expectedFalsePositives = newThresholdRule.falsePositivesExamples.join('');
-  const expectedTags = newThresholdRule.tags.join('');
-  const expectedMitre = formatMitreAttackDescription(newThresholdRule.mitre);
-
-  const rule = { ...newThresholdRule };
+  let rule = getNewThresholdRule();
+  const expectedUrls = getNewThresholdRule().referenceUrls.join('');
+  const expectedFalsePositives = getNewThresholdRule().falsePositivesExamples.join('');
+  const expectedTags = getNewThresholdRule().tags.join('');
+  const expectedMitre = formatMitreAttackDescription(getNewThresholdRule().mitre);
 
   beforeEach(() => {
+    rule = getNewThresholdRule();
     cleanKibana();
-    createTimeline(newThresholdRule.timeline).then((response) => {
+    createTimeline(getNewThresholdRule().timeline).then((response) => {
       rule.timeline.id = response.body.data.persistTimeline.timeline.savedObjectId;
     });
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
@@ -149,7 +154,7 @@ describe('Detection rules, threshold', () => {
     cy.get(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
     cy.get(ABOUT_INVESTIGATION_NOTES).should('have.text', INVESTIGATION_NOTES_MARKDOWN);
     cy.get(DEFINITION_DETAILS).within(() => {
-      getDetails(INDEX_PATTERNS_DETAILS).should('have.text', indexPatterns.join(''));
+      getDetails(INDEX_PATTERNS_DETAILS).should('have.text', getIndexPatterns().join(''));
       getDetails(CUSTOM_QUERY_DETAILS).should('have.text', rule.customQuery);
       getDetails(RULE_TYPE_DETAILS).should('have.text', 'Threshold');
       getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');
@@ -181,15 +186,14 @@ describe('Detection rules, threshold', () => {
   });
 
   it('Preview results of keyword using "host.name"', () => {
-    const previewRule: ThresholdRule = { ...newThresholdRule };
-    previewRule.index = [...previewRule.index, '.siem-signals*'];
+    rule.index = [...rule.index, '.siem-signals*'];
 
-    createCustomRuleActivated(newRule);
+    createCustomRuleActivated(getNewRule());
     goToManageAlertsDetectionRules();
     waitForRulesTableToBeLoaded();
     goToCreateNewRule();
     selectThresholdRuleType();
-    fillDefineThresholdRule(previewRule);
+    fillDefineThresholdRule(rule);
     previewResults();
 
     cy.get(PREVIEW_HEADER_SUBTITLE).should('have.text', '3 unique hits');
@@ -197,13 +201,13 @@ describe('Detection rules, threshold', () => {
 
   it('Preview results of "ip" using "source.ip"', () => {
     const previewRule: ThresholdRule = {
-      ...newThresholdRule,
+      ...rule,
       thresholdField: 'source.ip',
       threshold: '1',
     };
     previewRule.index = [...previewRule.index, '.siem-signals*'];
 
-    createCustomRuleActivated(newRule);
+    createCustomRuleActivated(getNewRule());
     goToManageAlertsDetectionRules();
     waitForRulesTableToBeLoaded();
     goToCreateNewRule();
diff --git a/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_modal.spec.ts b/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_modal.spec.ts
index a4b929f7d8e1d..7eedc99652f80 100644
--- a/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_modal.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_modal.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { newRule } from '../../objects/rule';
+import { getNewRule } from '../../objects/rule';
 
 import { RULE_STATUS } from '../../screens/create_new_rule';
 
@@ -44,7 +44,7 @@ describe('Exceptions modal', () => {
     cleanKibana();
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsIndexToBeCreated();
-    createCustomRule(newRule);
+    createCustomRule(getNewRule());
     goToManageAlertsDetectionRules();
     goToRuleDetails();
 
diff --git a/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_table.spec.ts b/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_table.spec.ts
index 83277075b35cc..051ebbb9643f6 100644
--- a/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_table.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_table.spec.ts
@@ -5,8 +5,12 @@
  * 2.0.
  */
 
-import { exception, exceptionList, expectedExportedExceptionList } from '../../objects/exception';
-import { newRule } from '../../objects/rule';
+import {
+  getException,
+  getExceptionList,
+  expectedExportedExceptionList,
+} from '../../objects/exception';
+import { getNewRule } from '../../objects/rule';
 
 import { RULE_STATUS } from '../../screens/create_new_rule';
 
@@ -46,7 +50,7 @@ describe('Exceptions Table', () => {
     cleanKibana();
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsIndexToBeCreated();
-    createCustomRule(newRule);
+    createCustomRule(getNewRule());
     goToManageAlertsDetectionRules();
     goToRuleDetails();
 
@@ -56,11 +60,11 @@ describe('Exceptions Table', () => {
 
     // Add a detections exception list
     goToExceptionsTab();
-    addsExceptionFromRuleSettings(exception);
+    addsExceptionFromRuleSettings(getException());
     waitForTheRuleToBeExecuted();
 
     // Create exception list not used by any rules
-    createExceptionList(exceptionList).as('exceptionListResponse');
+    createExceptionList(getExceptionList()).as('exceptionListResponse');
 
     goBackToAllRulesTable();
     waitForRulesTableToBeLoaded();
diff --git a/x-pack/plugins/security_solution/cypress/integration/exceptions/from_alert.spec.ts b/x-pack/plugins/security_solution/cypress/integration/exceptions/from_alert.spec.ts
index 4918de7488ddd..8a683aacd5f66 100644
--- a/x-pack/plugins/security_solution/cypress/integration/exceptions/from_alert.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/exceptions/from_alert.spec.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import { exception } from '../../objects/exception';
-import { newRule } from '../../objects/rule';
+import { getException } from '../../objects/exception';
+import { getNewRule } from '../../objects/rule';
 
 import { ALERTS_COUNT, NUMBER_OF_ALERTS } from '../../screens/alerts';
 import { RULE_STATUS } from '../../screens/create_new_rule';
@@ -43,7 +43,7 @@ describe('From alert', () => {
     cleanKibana();
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsIndexToBeCreated();
-    createCustomRule(newRule, 'rule_testing', '10s');
+    createCustomRule(getNewRule(), 'rule_testing', '10s');
     goToManageAlertsDetectionRules();
     goToRuleDetails();
 
@@ -66,7 +66,7 @@ describe('From alert', () => {
 
   it('Creates an exception and deletes it', () => {
     addExceptionFromFirstAlert();
-    addsException(exception);
+    addsException(getException());
     esArchiverLoad('auditbeat_for_exceptions2');
 
     cy.get(ALERTS_COUNT).should('exist');
diff --git a/x-pack/plugins/security_solution/cypress/integration/exceptions/from_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/exceptions/from_rule.spec.ts
index ea8988456d8b3..8fa0050a36521 100644
--- a/x-pack/plugins/security_solution/cypress/integration/exceptions/from_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/exceptions/from_rule.spec.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import { exception } from '../../objects/exception';
-import { newRule } from '../../objects/rule';
+import { getException } from '../../objects/exception';
+import { getNewRule } from '../../objects/rule';
 
 import { ALERTS_COUNT, NUMBER_OF_ALERTS } from '../../screens/alerts';
 import { RULE_STATUS } from '../../screens/create_new_rule';
@@ -41,7 +41,7 @@ describe('From rule', () => {
     cleanKibana();
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsIndexToBeCreated();
-    createCustomRule(newRule, 'rule_testing', '10s');
+    createCustomRule(getNewRule(), 'rule_testing', '10s');
     goToManageAlertsDetectionRules();
     goToRuleDetails();
 
@@ -64,7 +64,7 @@ describe('From rule', () => {
 
   it('Creates an exception and deletes it', () => {
     goToExceptionsTab();
-    addsExceptionFromRuleSettings(exception);
+    addsExceptionFromRuleSettings(getException());
     esArchiverLoad('auditbeat_for_exceptions2');
     waitForTheRuleToBeExecuted();
     goToAlertsTab();
diff --git a/x-pack/plugins/security_solution/cypress/integration/header/search_bar.spec.ts b/x-pack/plugins/security_solution/cypress/integration/header/search_bar.spec.ts
index d7bef9d67df2f..c02c2bd9ec139 100644
--- a/x-pack/plugins/security_solution/cypress/integration/header/search_bar.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/header/search_bar.spec.ts
@@ -8,7 +8,7 @@
 import { loginAndWaitForPage } from '../../tasks/login';
 import { openAddFilterPopover, fillAddFilterForm } from '../../tasks/search_bar';
 import { GLOBAL_SEARCH_BAR_FILTER_ITEM } from '../../screens/search_bar';
-import { hostIpFilter } from '../../objects/filter';
+import { getHostIpFilter } from '../../objects/filter';
 
 import { HOSTS_URL } from '../../urls/navigation';
 import { waitForAllHostsToBeLoaded } from '../../tasks/hosts/all_hosts';
@@ -23,11 +23,11 @@ describe('SearchBar', () => {
 
   it('adds correctly a filter to the global search bar', () => {
     openAddFilterPopover();
-    fillAddFilterForm(hostIpFilter);
+    fillAddFilterForm(getHostIpFilter());
 
     cy.get(GLOBAL_SEARCH_BAR_FILTER_ITEM).should(
       'have.text',
-      `${hostIpFilter.key}: ${hostIpFilter.value}`
+      `${getHostIpFilter().key}: ${getHostIpFilter().value}`
     );
   });
 });
diff --git a/x-pack/plugins/security_solution/cypress/integration/overview/overview.spec.ts b/x-pack/plugins/security_solution/cypress/integration/overview/overview.spec.ts
index 3ff036fa0107f..ca9f83183ab10 100644
--- a/x-pack/plugins/security_solution/cypress/integration/overview/overview.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/overview/overview.spec.ts
@@ -16,7 +16,7 @@ import overviewFixture from '../../fixtures/overview_search_strategy.json';
 import emptyInstance from '../../fixtures/empty_instance.json';
 import { cleanKibana } from '../../tasks/common';
 import { createTimeline, favoriteTimeline } from '../../tasks/api_calls/timelines';
-import { timeline } from '../../objects/timeline';
+import { getTimeline } from '../../objects/timeline';
 
 describe('Overview Page', () => {
   before(() => {
@@ -53,7 +53,7 @@ describe('Overview Page', () => {
 
   describe('Favorite Timelines', () => {
     it('should appear on overview page', () => {
-      createTimeline(timeline)
+      createTimeline(getTimeline())
         .then((response) => response.body.data.persistTimeline.timeline.savedObjectId)
         .then((timelineId: string) => {
           favoriteTimeline({ timelineId, timelineType: 'default' }).then(() => {
@@ -61,7 +61,7 @@ describe('Overview Page', () => {
             loginAndWaitForPage(OVERVIEW_URL);
             cy.get('[data-test-subj="overview-recent-timelines"]').should(
               'contain',
-              timeline.title
+              getTimeline().title
             );
           });
         });
diff --git a/x-pack/plugins/security_solution/cypress/integration/timeline_templates/creation.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timeline_templates/creation.spec.ts
index e2c1d7eef38c3..3930088f8bfdd 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timeline_templates/creation.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timeline_templates/creation.spec.ts
@@ -5,14 +5,13 @@
  * 2.0.
  */
 
-import { timeline } from '../../objects/timeline';
+import { getTimeline } from '../../objects/timeline';
 
 import {
   FAVORITE_TIMELINE,
   LOCKED_ICON,
   NOTES,
   NOTES_TAB_BUTTON,
-  // NOTES_COUNT,
   NOTES_TEXT_AREA,
   PIN_EVENT,
   TIMELINE_DESCRIPTION,
@@ -61,7 +60,7 @@ describe('Timeline Templates', () => {
     openTimelineUsingToggle();
     createNewTimelineTemplate();
     populateTimeline();
-    addFilter(timeline.filter);
+    addFilter(getTimeline().filter);
     cy.get(PIN_EVENT).should(
       'have.attr',
       'aria-label',
@@ -69,21 +68,21 @@ describe('Timeline Templates', () => {
     );
     cy.get(LOCKED_ICON).should('be.visible');
 
-    addNameToTimeline(timeline.title);
+    addNameToTimeline(getTimeline().title);
 
     cy.wait('@timeline').then(({ response }) => {
       const timelineId = response!.body.data.persistTimeline.timeline.savedObjectId;
 
-      addDescriptionToTimeline(timeline.description);
-      addNotesToTimeline(timeline.notes);
+      addDescriptionToTimeline(getTimeline().description);
+      addNotesToTimeline(getTimeline().notes);
       markAsFavorite();
       waitForTimelineChanges();
       createNewTimelineTemplate();
       closeTimeline();
       openTimelineTemplateFromSettings(timelineId);
 
-      cy.contains(timeline.title).should('exist');
-      cy.get(TIMELINES_DESCRIPTION).first().should('have.text', timeline.description);
+      cy.contains(getTimeline().title).should('exist');
+      cy.get(TIMELINES_DESCRIPTION).first().should('have.text', getTimeline().description);
       cy.get(TIMELINES_PINNED_EVENT_COUNT).first().should('have.text', '1');
       cy.get(TIMELINES_NOTES_COUNT).first().should('have.text', '1');
       cy.get(TIMELINES_FAVORITE).first().should('exist');
@@ -91,30 +90,30 @@ describe('Timeline Templates', () => {
       openTimeline(timelineId);
 
       cy.get(FAVORITE_TIMELINE).should('exist');
-      cy.get(TIMELINE_TITLE).should('have.text', timeline.title);
-      cy.get(TIMELINE_DESCRIPTION).should('have.text', timeline.description);
-      cy.get(TIMELINE_QUERY).should('have.text', timeline.query);
+      cy.get(TIMELINE_TITLE).should('have.text', getTimeline().title);
+      cy.get(TIMELINE_DESCRIPTION).should('have.text', getTimeline().description);
+      cy.get(TIMELINE_QUERY).should('have.text', getTimeline().query);
       // Comments this assertion until we agreed what to do with the filters.
       // cy.get(TIMELINE_FILTER(timeline.filter)).should('exist');
       // cy.get(NOTES_COUNT).should('have.text', '1');
       cy.get(NOTES_TAB_BUTTON).click();
       cy.get(NOTES_TEXT_AREA).should('exist');
-      cy.get(NOTES).should('have.text', timeline.notes);
+      cy.get(NOTES).should('have.text', getTimeline().notes);
     });
   });
 
   it('Create template from timeline', () => {
     waitForTimelinesPanelToBeLoaded();
 
-    createTimeline(timeline).then(() => {
+    createTimeline(getTimeline()).then(() => {
       expandEventAction();
       clickingOnCreateTemplateFromTimelineBtn();
       cy.wait('@timeline', { timeout: 100000 }).then(({ request }) => {
         expect(request.body.timeline).to.haveOwnProperty('templateTimelineId');
-        expect(request.body.timeline).to.haveOwnProperty('description', timeline.description);
+        expect(request.body.timeline).to.haveOwnProperty('description', getTimeline().description);
         expect(request.body.timeline.kqlQuery.filterQuery.kuery).to.haveOwnProperty(
           'expression',
-          timeline.query
+          getTimeline().query
         );
         cy.get(TIMELINE_FLYOUT_WRAPPER).should('have.css', 'visibility', 'visible');
       });
diff --git a/x-pack/plugins/security_solution/cypress/integration/timeline_templates/export.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timeline_templates/export.spec.ts
index aa0a6c9308a52..5c2d87c9b727f 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timeline_templates/export.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timeline_templates/export.spec.ts
@@ -9,7 +9,7 @@ import { exportTimeline } from '../../tasks/timelines';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import {
   expectedExportedTimelineTemplate,
-  timeline as timelineTemplate,
+  getTimeline as getTimelineTemplate,
 } from '../../objects/timeline';
 
 import { TIMELINE_TEMPLATES_URL } from '../../urls/navigation';
@@ -20,7 +20,7 @@ describe('Export timelines', () => {
   beforeEach(() => {
     cleanKibana();
     cy.intercept('POST', 'api/timeline/_export?file_name=timelines_export.ndjson').as('export');
-    createTimelineTemplate(timelineTemplate).then((response) => {
+    createTimelineTemplate(getTimelineTemplate()).then((response) => {
       cy.wrap(response).as('templateResponse');
       cy.wrap(response.body.data.persistTimeline.timeline.savedObjectId).as('templateId');
     });
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts
index 8a90b67682cb2..4203b9125d155 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { timeline } from '../../objects/timeline';
+import { getTimeline } from '../../objects/timeline';
 
 import {
   LOCKED_ICON,
@@ -64,7 +64,7 @@ describe('Timelines', (): void => {
 
     before(() => {
       openTimelineUsingToggle();
-      addNameAndDescriptionToTimeline(timeline);
+      addNameAndDescriptionToTimeline(getTimeline());
       populateTimeline();
     });
 
@@ -73,8 +73,8 @@ describe('Timelines', (): void => {
     });
 
     it('can be added filter', () => {
-      addFilter(timeline.filter);
-      cy.get(TIMELINE_FILTER(timeline.filter)).should('exist');
+      addFilter(getTimeline().filter);
+      cy.get(TIMELINE_FILTER(getTimeline().filter)).should('exist');
     });
 
     it('pins an event', () => {
@@ -89,8 +89,8 @@ describe('Timelines', (): void => {
     });
 
     it('can be added notes', () => {
-      addNotesToTimeline(timeline.notes);
-      cy.get(NOTES_TEXT).should('have.text', timeline.notes);
+      addNotesToTimeline(getTimeline().notes);
+      cy.get(NOTES_TEXT).should('have.text', getTimeline().notes);
     });
 
     it('should update timeline after adding eql', () => {
@@ -116,17 +116,20 @@ describe('Create a timeline from a template', () => {
   });
 
   it('Should have the same query and open the timeline modal', () => {
-    createTimelineTemplate(timeline).then(() => {
+    createTimelineTemplate(getTimeline()).then(() => {
       expandEventAction();
       cy.intercept('/api/timeline').as('timeline');
 
       clickingOnCreateTimelineFormTemplateBtn();
       cy.wait('@timeline', { timeout: 100000 }).then(({ request }) => {
         if (request.body && request.body.timeline) {
-          expect(request.body.timeline).to.haveOwnProperty('description', timeline.description);
+          expect(request.body.timeline).to.haveOwnProperty(
+            'description',
+            getTimeline().description
+          );
           expect(request.body.timeline.kqlQuery.filterQuery.kuery).to.haveOwnProperty(
             'expression',
-            timeline.query
+            getTimeline().query
           );
           cy.get(TIMELINE_FLYOUT_WRAPPER).should('have.css', 'visibility', 'visible');
         }
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/export.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/export.spec.ts
index c2bd31c635a70..918a554db5606 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/export.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/export.spec.ts
@@ -10,14 +10,14 @@ import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 
 import { TIMELINES_URL } from '../../urls/navigation';
 import { createTimeline } from '../../tasks/api_calls/timelines';
-import { expectedExportedTimeline, timeline } from '../../objects/timeline';
+import { expectedExportedTimeline, getTimeline } from '../../objects/timeline';
 import { cleanKibana } from '../../tasks/common';
 
 describe('Export timelines', () => {
   beforeEach(() => {
     cleanKibana();
     cy.intercept('POST', '/api/timeline/_export?file_name=timelines_export.ndjson').as('export');
-    createTimeline(timeline).then((response) => {
+    createTimeline(getTimeline()).then((response) => {
       cy.wrap(response).as('timelineResponse');
       cy.wrap(response.body.data.persistTimeline.timeline.savedObjectId).as('timelineId');
     });
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/notes_tab.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/notes_tab.spec.ts
index 24309b8fda084..0a784cf952ca6 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/notes_tab.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/notes_tab.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { timelineNonValidQuery } from '../../objects/timeline';
+import { getTimelineNonValidQuery } from '../../objects/timeline';
 
 import {
   NOTES_AUTHOR,
@@ -39,7 +39,7 @@ describe('Timeline notes tab', () => {
     loginAndWaitForPageWithoutDateRange(TIMELINES_URL);
     waitForTimelinesPanelToBeLoaded();
 
-    createTimeline(timelineNonValidQuery)
+    createTimeline(getTimelineNonValidQuery())
       .then((response) => response.body.data.persistTimeline.timeline.savedObjectId)
       .then((timelineId: string) =>
         refreshTimelinesUntilTimeLinePresent(timelineId)
@@ -56,16 +56,16 @@ describe('Timeline notes tab', () => {
   });
   it('should render mockdown', () => {
     cy.intercept('/api/note').as(`updateNote`);
-    addNotesToTimeline(timelineNonValidQuery.notes);
+    addNotesToTimeline(getTimelineNonValidQuery().notes);
     cy.wait('@updateNote').its('response.statusCode').should('eq', 200);
     cy.get(NOTES_TEXT_AREA).should('exist');
   });
 
   it('should contain notes', () => {
     cy.intercept('/api/note').as(`updateNote`);
-    addNotesToTimeline(timelineNonValidQuery.notes);
+    addNotesToTimeline(getTimelineNonValidQuery().notes);
     cy.wait('@updateNote').its('response.statusCode').should('eq', 200);
-    cy.get(NOTES_TEXT).first().should('have.text', timelineNonValidQuery.notes);
+    cy.get(NOTES_TEXT).first().should('have.text', getTimelineNonValidQuery().notes);
   });
 
   it('should be able to render font in bold', () => {
@@ -91,7 +91,7 @@ describe('Timeline notes tab', () => {
 
   it('should render the right author', () => {
     cy.intercept('/api/note').as(`updateNote`);
-    addNotesToTimeline(timelineNonValidQuery.notes);
+    addNotesToTimeline(getTimelineNonValidQuery().notes);
     cy.wait('@updateNote').its('response.statusCode').should('eq', 200);
     cy.get(NOTES_AUTHOR).first().should('have.text', text);
   });
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/open_timeline.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/open_timeline.spec.ts
index 814631b2af636..5c620a983b2b3 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/open_timeline.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/open_timeline.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { timeline } from '../../objects/timeline';
+import { getTimeline } from '../../objects/timeline';
 
 import { TIMELINE_DESCRIPTION, TIMELINE_TITLE, OPEN_TIMELINE_MODAL } from '../../screens/timeline';
 import {
@@ -39,7 +39,7 @@ describe('Open timeline', () => {
     loginAndWaitForPageWithoutDateRange(TIMELINES_URL);
     waitForTimelinesPanelToBeLoaded();
 
-    createTimeline(timeline)
+    createTimeline(getTimeline())
       .then((response) => response.body.data.persistTimeline.timeline.savedObjectId)
       .then((timelineId: string) => {
         refreshTimelinesUntilTimeLinePresent(timelineId)
@@ -47,7 +47,7 @@ describe('Open timeline', () => {
           // request responses and indeterminism since on clicks to activates URL's.
           .then(() => cy.wait(1000))
           .then(() =>
-            addNoteToTimeline(timeline.notes, timelineId).should((response) =>
+            addNoteToTimeline(getTimeline().notes, timelineId).should((response) =>
               expect(response.status).to.equal(200)
             )
           )
@@ -71,11 +71,11 @@ describe('Open timeline', () => {
     });
 
     it('should display timeline info - title', () => {
-      cy.contains(timeline.title).should('exist');
+      cy.contains(getTimeline().title).should('exist');
     });
 
     it('should display timeline info - description', () => {
-      cy.get(TIMELINES_DESCRIPTION).first().should('have.text', timeline.description);
+      cy.get(TIMELINES_DESCRIPTION).first().should('have.text', getTimeline().description);
     });
 
     it('should display timeline info - pinned event count', () => {
@@ -91,11 +91,11 @@ describe('Open timeline', () => {
     });
 
     it('should display timeline content - title', () => {
-      cy.get(TIMELINE_TITLE).should('have.text', timeline.title);
+      cy.get(TIMELINE_TITLE).should('have.text', getTimeline().title);
     });
 
     it('should display timeline content - description', () => {
-      cy.get(TIMELINE_DESCRIPTION).should('have.text', timeline.description);
+      cy.get(TIMELINE_DESCRIPTION).should('have.text', getTimeline().description);
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/query_tab.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/query_tab.spec.ts
index f37a66ac048fb..06891121d6354 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/query_tab.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/query_tab.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { timeline } from '../../objects/timeline';
+import { getTimeline } from '../../objects/timeline';
 
 import {
   UNLOCKED_ICON,
@@ -38,7 +38,7 @@ describe('Timeline query tab', () => {
     loginAndWaitForPageWithoutDateRange(TIMELINES_URL);
     waitForTimelinesPanelToBeLoaded();
 
-    createTimeline(timeline)
+    createTimeline(getTimeline())
       .then((response) => response.body.data.persistTimeline.timeline.savedObjectId)
       .then((timelineId: string) => {
         refreshTimelinesUntilTimeLinePresent(timelineId)
@@ -46,14 +46,14 @@ describe('Timeline query tab', () => {
           // request responses and indeterminism since on clicks to activates URL's.
           .then(() => cy.wait(1000))
           .then(() =>
-            addNoteToTimeline(timeline.notes, timelineId).should((response) =>
+            addNoteToTimeline(getTimeline().notes, timelineId).should((response) =>
               expect(response.status).to.equal(200)
             )
           )
           .then(() => openTimelineById(timelineId))
           .then(() => pinFirstEvent())
           .then(() => persistNoteToFirstEvent('event note'))
-          .then(() => addFilter(timeline.filter));
+          .then(() => addFilter(getTimeline().filter));
       });
   });
 
@@ -63,7 +63,7 @@ describe('Timeline query tab', () => {
     });
 
     it('should contain the right query', () => {
-      cy.get(TIMELINE_QUERY).should('have.text', `${timeline.query}`);
+      cy.get(TIMELINE_QUERY).should('have.text', `${getTimeline().query}`);
     });
 
     it('should be able to add event note', () => {
@@ -71,7 +71,7 @@ describe('Timeline query tab', () => {
     });
 
     it('should display timeline filter', () => {
-      cy.get(TIMELINE_FILTER(timeline.filter)).should('exist');
+      cy.get(TIMELINE_FILTER(getTimeline().filter)).should('exist');
     });
 
     it('should display pinned events', () => {
diff --git a/x-pack/plugins/security_solution/cypress/integration/urls/state.spec.ts b/x-pack/plugins/security_solution/cypress/integration/urls/state.spec.ts
index 842dd85b42ef8..a72657d78b70d 100644
--- a/x-pack/plugins/security_solution/cypress/integration/urls/state.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/urls/state.spec.ts
@@ -37,7 +37,7 @@ import { addNameToTimeline, closeTimeline, populateTimeline } from '../../tasks/
 import { HOSTS_URL } from '../../urls/navigation';
 import { ABSOLUTE_DATE_RANGE } from '../../urls/state';
 
-import { timeline } from '../../objects/timeline';
+import { getTimeline } from '../../objects/timeline';
 import { TIMELINE } from '../../screens/create_new_case';
 import { cleanKibana } from '../../tasks/common';
 
@@ -244,7 +244,7 @@ describe('url state', () => {
 
     cy.intercept('PATCH', '/api/timeline').as('timeline');
 
-    addNameToTimeline(timeline.title);
+    addNameToTimeline(getTimeline().title);
 
     cy.wait('@timeline').then(({ response }) => {
       closeTimeline();
@@ -256,7 +256,7 @@ describe('url state', () => {
       cy.get(DATE_PICKER_APPLY_BUTTON_TIMELINE).should('not.have.text', 'Updating');
       cy.get(TIMELINE).should('be.visible');
       cy.get(TIMELINE_TITLE).should('be.visible');
-      cy.get(TIMELINE_TITLE).should('have.text', timeline.title);
+      cy.get(TIMELINE_TITLE).should('have.text', getTimeline().title);
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/cypress/objects/case.ts b/x-pack/plugins/security_solution/cypress/objects/case.ts
index 847236688dee7..8bc90c5fa2a3b 100644
--- a/x-pack/plugins/security_solution/cypress/objects/case.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/case.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { CompleteTimeline, timeline } from './timeline';
+import { CompleteTimeline, getTimeline } from './timeline';
 
 export interface TestCase extends TestCaseWithoutTimeline {
   timeline: CompleteTimeline;
@@ -43,49 +43,50 @@ export interface IbmResilientConnectorOptions {
   incidentTypes: string[];
 }
 
-export const case1: TestCase = {
+export const getCase1 = (): TestCase => ({
   name: 'This is the title of the case',
   tags: ['Tag1', 'Tag2'],
   description: 'This is the case description',
-  timeline,
+  timeline: getTimeline(),
   reporter: 'elastic',
   owner: 'securitySolution',
-};
+});
 
-export const serviceNowConnector: Connector = {
+export const getServiceNowConnector = (): Connector => ({
   connectorName: 'New connector',
   URL: 'https://www.test.service-now.com',
   username: 'Username Name',
   password: 'password',
-};
+});
 
-export const jiraConnectorOptions: JiraConnectorOptions = {
+export const getJiraConnectorOptions = (): JiraConnectorOptions => ({
   issueType: '10006',
   priority: 'High',
-};
+});
 
-export const serviceNowConnectorOpions: ServiceNowconnectorOptions = {
+export const getServiceNowConnectorOptions = (): ServiceNowconnectorOptions => ({
   urgency: '2',
   severity: '1',
   impact: '3',
-};
+});
 
-export const ibmResilientConnectorOptions: IbmResilientConnectorOptions = {
+export const getIbmResilientConnectorOptions = (): IbmResilientConnectorOptions => ({
   title: 'Resilient',
   severity: 'Medium',
   incidentTypes: ['Communication error (fax; email)', 'Denial of Service'],
-};
+});
 
 export const TIMELINE_CASE_ID = '68248e00-f689-11ea-9ab2-59238b522856';
-export const connectorIds = {
+
+export const getConnectorIds = () => ({
   jira: '000e5f86-08b0-4882-adfd-6df981d45c1b',
   sn: '93a69ba3-3c31-4b4c-bf86-cc79a090f437',
   resilient: 'a6a8dd7f-7e88-48fe-9b9f-70b668da8cbc',
-};
+});
 
-export const mockConnectorsResponse = [
+export const getMockConnectorsResponse = () => [
   {
-    id: connectorIds.jira,
+    id: getConnectorIds().jira,
     actionTypeId: '.jira',
     name: 'Jira',
     config: {
@@ -96,7 +97,7 @@ export const mockConnectorsResponse = [
     referencedByCount: 0,
   },
   {
-    id: connectorIds.resilient,
+    id: getConnectorIds().resilient,
     actionTypeId: '.resilient',
     name: 'Resilient',
     config: {
@@ -107,7 +108,7 @@ export const mockConnectorsResponse = [
     referencedByCount: 0,
   },
   {
-    id: connectorIds.sn,
+    id: getConnectorIds().sn,
     actionTypeId: '.servicenow',
     name: 'ServiceNow',
     config: {
@@ -117,7 +118,8 @@ export const mockConnectorsResponse = [
     referencedByCount: 0,
   },
 ];
-export const executeResponses = {
+
+export const getExecuteResponses = () => ({
   servicenow: {
     choices: {
       status: 'ok',
@@ -208,7 +210,7 @@ export const executeResponses = {
         { id: '10006', name: 'Task' },
         { id: '10007', name: 'Sub-task' },
       ],
-      actionId: connectorIds.jira,
+      actionId: getConnectorIds().jira,
     },
     fieldsByIssueType: {
       status: 'ok',
@@ -299,7 +301,7 @@ export const executeResponses = {
         timetracking: { allowedValues: [], defaultValue: {} },
         labels: { allowedValues: [], defaultValue: {} },
       },
-      actionId: connectorIds.jira,
+      actionId: getConnectorIds().jira,
     },
   },
   resilient: {
@@ -309,7 +311,7 @@ export const executeResponses = {
         { id: 17, name: 'Communication error (fax; email)' },
         { id: 21, name: 'Denial of Service' },
       ],
-      actionId: connectorIds.resilient,
+      actionId: getConnectorIds().resilient,
     },
     severity: {
       status: 'ok',
@@ -318,7 +320,7 @@ export const executeResponses = {
         { id: 5, name: 'Medium' },
         { id: 6, name: 'High' },
       ],
-      actionId: connectorIds.resilient,
+      actionId: getConnectorIds().resilient,
     },
   },
-};
+});
diff --git a/x-pack/plugins/security_solution/cypress/objects/connector.ts b/x-pack/plugins/security_solution/cypress/objects/connector.ts
index 2a0f1cc43eff0..a5244583bf494 100644
--- a/x-pack/plugins/security_solution/cypress/objects/connector.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/connector.ts
@@ -14,11 +14,11 @@ export interface EmailConnector {
   password: string;
 }
 
-export const emailConnector: EmailConnector = {
+export const getEmailConnector = (): EmailConnector => ({
   name: 'Test connector',
   from: 'test@example.com',
   host: 'example.com',
   port: '80',
   user: 'username',
   password: 'password',
-};
+});
diff --git a/x-pack/plugins/security_solution/cypress/objects/exception.ts b/x-pack/plugins/security_solution/cypress/objects/exception.ts
index 73457f10ccec6..6a934e1ec4651 100644
--- a/x-pack/plugins/security_solution/cypress/objects/exception.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/exception.ts
@@ -20,22 +20,22 @@ export interface ExceptionList {
   type: 'detection' | 'endpoint';
 }
 
-export const exceptionList: ExceptionList = {
+export const getExceptionList = (): ExceptionList => ({
   description: 'Test exception list description',
   list_id: 'test_exception_list',
   name: 'Test exception list',
   namespace_type: 'single',
   tags: ['test tag'],
   type: 'detection',
-};
+});
 
-export const exception: Exception = {
+export const getException = (): Exception => ({
   field: 'host.name',
   operator: 'is',
   values: ['suricata-iowa'],
-};
+});
 
-export const expectedExportedExceptionList = (exceptionListResponse: Cypress.Response) => {
+export const expectedExportedExceptionList = (exceptionListResponse: Cypress.Response): string => {
   const jsonrule = exceptionListResponse.body;
 
   return `{"_version":"${jsonrule._version}","created_at":"${jsonrule.created_at}","created_by":"elastic","description":"${jsonrule.description}","id":"${jsonrule.id}","immutable":false,"list_id":"test_exception_list","name":"Test exception list","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"${jsonrule.tie_breaker_id}","type":"detection","updated_at":"${jsonrule.updated_at}","updated_by":"elastic","version":1}\n"\n""\n{"exception_list_items_details":"{"exported_count":0}\n"}`;
diff --git a/x-pack/plugins/security_solution/cypress/objects/filter.ts b/x-pack/plugins/security_solution/cypress/objects/filter.ts
index b00954de17422..5a69100a4b38a 100644
--- a/x-pack/plugins/security_solution/cypress/objects/filter.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/filter.ts
@@ -10,7 +10,7 @@ export interface SearchBarFilter {
   value: string;
 }
 
-export const hostIpFilter: SearchBarFilter = {
+export const getHostIpFilter = (): SearchBarFilter => ({
   key: 'host.ip',
   value: '1.1.1.1',
-};
+});
diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts
index 3383ef4996ead..7589c8fab3dae 100644
--- a/x-pack/plugins/security_solution/cypress/objects/rule.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts
@@ -7,8 +7,8 @@
 
 /* eslint-disable @kbn/eslint/no-restricted-paths */
 import { rawRules } from '../../server/lib/detection_engine/rules/prepackaged_rules/index';
-import { mockThreatData } from '../../public/detections/mitre/mitre_tactics_techniques';
-import { timeline, CompleteTimeline, indicatorMatchTimelineTemplate } from './timeline';
+import { getMockThreatData } from '../../public/detections/mitre/mitre_tactics_techniques';
+import { getTimeline, CompleteTimeline, getIndicatorMatchTimelineTemplate } from './timeline';
 
 export const totalNumberOfPrebuiltRules = rawRules.length;
 
@@ -96,8 +96,9 @@ export interface MachineLearningRule {
   lookBack: Interval;
 }
 
-export const indexPatterns = [
+export const getIndexPatterns = (): string[] => [
   'apm-*-transaction*',
+  'traces-apm*',
   'auditbeat-*',
   'endgame-*',
   'filebeat-*',
@@ -106,67 +107,69 @@ export const indexPatterns = [
   'winlogbeat-*',
 ];
 
-const { tactic, technique, subtechnique } = mockThreatData;
-
-const mitre1: Mitre = {
-  tactic: `${tactic.name} (${tactic.id})`,
+const getMitre1 = (): Mitre => ({
+  tactic: `${getMockThreatData().tactic.name} (${getMockThreatData().tactic.id})`,
   techniques: [
     {
-      name: `${technique.name} (${technique.id})`,
-      subtechniques: [`${subtechnique.name} (${subtechnique.id})`],
+      name: `${getMockThreatData().technique.name} (${getMockThreatData().technique.id})`,
+      subtechniques: [
+        `${getMockThreatData().subtechnique.name} (${getMockThreatData().subtechnique.id})`,
+      ],
     },
     {
-      name: `${technique.name} (${technique.id})`,
+      name: `${getMockThreatData().technique.name} (${getMockThreatData().technique.id})`,
       subtechniques: [],
     },
   ],
-};
+});
 
-const mitre2: Mitre = {
-  tactic: `${tactic.name} (${tactic.id})`,
+const getMitre2 = (): Mitre => ({
+  tactic: `${getMockThreatData().tactic.name} (${getMockThreatData().tactic.id})`,
   techniques: [
     {
-      name: `${technique.name} (${technique.id})`,
-      subtechniques: [`${subtechnique.name} (${subtechnique.id})`],
+      name: `${getMockThreatData().technique.name} (${getMockThreatData().technique.id})`,
+      subtechniques: [
+        `${getMockThreatData().subtechnique.name} (${getMockThreatData().subtechnique.id})`,
+      ],
     },
   ],
-};
+});
 
-const severityOverride1: SeverityOverride = {
+const getSeverityOverride1 = (): SeverityOverride => ({
   sourceField: 'host.name',
   sourceValue: 'host',
-};
+});
 
-const severityOverride2: SeverityOverride = {
+const getSeverityOverride2 = (): SeverityOverride => ({
   sourceField: '@timestamp',
   sourceValue: '10/02/2020',
-};
+});
 
-const severityOverride3: SeverityOverride = {
+const getSeverityOverride3 = (): SeverityOverride => ({
   sourceField: 'host.geo.name',
   sourceValue: 'atack',
-};
+});
 
-const severityOverride4: SeverityOverride = {
+const getSeverityOverride4 = (): SeverityOverride => ({
   sourceField: 'agent.type',
   sourceValue: 'auditbeat',
-};
+});
 
-const runsEvery: Interval = {
+const getRunsEvery = (): Interval => ({
   interval: '1',
   timeType: 'Seconds',
   type: 's',
-};
+});
 
-const lookBack: Interval = {
+const getLookBack = (): Interval => ({
   interval: '17520',
   timeType: 'Hours',
   type: 'h',
-};
+});
 
-export const newRule: CustomRule = {
+export const getNewRule = (): CustomRule => ({
   customQuery: 'host.name: *',
-  index: indexPatterns,
+  index: getIndexPatterns(),
   name: 'New Rule Test',
   description: 'The new rule description.',
   severity: 'High',
@@ -174,15 +177,15 @@ export const newRule: CustomRule = {
   tags: ['test', 'newRule'],
   referenceUrls: ['http://example.com/', 'https://example.com/'],
   falsePositivesExamples: ['False1', 'False2'],
-  mitre: [mitre1, mitre2],
+  mitre: [getMitre1(), getMitre2()],
   note: '# test markdown',
-  runsEvery,
-  lookBack,
-  timeline,
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+  timeline: getTimeline(),
   maxSignals: 100,
-};
+});
 
-export const unmappedRule: CustomRule = {
+export const getUnmappedRule = (): CustomRule => ({
   customQuery: '*:*',
   index: ['unmapped*'],
   name: 'Rule with unmapped fields',
@@ -192,15 +195,15 @@ export const unmappedRule: CustomRule = {
   tags: ['test', 'newRule'],
   referenceUrls: ['http://example.com/', 'https://example.com/'],
   falsePositivesExamples: ['False1', 'False2'],
-  mitre: [mitre1, mitre2],
+  mitre: [getMitre1(), getMitre2()],
   note: '# test markdown',
-  runsEvery,
-  lookBack,
-  timeline,
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+  timeline: getTimeline(),
   maxSignals: 100,
-};
+});
 
-export const unmappedCCSRule: CustomRule = {
+export const getUnmappedCCSRule = (): CustomRule => ({
   customQuery: '*:*',
   index: [`${ccsRemoteName}:unmapped*`],
   name: 'Rule with unmapped fields',
@@ -210,15 +213,15 @@ export const unmappedCCSRule: CustomRule = {
   tags: ['test', 'newRule'],
   referenceUrls: ['http://example.com/', 'https://example.com/'],
   falsePositivesExamples: ['False1', 'False2'],
-  mitre: [mitre1, mitre2],
+  mitre: [getMitre1(), getMitre2()],
   note: '# test markdown',
-  runsEvery,
-  lookBack,
-  timeline,
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+  timeline: getTimeline(),
   maxSignals: 100,
-};
+});
 
-export const existingRule: CustomRule = {
+export const getExistingRule = (): CustomRule => ({
   customQuery: 'host.name: *',
   name: 'Rule 1',
   description: 'Description for Rule 1',
@@ -231,17 +234,17 @@ export const existingRule: CustomRule = {
   falsePositivesExamples: [],
   mitre: [],
   note: 'This is my note',
-  runsEvery,
-  lookBack,
-  timeline,
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+  timeline: getTimeline(),
   // Please do not change, or if you do, needs
   // to be any number other than default value
   maxSignals: 500,
-};
+});
 
-export const newOverrideRule: OverrideRule = {
+export const getNewOverrideRule = (): OverrideRule => ({
   customQuery: 'host.name: *',
-  index: indexPatterns,
+  index: getIndexPatterns(),
   name: 'Override Rule',
   description: 'The new rule description.',
   severity: 'High',
@@ -249,21 +252,26 @@ export const newOverrideRule: OverrideRule = {
   tags: ['test', 'newRule'],
   referenceUrls: ['http://example.com/', 'https://example.com/'],
   falsePositivesExamples: ['False1', 'False2'],
-  mitre: [mitre1, mitre2],
+  mitre: [getMitre1(), getMitre2()],
   note: '# test markdown',
-  severityOverride: [severityOverride1, severityOverride2, severityOverride3, severityOverride4],
+  severityOverride: [
+    getSeverityOverride1(),
+    getSeverityOverride2(),
+    getSeverityOverride3(),
+    getSeverityOverride4(),
+  ],
   riskOverride: 'destination.port',
   nameOverride: 'agent.type',
   timestampOverride: '@timestamp',
-  runsEvery,
-  lookBack,
-  timeline,
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+  timeline: getTimeline(),
   maxSignals: 100,
-};
+});
 
-export const newThresholdRule: ThresholdRule = {
+export const getNewThresholdRule = (): ThresholdRule => ({
   customQuery: 'host.name: *',
-  index: indexPatterns,
+  index: getIndexPatterns(),
   name: 'Threshold Rule',
   description: 'The new rule description.',
   severity: 'High',
@@ -271,17 +279,17 @@ export const newThresholdRule: ThresholdRule = {
   tags: ['test', 'newRule'],
   referenceUrls: ['http://example.com/', 'https://example.com/'],
   falsePositivesExamples: ['False1', 'False2'],
-  mitre: [mitre1, mitre2],
+  mitre: [getMitre1(), getMitre2()],
   note: '# test markdown',
   thresholdField: 'host.name',
   threshold: '10',
-  runsEvery,
-  lookBack,
-  timeline,
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+  timeline: getTimeline(),
   maxSignals: 100,
-};
+});
 
-export const machineLearningRule: MachineLearningRule = {
+export const getMachineLearningRule = (): MachineLearningRule => ({
   machineLearningJobs: ['linux_anomalous_network_service', 'linux_anomalous_network_activity_ecs'],
   anomalyScoreThreshold: '20',
   name: 'New ML Rule Test',
@@ -291,52 +299,52 @@ export const machineLearningRule: MachineLearningRule = {
   tags: ['ML'],
   referenceUrls: ['https://elastic.co/'],
   falsePositivesExamples: ['False1'],
-  mitre: [mitre1],
+  mitre: [getMitre1()],
   note: '# test markdown',
-  runsEvery,
-  lookBack,
-};
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+});
 
-export const eqlRule: CustomRule = {
+export const getEqlRule = (): CustomRule => ({
   customQuery: 'any where process.name == "which"',
   name: 'New EQL Rule',
-  index: indexPatterns,
+  index: getIndexPatterns(),
   description: 'New EQL rule description.',
   severity: 'High',
   riskScore: '17',
   tags: ['test', 'newRule'],
   referenceUrls: ['http://example.com/', 'https://example.com/'],
   falsePositivesExamples: ['False1', 'False2'],
-  mitre: [mitre1, mitre2],
+  mitre: [getMitre1(), getMitre2()],
   note: '# test markdown',
-  runsEvery,
-  lookBack,
-  timeline,
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+  timeline: getTimeline(),
   maxSignals: 100,
-};
+});
 
-export const eqlSequenceRule: CustomRule = {
+export const getEqlSequenceRule = (): CustomRule => ({
   customQuery:
     'sequence with maxspan=30s\
      [any where process.name == "which"]\
      [any where process.name == "xargs"]',
   name: 'New EQL Sequence Rule',
-  index: indexPatterns,
+  index: getIndexPatterns(),
   description: 'New EQL rule description.',
   severity: 'High',
   riskScore: '17',
   tags: ['test', 'newRule'],
   referenceUrls: ['http://example.com/', 'https://example.com/'],
   falsePositivesExamples: ['False1', 'False2'],
-  mitre: [mitre1, mitre2],
+  mitre: [getMitre1(), getMitre2()],
   note: '# test markdown',
-  runsEvery,
-  lookBack,
-  timeline,
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+  timeline: getTimeline(),
   maxSignals: 100,
-};
+});
 
-export const newThreatIndicatorRule: ThreatIndicatorRule = {
+export const getNewThreatIndicatorRule = (): ThreatIndicatorRule => ({
   name: 'Threat Indicator Rule Test',
   description: 'The threat indicator rule description.',
   index: ['suspicious-*'],
@@ -345,31 +353,31 @@ export const newThreatIndicatorRule: ThreatIndicatorRule = {
   tags: ['test', 'threat'],
   referenceUrls: ['http://example.com/', 'https://example.com/'],
   falsePositivesExamples: ['False1', 'False2'],
-  mitre: [mitre1, mitre2],
+  mitre: [getMitre1(), getMitre2()],
   note: '# test markdown',
-  runsEvery,
-  lookBack,
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
   indicatorIndexPattern: ['filebeat-*'],
   indicatorMappingField: 'myhash.mysha256',
   indicatorIndexField: 'threatintel.indicator.file.hash.sha256',
   type: 'file',
   atomic: 'a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3',
-  timeline: indicatorMatchTimelineTemplate,
+  timeline: getIndicatorMatchTimelineTemplate(),
   maxSignals: 100,
-};
+});
 
-export const duplicatedRuleName = `${newThreatIndicatorRule.name} [Duplicate]`;
+export const duplicatedRuleName = `${getNewThreatIndicatorRule().name} [Duplicate]`;
 
-export const severitiesOverride = ['Low', 'Medium', 'High', 'Critical'];
+export const getSeveritiesOverride = (): string[] => ['Low', 'Medium', 'High', 'Critical'];
 
-export const editedRule = {
-  ...existingRule,
+export const getEditedRule = (): CustomRule => ({
+  ...getExistingRule(),
   severity: 'Medium',
   description: 'Edited Rule description',
-  tags: [...existingRule.tags, 'edited'],
-};
+  tags: [...getExistingRule().tags, 'edited'],
+});
 
-export const expectedExportedRule = (ruleResponse: Cypress.Response) => {
+export const expectedExportedRule = (ruleResponse: Cypress.Response): string => {
   const jsonrule = ruleResponse.body;
 
   return `{"id":"${jsonrule.id}","updated_at":"${jsonrule.updated_at}","updated_by":"elastic","created_at":"${jsonrule.created_at}","created_by":"elastic","name":"${jsonrule.name}","tags":[],"interval":"100m","enabled":false,"description":"${jsonrule.description}","risk_score":${jsonrule.risk_score},"severity":"${jsonrule.severity}","output_index":".siem-signals-default","author":[],"false_positives":[],"from":"now-17520h","rule_id":"rule_testing","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"type":"query","language":"kuery","index":["exceptions-*"],"query":"${jsonrule.query}","throttle":"no_actions","actions":[]}\n{"exported_count":1,"missing_rules":[],"missing_rules_count":0}\n`;
diff --git a/x-pack/plugins/security_solution/cypress/objects/timeline.ts b/x-pack/plugins/security_solution/cypress/objects/timeline.ts
index 1b66b50605508..c13c1b01ef0ed 100644
--- a/x-pack/plugins/security_solution/cypress/objects/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/timeline.ts
@@ -24,51 +24,51 @@ export interface TimelineFilter {
   value?: string;
 }
 
-export const filter: TimelineFilter = {
+export const getFilter = (): TimelineFilter => ({
   field: 'host.name',
   operator: 'exists',
   value: 'exists',
-};
+});
 
-export const timeline: CompleteTimeline = {
+export const getTimeline = (): CompleteTimeline => ({
   title: 'Security Timeline',
   description: 'This is the best timeline',
   query: 'host.name: *',
   notes: 'Yes, the best timeline',
-  filter,
-};
+  filter: getFilter(),
+});
 
-export const indicatorMatchTimelineTemplate: CompleteTimeline = {
-  ...timeline,
+export const getIndicatorMatchTimelineTemplate = (): CompleteTimeline => ({
+  ...getTimeline(),
   title: 'Generic Threat Match Timeline',
   templateTimelineId: '495ad7a7-316e-4544-8a0f-9c098daee76e',
-};
+});
 
 /**
  * Timeline query that finds no valid data to cut down on test failures
  * or other issues for when we want to test one specific thing and not also
  * test the queries happening
  */
-export const timelineNonValidQuery: CompleteTimeline = {
-  ...timeline,
+export const getTimelineNonValidQuery = (): CompleteTimeline => ({
+  ...getTimeline(),
   query: 'query_to_intentionally_find_nothing: *',
-};
+});
 
-export const caseTimeline: Timeline = {
+export const caseTimeline = (): Timeline => ({
   title: 'SIEM test',
   description: 'description',
   query: 'host.name: *',
   id: '0162c130-78be-11ea-9718-118a926974a4',
-};
+});
 
-export const expectedExportedTimelineTemplate = (templateResponse: Cypress.Response) => {
+export const expectedExportedTimelineTemplate = (templateResponse: Cypress.Response): string => {
   const timelineTemplateBody = templateResponse.body.data.persistTimeline.timeline;
 
   return `{"savedObjectId":"${timelineTemplateBody.savedObjectId}","version":"${timelineTemplateBody.version}","columns":[{"id":"@timestamp"},{"id":"user.name"},{"id":"event.category"},{"id":"event.action"},{"id":"host.name"}],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"expression":"${timelineTemplateBody.kqlQuery.filterQuery.kuery.expression}","kind":"kuery"}}},"dateRange":{"start":"${timelineTemplateBody.dateRange.start}","end":"${timelineTemplateBody.dateRange.end}"},"description":"${timelineTemplateBody.description}","title":"${timelineTemplateBody.title}","templateTimelineVersion":1,"timelineType":"template","created":${timelineTemplateBody.created},"createdBy":"elastic","updated":${timelineTemplateBody.updated},"updatedBy":"elastic","sort":[],"eventNotes":[],"globalNotes":[],"pinnedEventIds":[]}
 `;
 };
 
-export const expectedExportedTimeline = (timelineResponse: Cypress.Response) => {
+export const expectedExportedTimeline = (timelineResponse: Cypress.Response): string => {
   const timelineBody = timelineResponse.body.data.persistTimeline.timeline;
 
   return `{"savedObjectId":"${timelineBody.savedObjectId}","version":"${timelineBody.version}","columns":[{"id":"@timestamp"},{"id":"user.name"},{"id":"event.category"},{"id":"event.action"},{"id":"host.name"}],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"expression":"${timelineBody.kqlQuery.filterQuery.kuery.expression}","kind":"kuery"}}},"dateRange":{"start":"${timelineBody.dateRange.start}","end":"${timelineBody.dateRange.end}"},"description":"${timelineBody.description}","title":"${timelineBody.title}","created":${timelineBody.created},"createdBy":"elastic","updated":${timelineBody.updated},"updatedBy":"elastic","timelineType":"default","sort":[],"eventNotes":[],"globalNotes":[],"pinnedEventIds":[]}\n`;
diff --git a/x-pack/plugins/security_solution/cypress/screens/edit_connector.ts b/x-pack/plugins/security_solution/cypress/screens/edit_connector.ts
index 5b353983e5a92..598485b167c9f 100644
--- a/x-pack/plugins/security_solution/cypress/screens/edit_connector.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/edit_connector.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { connectorIds } from '../objects/case';
+import { getConnectorIds } from '../objects/case';
 
 export const CONNECTOR_RESILIENT = `[data-test-subj="connector-fields-resilient"]`;
 
@@ -17,14 +17,16 @@ export const SELECT_INCIDENT_TYPE = `[data-test-subj="incidentTypeComboBox"] inp
 
 export const SELECT_ISSUE_TYPE = `[data-test-subj="issueTypeSelect"]`;
 
-export const SELECT_JIRA = `[data-test-subj="dropdown-connector-${connectorIds.jira}"]`;
+export const SELECT_JIRA = `[data-test-subj="dropdown-connector-${getConnectorIds().jira}"]`;
 
 export const SELECT_PRIORITY = `[data-test-subj="prioritySelect"]`;
 
-export const SELECT_RESILIENT = `[data-test-subj="dropdown-connector-${connectorIds.resilient}"]`;
+export const SELECT_RESILIENT = `[data-test-subj="dropdown-connector-${
+  getConnectorIds().resilient
+}"]`;
 
 export const SELECT_SEVERITY = `[data-test-subj="severitySelect"]`;
 
-export const SELECT_SN = `[data-test-subj="dropdown-connector-${connectorIds.sn}"]`;
+export const SELECT_SN = `[data-test-subj="dropdown-connector-${getConnectorIds().sn}"]`;
 
 export const SELECT_URGENCY = `[data-test-subj="urgencySelect"]`;
diff --git a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
index 1b420cd6d1520..d8d91dc9ca624 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
-import { emailConnector, EmailConnector } from '../objects/connector';
+import { getEmailConnector, EmailConnector } from '../objects/connector';
 import {
   CustomRule,
   MachineLearningRule,
-  machineLearningRule,
+  getMachineLearningRule,
   OverrideRule,
   ThreatIndicatorRule,
   ThresholdRule,
@@ -397,7 +397,7 @@ export const fillIndexAndIndicatorIndexPattern = (
   getIndicatorIndicatorIndex().type(`${indicatorIndex}{enter}`);
 };
 
-export const fillEmailConnectorForm = (connector: EmailConnector = emailConnector) => {
+export const fillEmailConnectorForm = (connector: EmailConnector = getEmailConnector()) => {
   cy.get(CONNECTOR_NAME_INPUT).type(connector.name);
   cy.get(EMAIL_CONNECTOR_FROM_INPUT).type(connector.from);
   cy.get(EMAIL_CONNECTOR_HOST_INPUT).type(connector.host);
@@ -478,9 +478,12 @@ export const fillDefineMachineLearningRuleAndContinue = (rule: MachineLearningRu
     cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).type(`${machineLearningJob}{enter}`);
     cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).type('{esc}');
   });
-  cy.get(ANOMALY_THRESHOLD_INPUT).type(`{selectall}${machineLearningRule.anomalyScoreThreshold}`, {
-    force: true,
-  });
+  cy.get(ANOMALY_THRESHOLD_INPUT).type(
+    `{selectall}${getMachineLearningRule().anomalyScoreThreshold}`,
+    {
+      force: true,
+    }
+  );
   getDefineContinueButton().should('exist').click({ force: true });
 
   cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).should('not.exist');
diff --git a/x-pack/plugins/security_solution/public/cases/components/__mock__/form.ts b/x-pack/plugins/security_solution/public/cases/components/__mock__/form.ts
index 9ec356f70f9a4..3ba7aa616f1c1 100644
--- a/x-pack/plugins/security_solution/public/cases/components/__mock__/form.ts
+++ b/x-pack/plugins/security_solution/public/cases/components/__mock__/form.ts
@@ -25,6 +25,7 @@ export const mockFormHook = {
   setFieldErrors: jest.fn(),
   getFields: jest.fn(),
   getFormData: jest.fn(),
+  getFieldDefaultValue: jest.fn(),
   /* Returns a list of all errors in the form */
   getErrors: jest.fn(),
   reset: jest.fn(),
@@ -35,7 +36,6 @@ export const mockFormHook = {
   __validateFields: jest.fn(),
   __updateFormDataAt: jest.fn(),
   __readFieldConfigFromSchema: jest.fn(),
-  __getFieldDefaultValue: jest.fn(),
 };
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export const getFormMock = (sampleData: any) => ({
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field.tsx
index d4185fe639695..a175a9b847c71 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/field.tsx
@@ -25,6 +25,13 @@ interface OperatorProps {
   onChange: (a: IFieldType[]) => void;
 }
 
+/**
+ * There is a copy within:
+ * x-pack/plugins/lists/public/exceptions/components/autocomplete/field.tsx
+ *
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
+ * NOTE: This has deviated from the copy and will have to be reconciled.
+ */
 export const FieldComponent: React.FC<OperatorProps> = ({
   placeholder,
   selectedField,
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_exists.test.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_exists.test.tsx
deleted file mode 100644
index b6300581f12dd..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_exists.test.tsx
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { mount } from 'enzyme';
-
-import { AutocompleteFieldExistsComponent } from './field_value_exists';
-
-describe('AutocompleteFieldExistsComponent', () => {
-  test('it renders field disabled', () => {
-    const wrapper = mount(<AutocompleteFieldExistsComponent placeholder="Placeholder text" />);
-
-    expect(
-      wrapper
-        .find(`[data-test-subj="valuesAutocompleteComboBox existsComboxBox"] input`)
-        .prop('disabled')
-    ).toBeTruthy();
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_exists.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_exists.tsx
deleted file mode 100644
index 715ba52701177..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_exists.tsx
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { EuiFormRow, EuiComboBox } from '@elastic/eui';
-
-interface AutocompleteFieldExistsProps {
-  placeholder: string;
-  rowLabel?: string;
-}
-
-export const AutocompleteFieldExistsComponent: React.FC<AutocompleteFieldExistsProps> = ({
-  placeholder,
-  rowLabel,
-}): JSX.Element => (
-  <EuiFormRow label={rowLabel} fullWidth>
-    <EuiComboBox
-      placeholder={placeholder}
-      options={[]}
-      selectedOptions={[]}
-      onChange={undefined}
-      isDisabled
-      data-test-subj="valuesAutocompleteComboBox existsComboxBox"
-      fullWidth
-    />
-  </EuiFormRow>
-);
-
-AutocompleteFieldExistsComponent.displayName = 'AutocompleteFieldExists';
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.test.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.test.tsx
deleted file mode 100644
index 164b8e8d2a6d6..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.test.tsx
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { mount } from 'enzyme';
-import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
-import { waitFor } from '@testing-library/react';
-
-import { getField } from '../../../../../../../src/plugins/data/common/index_patterns/fields/fields.mocks';
-import type { ListSchema } from '@kbn/securitysolution-io-ts-list-types';
-import { getFoundListSchemaMock } from '../../../../../lists/common/schemas/response/found_list_schema.mock';
-import { getListResponseMock } from '../../../../../lists/common/schemas/response/list_schema.mock';
-import { DATE_NOW, VERSION, IMMUTABLE } from '../../../../../lists/common/constants.mock';
-
-import { AutocompleteFieldListsComponent } from './field_value_lists';
-
-jest.mock('../../../common/lib/kibana');
-const mockStart = jest.fn();
-const mockKeywordList: ListSchema = {
-  ...getListResponseMock(),
-  id: 'keyword_list',
-  type: 'keyword',
-  name: 'keyword list',
-};
-const mockResult = { ...getFoundListSchemaMock() };
-mockResult.data = [...mockResult.data, mockKeywordList];
-jest.mock('@kbn/securitysolution-list-hooks', () => {
-  const originalModule = jest.requireActual('@kbn/securitysolution-list-hooks');
-
-  return {
-    ...originalModule,
-    useFindLists: () => ({
-      loading: false,
-      start: mockStart.mockReturnValue(mockResult),
-      result: mockResult,
-      error: undefined,
-    }),
-  };
-});
-
-describe('AutocompleteFieldListsComponent', () => {
-  test('it renders disabled if "isDisabled" is true', async () => {
-    const wrapper = mount(
-      <AutocompleteFieldListsComponent
-        placeholder="Placeholder text"
-        selectedField={getField('ip')}
-        selectedValue="some-list-id"
-        isLoading={false}
-        isClearable={true}
-        isDisabled
-        onChange={jest.fn()}
-      />
-    );
-
-    expect(
-      wrapper
-        .find(`[data-test-subj="valuesAutocompleteComboBox listsComboxBox"] input`)
-        .prop('disabled')
-    ).toBeTruthy();
-  });
-
-  test('it renders loading if "isLoading" is true', async () => {
-    const wrapper = mount(
-      <AutocompleteFieldListsComponent
-        placeholder="Placeholder text"
-        selectedField={getField('@tags')}
-        selectedValue=""
-        isLoading
-        isClearable={false}
-        isDisabled={false}
-        onChange={jest.fn()}
-      />
-    );
-
-    wrapper
-      .find(`[data-test-subj="valuesAutocompleteComboBox listsComboxBox"] button`)
-      .at(0)
-      .simulate('click');
-    expect(
-      wrapper
-        .find(
-          `EuiComboBoxOptionsList[data-test-subj="valuesAutocompleteComboBox listsComboxBox-optionsList"]`
-        )
-        .prop('isLoading')
-    ).toBeTruthy();
-  });
-
-  test('it allows user to clear values if "isClearable" is true', async () => {
-    const wrapper = mount(
-      <AutocompleteFieldListsComponent
-        placeholder="Placeholder text"
-        selectedField={getField('ip')}
-        selectedValue=""
-        isLoading={false}
-        isClearable={false}
-        isDisabled={false}
-        onChange={jest.fn()}
-      />
-    );
-    expect(
-      wrapper
-        .find('EuiComboBox[data-test-subj="valuesAutocompleteComboBox listsComboxBox"]')
-        .prop('options')
-    ).toEqual([{ label: 'some name' }]);
-  });
-
-  test('it correctly displays lists that match the selected "keyword" field esType', () => {
-    const wrapper = mount(
-      <AutocompleteFieldListsComponent
-        placeholder="Placeholder text"
-        selectedField={getField('@tags')}
-        selectedValue=""
-        isLoading={false}
-        isClearable={false}
-        isDisabled={false}
-        onChange={jest.fn()}
-      />
-    );
-
-    wrapper.find('[data-test-subj="comboBoxToggleListButton"] button').simulate('click');
-
-    expect(
-      wrapper
-        .find('EuiComboBox[data-test-subj="valuesAutocompleteComboBox listsComboxBox"]')
-        .prop('options')
-    ).toEqual([{ label: 'keyword list' }]);
-  });
-
-  test('it correctly displays lists that match the selected "ip" field esType', () => {
-    const wrapper = mount(
-      <AutocompleteFieldListsComponent
-        placeholder="Placeholder text"
-        selectedField={getField('ip')}
-        selectedValue=""
-        isLoading={false}
-        isClearable={false}
-        isDisabled={false}
-        onChange={jest.fn()}
-      />
-    );
-
-    wrapper.find('[data-test-subj="comboBoxToggleListButton"] button').simulate('click');
-
-    expect(
-      wrapper
-        .find('EuiComboBox[data-test-subj="valuesAutocompleteComboBox listsComboxBox"]')
-        .prop('options')
-    ).toEqual([{ label: 'some name' }]);
-  });
-
-  test('it correctly displays selected list', async () => {
-    const wrapper = mount(
-      <AutocompleteFieldListsComponent
-        placeholder="Placeholder text"
-        selectedField={getField('ip')}
-        selectedValue="some-list-id"
-        isLoading={false}
-        isClearable={false}
-        isDisabled={false}
-        onChange={jest.fn()}
-      />
-    );
-
-    expect(
-      wrapper
-        .find(`[data-test-subj="valuesAutocompleteComboBox listsComboxBox"] EuiComboBoxPill`)
-        .at(0)
-        .text()
-    ).toEqual('some name');
-  });
-
-  test('it invokes "onChange" when option selected', async () => {
-    const mockOnChange = jest.fn();
-    const wrapper = mount(
-      <AutocompleteFieldListsComponent
-        placeholder="Placeholder text"
-        selectedField={getField('ip')}
-        selectedValue=""
-        isLoading={false}
-        isClearable={false}
-        isDisabled={false}
-        onChange={mockOnChange}
-      />
-    );
-
-    ((wrapper.find(EuiComboBox).props() as unknown) as {
-      onChange: (a: EuiComboBoxOptionOption[]) => void;
-    }).onChange([{ label: 'some name' }]);
-
-    await waitFor(() => {
-      expect(mockOnChange).toHaveBeenCalledWith({
-        created_at: DATE_NOW,
-        created_by: 'some user',
-        description: 'some description',
-        id: 'some-list-id',
-        meta: {},
-        name: 'some name',
-        tie_breaker_id: '6a76b69d-80df-4ab2-8c3e-85f466b06a0e',
-        type: 'ip',
-        updated_at: DATE_NOW,
-        updated_by: 'some user',
-        _version: undefined,
-        version: VERSION,
-        deserializer: undefined,
-        serializer: undefined,
-        immutable: IMMUTABLE,
-      });
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.tsx
deleted file mode 100644
index e8a3c2e70c75b..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.tsx
+++ /dev/null
@@ -1,121 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useState, useEffect, useCallback, useMemo } from 'react';
-import { EuiFormRow, EuiComboBoxOptionOption, EuiComboBox } from '@elastic/eui';
-
-import type { ListSchema } from '@kbn/securitysolution-io-ts-list-types';
-import { useFindLists } from '@kbn/securitysolution-list-hooks';
-import { IFieldType } from '../../../../../../../src/plugins/data/common';
-import { useKibana } from '../../../common/lib/kibana';
-import { filterFieldToList, getGenericComboBoxProps } from './helpers';
-import * as i18n from './translations';
-
-interface AutocompleteFieldListsProps {
-  placeholder: string;
-  selectedField: IFieldType | undefined;
-  selectedValue: string | undefined;
-  isLoading: boolean;
-  isDisabled: boolean;
-  isClearable: boolean;
-  isRequired?: boolean;
-  rowLabel?: string;
-  onChange: (arg: ListSchema) => void;
-}
-
-export const AutocompleteFieldListsComponent: React.FC<AutocompleteFieldListsProps> = ({
-  placeholder,
-  rowLabel,
-  selectedField,
-  selectedValue,
-  isLoading = false,
-  isDisabled = false,
-  isClearable = false,
-  isRequired = false,
-  onChange,
-}): JSX.Element => {
-  const [error, setError] = useState<string | undefined>(undefined);
-  const { http } = useKibana().services;
-  const [lists, setLists] = useState<ListSchema[]>([]);
-  const { loading, result, start } = useFindLists();
-  const getLabel = useCallback(({ name }) => name, []);
-
-  const optionsMemo = useMemo(() => filterFieldToList(lists, selectedField), [
-    lists,
-    selectedField,
-  ]);
-  const selectedOptionsMemo = useMemo(() => {
-    if (selectedValue != null) {
-      const list = lists.filter(({ id }) => id === selectedValue);
-      return list ?? [];
-    } else {
-      return [];
-    }
-  }, [selectedValue, lists]);
-  const { comboOptions, labels, selectedComboOptions } = useMemo(
-    () =>
-      getGenericComboBoxProps<ListSchema>({
-        options: optionsMemo,
-        selectedOptions: selectedOptionsMemo,
-        getLabel,
-      }),
-    [optionsMemo, selectedOptionsMemo, getLabel]
-  );
-
-  const handleValuesChange = useCallback(
-    (newOptions: EuiComboBoxOptionOption[]) => {
-      const [newValue] = newOptions.map(({ label }) => optionsMemo[labels.indexOf(label)]);
-      onChange(newValue ?? '');
-    },
-    [labels, optionsMemo, onChange]
-  );
-
-  const setIsTouchedValue = useCallback((): void => {
-    setError(selectedValue == null ? i18n.FIELD_REQUIRED_ERR : undefined);
-  }, [selectedValue]);
-
-  useEffect(() => {
-    if (result != null) {
-      setLists(result.data);
-    }
-  }, [result]);
-
-  useEffect(() => {
-    if (selectedField != null) {
-      start({
-        http,
-        pageIndex: 1,
-        pageSize: 500,
-      });
-    }
-  }, [selectedField, start, http]);
-
-  const isLoadingState = useMemo((): boolean => isLoading || loading, [isLoading, loading]);
-
-  return (
-    <EuiFormRow label={rowLabel} error={error} isInvalid={error != null} fullWidth>
-      <EuiComboBox
-        placeholder={placeholder}
-        isDisabled={isDisabled}
-        isLoading={isLoadingState}
-        isClearable={isClearable}
-        options={comboOptions}
-        selectedOptions={selectedComboOptions}
-        onChange={handleValuesChange}
-        isInvalid={error != null}
-        onBlur={setIsTouchedValue}
-        singleSelection={{ asPlainText: true }}
-        sortMatchesBy="startsWith"
-        data-test-subj="valuesAutocompleteComboBox listsComboxBox"
-        fullWidth
-        async
-      />
-    </EuiFormRow>
-  );
-};
-
-AutocompleteFieldListsComponent.displayName = 'AutocompleteFieldList';
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx
index 9cb219e7a8d45..21d1d9b4b31aa 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx
@@ -38,6 +38,11 @@ interface AutocompleteFieldMatchProps {
   onError?: (arg: boolean) => void;
 }
 
+/**
+ * There is a copy of this within:
+ * x-pack/plugins/lists/public/exceptions/components/autocomplete/field_value_match.tsx
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
+ */
 export const AutocompleteFieldMatchComponent: React.FC<AutocompleteFieldMatchProps> = ({
   placeholder,
   rowLabel,
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.test.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.test.tsx
deleted file mode 100644
index 6b479c5ab8c4c..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.test.tsx
+++ /dev/null
@@ -1,238 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { mount, ReactWrapper } from 'enzyme';
-import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
-import { act } from '@testing-library/react';
-
-import {
-  fields,
-  getField,
-} from '../../../../../../../src/plugins/data/common/index_patterns/fields/fields.mocks';
-import { AutocompleteFieldMatchAnyComponent } from './field_value_match_any';
-import { useFieldValueAutocomplete } from './hooks/use_field_value_autocomplete';
-
-jest.mock('./hooks/use_field_value_autocomplete');
-
-describe('AutocompleteFieldMatchAnyComponent', () => {
-  let wrapper: ReactWrapper;
-  const getValueSuggestionsMock = jest
-    .fn()
-    .mockResolvedValue([false, true, ['value 3', 'value 4'], jest.fn()]);
-
-  beforeEach(() => {
-    (useFieldValueAutocomplete as jest.Mock).mockReturnValue([
-      false,
-      true,
-      ['value 1', 'value 2'],
-      getValueSuggestionsMock,
-    ]);
-  });
-
-  afterEach(() => {
-    jest.clearAllMocks();
-    wrapper.unmount();
-  });
-
-  test('it renders disabled if "isDisabled" is true', () => {
-    wrapper = mount(
-      <AutocompleteFieldMatchAnyComponent
-        rowLabel={'Row Label'}
-        placeholder="Placeholder text"
-        selectedField={getField('ip')}
-        selectedValue={['126.45.211.34']}
-        indexPattern={{
-          id: '1234',
-          title: 'logstash-*',
-          fields,
-        }}
-        isLoading={false}
-        isClearable={false}
-        isDisabled={true}
-        onChange={jest.fn()}
-        onError={jest.fn()}
-      />
-    );
-
-    expect(
-      wrapper.find(`[data-test-subj="valuesAutocompleteMatchAny"] input`).prop('disabled')
-    ).toBeTruthy();
-  });
-
-  test('it renders loading if "isLoading" is true', () => {
-    wrapper = mount(
-      <AutocompleteFieldMatchAnyComponent
-        rowLabel={'Row Label'}
-        placeholder="Placeholder text"
-        selectedField={getField('ip')}
-        selectedValue={[]}
-        indexPattern={{
-          id: '1234',
-          title: 'logstash-*',
-          fields,
-        }}
-        isLoading={true}
-        isClearable={false}
-        isDisabled={false}
-        onChange={jest.fn()}
-        onError={jest.fn()}
-      />
-    );
-    wrapper.find(`[data-test-subj="valuesAutocompleteMatchAny"] button`).at(0).simulate('click');
-    expect(
-      wrapper
-        .find(`EuiComboBoxOptionsList[data-test-subj="valuesAutocompleteMatchAny-optionsList"]`)
-        .prop('isLoading')
-    ).toBeTruthy();
-  });
-
-  test('it allows user to clear values if "isClearable" is true', () => {
-    wrapper = mount(
-      <AutocompleteFieldMatchAnyComponent
-        rowLabel={'Row Label'}
-        placeholder="Placeholder text"
-        selectedField={getField('ip')}
-        selectedValue={['126.45.211.34']}
-        indexPattern={{
-          id: '1234',
-          title: 'logstash-*',
-          fields,
-        }}
-        isLoading={false}
-        isClearable={true}
-        isDisabled={false}
-        onChange={jest.fn()}
-        onError={jest.fn()}
-      />
-    );
-
-    expect(
-      wrapper
-        .find(`[data-test-subj="comboBoxInput"]`)
-        .hasClass('euiComboBox__inputWrap-isClearable')
-    ).toBeTruthy();
-  });
-
-  test('it correctly displays selected value', () => {
-    wrapper = mount(
-      <AutocompleteFieldMatchAnyComponent
-        rowLabel={'Row Label'}
-        placeholder="Placeholder text"
-        selectedField={getField('ip')}
-        selectedValue={['126.45.211.34']}
-        indexPattern={{
-          id: '1234',
-          title: 'logstash-*',
-          fields,
-        }}
-        isLoading={false}
-        isClearable={false}
-        isDisabled={false}
-        onChange={jest.fn()}
-        onError={jest.fn()}
-      />
-    );
-
-    expect(
-      wrapper.find(`[data-test-subj="valuesAutocompleteMatchAny"] EuiComboBoxPill`).at(0).text()
-    ).toEqual('126.45.211.34');
-  });
-
-  test('it invokes "onChange" when new value created', async () => {
-    const mockOnChange = jest.fn();
-    wrapper = mount(
-      <AutocompleteFieldMatchAnyComponent
-        rowLabel={'Row Label'}
-        placeholder="Placeholder text"
-        selectedField={getField('ip')}
-        selectedValue={[]}
-        indexPattern={{
-          id: '1234',
-          title: 'logstash-*',
-          fields,
-        }}
-        isLoading={false}
-        isClearable={false}
-        isDisabled={false}
-        onChange={mockOnChange}
-        onError={jest.fn()}
-      />
-    );
-
-    ((wrapper.find(EuiComboBox).props() as unknown) as {
-      onCreateOption: (a: string) => void;
-    }).onCreateOption('126.45.211.34');
-
-    expect(mockOnChange).toHaveBeenCalledWith(['126.45.211.34']);
-  });
-
-  test('it invokes "onChange" when new value selected', async () => {
-    const mockOnChange = jest.fn();
-    wrapper = mount(
-      <AutocompleteFieldMatchAnyComponent
-        rowLabel={'Row Label'}
-        placeholder="Placeholder text"
-        selectedField={getField('machine.os.raw')}
-        selectedValue={[]}
-        indexPattern={{
-          id: '1234',
-          title: 'logstash-*',
-          fields,
-        }}
-        isLoading={false}
-        isClearable={false}
-        isDisabled={false}
-        onChange={mockOnChange}
-        onError={jest.fn()}
-      />
-    );
-
-    ((wrapper.find(EuiComboBox).props() as unknown) as {
-      onChange: (a: EuiComboBoxOptionOption[]) => void;
-    }).onChange([{ label: 'value 1' }]);
-
-    expect(mockOnChange).toHaveBeenCalledWith(['value 1']);
-  });
-
-  test('it refreshes autocomplete with search query when new value searched', () => {
-    wrapper = mount(
-      <AutocompleteFieldMatchAnyComponent
-        rowLabel={'Row Label'}
-        placeholder="Placeholder text"
-        selectedField={getField('machine.os.raw')}
-        selectedValue={[]}
-        indexPattern={{
-          id: '1234',
-          title: 'logstash-*',
-          fields,
-        }}
-        isLoading={false}
-        isClearable={false}
-        isDisabled={false}
-        onChange={jest.fn()}
-      />
-    );
-    act(() => {
-      ((wrapper.find(EuiComboBox).props() as unknown) as {
-        onSearchChange: (a: string) => void;
-      }).onSearchChange('value 1');
-    });
-
-    expect(useFieldValueAutocomplete).toHaveBeenCalledWith({
-      selectedField: getField('machine.os.raw'),
-      operatorType: 'match_any',
-      query: 'value 1',
-      fieldValue: [],
-      indexPattern: {
-        id: '1234',
-        title: 'logstash-*',
-        fields,
-      },
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx
deleted file mode 100644
index dbfdaf9749b6d..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx
+++ /dev/null
@@ -1,221 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useState, useCallback, useMemo } from 'react';
-import { EuiFormRow, EuiComboBoxOptionOption, EuiComboBox } from '@elastic/eui';
-import { uniq } from 'lodash';
-
-import { ListOperatorTypeEnum as OperatorTypeEnum } from '@kbn/securitysolution-io-ts-list-types';
-import { IFieldType, IIndexPattern } from '../../../../../../../src/plugins/data/common';
-import { useFieldValueAutocomplete } from './hooks/use_field_value_autocomplete';
-import { getGenericComboBoxProps, paramIsValid } from './helpers';
-import { GetGenericComboBoxPropsReturn } from './types';
-
-import * as i18n from './translations';
-
-interface AutocompleteFieldMatchAnyProps {
-  placeholder: string;
-  selectedField: IFieldType | undefined;
-  selectedValue: string[];
-  indexPattern: IIndexPattern | undefined;
-  isLoading: boolean;
-  isDisabled: boolean;
-  isClearable: boolean;
-  isRequired?: boolean;
-  rowLabel?: string;
-  onChange: (arg: string[]) => void;
-  onError?: (arg: boolean) => void;
-}
-
-export const AutocompleteFieldMatchAnyComponent: React.FC<AutocompleteFieldMatchAnyProps> = ({
-  placeholder,
-  rowLabel,
-  selectedField,
-  selectedValue,
-  indexPattern,
-  isLoading,
-  isDisabled = false,
-  isClearable = false,
-  isRequired = false,
-  onChange,
-  onError,
-}): JSX.Element => {
-  const [searchQuery, setSearchQuery] = useState('');
-  const [touched, setIsTouched] = useState(false);
-  const [error, setError] = useState<string | undefined>(undefined);
-  const [isLoadingSuggestions, isSuggestingValues, suggestions] = useFieldValueAutocomplete({
-    selectedField,
-    operatorType: OperatorTypeEnum.MATCH_ANY,
-    fieldValue: selectedValue,
-    query: searchQuery,
-    indexPattern,
-  });
-  const getLabel = useCallback((option: string): string => option, []);
-  const optionsMemo = useMemo(
-    (): string[] => (selectedValue ? uniq([...selectedValue, ...suggestions]) : suggestions),
-    [suggestions, selectedValue]
-  );
-  const { comboOptions, labels, selectedComboOptions } = useMemo(
-    (): GetGenericComboBoxPropsReturn =>
-      getGenericComboBoxProps<string>({
-        options: optionsMemo,
-        selectedOptions: selectedValue,
-        getLabel,
-      }),
-    [optionsMemo, selectedValue, getLabel]
-  );
-
-  const handleError = useCallback(
-    (err: string | undefined): void => {
-      setError((existingErr): string | undefined => {
-        const oldErr = existingErr != null;
-        const newErr = err != null;
-        if (oldErr !== newErr && onError != null) {
-          onError(newErr);
-        }
-
-        return err;
-      });
-    },
-    [setError, onError]
-  );
-
-  const handleValuesChange = useCallback(
-    (newOptions: EuiComboBoxOptionOption[]): void => {
-      const newValues: string[] = newOptions.map(({ label }) => optionsMemo[labels.indexOf(label)]);
-      handleError(undefined);
-      onChange(newValues);
-    },
-    [handleError, labels, onChange, optionsMemo]
-  );
-
-  const handleSearchChange = useCallback(
-    (searchVal: string) => {
-      if (searchVal === '') {
-        handleError(undefined);
-      }
-
-      if (searchVal !== '' && selectedField != null) {
-        const err = paramIsValid(searchVal, selectedField, isRequired, touched);
-        handleError(err);
-
-        setSearchQuery(searchVal);
-      }
-    },
-    [handleError, isRequired, selectedField, touched]
-  );
-
-  const handleCreateOption = useCallback(
-    (option: string): boolean | void => {
-      const err = paramIsValid(option, selectedField, isRequired, touched);
-      handleError(err);
-
-      if (err != null) {
-        // Explicitly reject the user's input
-        return false;
-      } else {
-        onChange([...(selectedValue || []), option]);
-      }
-    },
-    [handleError, isRequired, onChange, selectedField, selectedValue, touched]
-  );
-
-  const setIsTouchedValue = useCallback((): void => {
-    handleError(selectedComboOptions.length === 0 ? i18n.FIELD_REQUIRED_ERR : undefined);
-    setIsTouched(true);
-  }, [setIsTouched, handleError, selectedComboOptions]);
-
-  const inputPlaceholder = useMemo(
-    (): string => (isLoading || isLoadingSuggestions ? i18n.LOADING : placeholder),
-    [isLoading, isLoadingSuggestions, placeholder]
-  );
-
-  const isLoadingState = useMemo((): boolean => isLoading || isLoadingSuggestions, [
-    isLoading,
-    isLoadingSuggestions,
-  ]);
-
-  const defaultInput = useMemo((): JSX.Element => {
-    return (
-      <EuiFormRow
-        label={rowLabel}
-        error={error}
-        isInvalid={selectedField != null && error != null}
-        fullWidth
-      >
-        <EuiComboBox
-          placeholder={inputPlaceholder}
-          isLoading={isLoadingState}
-          isClearable={isClearable}
-          isDisabled={isDisabled}
-          options={comboOptions}
-          selectedOptions={selectedComboOptions}
-          onChange={handleValuesChange}
-          onSearchChange={handleSearchChange}
-          onCreateOption={handleCreateOption}
-          isInvalid={selectedField != null && error != null}
-          onBlur={setIsTouchedValue}
-          delimiter=", "
-          data-test-subj="valuesAutocompleteMatchAny"
-          fullWidth
-          async
-        />
-      </EuiFormRow>
-    );
-  }, [
-    comboOptions,
-    error,
-    handleCreateOption,
-    handleSearchChange,
-    handleValuesChange,
-    inputPlaceholder,
-    isClearable,
-    isDisabled,
-    isLoadingState,
-    rowLabel,
-    selectedComboOptions,
-    selectedField,
-    setIsTouchedValue,
-  ]);
-
-  if (!isSuggestingValues && selectedField != null) {
-    switch (selectedField.type) {
-      case 'number':
-        return (
-          <EuiFormRow
-            label={rowLabel}
-            error={error}
-            isInvalid={selectedField != null && error != null}
-            fullWidth
-          >
-            <EuiComboBox
-              noSuggestions
-              placeholder={inputPlaceholder}
-              isLoading={isLoadingState}
-              isClearable={isClearable}
-              isDisabled={isDisabled}
-              selectedOptions={selectedComboOptions}
-              onChange={handleValuesChange}
-              onSearchChange={handleSearchChange}
-              onCreateOption={handleCreateOption}
-              isInvalid={selectedField != null && error != null}
-              onFocus={setIsTouchedValue}
-              delimiter=", "
-              data-test-subj="valuesAutocompleteMatchAnyNumber"
-              fullWidth
-            />
-          </EuiFormRow>
-        );
-      default:
-        return defaultInput;
-    }
-  }
-
-  return defaultInput;
-};
-
-AutocompleteFieldMatchAnyComponent.displayName = 'AutocompleteFieldMatchAny';
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.test.ts b/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.test.ts
index ae695bf7be978..1618de245365d 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.test.ts
@@ -8,65 +8,13 @@
 import moment from 'moment';
 import '../../../common/mock/match_media';
 import { getField } from '../../../../../../../src/plugins/data/common/index_patterns/fields/fields.mocks';
-import { IFieldType } from '../../../../../../../src/plugins/data/common';
 
 import * as i18n from './translations';
-import {
-  EXCEPTION_OPERATORS,
-  isOperator,
-  isNotOperator,
-  existsOperator,
-  doesNotExistOperator,
-} from '@kbn/securitysolution-list-utils';
-import {
-  getOperators,
-  checkEmptyValue,
-  paramIsValid,
-  getGenericComboBoxProps,
-  typeMatch,
-  filterFieldToList,
-} from './helpers';
-import { getListResponseMock } from '../../../../../lists/common/schemas/response/list_schema.mock';
-import type { ListSchema } from '@kbn/securitysolution-io-ts-list-types';
+import { checkEmptyValue, paramIsValid, getGenericComboBoxProps } from './helpers';
 
 describe('helpers', () => {
   // @ts-ignore
   moment.suppressDeprecationWarnings = true;
-  describe('#getOperators', () => {
-    test('it returns "isOperator" if passed in field is "undefined"', () => {
-      const operator = getOperators(undefined);
-
-      expect(operator).toEqual([isOperator]);
-    });
-
-    test('it returns expected operators when field type is "boolean"', () => {
-      const operator = getOperators(getField('ssl'));
-
-      expect(operator).toEqual([isOperator, isNotOperator, existsOperator, doesNotExistOperator]);
-    });
-
-    test('it returns "isOperator" when field type is "nested"', () => {
-      const operator = getOperators({
-        name: 'nestedField',
-        type: 'nested',
-        esTypes: ['text'],
-        count: 0,
-        scripted: false,
-        searchable: true,
-        aggregatable: false,
-        readFromDocValues: false,
-        subType: { nested: { path: 'nestedField' } },
-      });
-
-      expect(operator).toEqual([isOperator]);
-    });
-
-    test('it returns all operator types when field type is not null, boolean, or nested', () => {
-      const operator = getOperators(getField('machine.os.raw'));
-
-      expect(operator).toEqual(EXCEPTION_OPERATORS);
-    });
-  });
 
   describe('#checkEmptyValue', () => {
     test('returns no errors if no field has been selected', () => {
@@ -272,117 +220,4 @@ describe('helpers', () => {
       });
     });
   });
-
-  describe('#typeMatch', () => {
-    test('ip -> ip is true', () => {
-      expect(typeMatch('ip', 'ip')).toEqual(true);
-    });
-
-    test('keyword -> keyword is true', () => {
-      expect(typeMatch('keyword', 'keyword')).toEqual(true);
-    });
-
-    test('text -> text is true', () => {
-      expect(typeMatch('text', 'text')).toEqual(true);
-    });
-
-    test('ip_range -> ip is true', () => {
-      expect(typeMatch('ip_range', 'ip')).toEqual(true);
-    });
-
-    test('date_range -> date is true', () => {
-      expect(typeMatch('date_range', 'date')).toEqual(true);
-    });
-
-    test('double_range -> double is true', () => {
-      expect(typeMatch('double_range', 'double')).toEqual(true);
-    });
-
-    test('float_range -> float is true', () => {
-      expect(typeMatch('float_range', 'float')).toEqual(true);
-    });
-
-    test('integer_range -> integer is true', () => {
-      expect(typeMatch('integer_range', 'integer')).toEqual(true);
-    });
-
-    test('long_range -> long is true', () => {
-      expect(typeMatch('long_range', 'long')).toEqual(true);
-    });
-
-    test('ip -> date is false', () => {
-      expect(typeMatch('ip', 'date')).toEqual(false);
-    });
-
-    test('long -> float is false', () => {
-      expect(typeMatch('long', 'float')).toEqual(false);
-    });
-
-    test('integer -> long is false', () => {
-      expect(typeMatch('integer', 'long')).toEqual(false);
-    });
-  });
-
-  describe('#filterFieldToList', () => {
-    test('it returns empty array if given a undefined for field', () => {
-      const filter = filterFieldToList([], undefined);
-      expect(filter).toEqual([]);
-    });
-
-    test('it returns empty array if filed does not contain esTypes', () => {
-      const field: IFieldType = { name: 'some-name', type: 'some-type' };
-      const filter = filterFieldToList([], field);
-      expect(filter).toEqual([]);
-    });
-
-    test('it returns single filtered list of ip_range -> ip', () => {
-      const field: IFieldType = { name: 'some-name', type: 'ip', esTypes: ['ip'] };
-      const listItem: ListSchema = { ...getListResponseMock(), type: 'ip_range' };
-      const filter = filterFieldToList([listItem], field);
-      const expected: ListSchema[] = [listItem];
-      expect(filter).toEqual(expected);
-    });
-
-    test('it returns single filtered list of ip -> ip', () => {
-      const field: IFieldType = { name: 'some-name', type: 'ip', esTypes: ['ip'] };
-      const listItem: ListSchema = { ...getListResponseMock(), type: 'ip' };
-      const filter = filterFieldToList([listItem], field);
-      const expected: ListSchema[] = [listItem];
-      expect(filter).toEqual(expected);
-    });
-
-    test('it returns single filtered list of keyword -> keyword', () => {
-      const field: IFieldType = { name: 'some-name', type: 'keyword', esTypes: ['keyword'] };
-      const listItem: ListSchema = { ...getListResponseMock(), type: 'keyword' };
-      const filter = filterFieldToList([listItem], field);
-      const expected: ListSchema[] = [listItem];
-      expect(filter).toEqual(expected);
-    });
-
-    test('it returns single filtered list of text -> text', () => {
-      const field: IFieldType = { name: 'some-name', type: 'text', esTypes: ['text'] };
-      const listItem: ListSchema = { ...getListResponseMock(), type: 'text' };
-      const filter = filterFieldToList([listItem], field);
-      const expected: ListSchema[] = [listItem];
-      expect(filter).toEqual(expected);
-    });
-
-    test('it returns 2 filtered lists of ip_range -> ip', () => {
-      const field: IFieldType = { name: 'some-name', type: 'ip', esTypes: ['ip'] };
-      const listItem1: ListSchema = { ...getListResponseMock(), type: 'ip_range' };
-      const listItem2: ListSchema = { ...getListResponseMock(), type: 'ip_range' };
-      const filter = filterFieldToList([listItem1, listItem2], field);
-      const expected: ListSchema[] = [listItem1, listItem2];
-      expect(filter).toEqual(expected);
-    });
-
-    test('it returns 1 filtered lists of ip_range -> ip if the 2nd is not compatible type', () => {
-      const field: IFieldType = { name: 'some-name', type: 'ip', esTypes: ['ip'] };
-      const listItem1: ListSchema = { ...getListResponseMock(), type: 'ip_range' };
-      const listItem2: ListSchema = { ...getListResponseMock(), type: 'text' };
-      const filter = filterFieldToList([listItem1, listItem2], field);
-      const expected: ListSchema[] = [listItem1];
-      expect(filter).toEqual(expected);
-    });
-  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts b/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts
index 81f5a66238567..890f1e6755834 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts
@@ -8,46 +8,17 @@
 import dateMath from '@elastic/datemath';
 import { EuiComboBoxOptionOption } from '@elastic/eui';
 
-import type { Type, ListSchema } from '@kbn/securitysolution-io-ts-list-types';
-import {
-  EXCEPTION_OPERATORS,
-  isOperator,
-  isNotOperator,
-  existsOperator,
-  doesNotExistOperator,
-} from '@kbn/securitysolution-list-utils';
 import { IFieldType } from '../../../../../../../src/plugins/data/common';
 
-import { GetGenericComboBoxPropsReturn, OperatorOption } from './types';
+import { GetGenericComboBoxPropsReturn } from './types';
 import * as i18n from './translations';
 
-/**
- * Returns the appropriate operators given a field type
- *
- * @param field IFieldType selected field
- *
- */
-export const getOperators = (field: IFieldType | undefined): OperatorOption[] => {
-  if (field == null) {
-    return [isOperator];
-  } else if (field.type === 'boolean') {
-    return [isOperator, isNotOperator, existsOperator, doesNotExistOperator];
-  } else if (field.type === 'nested') {
-    return [isOperator];
-  } else {
-    return EXCEPTION_OPERATORS;
-  }
-};
-
 /**
  * Determines if empty value is ok
+ * There is a copy within:
+ * x-pack/plugins/lists/public/exceptions/components/autocomplete/helpers.ts
  *
- * @param param the value being checked
- * @param field the selected field
- * @param isRequired whether or not an empty value is allowed
- * @param touched has field been touched by user
- * @returns undefined if valid, string with error message if invalid,
- * null if no checks matched
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
  */
 export const checkEmptyValue = (
   param: string | undefined,
@@ -72,7 +43,10 @@ export const checkEmptyValue = (
 
 /**
  * Very basic validation for values
+ * There is a copy within:
+ * x-pack/plugins/lists/public/exceptions/components/autocomplete/helpers.ts
  *
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
  * @param param the value being checked
  * @param field the selected field
  * @param isRequired whether or not an empty value is allowed
@@ -109,7 +83,10 @@ export const paramIsValid = (
 
 /**
  * Determines the options, selected values and option labels for EUI combo box
+ * There is a copy within:
+ * x-pack/plugins/lists/public/exceptions/components/autocomplete/helpers.ts
  *
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
  * @param options options user can select from
  * @param selectedOptions user selection if any
  * @param getLabel helper function to know which property to use for labels
@@ -140,36 +117,3 @@ export function getGenericComboBoxProps<T>({
     selectedComboOptions: newSelectedComboOptions,
   };
 }
-
-/**
- * Given an array of lists and optionally a field this will return all
- * the lists that match against the field based on the types from the field
- * @param lists The lists to match against the field
- * @param field The field to check against the list to see if they are compatible
- */
-export const filterFieldToList = (lists: ListSchema[], field?: IFieldType): ListSchema[] => {
-  if (field != null) {
-    const { esTypes = [] } = field;
-    return lists.filter(({ type }) => esTypes.some((esType) => typeMatch(type, esType)));
-  } else {
-    return [];
-  }
-};
-
-/**
- * Given an input list type and a string based ES type this will match
- * if they're exact or if they are compatible with a range
- * @param type The type to match against the esType
- * @param esType The ES type to match with
- */
-export const typeMatch = (type: Type, esType: string): boolean => {
-  return (
-    type === esType ||
-    (type === 'ip_range' && esType === 'ip') ||
-    (type === 'date_range' && esType === 'date') ||
-    (type === 'double_range' && esType === 'double') ||
-    (type === 'float_range' && esType === 'float') ||
-    (type === 'integer_range' && esType === 'integer') ||
-    (type === 'long_range' && esType === 'long')
-  );
-};
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts b/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts
index 0f369fa01d01e..0fc4a663b7e11 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts
@@ -30,9 +30,13 @@ export interface UseFieldValueAutocompleteProps {
   query: string;
   indexPattern: IIndexPattern | undefined;
 }
+
 /**
  * Hook for using the field value autocomplete service
+ * There is a copy within:
+ * x-pack/plugins/lists/public/exceptions/components/autocomplete/hooks.ts
  *
+ * TODO: This should be in its own packaged and not copied, https://github.com/elastic/kibana/issues/105378
  */
 export const useFieldValueAutocomplete = ({
   selectedField,
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/operator.test.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/operator.test.tsx
deleted file mode 100644
index 5e00d2beb571c..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/operator.test.tsx
+++ /dev/null
@@ -1,225 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { mount } from 'enzyme';
-import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
-
-import { getField } from '../../../../../../../src/plugins/data/common/index_patterns/fields/fields.mocks';
-import { OperatorComponent } from './operator';
-import { isOperator, isNotOperator } from '@kbn/securitysolution-list-utils';
-
-describe('OperatorComponent', () => {
-  test('it renders disabled if "isDisabled" is true', () => {
-    const wrapper = mount(
-      <OperatorComponent
-        placeholder="Placeholder text"
-        selectedField={getField('machine.os.raw')}
-        operator={isOperator}
-        isDisabled={true}
-        isLoading={false}
-        isClearable={false}
-        onChange={jest.fn()}
-      />
-    );
-
-    expect(
-      wrapper.find(`[data-test-subj="operatorAutocompleteComboBox"] input`).prop('disabled')
-    ).toBeTruthy();
-  });
-
-  test('it renders loading if "isLoading" is true', () => {
-    const wrapper = mount(
-      <OperatorComponent
-        placeholder="Placeholder text"
-        selectedField={getField('machine.os.raw')}
-        operator={isOperator}
-        isDisabled={false}
-        isLoading={true}
-        isClearable={false}
-        onChange={jest.fn()}
-      />
-    );
-    wrapper.find(`[data-test-subj="operatorAutocompleteComboBox"] button`).at(0).simulate('click');
-    expect(
-      wrapper
-        .find(`EuiComboBoxOptionsList[data-test-subj="operatorAutocompleteComboBox-optionsList"]`)
-        .prop('isLoading')
-    ).toBeTruthy();
-  });
-
-  test('it allows user to clear values if "isClearable" is true', () => {
-    const wrapper = mount(
-      <OperatorComponent
-        placeholder="Placeholder text"
-        selectedField={getField('machine.os.raw')}
-        operator={isOperator}
-        isDisabled={false}
-        isLoading={false}
-        isClearable={true}
-        onChange={jest.fn()}
-      />
-    );
-
-    expect(wrapper.find(`button[data-test-subj="comboBoxClearButton"]`).exists()).toBeTruthy();
-  });
-
-  test('it displays "operatorOptions" if param is passed in with items', () => {
-    const wrapper = mount(
-      <OperatorComponent
-        placeholder="Placeholder text"
-        selectedField={getField('machine.os.raw')}
-        operator={isOperator}
-        isDisabled={false}
-        isLoading={false}
-        isClearable={false}
-        onChange={jest.fn()}
-        operatorOptions={[isNotOperator]}
-      />
-    );
-
-    expect(
-      wrapper.find(`[data-test-subj="operatorAutocompleteComboBox"]`).at(0).prop('options')
-    ).toEqual([{ label: 'is not' }]);
-  });
-
-  test('it does not display "operatorOptions" if param is passed in with no items', () => {
-    const wrapper = mount(
-      <OperatorComponent
-        placeholder="Placeholder text"
-        selectedField={getField('machine.os.raw')}
-        operator={isOperator}
-        isDisabled={false}
-        isLoading={false}
-        isClearable={false}
-        onChange={jest.fn()}
-        operatorOptions={[]}
-      />
-    );
-
-    expect(
-      wrapper.find(`[data-test-subj="operatorAutocompleteComboBox"]`).at(0).prop('options')
-    ).toEqual([
-      {
-        label: 'is',
-      },
-      {
-        label: 'is not',
-      },
-      {
-        label: 'is one of',
-      },
-      {
-        label: 'is not one of',
-      },
-      {
-        label: 'exists',
-      },
-      {
-        label: 'does not exist',
-      },
-      {
-        label: 'is in list',
-      },
-      {
-        label: 'is not in list',
-      },
-    ]);
-  });
-
-  test('it correctly displays selected operator', () => {
-    const wrapper = mount(
-      <OperatorComponent
-        placeholder="Placeholder text"
-        selectedField={getField('machine.os.raw')}
-        operator={isOperator}
-        isDisabled={false}
-        isLoading={false}
-        isClearable={false}
-        onChange={jest.fn()}
-      />
-    );
-
-    expect(
-      wrapper.find(`[data-test-subj="operatorAutocompleteComboBox"] EuiComboBoxPill`).at(0).text()
-    ).toEqual('is');
-  });
-
-  test('it only displays subset of operators if field type is nested', () => {
-    const wrapper = mount(
-      <OperatorComponent
-        placeholder="Placeholder text"
-        selectedField={{
-          name: 'nestedField',
-          type: 'nested',
-          esTypes: ['text'],
-          count: 0,
-          scripted: false,
-          searchable: true,
-          aggregatable: false,
-          readFromDocValues: false,
-          subType: { nested: { path: 'nestedField' } },
-        }}
-        operator={isOperator}
-        isDisabled={false}
-        isLoading={false}
-        isClearable={false}
-        onChange={jest.fn()}
-      />
-    );
-
-    expect(
-      wrapper.find(`[data-test-subj="operatorAutocompleteComboBox"]`).at(0).prop('options')
-    ).toEqual([{ label: 'is' }]);
-  });
-
-  test('it only displays subset of operators if field type is boolean', () => {
-    const wrapper = mount(
-      <OperatorComponent
-        placeholder="Placeholder text"
-        selectedField={getField('ssl')}
-        operator={isOperator}
-        isDisabled={false}
-        isLoading={false}
-        isClearable={false}
-        onChange={jest.fn()}
-      />
-    );
-
-    expect(
-      wrapper.find(`[data-test-subj="operatorAutocompleteComboBox"]`).at(0).prop('options')
-    ).toEqual([
-      { label: 'is' },
-      { label: 'is not' },
-      { label: 'exists' },
-      { label: 'does not exist' },
-    ]);
-  });
-
-  test('it invokes "onChange" when option selected', () => {
-    const mockOnChange = jest.fn();
-    const wrapper = mount(
-      <OperatorComponent
-        placeholder="Placeholder text"
-        selectedField={getField('machine.os.raw')}
-        operator={isOperator}
-        isDisabled={false}
-        isLoading={false}
-        isClearable={false}
-        onChange={mockOnChange}
-      />
-    );
-
-    ((wrapper.find(EuiComboBox).props() as unknown) as {
-      onChange: (a: EuiComboBoxOptionOption[]) => void;
-    }).onChange([{ label: 'is not' }]);
-
-    expect(mockOnChange).toHaveBeenCalledWith([
-      { message: 'is not', operator: 'excluded', type: 'match', value: 'is_not' },
-    ]);
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/operator.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/operator.tsx
deleted file mode 100644
index d8f49acd04b99..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/operator.tsx
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useCallback, useMemo } from 'react';
-import { EuiComboBoxOptionOption, EuiComboBox } from '@elastic/eui';
-
-import { IFieldType } from '../../../../../../../src/plugins/data/common';
-import { getOperators, getGenericComboBoxProps } from './helpers';
-import { GetGenericComboBoxPropsReturn, OperatorOption } from './types';
-
-interface OperatorState {
-  placeholder: string;
-  selectedField: IFieldType | undefined;
-  operator: OperatorOption;
-  isLoading: boolean;
-  isDisabled: boolean;
-  isClearable: boolean;
-  operatorInputWidth?: number;
-  operatorOptions?: OperatorOption[];
-  onChange: (arg: OperatorOption[]) => void;
-}
-
-export const OperatorComponent: React.FC<OperatorState> = ({
-  placeholder,
-  selectedField,
-  operator,
-  isLoading = false,
-  isDisabled = false,
-  isClearable = false,
-  operatorOptions,
-  operatorInputWidth = 150,
-  onChange,
-}): JSX.Element => {
-  const getLabel = useCallback(({ message }): string => message, []);
-  const optionsMemo = useMemo(
-    (): OperatorOption[] =>
-      operatorOptions != null && operatorOptions.length > 0
-        ? operatorOptions
-        : getOperators(selectedField),
-    [operatorOptions, selectedField]
-  );
-  const selectedOptionsMemo = useMemo((): OperatorOption[] => (operator ? [operator] : []), [
-    operator,
-  ]);
-  const { comboOptions, labels, selectedComboOptions } = useMemo(
-    (): GetGenericComboBoxPropsReturn =>
-      getGenericComboBoxProps<OperatorOption>({
-        options: optionsMemo,
-        selectedOptions: selectedOptionsMemo,
-        getLabel,
-      }),
-    [optionsMemo, selectedOptionsMemo, getLabel]
-  );
-
-  const handleValuesChange = (newOptions: EuiComboBoxOptionOption[]): void => {
-    const newValues: OperatorOption[] = newOptions.map(
-      ({ label }) => optionsMemo[labels.indexOf(label)]
-    );
-    onChange(newValues);
-  };
-
-  return (
-    <EuiComboBox
-      placeholder={placeholder}
-      options={comboOptions}
-      selectedOptions={selectedComboOptions}
-      onChange={handleValuesChange}
-      isLoading={isLoading}
-      isDisabled={isDisabled}
-      isClearable={isClearable}
-      singleSelection={{ asPlainText: true }}
-      data-test-subj="operatorAutocompleteComboBox"
-      style={{ width: `${operatorInputWidth}px` }}
-    />
-  );
-};
-
-OperatorComponent.displayName = 'Operator';
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts b/x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts
index 1d8e3e9aee28e..07f1903fb70e1 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts
@@ -7,20 +7,8 @@
 
 import { EuiComboBoxOptionOption } from '@elastic/eui';
 
-import type {
-  ListOperatorEnum as OperatorEnum,
-  ListOperatorTypeEnum as OperatorTypeEnum,
-} from '@kbn/securitysolution-io-ts-list-types';
-
 export interface GetGenericComboBoxPropsReturn {
   comboOptions: EuiComboBoxOptionOption[];
   labels: string[];
   selectedComboOptions: EuiComboBoxOptionOption[];
 }
-
-export interface OperatorOption {
-  message: string;
-  value: string;
-  operator: OperatorEnum;
-  type: OperatorTypeEnum;
-}
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap
index 2dc3f7fd336a2..6ef797580be9b 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap
@@ -366,6 +366,7 @@ exports[`DragDropContextWrapper rendering it renders against the snapshot 1`] =
             "format": "",
             "indexes": Array [
               "apm-*-transaction*",
+              "traces-apm*",
               "auditbeat-*",
               "endgame-*",
               "filebeat-*",
diff --git a/x-pack/plugins/security_solution/public/common/components/endpoint/agent_status.tsx b/x-pack/plugins/security_solution/public/common/components/endpoint/agent_status.tsx
index f93721349fdac..d709105901215 100644
--- a/x-pack/plugins/security_solution/public/common/components/endpoint/agent_status.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/endpoint/agent_status.tsx
@@ -20,7 +20,7 @@ export const AgentStatus = React.memo(({ hostStatus }: { hostStatus: HostStatus
     >
       <FormattedMessage
         id="xpack.securitySolution.endpoint.list.hostStatusValue"
-        defaultMessage="{hostStatus, select, healthy {Healthy} unhealthy {Unhealthy} updating {Updating} offline {Offline} inactive {Inactive} other {Unhealthy}}"
+        defaultMessage="{hostStatus, select, healthy {Healthy} unhealthy {Unhealthy} updating {Updating} offline {Offline} inactive {Inactive} unenrolled {Unenrolled} other {Unhealthy}}"
         values={{ hostStatus }}
       />
     </EuiBadge>
diff --git a/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/action_completion_return_button.tsx b/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/action_completion_return_button.tsx
new file mode 100644
index 0000000000000..af05999b2de26
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/action_completion_return_button.tsx
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback } from 'react';
+import { EuiSpacer, EuiFlexGroup, EuiFlexItem, EuiButtonEmpty, EuiText } from '@elastic/eui';
+
+export const ActionCompletionReturnButton = React.memo(
+  ({ onClick, buttonText }: { onClick: () => void; buttonText: string }) => {
+    const onClickCallback = useCallback(() => onClick(), [onClick]);
+
+    return (
+      <>
+        <EuiSpacer size="m" />
+        <EuiFlexGroup gutterSize="none" justifyContent="flexEnd">
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty
+              flush="right"
+              onClick={onClickCallback}
+              data-test-subj="hostIsolateSuccessCompleteButton"
+            >
+              <EuiText size="s">
+                <p>{buttonText}</p>
+              </EuiText>
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </>
+    );
+  }
+);
+
+ActionCompletionReturnButton.displayName = 'ActionCompletionReturnButton';
diff --git a/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/index.ts b/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/index.ts
index bd8e23e3a4559..24b94cd6212b7 100644
--- a/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/index.ts
+++ b/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/index.ts
@@ -9,3 +9,4 @@ export * from './isolate_success';
 export * from './isolate_form';
 export * from './unisolate_form';
 export * from './endpoint_host_isolation_status';
+export * from './action_completion_return_button';
diff --git a/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/isolate_success.tsx b/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/isolate_success.tsx
index 3459da068b282..7f05e8eafac87 100644
--- a/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/isolate_success.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/isolate_success.tsx
@@ -5,58 +5,84 @@
  * 2.0.
  */
 
-import React, { memo, ReactNode } from 'react';
-import { EuiButtonEmpty, EuiCallOut, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
+import React, { memo, ReactNode, useMemo } from 'react';
+import { EuiCallOut, EuiText } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { GET_ISOLATION_SUCCESS_MESSAGE, GET_UNISOLATION_SUCCESS_MESSAGE } from './translations';
+import { useCasesFromAlerts } from '../../../../detections/containers/detection_engine/alerts/use_cases_from_alerts';
+import { CaseDetailsLink } from '../../../../common/components/links';
 
 export interface EndpointIsolateSuccessProps {
   hostName: string;
+  alertId?: string;
   isolateAction?: 'isolateHost' | 'unisolateHost';
-  completeButtonLabel: string;
-  onComplete: () => void;
   additionalInfo?: ReactNode;
 }
 
+const CasesAdditionalInfo: React.FC<{ alertIdForCase: string }> = ({ alertIdForCase }) => {
+  const { casesInfo } = useCasesFromAlerts({ alertId: alertIdForCase });
+
+  const caseCount: number = useMemo(() => casesInfo.length, [casesInfo]);
+
+  const casesList = useMemo(
+    () =>
+      casesInfo.map((caseInfo, index) => {
+        return (
+          <li key={caseInfo.id}>
+            <CaseDetailsLink detailName={caseInfo.id}>
+              <FormattedMessage
+                id="xpack.securitySolution.endpoint.hostIsolation.placeholderCase"
+                defaultMessage="{caseName}"
+                values={{ caseName: caseInfo.title }}
+              />
+            </CaseDetailsLink>
+          </li>
+        );
+      }),
+    [casesInfo]
+  );
+
+  return (
+    <>
+      {caseCount > 0 && (
+        <>
+          <EuiText size="s">
+            <p>
+              <FormattedMessage
+                id="xpack.securitySolution.endpoint.hostIsolation.successfulIsolation.cases"
+                defaultMessage="This action has been attached to the following {caseCount, plural, one {case} other {cases}}:"
+                values={{ caseCount }}
+              />
+            </p>
+          </EuiText>
+          <EuiText size="s">
+            <ul>{casesList}</ul>
+          </EuiText>
+        </>
+      )}
+    </>
+  );
+};
+
 export const EndpointIsolateSuccess = memo<EndpointIsolateSuccessProps>(
-  ({
-    hostName,
-    isolateAction = 'isolateHost',
-    onComplete,
-    completeButtonLabel,
-    additionalInfo,
-  }) => {
+  ({ hostName, alertId, isolateAction = 'isolateHost', additionalInfo }) => {
     return (
-      <>
-        <EuiCallOut
-          iconType="check"
-          color="success"
-          title={
-            isolateAction === 'isolateHost'
-              ? GET_ISOLATION_SUCCESS_MESSAGE(hostName)
-              : GET_UNISOLATION_SUCCESS_MESSAGE(hostName)
-          }
-          data-test-subj={
-            isolateAction === 'isolateHost'
-              ? 'hostIsolateSuccessMessage'
-              : 'hostUnisolateSuccessMessage'
-          }
-        >
-          {additionalInfo}
-        </EuiCallOut>
-        <EuiFlexGroup gutterSize="none" justifyContent="flexEnd">
-          <EuiFlexItem grow={false}>
-            <EuiButtonEmpty
-              flush="right"
-              onClick={onComplete}
-              data-test-subj="hostIsolateSuccessCompleteButton"
-            >
-              <EuiText size="s">
-                <p>{completeButtonLabel}</p>
-              </EuiText>
-            </EuiButtonEmpty>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </>
+      <EuiCallOut
+        iconType="check"
+        color="success"
+        title={
+          isolateAction === 'isolateHost'
+            ? GET_ISOLATION_SUCCESS_MESSAGE(hostName)
+            : GET_UNISOLATION_SUCCESS_MESSAGE(hostName)
+        }
+        data-test-subj={
+          isolateAction === 'isolateHost'
+            ? 'hostIsolateSuccessMessage'
+            : 'hostUnisolateSuccessMessage'
+        }
+      >
+        {alertId !== undefined ? CasesAdditionalInfo({ alertIdForCase: alertId }) : additionalInfo}
+      </EuiCallOut>
     );
   }
 );
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__mocks__/index.ts b/x-pack/plugins/security_solution/public/common/components/event_details/__mocks__/index.ts
index 3edd6e6fda14b..620c3991b0ad9 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__mocks__/index.ts
@@ -406,6 +406,7 @@ export const mockAlertDetailsData = [
     field: 'signal.rule.index',
     values: [
       'apm-*-transaction*',
+      'traces-apm*',
       'auditbeat-*',
       'endgame-*',
       'filebeat-*',
@@ -415,6 +416,7 @@ export const mockAlertDetailsData = [
     ],
     originalValue: [
       'apm-*-transaction*',
+      'traces-apm*',
       'auditbeat-*',
       'endgame-*',
       'filebeat-*',
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/exceptionable_endpoint_fields.json b/x-pack/plugins/security_solution/public/common/components/exceptions/exceptionable_endpoint_fields.json
index b5480aac27f67..c37be60545ab2 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/exceptionable_endpoint_fields.json
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/exceptionable_endpoint_fields.json
@@ -2,10 +2,12 @@
   "Endpoint.policy.applied.id",
   "Target.process.Ext.services",
   "Target.process.Ext.user",
+  "Target.process.executable",
   "Target.process.hash.md5",
   "Target.process.hash.sha1",
   "Target.process.hash.sha256",
   "Target.process.hash.sha512",
+  "Target.process.name",
   "Target.process.parent.hash.md5",
   "Target.process.parent.hash.sha1",
   "Target.process.parent.hash.sha256",
@@ -17,6 +19,14 @@
   "Target.process.pe.original_file_name",
   "Target.process.pe.product",
   "Target.process.pgid",
+  "Target.process.thread.Ext.start_address_details.allocation_type",
+  "Target.process.thread.Ext.start_address_bytes_disasm_hash",
+  "Target.process.thread.Ext.start_address_allocation_offset",
+  "Target.process.thread.Ext.start_address_details.allocation_size",
+  "Target.process.thread.Ext.start_address_details.region_size",
+  "Target.process.thread.Ext.start_address_details.region_protection",
+  "Target.process.thread.Ext.start_address_details.memory_pe.imphash",
+  "Target.process.thread.Ext.start_address_bytes",
   "agent.id",
   "agent.type",
   "agent.version",
@@ -68,10 +78,13 @@
   "host.type",
   "process.Ext.services",
   "process.Ext.user",
+  "process.Ext.code_signature",
+  "process.executable",
   "process.hash.md5",
   "process.hash.sha1",
   "process.hash.sha256",
   "process.hash.sha512",
+  "process.name",
   "process.parent.hash.md5",
   "process.parent.hash.sha1",
   "process.parent.hash.sha256",
@@ -88,5 +101,7 @@
   "user.email",
   "user.hash",
   "user.id",
-  "Ransomware.feature"
+  "Ransomware.feature",
+  "Memory_protection.feature",
+  "Memory_protection.self_injection"
 ]
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
index 0af83e2cff3b5..32eb4baad5059 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
@@ -928,5 +928,172 @@ describe('Exception helpers', () => {
         },
       ]);
     });
+
+    test('it should return pre-populated memory signature items for event code `memory_signature`', () => {
+      const defaultItems = defaultEndpointExceptionItems('list_id', 'my_rule', {
+        _id: '123',
+        process: {
+          name: 'some name',
+          executable: 'some file path',
+          hash: {
+            sha256: 'some hash',
+          },
+        },
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        Memory_protection: {
+          feature: 'signature',
+        },
+        event: {
+          code: 'memory_signature',
+        },
+      });
+
+      expect(defaultItems[0].entries).toEqual([
+        {
+          field: 'Memory_protection.feature',
+          operator: 'included',
+          type: 'match',
+          value: 'signature',
+          id: '123',
+        },
+        {
+          field: 'process.executable.caseless',
+          operator: 'included',
+          type: 'match',
+          value: 'some file path',
+          id: '123',
+        },
+        {
+          field: 'process.name.caseless',
+          operator: 'included',
+          type: 'match',
+          value: 'some name',
+          id: '123',
+        },
+        {
+          field: 'process.hash.sha256',
+          operator: 'included',
+          type: 'match',
+          value: 'some hash',
+          id: '123',
+        },
+      ]);
+    });
+
+    test('it should return pre-populated memory shellcode items for event code `malicious_thread`', () => {
+      const defaultItems = defaultEndpointExceptionItems('list_id', 'my_rule', {
+        _id: '123',
+        process: {
+          name: 'some name',
+          executable: 'some file path',
+          Ext: {
+            token: {
+              integrity_level_name: 'high',
+            },
+          },
+        },
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        Memory_protection: {
+          feature: 'shellcode_thread',
+          self_injection: true,
+        },
+        event: {
+          code: 'malicious_thread',
+        },
+        Target: {
+          process: {
+            thread: {
+              Ext: {
+                start_address_allocation_offset: 0,
+                start_address_bytes_disasm_hash: 'a disam hash',
+                start_address_details: {
+                  allocation_type: 'PRIVATE',
+                  allocation_size: 4000,
+                  region_size: 4000,
+                  region_protection: 'RWX',
+                  memory_pe: {
+                    imphash: 'a hash',
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+
+      expect(defaultItems[0].entries).toEqual([
+        {
+          field: 'Memory_protection.feature',
+          operator: 'included',
+          type: 'match',
+          value: 'shellcode_thread',
+          id: '123',
+        },
+        {
+          field: 'Memory_protection.self_injection',
+          operator: 'included',
+          type: 'match',
+          value: 'true',
+          id: '123',
+        },
+        {
+          field: 'process.executable.caseless',
+          operator: 'included',
+          type: 'match',
+          value: 'some file path',
+          id: '123',
+        },
+        {
+          field: 'process.name.caseless',
+          operator: 'included',
+          type: 'match',
+          value: 'some name',
+          id: '123',
+        },
+        {
+          field: 'process.Ext.token.integrity_level_name',
+          operator: 'included',
+          type: 'match',
+          value: 'high',
+          id: '123',
+        },
+        {
+          field: 'Target.process.thread.Ext.start_address_details',
+          type: 'nested',
+          entries: [
+            {
+              field: 'allocation_type',
+              operator: 'included',
+              type: 'match',
+              value: 'PRIVATE',
+              id: '123',
+            },
+            {
+              field: 'allocation_size',
+              operator: 'included',
+              type: 'match',
+              value: '4000',
+              id: '123',
+            },
+            { field: 'region_size', operator: 'included', type: 'match', value: '4000', id: '123' },
+            {
+              field: 'region_protection',
+              operator: 'included',
+              type: 'match',
+              value: 'RWX',
+              id: '123',
+            },
+            {
+              field: 'memory_pe.imphash',
+              operator: 'included',
+              type: 'match',
+              value: 'a hash',
+              id: '123',
+            },
+          ],
+          id: '123',
+        },
+      ]);
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
index bfb5c7298f330..3c8652637a997 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
@@ -496,6 +496,139 @@ export const getPrepopulatedRansomwareException = ({
   };
 };
 
+export const getPrepopulatedMemorySignatureException = ({
+  listId,
+  ruleName,
+  eventCode,
+  listNamespace = 'agnostic',
+  alertEcsData,
+}: {
+  listId: string;
+  listNamespace?: NamespaceType;
+  ruleName: string;
+  eventCode: string;
+  alertEcsData: Flattened<Ecs>;
+}): ExceptionsBuilderExceptionItem => {
+  const { process } = alertEcsData;
+  return {
+    ...getNewExceptionItem({ listId, namespaceType: listNamespace, ruleName }),
+    entries: addIdToEntries([
+      {
+        field: 'Memory_protection.feature',
+        operator: 'included',
+        type: 'match',
+        value: alertEcsData.Memory_protection?.feature ?? '',
+      },
+      {
+        field: 'process.executable.caseless',
+        operator: 'included',
+        type: 'match',
+        value: process?.executable ?? '',
+      },
+      {
+        field: 'process.name.caseless',
+        operator: 'included',
+        type: 'match',
+        value: process?.name ?? '',
+      },
+      {
+        field: 'process.hash.sha256',
+        operator: 'included',
+        type: 'match',
+        value: process?.hash?.sha256 ?? '',
+      },
+    ]),
+  };
+};
+export const getPrepopulatedMemoryShellcodeException = ({
+  listId,
+  ruleName,
+  eventCode,
+  listNamespace = 'agnostic',
+  alertEcsData,
+}: {
+  listId: string;
+  listNamespace?: NamespaceType;
+  ruleName: string;
+  eventCode: string;
+  alertEcsData: Flattened<Ecs>;
+}): ExceptionsBuilderExceptionItem => {
+  const { process, Target } = alertEcsData;
+  return {
+    ...getNewExceptionItem({ listId, namespaceType: listNamespace, ruleName }),
+    entries: addIdToEntries([
+      {
+        field: 'Memory_protection.feature',
+        operator: 'included',
+        type: 'match',
+        value: alertEcsData.Memory_protection?.feature ?? '',
+      },
+      {
+        field: 'Memory_protection.self_injection',
+        operator: 'included',
+        type: 'match',
+        value: String(alertEcsData.Memory_protection?.self_injection) ?? '',
+      },
+      {
+        field: 'process.executable.caseless',
+        operator: 'included',
+        type: 'match',
+        value: process?.executable ?? '',
+      },
+      {
+        field: 'process.name.caseless',
+        operator: 'included',
+        type: 'match',
+        value: process?.name ?? '',
+      },
+      {
+        field: 'process.Ext.token.integrity_level_name',
+        operator: 'included',
+        type: 'match',
+        value: process?.Ext?.token?.integrity_level_name ?? '',
+      },
+      {
+        field: 'Target.process.thread.Ext.start_address_details',
+        type: 'nested',
+        entries: [
+          {
+            field: 'allocation_type',
+            operator: 'included',
+            type: 'match',
+            value: Target?.process?.thread?.Ext?.start_address_details?.allocation_type ?? '',
+          },
+          {
+            field: 'allocation_size',
+            operator: 'included',
+            type: 'match',
+            value:
+              String(Target?.process?.thread?.Ext?.start_address_details?.allocation_size) ?? '',
+          },
+          {
+            field: 'region_size',
+            operator: 'included',
+            type: 'match',
+            value: String(Target?.process?.thread?.Ext?.start_address_details?.region_size) ?? '',
+          },
+          {
+            field: 'region_protection',
+            operator: 'included',
+            type: 'match',
+            value:
+              String(Target?.process?.thread?.Ext?.start_address_details?.region_protection) ?? '',
+          },
+          {
+            field: 'memory_pe.imphash',
+            operator: 'included',
+            type: 'match',
+            value:
+              String(Target?.process?.thread?.Ext?.start_address_details?.memory_pe?.imphash) ?? '',
+          },
+        ],
+      },
+    ]),
+  };
+};
 /**
  * Determines whether or not any entries within the given exceptionItems contain values not in the specified ECS mapping
  */
@@ -537,26 +670,45 @@ export const defaultEndpointExceptionItems = (
   const { event: alertEvent } = alertEcsData;
   const eventCode = alertEvent?.code ?? '';
 
-  if (eventCode === 'ransomware') {
-    return getProcessCodeSignature(alertEcsData).map((codeSignature) =>
-      getPrepopulatedRansomwareException({
-        listId,
-        ruleName,
-        eventCode,
-        codeSignature,
-        alertEcsData,
-      })
-    );
+  switch (eventCode) {
+    case 'memory_signature':
+      return [
+        getPrepopulatedMemorySignatureException({
+          listId,
+          ruleName,
+          eventCode,
+          alertEcsData,
+        }),
+      ];
+    case 'malicious_thread':
+      return [
+        getPrepopulatedMemoryShellcodeException({
+          listId,
+          ruleName,
+          eventCode,
+          alertEcsData,
+        }),
+      ];
+    case 'ransomware':
+      return getProcessCodeSignature(alertEcsData).map((codeSignature) =>
+        getPrepopulatedRansomwareException({
+          listId,
+          ruleName,
+          eventCode,
+          codeSignature,
+          alertEcsData,
+        })
+      );
+    default:
+      // By default return the standard prepopulated Endpoint Exception fields
+      return getFileCodeSignature(alertEcsData).map((codeSignature) =>
+        getPrepopulatedEndpointException({
+          listId,
+          ruleName,
+          eventCode,
+          codeSignature,
+          alertEcsData,
+        })
+      );
   }
-
-  // By default return the standard prepopulated Endpoint Exception fields
-  return getFileCodeSignature(alertEcsData).map((codeSignature) =>
-    getPrepopulatedEndpointException({
-      listId,
-      ruleName,
-      eventCode,
-      codeSignature,
-      alertEcsData,
-    })
-  );
 };
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/breadcrumbs/index.test.ts b/x-pack/plugins/security_solution/public/common/components/navigation/breadcrumbs/index.test.ts
index 1f7e668b21b98..f415dc287ca35 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/breadcrumbs/index.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/breadcrumbs/index.test.ts
@@ -323,8 +323,7 @@ describe('Navigation Breadcrumbs', () => {
         },
         {
           text: 'Create',
-          href:
-            "securitySolution/rules/create?sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-05-16T23:10:43.696Z',fromStr:now-24h,kind:relative,to:'2019-05-17T23:10:43.697Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2019-05-16T23:10:43.696Z',fromStr:now-24h,kind:relative,to:'2019-05-17T23:10:43.697Z',toStr:now)))",
+          href: '',
         },
       ]);
     });
@@ -382,7 +381,7 @@ describe('Navigation Breadcrumbs', () => {
         },
         {
           text: 'Edit',
-          href: `securitySolution/rules/id/${mockDetailName}/edit?sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-05-16T23:10:43.696Z',fromStr:now-24h,kind:relative,to:'2019-05-17T23:10:43.697Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2019-05-16T23:10:43.696Z',fromStr:now-24h,kind:relative,to:'2019-05-17T23:10:43.697Z',toStr:now)))`,
+          href: '',
         },
       ]);
     });
diff --git a/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx
index e8f382a5050d8..87a7ce805940f 100644
--- a/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx
@@ -39,6 +39,7 @@ const mockOptions = [
   { label: 'filebeat-*', value: 'filebeat-*' },
   { label: 'logs-*', value: 'logs-*' },
   { label: 'packetbeat-*', value: 'packetbeat-*' },
+  { label: 'traces-apm*', value: 'traces-apm*' },
   { label: 'winlogbeat-*', value: 'winlogbeat-*' },
 ];
 
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.test.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.test.ts
index 730857b6494d9..dd608138ef9f0 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.test.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.test.ts
@@ -23,6 +23,7 @@ describe('Sourcerer selectors', () => {
         'filebeat-*',
         'logs-*',
         'packetbeat-*',
+        'traces-apm*',
         'winlogbeat-*',
         '-*elastic-cloud-logs-*',
       ]);
@@ -42,6 +43,7 @@ describe('Sourcerer selectors', () => {
         'endgame-*',
         'filebeat-*',
         'packetbeat-*',
+        'traces-apm*',
         'winlogbeat-*',
       ]);
     });
@@ -64,6 +66,7 @@ describe('Sourcerer selectors', () => {
         'filebeat-*',
         'logs-endpoint.event-*',
         'packetbeat-*',
+        'traces-apm*',
         'winlogbeat-*',
       ]);
     });
diff --git a/x-pack/plugins/security_solution/public/common/utils/shorten_count_into_string.test.ts b/x-pack/plugins/security_solution/public/common/utils/shorten_count_into_string.test.ts
new file mode 100644
index 0000000000000..13699f5dc3060
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/utils/shorten_count_into_string.test.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { shortenCountIntoString } from './shorten_count_into_string';
+
+describe('utils', () => {
+  describe('shortenCountIntoString', () => {
+    it('should not change small numbers', () => {
+      expect(shortenCountIntoString(0)).toBe('0');
+      expect(shortenCountIntoString(9999)).toBe('9999');
+    });
+
+    it('should add K when appropriate', () => {
+      expect(shortenCountIntoString(10000)).toBe('10K');
+      expect(shortenCountIntoString(109000)).toBe('109K');
+      expect(shortenCountIntoString(109800)).toBe('109.8K');
+      expect(shortenCountIntoString(109897)).toBe('109.8K');
+    });
+
+    it('should add M when appropriate', () => {
+      expect(shortenCountIntoString(10000000)).toBe('10M');
+      expect(shortenCountIntoString(109000000)).toBe('109M');
+      expect(shortenCountIntoString(109800000)).toBe('109.8M');
+      expect(shortenCountIntoString(109890000)).toBe('109.8M');
+    });
+
+    it('should add B when appropriate', () => {
+      expect(shortenCountIntoString(10000000000)).toBe('10B');
+      expect(shortenCountIntoString(109000000000)).toBe('109B');
+      expect(shortenCountIntoString(109800000000)).toBe('109.8B');
+      expect(shortenCountIntoString(109890000000)).toBe('109.8B');
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/utils/shorten_count_into_string.ts b/x-pack/plugins/security_solution/public/common/utils/shorten_count_into_string.ts
new file mode 100644
index 0000000000000..63d2c8f597911
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/utils/shorten_count_into_string.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const shortenCountIntoString = (count: number): string => {
+  if (count < 10000) {
+    return count.toString();
+  }
+  const abbreviations = [
+    { magnitude: 1e18, unit: 'E' },
+    { magnitude: 1e15, unit: 'P' },
+    { magnitude: 1e12, unit: 'T' },
+    { magnitude: 1e9, unit: 'B' },
+    { magnitude: 1e6, unit: 'M' },
+    { magnitude: 1e3, unit: 'K' },
+  ];
+  const { magnitude, unit } = abbreviations.find(
+    (abbreviation) => count >= abbreviation.magnitude
+  ) ?? {
+    magnitude: 1,
+    unit: '',
+  };
+
+  return (
+    toFixedWithoutRounding(count / magnitude, 1).replace(/\.0+$|(\.[0-9]*[1-9])0+$/, '$1') + unit
+  );
+};
+
+const toFixedWithoutRounding = (n: number, p: number) => {
+  const result = n.toFixed(p);
+  return +result <= n ? result : (+result - Math.pow(0.1, p)).toFixed(p);
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/host_isolation/index.tsx b/x-pack/plugins/security_solution/public/detections/components/host_isolation/index.tsx
index 36443cc91f4e8..acbae367fe75e 100644
--- a/x-pack/plugins/security_solution/public/detections/components/host_isolation/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/host_isolation/index.tsx
@@ -7,11 +7,8 @@
 
 import React, { useMemo } from 'react';
 import { find } from 'lodash/fp';
-import { EuiText } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
 import { Maybe } from '../../../../../observability/common/typings';
 import { useCasesFromAlerts } from '../../containers/detection_engine/alerts/use_cases_from_alerts';
-import { CaseDetailsLink } from '../../../common/components/links';
 import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
 import { IsolateHost } from './isolate';
 import { UnisolateHost } from './unisolate';
@@ -45,53 +42,10 @@ export const HostIsolationPanel = React.memo(
 
     const { casesInfo } = useCasesFromAlerts({ alertId });
 
-    // Cases related components to be used in both isolate and unisolate actions from the alert details flyout entry point
-    const caseCount: number = useMemo(() => casesInfo.length, [casesInfo]);
-
-    const casesList = useMemo(
-      () =>
-        casesInfo.map((caseInfo, index) => {
-          return (
-            <li key={caseInfo.id}>
-              <CaseDetailsLink detailName={caseInfo.id}>
-                <FormattedMessage
-                  id="xpack.securitySolution.endpoint.hostIsolation.placeholderCase"
-                  defaultMessage="{caseName}"
-                  values={{ caseName: caseInfo.title }}
-                />
-              </CaseDetailsLink>
-            </li>
-          );
-        }),
-      [casesInfo]
-    );
-
-    const associatedCases = useMemo(() => {
-      if (caseCount > 0) {
-        return (
-          <>
-            <EuiText size="s">
-              <p>
-                <FormattedMessage
-                  id="xpack.securitySolution.endpoint.hostIsolation.successfulIsolation.cases"
-                  defaultMessage="This action has been attached to the following {caseCount, plural, one {case} other {cases}}:"
-                  values={{ caseCount }}
-                />
-              </p>
-            </EuiText>
-            <EuiText size="s">
-              <ul>{casesList}</ul>
-            </EuiText>
-          </>
-        );
-      }
-    }, [caseCount, casesList]);
-
     return isolateAction === 'isolateHost' ? (
       <IsolateHost
         endpointId={endpointId}
         hostName={hostName}
-        cases={associatedCases}
         casesInfo={casesInfo}
         cancelCallback={cancelCallback}
         successCallback={successCallback}
@@ -100,7 +54,6 @@ export const HostIsolationPanel = React.memo(
       <UnisolateHost
         endpointId={endpointId}
         hostName={hostName}
-        cases={associatedCases}
         casesInfo={casesInfo}
         cancelCallback={cancelCallback}
         successCallback={successCallback}
diff --git a/x-pack/plugins/security_solution/public/detections/components/host_isolation/isolate.tsx b/x-pack/plugins/security_solution/public/detections/components/host_isolation/isolate.tsx
index 75dd850c30f43..ac49984891443 100644
--- a/x-pack/plugins/security_solution/public/detections/components/host_isolation/isolate.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/host_isolation/isolate.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useMemo, useState, useCallback, ReactNode } from 'react';
+import React, { useMemo, useState, useCallback } from 'react';
 import { EuiSpacer } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { useHostIsolation } from '../../containers/detection_engine/alerts/use_host_isolation';
@@ -13,7 +13,7 @@ import { CASES_ASSOCIATED_WITH_ALERT, RETURN_TO_ALERT_DETAILS } from './translat
 import {
   EndpointIsolatedFormProps,
   EndpointIsolateForm,
-  EndpointIsolateSuccess,
+  ActionCompletionReturnButton,
 } from '../../../common/components/endpoint/host_isolation';
 import { CasesFromAlertsResponse } from '../../containers/detection_engine/alerts/types';
 
@@ -21,14 +21,12 @@ export const IsolateHost = React.memo(
   ({
     endpointId,
     hostName,
-    cases,
     casesInfo,
     cancelCallback,
     successCallback,
   }: {
     endpointId: string;
     hostName: string;
-    cases: ReactNode;
     casesInfo: CasesFromAlertsResponse;
     cancelCallback: () => void;
     successCallback?: () => void;
@@ -60,20 +58,14 @@ export const IsolateHost = React.memo(
 
     const caseCount: number = useMemo(() => casesInfo.length, [casesInfo]);
 
-    const hostIsolatedSuccess = useMemo(() => {
+    const hostIsolatedSuccessButton = useMemo(() => {
       return (
-        <>
-          <EuiSpacer size="m" />
-          <EndpointIsolateSuccess
-            hostName={hostName}
-            isolateAction="isolateHost"
-            completeButtonLabel={RETURN_TO_ALERT_DETAILS}
-            onComplete={backToAlertDetails}
-            additionalInfo={cases}
-          />
-        </>
+        <ActionCompletionReturnButton
+          onClick={backToAlertDetails}
+          buttonText={RETURN_TO_ALERT_DETAILS}
+        />
       );
-    }, [backToAlertDetails, hostName, cases]);
+    }, [backToAlertDetails]);
 
     const hostNotIsolated = useMemo(() => {
       return (
@@ -108,7 +100,7 @@ export const IsolateHost = React.memo(
       caseCount,
     ]);
 
-    return isIsolated ? hostIsolatedSuccess : hostNotIsolated;
+    return isIsolated ? hostIsolatedSuccessButton : hostNotIsolated;
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/host_isolation/take_action_dropdown.tsx b/x-pack/plugins/security_solution/public/detections/components/host_isolation/take_action_dropdown.tsx
index a10ad901441ea..1404f7927d6ec 100644
--- a/x-pack/plugins/security_solution/public/detections/components/host_isolation/take_action_dropdown.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/host_isolation/take_action_dropdown.tsx
@@ -10,6 +10,7 @@ import { EuiContextMenuItem, EuiContextMenuPanel, EuiButton, EuiPopover } from '
 import { ISOLATE_HOST, UNISOLATE_HOST } from './translations';
 import { TAKE_ACTION } from '../alerts_table/alerts_utility_bar/translations';
 import { useHostIsolationStatus } from '../../containers/detection_engine/alerts/use_host_isolation_status';
+import { HostStatus } from '../../../../common/endpoint/types';
 
 export const TakeActionDropdown = React.memo(
   ({
@@ -19,7 +20,9 @@ export const TakeActionDropdown = React.memo(
     onChange: (action: 'isolateHost' | 'unisolateHost') => void;
     agentId: string;
   }) => {
-    const { loading, isIsolated: isolationStatus } = useHostIsolationStatus({ agentId });
+    const { loading, isIsolated: isolationStatus, agentStatus } = useHostIsolationStatus({
+      agentId,
+    });
     const [isPopoverOpen, setIsPopoverOpen] = useState(false);
 
     const closePopoverHandler = useCallback(() => {
@@ -41,7 +44,7 @@ export const TakeActionDropdown = React.memo(
           iconSide="right"
           fill
           iconType="arrowDown"
-          disabled={loading}
+          disabled={loading || agentStatus === HostStatus.UNENROLLED}
           onClick={() => {
             setIsPopoverOpen(!isPopoverOpen);
           }}
@@ -49,7 +52,7 @@ export const TakeActionDropdown = React.memo(
           {TAKE_ACTION}
         </EuiButton>
       );
-    }, [isPopoverOpen, loading]);
+    }, [isPopoverOpen, loading, agentStatus]);
 
     return (
       <EuiPopover
diff --git a/x-pack/plugins/security_solution/public/detections/components/host_isolation/unisolate.tsx b/x-pack/plugins/security_solution/public/detections/components/host_isolation/unisolate.tsx
index 2b810dc16eec8..5cc862694bef8 100644
--- a/x-pack/plugins/security_solution/public/detections/components/host_isolation/unisolate.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/host_isolation/unisolate.tsx
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import React, { useMemo, useState, useCallback, ReactNode } from 'react';
+import React, { useMemo, useState, useCallback } from 'react';
 import { EuiSpacer } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { CASES_ASSOCIATED_WITH_ALERT, RETURN_TO_ALERT_DETAILS } from './translations';
 import {
   EndpointIsolatedFormProps,
-  EndpointIsolateSuccess,
   EndpointUnisolateForm,
+  ActionCompletionReturnButton,
 } from '../../../common/components/endpoint/host_isolation';
 import { useHostUnisolation } from '../../containers/detection_engine/alerts/use_host_unisolation';
 import { CasesFromAlertsResponse } from '../../containers/detection_engine/alerts/types';
@@ -21,14 +21,12 @@ export const UnisolateHost = React.memo(
   ({
     endpointId,
     hostName,
-    cases,
     casesInfo,
     cancelCallback,
     successCallback,
   }: {
     endpointId: string;
     hostName: string;
-    cases: ReactNode;
     casesInfo: CasesFromAlertsResponse;
     cancelCallback: () => void;
     successCallback?: () => void;
@@ -60,20 +58,14 @@ export const UnisolateHost = React.memo(
 
     const caseCount: number = useMemo(() => casesInfo.length, [casesInfo]);
 
-    const hostUnisolatedSuccess = useMemo(() => {
+    const hostUnisolatedSuccessButton = useMemo(() => {
       return (
-        <>
-          <EuiSpacer size="m" />
-          <EndpointIsolateSuccess
-            hostName={hostName}
-            isolateAction="unisolateHost"
-            completeButtonLabel={RETURN_TO_ALERT_DETAILS}
-            onComplete={backToAlertDetails}
-            additionalInfo={cases}
-          />
-        </>
+        <ActionCompletionReturnButton
+          onClick={backToAlertDetails}
+          buttonText={RETURN_TO_ALERT_DETAILS}
+        />
       );
-    }, [backToAlertDetails, hostName, cases]);
+    }, [backToAlertDetails]);
 
     const hostNotUnisolated = useMemo(() => {
       return (
@@ -108,7 +100,7 @@ export const UnisolateHost = React.memo(
       caseCount,
     ]);
 
-    return isUnIsolated ? hostUnisolatedSuccess : hostNotUnisolated;
+    return isUnIsolated ? hostUnisolatedSuccessButton : hostNotUnisolated;
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx
index 3467b34d47135..1dd59d49e4ff5 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx
@@ -13,6 +13,7 @@ import {
   FormSchema,
   ValidationFunc,
   ERROR_CODE,
+  VALIDATION_TYPES,
 } from '../../../../shared_imports';
 import { AboutStepRule } from '../../../pages/detection_engine/rules/types';
 import { OptionalFieldLabel } from '../optional_field_label';
@@ -38,6 +39,20 @@ export const schema: FormSchema<AboutStepRule> = {
       }
     ),
     labelAppend: OptionalFieldLabel,
+    validations: [
+      {
+        validator: emptyField(
+          i18n.translate(
+            'xpack.securitySolution.detectionEngine.createRule.stepAboutRule.authorFieldEmptyError',
+            {
+              defaultMessage: 'An author must not be empty',
+            }
+          )
+        ),
+        type: VALIDATION_TYPES.ARRAY_ITEM,
+        isBlocking: false,
+      },
+    ],
   },
   name: {
     type: FIELD_TYPES.TEXT,
@@ -243,6 +258,20 @@ export const schema: FormSchema<AboutStepRule> = {
       }
     ),
     labelAppend: OptionalFieldLabel,
+    validations: [
+      {
+        validator: emptyField(
+          i18n.translate(
+            'xpack.securitySolution.detectionEngine.createRule.stepAboutRule.tagFieldEmptyError',
+            {
+              defaultMessage: 'A tag must not be empty',
+            }
+          )
+        ),
+        type: VALIDATION_TYPES.ARRAY_ITEM,
+        isBlocking: false,
+      },
+    ],
   },
   note: {
     type: FIELD_TYPES.TEXTAREA,
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/mock.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/mock.ts
index e4bddfba8278b..7aba8fa4ac10f 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/mock.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/mock.ts
@@ -175,6 +175,7 @@ export const alertsMock: AlertSearchResponse<unknown, unknown> = {
               immutable: false,
               index: [
                 'apm-*-transaction*',
+                'traces-apm*',
                 'auditbeat-*',
                 'endgame-*',
                 'filebeat-*',
@@ -414,6 +415,7 @@ export const alertsMock: AlertSearchResponse<unknown, unknown> = {
               immutable: false,
               index: [
                 'apm-*-transaction*',
+                'traces-apm*',
                 'auditbeat-*',
                 'endgame-*',
                 'filebeat-*',
@@ -619,6 +621,7 @@ export const alertsMock: AlertSearchResponse<unknown, unknown> = {
               immutable: false,
               index: [
                 'apm-*-transaction*',
+                'traces-apm*',
                 'auditbeat-*',
                 'endgame-*',
                 'filebeat-*',
@@ -822,6 +825,7 @@ export const alertsMock: AlertSearchResponse<unknown, unknown> = {
               immutable: false,
               index: [
                 'apm-*-transaction*',
+                'traces-apm*',
                 'auditbeat-*',
                 'endgame-*',
                 'filebeat-*',
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/translations.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/translations.ts
index d5234e719b869..ed6a22375a776 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/translations.ts
@@ -37,13 +37,3 @@ export const CASES_FROM_ALERTS_FAILURE = i18n.translate(
   'xpack.securitySolution.endpoint.hostIsolation.casesFromAlerts.title',
   { defaultMessage: 'Failed to find associated cases' }
 );
-
-export const ISOLATION_STATUS_FAILURE = i18n.translate(
-  'xpack.securitySolution.endpoint.hostIsolation.isolationStatus.title',
-  { defaultMessage: 'Failed to retrieve current isolation status' }
-);
-
-export const ISOLATION_PENDING_FAILURE = i18n.translate(
-  'xpack.securitySolution.endpoint.hostIsolation.isolationPending.title',
-  { defaultMessage: 'Failed to retrieve isolation pending statuses' }
-);
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_host_isolation_status.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_host_isolation_status.tsx
index 259a377b10b79..6a40898d0a109 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_host_isolation_status.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_host_isolation_status.tsx
@@ -7,9 +7,7 @@
 
 import { isEmpty } from 'lodash';
 import { useEffect, useState } from 'react';
-import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
 import { getHostMetadata } from './api';
-import { ISOLATION_STATUS_FAILURE, ISOLATION_PENDING_FAILURE } from './translations';
 import { fetchPendingActionsByAgentId } from '../../../../common/lib/endpoint_pending_actions';
 import { isEndpointHostIsolated } from '../../../../common/utils/validators';
 import { HostStatus } from '../../../../../common/endpoint/types';
@@ -17,7 +15,7 @@ import { HostStatus } from '../../../../../common/endpoint/types';
 interface HostIsolationStatusResponse {
   loading: boolean;
   isIsolated: boolean;
-  agentStatus: HostStatus;
+  agentStatus: HostStatus | undefined;
   pendingIsolation: number;
   pendingUnisolation: number;
 }
@@ -30,13 +28,11 @@ export const useHostIsolationStatus = ({
   agentId: string;
 }): HostIsolationStatusResponse => {
   const [isIsolated, setIsIsolated] = useState<boolean>(false);
-  const [agentStatus, setAgentStatus] = useState<HostStatus>(HostStatus.UNHEALTHY);
+  const [agentStatus, setAgentStatus] = useState<HostStatus>();
   const [pendingIsolation, setPendingIsolation] = useState(0);
   const [pendingUnisolation, setPendingUnisolation] = useState(0);
   const [loading, setLoading] = useState(false);
 
-  const { addError } = useAppToasts();
-
   useEffect(() => {
     const abortCtrl = new AbortController();
     // isMounted tracks if a component is mounted before changing state
@@ -55,7 +51,10 @@ export const useHostIsolationStatus = ({
         if (error.name === 'AbortError') {
           return;
         }
-        addError(error.message, { title: ISOLATION_STATUS_FAILURE });
+
+        if (isMounted && error.body.statusCode === 404) {
+          setAgentStatus(HostStatus.UNENROLLED);
+        }
       }
 
       try {
@@ -65,7 +64,8 @@ export const useHostIsolationStatus = ({
           setPendingUnisolation(data[0].pending_actions?.unisolate ?? 0);
         }
       } catch (error) {
-        addError(error.message, { title: ISOLATION_PENDING_FAILURE });
+        // silently catch non-user initiated error
+        return;
       }
 
       if (isMounted) {
@@ -87,6 +87,6 @@ export const useHostIsolationStatus = ({
       isMounted = false;
       abortCtrl.abort();
     };
-  }, [addError, agentId]);
+  }, [agentId]);
   return { loading, isIsolated, agentStatus, pendingIsolation, pendingUnisolation };
 };
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/mock.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/mock.ts
index 1104cb86064b0..533ab6138cb09 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/mock.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/mock.ts
@@ -20,6 +20,7 @@ export const savedRuleMock: Rule = {
   id: '12345678987654321',
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule.test.tsx
index ca6cd5b11f705..096463872fc01 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule.test.tsx
@@ -54,6 +54,7 @@ describe('useRule', () => {
           immutable: false,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_status.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_status.test.tsx
index 3394f1fc553ae..4d01e2ff00ec1 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_status.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_status.test.tsx
@@ -43,6 +43,7 @@ const testRule: Rule = {
   immutable: false,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_with_fallback.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_with_fallback.test.tsx
index abd5a2781c8a7..1f08a35660215 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_with_fallback.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_with_fallback.test.tsx
@@ -62,6 +62,7 @@ describe('useRuleWithFallback', () => {
             "immutable": false,
             "index": Array [
               "apm-*-transaction*",
+              "traces-apm*",
               "auditbeat-*",
               "endgame-*",
               "filebeat-*",
@@ -125,6 +126,7 @@ describe('useRuleWithFallback', () => {
             "immutable": false,
             "index": Array [
               "apm-*-transaction*",
+              "traces-apm*",
               "auditbeat-*",
               "endgame-*",
               "filebeat-*",
diff --git a/x-pack/plugins/security_solution/public/detections/mitre/mitre_tactics_techniques.ts b/x-pack/plugins/security_solution/public/detections/mitre/mitre_tactics_techniques.ts
index a5da747787ba6..f28311d9c96e7 100644
--- a/x-pack/plugins/security_solution/public/detections/mitre/mitre_tactics_techniques.ts
+++ b/x-pack/plugins/security_solution/public/detections/mitre/mitre_tactics_techniques.ts
@@ -10143,7 +10143,7 @@ export const subtechniquesOptions: MitreSubtechniquesOptions[] = [
  *
  * Is built alongside and sampled from the data in the file so to always be valid with the most up to date MITRE ATT&CK data
  */
-export const mockThreatData = {
+export const getMockThreatData = () => ({
   tactic: {
     name: 'Privilege Escalation',
     id: 'TA0004',
@@ -10162,4 +10162,4 @@ export const mockThreatData = {
     tactics: ['privilege-escalation', 'persistence'],
     techniqueId: 'T1546',
   },
-};
+});
diff --git a/x-pack/plugins/security_solution/public/detections/mitre/valid_threat_mock.ts b/x-pack/plugins/security_solution/public/detections/mitre/valid_threat_mock.ts
index a7de7494e1116..743b143213c22 100644
--- a/x-pack/plugins/security_solution/public/detections/mitre/valid_threat_mock.ts
+++ b/x-pack/plugins/security_solution/public/detections/mitre/valid_threat_mock.ts
@@ -6,9 +6,9 @@
  */
 
 import { Threats } from '@kbn/securitysolution-io-ts-alerting-types';
-import { mockThreatData } from './mitre_tactics_techniques';
+import { getMockThreatData } from './mitre_tactics_techniques';
 
-const { tactic, technique, subtechnique } = mockThreatData;
+const { tactic, technique, subtechnique } = getMockThreatData();
 const { tactics, ...mockTechnique } = technique;
 const { tactics: subtechniqueTactics, ...mockSubtechnique } = subtechnique;
 
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts
index bbc085eaa0be8..92c828b6cbf79 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts
@@ -11,8 +11,6 @@ import { ChromeBreadcrumb } from '../../../../../../../../src/core/public';
 import {
   getRulesUrl,
   getRuleDetailsUrl,
-  getCreateRuleUrl,
-  getEditRuleUrl,
 } from '../../../../common/components/link_to/redirect_to_detection_engine';
 import * as i18nRules from './translations';
 import { RouteSpyState } from '../../../../common/utils/route/types';
@@ -79,10 +77,7 @@ export const getBreadcrumbs = (
       ...breadcrumb,
       {
         text: i18nRules.ADD_PAGE_TITLE,
-        href: getUrlForApp(APP_ID, {
-          deepLinkId: SecurityPageName.rules,
-          path: getCreateRuleUrl(!isEmpty(search[0]) ? search[0] : ''),
-        }),
+        href: '',
       },
     ];
   }
@@ -92,10 +87,7 @@ export const getBreadcrumbs = (
       ...breadcrumb,
       {
         text: i18nRules.EDIT_PAGE_TITLE,
-        href: getUrlForApp(APP_ID, {
-          deepLinkId: SecurityPageName.rules,
-          path: getEditRuleUrl(params.detailName, !isEmpty(search[0]) ? search[0] : ''),
-        }),
+        href: '',
       },
     ];
   }
diff --git a/x-pack/plugins/security_solution/public/management/common/routing.ts b/x-pack/plugins/security_solution/public/management/common/routing.ts
index 9cb25dd4bb5a5..e6c02ffefa3c5 100644
--- a/x-pack/plugins/security_solution/public/management/common/routing.ts
+++ b/x-pack/plugins/security_solution/public/management/common/routing.ts
@@ -81,6 +81,9 @@ export const getEndpointDetailsPath = (
   const queryParams: EndpointDetailsUrlProps = { ...rest };
 
   switch (props.name) {
+    case 'endpointDetails':
+      queryParams.show = 'details';
+      break;
     case 'endpointIsolate':
       queryParams.show = 'isolate';
       break;
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
index 3fe6821abbcbe..b92a1958a57ac 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
@@ -15,7 +15,7 @@ import {
 } from '../../../../../common/endpoint/types';
 import { ServerApiError } from '../../../../common/types';
 import { GetPolicyListResponse } from '../../policy/types';
-import { EndpointIndexUIQueryParams, EndpointState } from '../types';
+import { EndpointState } from '../types';
 import { IIndexPattern } from '../../../../../../../../src/plugins/data/public';
 
 export interface ServerReturnedEndpointList {
@@ -173,11 +173,6 @@ export interface EndpointDetailsActivityLogUpdateIsInvalidDateRange {
   };
 }
 
-export interface EndpointDetailsFlyoutTabChanged {
-  type: 'endpointDetailsFlyoutTabChanged';
-  payload: { flyoutView: EndpointIndexUIQueryParams['show'] };
-}
-
 export type EndpointAction =
   | ServerReturnedEndpointList
   | ServerFailedToReturnEndpointList
@@ -185,7 +180,6 @@ export type EndpointAction =
   | ServerFailedToReturnEndpointDetails
   | EndpointDetailsActivityLogUpdatePaging
   | EndpointDetailsActivityLogUpdateIsInvalidDateRange
-  | EndpointDetailsFlyoutTabChanged
   | EndpointDetailsActivityLogChanged
   | ServerReturnedEndpointPolicyResponse
   | ServerFailedToReturnEndpointPolicyResponse
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/builders.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/builders.ts
index 384a7b999d826..78da5ec54a44a 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/builders.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/builders.ts
@@ -19,7 +19,6 @@ export const initialEndpointPageState = (): Immutable<EndpointState> => {
     loading: false,
     error: undefined,
     endpointDetails: {
-      flyoutView: undefined,
       activityLog: {
         paging: {
           disabled: false,
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts
index a9c65c74015c6..1091d9a1a6478 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts
@@ -42,7 +42,6 @@ describe('EndpointList store concerns', () => {
         loading: false,
         error: undefined,
         endpointDetails: {
-          flyoutView: undefined,
           activityLog: {
             paging: {
               disabled: false,
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts
index a123f06f62f96..4ef67065a7174 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts
@@ -44,7 +44,6 @@ import {
 } from '../../../../common/lib/endpoint_isolation/mocks';
 import { FleetActionGenerator } from '../../../../../common/endpoint/data_generators/fleet_action_generator';
 import { endpointPageHttpMock } from '../mocks';
-import { EndpointDetailsTabsTypes } from '../view/details/components/endpoint_details_tabs';
 
 jest.mock('../../policy/store/services/ingest', () => ({
   sendGetAgentConfigList: () => Promise.resolve({ items: [] }),
@@ -221,20 +220,12 @@ describe('endpoint list middleware', () => {
   describe('handle ActivityLog State Change actions', () => {
     const endpointList = getEndpointListApiResponse();
     const search = getEndpointDetailsPath({
-      name: 'endpointDetails',
+      name: 'endpointActivityLog',
       selected_endpoint: endpointList.hosts[0].metadata.agent.id,
     });
     const dispatchUserChangedUrl = () => {
       dispatchUserChangedUrlToEndpointList({ search: `?${search.split('?').pop()}` });
     };
-    const dispatchFlyoutViewChange = () => {
-      dispatch({
-        type: 'endpointDetailsFlyoutTabChanged',
-        payload: {
-          flyoutView: EndpointDetailsTabsTypes.activityLog,
-        },
-      });
-    };
 
     const fleetActionGenerator = new FleetActionGenerator('seed');
     const actionData = fleetActionGenerator.generate({
@@ -274,7 +265,6 @@ describe('endpoint list middleware', () => {
 
     it('should set ActivityLog state to loading', async () => {
       dispatchUserChangedUrl();
-      dispatchFlyoutViewChange();
 
       const loadingDispatched = waitForAction('endpointDetailsActivityLogChanged', {
         validate(action) {
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
index 922f10cee2f8b..32e0fa8258637 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
@@ -34,8 +34,8 @@ import {
   getActivityLogDataPaging,
   getLastLoadedActivityLogData,
   detailsData,
-  getEndpointDetailsFlyoutView,
   getIsEndpointPackageInfoUninitialized,
+  getIsOnEndpointDetailsActivityLog,
 } from './selectors';
 import { AgentIdsPendingActions, EndpointState, PolicyIds } from '../types';
 import {
@@ -63,7 +63,6 @@ import { AppAction } from '../../../../common/store/actions';
 import { resolvePathVariables } from '../../../../common/utils/resolve_path_variables';
 import { EndpointPackageInfoStateChanged } from './action';
 import { fetchPendingActionsByAgentId } from '../../../../common/lib/endpoint_pending_actions';
-import { EndpointDetailsTabsTypes } from '../view/details/components/endpoint_details_tabs';
 import { getIsInvalidDateRange } from '../utils';
 
 type EndpointPageStore = ImmutableMiddlewareAPI<EndpointState, AppAction>;
@@ -369,7 +368,7 @@ export const endpointMiddlewareFactory: ImmutableMiddlewareFactory<EndpointState
     if (
       action.type === 'userChangedUrl' &&
       hasSelectedEndpoint(getState()) === true &&
-      getEndpointDetailsFlyoutView(getState()) === EndpointDetailsTabsTypes.activityLog
+      getIsOnEndpointDetailsActivityLog(getState())
     ) {
       // call the activity log api
       dispatch({
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts
index c6bf13a3b5715..029f49b64d3c3 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts
@@ -14,6 +14,7 @@ import {
   isOnEndpointPage,
   hasSelectedEndpoint,
   uiQueryParams,
+  getIsOnEndpointDetailsActivityLog,
   getCurrentIsolationRequestState,
 } from './selectors';
 import { EndpointState } from '../types';
@@ -190,14 +191,6 @@ export const endpointListReducer: StateReducer = (state = initialEndpointPageSta
         },
       },
     };
-  } else if (action.type === 'endpointDetailsFlyoutTabChanged') {
-    return {
-      ...state,
-      endpointDetails: {
-        ...state.endpointDetails!,
-        flyoutView: action.payload.flyoutView,
-      },
-    };
   } else if (action.type === 'endpointDetailsActivityLogChanged') {
     return handleEndpointDetailsActivityLogChanged(state, action);
   } else if (action.type === 'endpointPendingActionsStateChanged') {
@@ -289,6 +282,19 @@ export const endpointListReducer: StateReducer = (state = initialEndpointPageSta
     const wasPreviouslyOnListPage = isOnEndpointPage(state) && !hasSelectedEndpoint(state);
     const isCurrentlyOnDetailsPage = isOnEndpointPage(newState) && hasSelectedEndpoint(newState);
     const wasPreviouslyOnDetailsPage = isOnEndpointPage(state) && hasSelectedEndpoint(state);
+    const wasPreviouslyOnActivityLogPage =
+      isOnEndpointPage(state) &&
+      hasSelectedEndpoint(state) &&
+      getIsOnEndpointDetailsActivityLog(state);
+    const isCurrentlyOnActivityLogPage =
+      isOnEndpointPage(newState) &&
+      hasSelectedEndpoint(newState) &&
+      getIsOnEndpointDetailsActivityLog(newState);
+
+    const isNotLoadingDetails =
+      isCurrentlyOnActivityLogPage ||
+      (wasPreviouslyOnActivityLogPage &&
+        uiQueryParams(state).selected_endpoint === uiQueryParams(newState).selected_endpoint);
 
     const stateUpdates: Partial<EndpointState> = {
       location: action.payload,
@@ -343,7 +349,7 @@ export const endpointListReducer: StateReducer = (state = initialEndpointPageSta
             activityLog,
             hostDetails: {
               ...state.endpointDetails.hostDetails,
-              detailsLoading: true,
+              detailsLoading: !isNotLoadingDetails,
               detailsError: undefined,
             },
           },
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts
index 4287cf9a109ea..d0126aa3a9489 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts
@@ -38,6 +38,7 @@ import {
 import { ServerApiError } from '../../../../common/types';
 import { isEndpointHostIsolated } from '../../../../common/utils/validators';
 import { EndpointHostIsolationStatusProps } from '../../../../common/components/endpoint/host_isolation';
+import { EndpointDetailsTabsTypes } from '../view/details/components/endpoint_details_tabs';
 
 export const listData = (state: Immutable<EndpointState>) => state.hosts;
 
@@ -362,9 +363,11 @@ export const getIsolationRequestError: (
   }
 });
 
-export const getEndpointDetailsFlyoutView = (
+export const getIsOnEndpointDetailsActivityLog: (
   state: Immutable<EndpointState>
-): EndpointIndexUIQueryParams['show'] => state.endpointDetails.flyoutView;
+) => boolean = createSelector(uiQueryParams, (searchParams) => {
+  return searchParams.show === EndpointDetailsTabsTypes.activityLog;
+});
 
 export const getActivityLogDataPaging = (
   state: Immutable<EndpointState>
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
index 875841cb55b73..3882ab74f8573 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
@@ -36,7 +36,6 @@ export interface EndpointState {
   /** api error from retrieving host list */
   error?: ServerApiError;
   endpointDetails: {
-    flyoutView: EndpointIndexUIQueryParams['show'];
     activityLog: {
       paging: {
         disabled?: boolean;
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/endpoint_details_tabs.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/endpoint_details_tabs.tsx
index 73a3734e4ca88..a6e571dbd7df9 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/endpoint_details_tabs.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/endpoint_details_tabs.tsx
@@ -6,16 +6,18 @@
  */
 
 import { useDispatch } from 'react-redux';
-import React, { memo, useCallback, useMemo, useState } from 'react';
+import React, { memo, useCallback, useMemo } from 'react';
 import { EuiTab, EuiTabs, EuiFlyoutBody, EuiTabbedContentTab, EuiSpacer } from '@elastic/eui';
 import { EndpointIndexUIQueryParams } from '../../../types';
 import { EndpointAction } from '../../../store/action';
 import { useEndpointSelector } from '../../hooks';
 import { getActivityLogDataPaging } from '../../../store/selectors';
 import { EndpointDetailsFlyoutHeader } from './flyout_header';
+import { useNavigateByRouterEventHandler } from '../../../../../../common/hooks/endpoint/use_navigate_by_router_event_handler';
+import { useAppUrl } from '../../../../../../common/lib/kibana';
 
 export enum EndpointDetailsTabsTypes {
-  overview = 'overview',
+  overview = 'details',
   activityLog = 'activity_log',
 }
 
@@ -27,34 +29,52 @@ interface EndpointDetailsTabs {
   id: string;
   name: string;
   content: JSX.Element;
+  route: string;
 }
 
+const EndpointDetailsTab = memo(
+  ({
+    tab,
+    isSelected,
+    handleTabClick,
+  }: {
+    tab: EndpointDetailsTabs;
+    isSelected: boolean;
+    handleTabClick: () => void;
+  }) => {
+    const { getAppUrl } = useAppUrl();
+    const onClick = useNavigateByRouterEventHandler(tab.route, handleTabClick);
+    return (
+      <EuiTab
+        href={getAppUrl({ path: tab.route })}
+        onClick={onClick}
+        isSelected={isSelected}
+        key={tab.id}
+        data-test-subj={tab.id}
+      >
+        {tab.name}
+      </EuiTab>
+    );
+  }
+);
+
+EndpointDetailsTab.displayName = 'EndpointDetailsTab';
+
 export const EndpointDetailsFlyoutTabs = memo(
   ({
     hostname,
     show,
     tabs,
   }: {
-    hostname?: string;
+    hostname: string;
     show: EndpointIndexUIQueryParams['show'];
     tabs: EndpointDetailsTabs[];
   }) => {
     const dispatch = useDispatch<(action: EndpointAction) => void>();
     const { pageSize } = useEndpointSelector(getActivityLogDataPaging);
-    const [selectedTabId, setSelectedTabId] = useState<EndpointDetailsTabsId>(() => {
-      return show === 'details'
-        ? EndpointDetailsTabsTypes.overview
-        : EndpointDetailsTabsTypes.activityLog;
-    });
 
     const handleTabClick = useCallback(
       (tab: EuiTabbedContentTab) => {
-        dispatch({
-          type: 'endpointDetailsFlyoutTabChanged',
-          payload: {
-            flyoutView: tab.id as EndpointIndexUIQueryParams['show'],
-          },
-        });
         if (tab.id === EndpointDetailsTabsTypes.activityLog) {
           dispatch({
             type: 'endpointDetailsActivityLogUpdatePaging',
@@ -67,25 +87,18 @@ export const EndpointDetailsFlyoutTabs = memo(
             },
           });
         }
-        return setSelectedTabId(tab.id as EndpointDetailsTabsId);
       },
-      [dispatch, pageSize, setSelectedTabId]
+      [dispatch, pageSize]
     );
 
-    const selectedTab = useMemo(() => tabs.find((tab) => tab.id === selectedTabId), [
-      tabs,
-      selectedTabId,
-    ]);
+    const selectedTab = useMemo(() => tabs.find((tab) => tab.id === show), [tabs, show]);
 
     const renderTabs = tabs.map((tab) => (
-      <EuiTab
-        onClick={() => handleTabClick(tab)}
-        isSelected={tab.id === selectedTabId}
-        key={tab.id}
-        data-test-subj={tab.id}
-      >
-        {tab.name}
-      </EuiTab>
+      <EndpointDetailsTab
+        tab={tab}
+        handleTabClick={() => handleTabClick(tab)}
+        isSelected={tab.id === selectedTab?.id}
+      />
     ));
 
     return (
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/endpoint_isolate_flyout_panel.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/endpoint_isolate_flyout_panel.tsx
index 289c1efeab041..527189a3ef394 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/endpoint_isolate_flyout_panel.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/endpoint_isolate_flyout_panel.tsx
@@ -9,8 +9,8 @@ import React, { memo, useCallback, useState } from 'react';
 import { useHistory } from 'react-router-dom';
 import { useDispatch } from 'react-redux';
 import { Dispatch } from 'redux';
-import { i18n } from '@kbn/i18n';
 import { EuiForm } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 import { HostMetadata } from '../../../../../../../common/endpoint/types';
 import { BackToEndpointDetailsFlyoutSubHeader } from './back_to_endpoint_details_flyout_subheader';
 import {
@@ -18,6 +18,7 @@ import {
   EndpointIsolateForm,
   EndpointIsolateSuccess,
   EndpointUnisolateForm,
+  ActionCompletionReturnButton,
 } from '../../../../../../common/components/endpoint/host_isolation';
 import { FlyoutBodyNoTopPadding } from './flyout_body_no_top_padding';
 import { getEndpointDetailsPath } from '../../../../../common/routing';
@@ -88,16 +89,20 @@ export const EndpointIsolationFlyoutPanel = memo<{
     <>
       <BackToEndpointDetailsFlyoutSubHeader endpointId={hostMeta.agent.id} />
 
+      {wasSuccessful && (
+        <EndpointIsolateSuccess
+          hostName={hostMeta.host.name}
+          isolateAction={isCurrentlyIsolated ? 'unisolateHost' : 'isolateHost'}
+        />
+      )}
       <FlyoutBodyNoTopPadding>
         {wasSuccessful ? (
-          <EndpointIsolateSuccess
-            hostName={hostMeta.host.name}
-            isolateAction={isCurrentlyIsolated ? 'unisolateHost' : 'isolateHost'}
-            completeButtonLabel={i18n.translate(
+          <ActionCompletionReturnButton
+            onClick={handleCancel}
+            buttonText={i18n.translate(
               'xpack.securitySolution.endpoint.hostIsolation.successProceedButton',
               { defaultMessage: 'Return to endpoint details' }
             )}
-            onComplete={handleCancel}
           />
         ) : (
           <EuiForm
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/endpoints.stories.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/endpoints.stories.tsx
index d3c91f6f18499..372bd4491d7d4 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/endpoints.stories.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/endpoints.stories.tsx
@@ -120,16 +120,21 @@ export default {
 export const Tabs = () => (
   <EndpointDetailsFlyoutTabs
     show="details"
+    hostname="endpoint-name-01"
     tabs={[
       {
         id: 'overview',
         name: 'Overview',
         content: <>{'Endpoint Details'}</>,
+        route:
+          '/administration/endpoints?page_index=0&page_size=10&selected_endpoint=endpoint-id-00001010&show=details',
       },
       {
         id: 'activity_log',
         name: 'Activity Log',
         content: ActivityLogMarkup(),
+        route:
+          '/administration/endpoints?page_index=0&page_size=10&selected_endpoint=endpoint-id-00001010&show=activity_log',
       },
     ]}
   />
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/index.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/index.tsx
index edfa410ee5237..d3fc812f6317b 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/index.tsx
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { useDispatch } from 'react-redux';
 import React, { useCallback, useEffect, useMemo, memo } from 'react';
 import {
   EuiFlyout,
@@ -51,14 +50,11 @@ import { PreferenceFormattedDateFromPrimitive } from '../../../../../common/comp
 import { EndpointIsolationFlyoutPanel } from './components/endpoint_isolate_flyout_panel';
 import { BackToEndpointDetailsFlyoutSubHeader } from './components/back_to_endpoint_details_flyout_subheader';
 import { FlyoutBodyNoTopPadding } from './components/flyout_body_no_top_padding';
-import { getEndpointListPath } from '../../../../common/routing';
+import { getEndpointListPath, getEndpointDetailsPath } from '../../../../common/routing';
 import { ActionsMenu } from './components/actions_menu';
-import { EndpointIndexUIQueryParams } from '../../types';
-import { EndpointAction } from '../../store/action';
 import { EndpointDetailsFlyoutHeader } from './components/flyout_header';
 
 export const EndpointDetailsFlyout = memo(() => {
-  const dispatch = useDispatch<(action: EndpointAction) => void>();
   const history = useHistory();
   const toasts = useToasts();
   const queryParams = useEndpointSelector(uiQueryParams);
@@ -75,18 +71,6 @@ export const EndpointDetailsFlyout = memo(() => {
   const hostStatus = useEndpointSelector(hostStatusInfo);
   const show = useEndpointSelector(showView);
 
-  const setFlyoutView = useCallback(
-    (flyoutView: EndpointIndexUIQueryParams['show']) => {
-      dispatch({
-        type: 'endpointDetailsFlyoutTabChanged',
-        payload: {
-          flyoutView,
-        },
-      });
-    },
-    [dispatch]
-  );
-
   const ContentLoadingMarkup = useMemo(
     () => (
       <>
@@ -98,23 +82,40 @@ export const EndpointDetailsFlyout = memo(() => {
     []
   );
 
-  const tabs = [
-    {
-      id: EndpointDetailsTabsTypes.overview,
-      name: i18.OVERVIEW,
-      content:
-        hostDetails === undefined ? (
-          ContentLoadingMarkup
-        ) : (
-          <EndpointDetails details={hostDetails} policyInfo={policyInfo} hostStatus={hostStatus} />
-        ),
-    },
-    {
-      id: EndpointDetailsTabsTypes.activityLog,
-      name: i18.ACTIVITY_LOG.tabTitle,
-      content: <EndpointActivityLog activityLog={activityLog} />,
-    },
-  ];
+  const getTabs = useCallback(
+    (id: string) => [
+      {
+        id: EndpointDetailsTabsTypes.overview,
+        name: i18.OVERVIEW,
+        route: getEndpointDetailsPath({
+          ...queryParams,
+          name: 'endpointDetails',
+          selected_endpoint: id,
+        }),
+        content:
+          hostDetails === undefined ? (
+            ContentLoadingMarkup
+          ) : (
+            <EndpointDetails
+              details={hostDetails}
+              policyInfo={policyInfo}
+              hostStatus={hostStatus}
+            />
+          ),
+      },
+      {
+        id: EndpointDetailsTabsTypes.activityLog,
+        name: i18.ACTIVITY_LOG.tabTitle,
+        route: getEndpointDetailsPath({
+          ...queryParams,
+          name: 'endpointActivityLog',
+          selected_endpoint: id,
+        }),
+        content: <EndpointActivityLog activityLog={activityLog} />,
+      },
+    ],
+    [ContentLoadingMarkup, hostDetails, policyInfo, hostStatus, activityLog, queryParams]
+  );
 
   const showFlyoutFooter =
     show === 'details' || show === 'policy_response' || show === 'activity_log';
@@ -127,11 +128,9 @@ export const EndpointDetailsFlyout = memo(() => {
         ...urlSearchParams,
       })
     );
-    setFlyoutView(undefined);
-  }, [setFlyoutView, history, queryParamsWithoutSelectedEndpoint]);
+  }, [history, queryParamsWithoutSelectedEndpoint]);
 
   useEffect(() => {
-    setFlyoutView(show);
     if (hostDetailsError !== undefined) {
       toasts.addDanger({
         title: i18n.translate('xpack.securitySolution.endpoint.details.errorTitle', {
@@ -142,10 +141,7 @@ export const EndpointDetailsFlyout = memo(() => {
         }),
       });
     }
-    return () => {
-      setFlyoutView(undefined);
-    };
-  }, [hostDetailsError, setFlyoutView, show, toasts]);
+  }, [hostDetailsError, show, toasts]);
 
   return (
     <EuiFlyout
@@ -167,9 +163,9 @@ export const EndpointDetailsFlyout = memo(() => {
         <>
           {(show === 'details' || show === 'activity_log') && (
             <EndpointDetailsFlyoutTabs
-              hostname={hostDetails?.host?.hostname}
+              hostname={hostDetails.host.hostname}
               show={show}
-              tabs={tabs}
+              tabs={getTabs(hostDetails.agent.id)}
             />
           )}
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/host_constants.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/host_constants.ts
index fb9661b509a33..45cf7d725443d 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/host_constants.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/host_constants.ts
@@ -18,6 +18,7 @@ export const HOST_STATUS_TO_BADGE_COLOR = Object.freeze<
   [HostStatus.UPDATING]: 'primary',
   [HostStatus.OFFLINE]: 'default',
   [HostStatus.INACTIVE]: 'default',
+  [HostStatus.UNENROLLED]: 'default',
 });
 
 export const POLICY_STATUS_TO_HEALTH_COLOR = Object.freeze<
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
index 26d0d53e39982..48077471b131c 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
@@ -997,7 +997,7 @@ describe('when on the endpoint list page', () => {
         const subHeaderBackLink = await renderResult.findByTestId('flyoutSubHeaderBackButton');
         expect(subHeaderBackLink.textContent).toBe('Endpoint Details');
         expect(subHeaderBackLink.getAttribute('href')).toEqual(
-          `${APP_PATH}${MANAGEMENT_PATH}/endpoints?page_index=0&page_size=10&selected_endpoint=1`
+          `${APP_PATH}${MANAGEMENT_PATH}/endpoints?page_index=0&page_size=10&selected_endpoint=1&show=details`
         );
       });
 
@@ -1009,7 +1009,7 @@ describe('when on the endpoint list page', () => {
         });
         const changedUrlAction = await userChangedUrlChecker;
         expect(changedUrlAction.payload.search).toEqual(
-          '?page_index=0&page_size=10&selected_endpoint=1'
+          '?page_index=0&page_size=10&selected_endpoint=1&show=details'
         );
       });
 
@@ -1082,7 +1082,7 @@ describe('when on the endpoint list page', () => {
 
         expect((await changeUrlAction).payload).toMatchObject({
           pathname: `${MANAGEMENT_PATH}/endpoints`,
-          search: '?page_index=0&page_size=10&selected_endpoint=1',
+          search: '?page_index=0&page_size=10&selected_endpoint=1&show=details',
         });
       });
 
@@ -1095,7 +1095,7 @@ describe('when on the endpoint list page', () => {
 
         expect((await changeUrlAction).payload).toMatchObject({
           pathname: `${MANAGEMENT_PATH}/endpoints`,
-          search: '?page_index=0&page_size=10&selected_endpoint=1',
+          search: '?page_index=0&page_size=10&selected_endpoint=1&show=details',
         });
       });
 
@@ -1115,7 +1115,7 @@ describe('when on the endpoint list page', () => {
 
         expect((await changeUrlAction).payload).toMatchObject({
           pathname: `${MANAGEMENT_PATH}/endpoints`,
-          search: '?page_index=0&page_size=10&selected_endpoint=1',
+          search: '?page_index=0&page_size=10&selected_endpoint=1&show=details',
         });
       });
 
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/__mocks__/mock.ts b/x-pack/plugins/security_solution/public/network/components/embeddables/__mocks__/mock.ts
index ba9b6518c6acc..834447b21929f 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/__mocks__/mock.ts
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/__mocks__/mock.ts
@@ -14,6 +14,7 @@ export const mockIndexPatternIds: IndexPatternMapping[] = [
 
 export const mockAPMIndexPatternIds: IndexPatternMapping[] = [
   { title: 'apm-*', id: '8c7323ac-97ad-4b53-ac0a-40f8f691a918' },
+  { title: 'traces-apm*,logs-apm*,metrics-apm*,apm-*', id: '8c7323ac-97ad-4b53-ac0a-40f8f691a918' },
 ];
 
 export const mockSourceLayer = {
@@ -183,6 +184,11 @@ export const mockClientLayer = {
   joins: [],
 };
 
+const mockApmDataStreamClientLayer = {
+  ...mockClientLayer,
+  label: 'traces-apm*,logs-apm*,metrics-apm*,apm-* | Client Point',
+};
+
 export const mockServerLayer = {
   sourceDescriptor: {
     id: 'uuid.v4()',
@@ -238,6 +244,11 @@ export const mockServerLayer = {
   query: { query: '', language: 'kuery' },
 };
 
+const mockApmDataStreamServerLayer = {
+  ...mockServerLayer,
+  label: 'traces-apm*,logs-apm*,metrics-apm*,apm-* | Server Point',
+};
+
 export const mockLineLayer = {
   sourceDescriptor: {
     type: 'ES_PEW_PEW',
@@ -365,6 +376,10 @@ export const mockClientServerLineLayer = {
   type: 'VECTOR',
   query: { query: '', language: 'kuery' },
 };
+const mockApmDataStreamClientServerLineLayer = {
+  ...mockClientServerLineLayer,
+  label: 'traces-apm*,logs-apm*,metrics-apm*,apm-* | Line',
+};
 
 export const mockLayerList = [
   {
@@ -421,6 +436,9 @@ export const mockLayerListMixed = [
   mockClientServerLineLayer,
   mockServerLayer,
   mockClientLayer,
+  mockApmDataStreamClientServerLineLayer,
+  mockApmDataStreamServerLayer,
+  mockApmDataStreamClientLayer,
 ];
 
 export const mockAPMIndexPattern: IndexPatternSavedObject = {
@@ -468,6 +486,15 @@ export const mockAPMTransactionIndexPattern: IndexPatternSavedObject = {
   },
 };
 
+export const mockAPMTracesDataStreamIndexPattern: IndexPatternSavedObject = {
+  id: 'traces-apm*',
+  type: 'index-pattern',
+  _version: 'abc',
+  attributes: {
+    title: 'traces-apm*',
+  },
+};
+
 export const mockGlobIndexPattern: IndexPatternSavedObject = {
   id: '*',
   type: 'index-pattern',
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.test.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.test.tsx
index 6136f5da51d51..613a6ce4c00da 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.test.tsx
@@ -12,6 +12,7 @@ import {
   mockAPMIndexPattern,
   mockAPMRegexIndexPattern,
   mockAPMTransactionIndexPattern,
+  mockAPMTracesDataStreamIndexPattern,
   mockAuditbeatIndexPattern,
   mockCCSGlobIndexPattern,
   mockCommaFilebeatAuditbeatCCSGlobIndexPattern,
@@ -69,6 +70,7 @@ describe('embedded_map_helpers', () => {
   describe('findMatchingIndexPatterns', () => {
     const siemDefaultIndices = [
       'apm-*-transaction*',
+      'traces-apm*',
       'auditbeat-*',
       'endgame-*',
       'filebeat-*',
@@ -102,11 +104,16 @@ describe('embedded_map_helpers', () => {
 
     test('finds exact glob-matched index patterns ', () => {
       const matchingIndexPatterns = findMatchingIndexPatterns({
-        kibanaIndexPatterns: [mockAPMTransactionIndexPattern, mockFilebeatIndexPattern],
+        kibanaIndexPatterns: [
+          mockAPMTransactionIndexPattern,
+          mockAPMTracesDataStreamIndexPattern,
+          mockFilebeatIndexPattern,
+        ],
         siemDefaultIndices,
       });
       expect(matchingIndexPatterns).toEqual([
         mockAPMTransactionIndexPattern,
+        mockAPMTracesDataStreamIndexPattern,
         mockFilebeatIndexPattern,
       ]);
     });
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/map_config.ts b/x-pack/plugins/security_solution/public/network/components/embeddables/map_config.ts
index f4af4dd3b25f2..ecbb80123e07e 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/map_config.ts
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/map_config.ts
@@ -61,6 +61,21 @@ export const SUM_OF_DESTINATION_BYTES = 'sum_of_destination.bytes';
 export const SUM_OF_CLIENT_BYTES = 'sum_of_client.bytes';
 export const SUM_OF_SERVER_BYTES = 'sum_of_server.bytes';
 
+const APM_LAYER_FIELD_MAPPING = {
+  source: {
+    metricField: 'client.bytes',
+    geoField: 'client.geo.location',
+    tooltipProperties: Object.keys(clientFieldMappings),
+    label: i18n.CLIENT_LAYER,
+  },
+  destination: {
+    metricField: 'server.bytes',
+    geoField: 'server.geo.location',
+    tooltipProperties: Object.keys(serverFieldMappings),
+    label: i18n.SERVER_LAYER,
+  },
+};
+
 // Mapping to fields for creating specific layers for a given index pattern
 // e.g. The apm-* index pattern needs layers for client/server instead of source/destination
 export const lmc: LayerMappingCollection = {
@@ -78,20 +93,8 @@ export const lmc: LayerMappingCollection = {
       label: i18n.DESTINATION_LAYER,
     },
   },
-  'apm-*': {
-    source: {
-      metricField: 'client.bytes',
-      geoField: 'client.geo.location',
-      tooltipProperties: Object.keys(clientFieldMappings),
-      label: i18n.CLIENT_LAYER,
-    },
-    destination: {
-      metricField: 'server.bytes',
-      geoField: 'server.geo.location',
-      tooltipProperties: Object.keys(serverFieldMappings),
-      label: i18n.SERVER_LAYER,
-    },
-  },
+  'apm-*': APM_LAYER_FIELD_MAPPING,
+  'traces-apm*,logs-apm*,metrics-apm*,apm-*': APM_LAYER_FIELD_MAPPING,
 };
 
 /**
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_disabled_module.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_disabled_module.tsx
index 21a4beca72f3b..1600356882c36 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_disabled_module.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_disabled_module.tsx
@@ -21,11 +21,11 @@ export const CtiDisabledModuleComponent = () => {
   const danger = useMemo(
     () => (
       <CtiInnerPanel
-        color={'danger'}
+        color={'warning'}
         title={i18n.DANGER_TITLE}
         body={i18n.DANGER_BODY}
         button={
-          <EuiButton href={threatIntelDocLink} color={'danger'} fill target="_blank">
+          <EuiButton href={threatIntelDocLink} color={'warning'} target="_blank">
             {i18n.DANGER_BUTTON}
           </EuiButton>
         }
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_inner_panel.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_inner_panel.tsx
index 08bf0a432f9bb..ddff78608dfb0 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_inner_panel.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_inner_panel.tsx
@@ -17,13 +17,9 @@ const ButtonContainer = styled(EuiFlexGroup)`
   padding: ${({ theme }) => theme.eui.paddingSizes.s};
 `;
 
-const Title = styled(EuiText)<{ textcolor: 'primary' | 'warning' | 'danger' }>`
+const Title = styled(EuiText)<{ textcolor: 'primary' | 'warning' }>`
   color: ${({ theme, textcolor }) =>
-    textcolor === 'primary'
-      ? theme.eui.euiColorPrimary
-      : textcolor === 'warning'
-      ? theme.eui.euiColorWarningText
-      : theme.eui.euiColorDangerText};
+    textcolor === 'primary' ? theme.eui.euiColorPrimary : theme.eui.euiColorWarningText};
   margin-bottom: ${({ theme }) => theme.eui.paddingSizes.m};
 `;
 
@@ -40,12 +36,12 @@ export const CtiInnerPanel = ({
   body,
   button,
 }: {
-  color: 'primary' | 'warning' | 'danger';
+  color: 'primary' | 'warning';
   title: string;
   body: string;
   button?: JSX.Element;
 }) => {
-  const iconType = color === 'primary' ? 'iInCircle' : color === 'warning' ? 'help' : 'alert';
+  const iconType = color === 'primary' ? 'iInCircle' : 'help';
   return (
     <PanelContainer grow={false} color={color}>
       <EuiFlexGroup direction={'column'}>
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_no_events.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_no_events.test.tsx
index 5e1697279dd4c..f00e1053e8082 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_no_events.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_no_events.test.tsx
@@ -69,7 +69,7 @@ describe('CtiNoEvents', () => {
     );
 
     expect(wrapper.find('[data-test-subj="cti-total-event-count"]').text()).toEqual(
-      'Showing: 0 events'
+      'Showing: 0 indicators'
     );
   });
 });
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_with_events.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_with_events.test.tsx
index 3b03b9c418a1c..fac05bb72df38 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_with_events.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_with_events.test.tsx
@@ -51,7 +51,7 @@ describe('CtiWithEvents', () => {
     );
 
     expect(wrapper.find('[data-test-subj="cti-total-event-count"]').text()).toEqual(
-      `Showing: ${mockCtiWithEventsProps.totalCount} events`
+      `Showing: ${mockCtiWithEventsProps.totalCount} indicators`
     );
   });
 });
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/threat_intel_panel_view.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/threat_intel_panel_view.test.tsx
index 59ee1e5447ba3..f0e3bcaaec6e0 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/threat_intel_panel_view.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/threat_intel_panel_view.test.tsx
@@ -141,7 +141,7 @@ describe('ThreatIntelPanelView', () => {
     );
 
     expect(wrapper.find('[data-test-subj="cti-total-event-count"]').text()).toEqual(
-      `Showing: ${mockThreatIntelPanelViewProps.totalEventCount} events`
+      `Showing: ${mockThreatIntelPanelViewProps.totalEventCount} indicators`
     );
   });
 });
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/threat_intel_panel_view.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/threat_intel_panel_view.tsx
index b34f6e657d39a..babbd5d13224f 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/threat_intel_panel_view.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_cti_links/threat_intel_panel_view.tsx
@@ -25,6 +25,7 @@ import { CtiListItem } from '../../containers/overview_cti_links/helpers';
 import { useKibana } from '../../../common/lib/kibana';
 import { CtiInnerPanel } from './cti_inner_panel';
 import * as i18n from './translations';
+import { shortenCountIntoString } from '../../../common/utils/shorten_count_into_string';
 
 const DashboardLink = styled.li`
   margin: 0 ${({ theme }) => theme.eui.paddingSizes.s} 0 ${({ theme }) => theme.eui.paddingSizes.m};
@@ -84,7 +85,7 @@ export const ThreatIntelPanelView: React.FC<ThreatIntelPanelViewProps> = ({
     () => (
       <FormattedMessage
         data-test-subj="cti-total-event-count"
-        defaultMessage="Showing: {totalEventCount} {totalEventCount, plural, one {event} other {events}}"
+        defaultMessage="Showing: {totalEventCount} {totalEventCount, plural, one {indicator} other {indicators}}"
         id="xpack.securitySolution.overview.ctiDashboardSubtitle"
         values={{ totalEventCount }}
       />
@@ -159,10 +160,10 @@ export const ThreatIntelPanelView: React.FC<ThreatIntelPanelViewProps> = ({
                           alignItems="center"
                           justifyContent="flexEnd"
                         >
-                          <DashboardRightSideElement key={`${title}-count`}>
-                            {count}
+                          <DashboardRightSideElement key={`${title}-count`} grow={false}>
+                            {shortenCountIntoString(count)}
                           </DashboardRightSideElement>
-                          <DashboardRightSideElement key={`${title}-source`}>
+                          <DashboardRightSideElement key={`${title}-source`} grow={false}>
                             {path ? (
                               <RightSideLink href={path} target="_blank">
                                 {linkCopy}
diff --git a/x-pack/plugins/security_solution/public/overview/containers/overview_cti_links/index.tsx b/x-pack/plugins/security_solution/public/overview/containers/overview_cti_links/index.tsx
index b7f919dc97013..8839aff7dc33d 100644
--- a/x-pack/plugins/security_solution/public/overview/containers/overview_cti_links/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/containers/overview_cti_links/index.tsx
@@ -74,8 +74,8 @@ export const useCtiDashboardLinks = (
                   })
                 )
               );
-              const items = DashboardsSO.savedObjects?.reduce(
-                (acc: CtiListItem[], dashboardSO, i) => {
+              const items = DashboardsSO.savedObjects
+                ?.reduce((acc: CtiListItem[], dashboardSO, i) => {
                   const item = createLinkFromDashboardSO(
                     dashboardSO,
                     eventCountsByDataset,
@@ -87,9 +87,8 @@ export const useCtiDashboardLinks = (
                     acc.push(item);
                   }
                   return acc;
-                },
-                []
-              );
+                }, [])
+                .sort((a, b) => (a.title > b.title ? 1 : -1));
               setListItems(items);
             } else {
               handleDisabledPlugin();
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx
index 3c9d9161a7a48..2afb2af01406d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx
@@ -26,7 +26,7 @@ interface FlyoutPaneComponentProps {
 const StyledEuiFlyout = styled(EuiFlyout)<EuiFlyoutProps>`
   animation: none;
   min-width: 150px;
-  z-index: ${({ theme }) => theme.eui.euiZLevel6};
+  z-index: ${({ theme }) => theme.eui.euiZLevel4};
 `;
 
 const FlyoutPaneComponent: React.FC<FlyoutPaneComponentProps> = ({
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
index 94ef690a1fdc1..96b6aa4ebeb8d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
@@ -25,6 +25,7 @@ import { ExpandableEvent, ExpandableEventTitle } from './expandable_event';
 import { useTimelineEventsDetails } from '../../../containers/details';
 import { TimelineTabs } from '../../../../../common/types/timeline';
 import { HostIsolationPanel } from '../../../../detections/components/host_isolation';
+import { EndpointIsolateSuccess } from '../../../../common/components/endpoint/host_isolation';
 import { TakeActionDropdown } from '../../../../detections/components/host_isolation/take_action_dropdown';
 import {
   ISOLATE_HOST,
@@ -78,10 +79,17 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
 
   const [isHostIsolationPanelOpen, setIsHostIsolationPanel] = useState(false);
 
-  const [isolateAction, setIsolateAction] = useState('isolateHost');
+  const [isolateAction, setIsolateAction] = useState<'isolateHost' | 'unisolateHost'>(
+    'isolateHost'
+  );
+
+  const [isIsolateActionSuccessBannerVisible, setIsIsolateActionSuccessBannerVisible] = useState(
+    false
+  );
 
   const showAlertDetails = useCallback(() => {
     setIsHostIsolationPanel(false);
+    setIsIsolateActionSuccessBannerVisible(false);
   }, []);
 
   const { isAllowed: isIsolationAllowed } = useIsolationPrivileges();
@@ -114,6 +122,16 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
     return findAgentVersion ? findAgentVersion[0] : '';
   }, [detailsData]);
 
+  const alertId = useMemo(() => {
+    const findAlertId = find({ category: '_id', field: '_id' }, detailsData)?.values;
+    return findAlertId ? findAlertId[0] : '';
+  }, [detailsData]);
+
+  const hostName = useMemo(() => {
+    const findHostName = find({ category: 'host', field: 'host.name' }, detailsData)?.values;
+    return findHostName ? findHostName[0] : '';
+  }, [detailsData]);
+
   const isolationSupported = isIsolationSupported({
     osName: hostOsFamily,
     version: agentVersion,
@@ -142,6 +160,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
   const caseDetailsRefresh = useWithCaseDetailsRefresh();
 
   const handleIsolationActionSuccess = useCallback(() => {
+    setIsIsolateActionSuccessBannerVisible(true);
     // If a case details refresh ref is defined, then refresh actions and comments
     if (caseDetailsRefresh) {
       caseDetailsRefresh.refreshUserActionsAndComments();
@@ -161,6 +180,13 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
           <ExpandableEventTitle isAlert={isAlert} loading={loading} />
         )}
       </EuiFlyoutHeader>
+      {isIsolateActionSuccessBannerVisible && (
+        <EndpointIsolateSuccess
+          hostName={hostName}
+          alertId={alertId}
+          isolateAction={isolateAction}
+        />
+      )}
       <StyledEuiFlyoutBody>
         {isHostIsolationPanelOpen ? (
           <HostIsolationPanel
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
index d484a76940d5f..b008f95285f23 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
@@ -367,6 +367,7 @@ exports[`ColumnHeaders rendering renders correctly against snapshot 1`] = `
             "format": "",
             "indexes": Array [
               "apm-*-transaction*",
+              "traces-apm*",
               "auditbeat-*",
               "endgame-*",
               "filebeat-*",
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/agent_statuses.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/agent_statuses.tsx
index 2c88b305c7d05..dac10f4648784 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/agent_statuses.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/agent_statuses.tsx
@@ -6,11 +6,12 @@
  */
 
 import React from 'react';
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
 import { DefaultDraggable } from '../../../../../common/components/draggables';
 import { EndpointHostIsolationStatus } from '../../../../../common/components/endpoint/host_isolation';
 import { useHostIsolationStatus } from '../../../../../detections/containers/detection_engine/alerts/use_host_isolation_status';
 import { AgentStatus } from '../../../../../common/components/endpoint/agent_status';
+import { EMPTY_STATUS } from './translations';
 
 export const AgentStatuses = React.memo(
   ({
@@ -33,16 +34,22 @@ export const AgentStatuses = React.memo(
     const isolationFieldName = 'host.isolation';
     return (
       <EuiFlexGroup gutterSize="none">
-        <EuiFlexItem grow={false}>
-          <DefaultDraggable
-            field={fieldName}
-            id={`event-details-value-default-draggable-${contextId}-${eventId}-${fieldName}-${value}`}
-            tooltipContent={fieldName}
-            value={`${agentStatus}`}
-          >
-            <AgentStatus hostStatus={agentStatus} />
-          </DefaultDraggable>
-        </EuiFlexItem>
+        {agentStatus !== undefined ? (
+          <EuiFlexItem grow={false}>
+            <DefaultDraggable
+              field={fieldName}
+              id={`event-details-value-default-draggable-${contextId}-${eventId}-${fieldName}-${value}`}
+              tooltipContent={fieldName}
+              value={`${agentStatus}`}
+            >
+              <AgentStatus hostStatus={agentStatus} />
+            </DefaultDraggable>
+          </EuiFlexItem>
+        ) : (
+          <EuiText>
+            <p>{EMPTY_STATUS}</p>
+          </EuiText>
+        )}
         <EuiFlexItem grow={false}>
           <DefaultDraggable
             field={isolationFieldName}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap
index b5bc87ff636b3..2934d35dc184d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap
@@ -368,6 +368,7 @@ exports[`suricata_row_renderer renders correctly against snapshot 1`] = `
                 "format": "",
                 "indexes": Array [
                   "apm-*-transaction*",
+                  "traces-apm*",
                   "auditbeat-*",
                   "endgame-*",
                   "filebeat-*",
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/translations.ts
index 476fd77ce0647..d00148d41f3f6 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/translations.ts
@@ -44,3 +44,10 @@ export const LINK_ELASTIC_ENDPOINT_SECURITY = i18n.translate(
     defaultMessage: 'Open in Endpoint Security',
   }
 );
+
+export const EMPTY_STATUS = i18n.translate(
+  'xpack.securitySolution.hostIsolation.agentStatuses.empty',
+  {
+    defaultMessage: '-',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
index bd50554ea3612..64ca766e4dee6 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
@@ -366,6 +366,7 @@ exports[`ZeekDetails rendering it renders the default ZeekDetails 1`] = `
             "format": "",
             "indexes": Array [
               "apm-*-transaction*",
+              "traces-apm*",
               "auditbeat-*",
               "endgame-*",
               "filebeat-*",
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap
index a136ac80ec7e3..6c59df606cd36 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap
@@ -368,6 +368,7 @@ exports[`zeek_row_renderer renders correctly against snapshot 1`] = `
                 "format": "",
                 "indexes": Array [
                   "apm-*-transaction*",
+                  "traces-apm*",
                   "auditbeat-*",
                   "endgame-*",
                   "filebeat-*",
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.test.tsx
index cf8d51546a899..bb7eda8ef1ff0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.test.tsx
@@ -161,6 +161,50 @@ describe('Footer Timeline Component', () => {
       wrapper.find('[data-test-subj="timelineSizeRowPopover"] button').first().simulate('click');
       expect(wrapper.find('[data-test-subj="timelinePickSizeRow"]').exists()).toBeTruthy();
     });
+
+    test('it renders last updated when updated at is > 0', () => {
+      const wrapper = mount(
+        <TestProviders>
+          <FooterComponent
+            activePage={0}
+            updatedAt={updatedAt}
+            height={100}
+            id={'timeline-id'}
+            isLive={false}
+            isLoading={false}
+            itemsCount={itemsCount}
+            itemsPerPage={2}
+            itemsPerPageOptions={[1, 5, 10, 20]}
+            onChangePage={loadMore}
+            totalCount={serverSideEventCount}
+          />
+        </TestProviders>
+      );
+
+      expect(wrapper.find('[data-test-subj="fixed-width-last-updated"]').exists()).toBeTruthy();
+    });
+
+    test('it does NOT render last updated when updated at is 0', () => {
+      const wrapper = mount(
+        <TestProviders>
+          <FooterComponent
+            activePage={0}
+            updatedAt={0}
+            height={100}
+            id={'timeline-id'}
+            isLive={false}
+            isLoading={false}
+            itemsCount={itemsCount}
+            itemsPerPage={2}
+            itemsPerPageOptions={[1, 5, 10, 20]}
+            onChangePage={loadMore}
+            totalCount={serverSideEventCount}
+          />
+        </TestProviders>
+      );
+
+      expect(wrapper.find('[data-test-subj="fixed-width-last-updated"]').exists()).toBeFalsy();
+    });
   });
 
   describe('Events', () => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx
index b71cbb4c082ef..2a253087567a7 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx
@@ -45,11 +45,11 @@ const FixedWidthLastUpdatedContainer = React.memo<FixedWidthLastUpdatedContainer
     const width = useEventDetailsWidthContext();
     const compact = useMemo(() => isCompactFooter(width), [width]);
 
-    return (
+    return updatedAt > 0 ? (
       <FixedWidthLastUpdated data-test-subj="fixed-width-last-updated" compact={compact}>
         {timelines.getLastUpdated({ updatedAt, compact })}
       </FixedWidthLastUpdated>
-    );
+    ) : null;
   }
 );
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/detections_admin/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/detections_admin/detections_role.json
index 6c9b4e2cba49c..82ef8cc6687b4 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/detections_admin/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/detections_admin/detections_role.json
@@ -8,6 +8,7 @@
           ".lists*",
           ".items*",
           "apm-*-transaction*",
+          "traces-apm*",
           "auditbeat-*",
           "endgame-*",
           "filebeat-*",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/hunter/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/hunter/detections_role.json
index 119fe5421c86c..ba9adfda82bea 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/hunter/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/hunter/detections_role.json
@@ -5,6 +5,7 @@
       {
         "names": [
           "apm-*-transaction*",
+          "traces-apm*",
           "auditbeat-*",
           "endgame-*",
           "filebeat-*",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/platform_engineer/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/platform_engineer/detections_role.json
index 17dbd90d17925..73a9559389b4e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/platform_engineer/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/platform_engineer/detections_role.json
@@ -9,6 +9,7 @@
       {
         "names": [
           "apm-*-transaction*",
+          "traces-apm*",
           "auditbeat-*",
           "endgame-*",
           "filebeat-*",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/rule_author/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/rule_author/detections_role.json
index 0db8359c57764..bb606616d1bd5 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/rule_author/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/rule_author/detections_role.json
@@ -5,6 +5,7 @@
       {
         "names": [
           "apm-*-transaction*",
+          "traces-apm*",
           "auditbeat-*",
           "endgame-*",
           "filebeat-*",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/soc_manager/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/soc_manager/detections_role.json
index 6962701ae5be3..92a62034afcef 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/soc_manager/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/soc_manager/detections_role.json
@@ -5,6 +5,7 @@
       {
         "names": [
           "apm-*-transaction*",
+          "traces-apm*",
           "auditbeat-*",
           "endgame-*",
           "filebeat-*",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/detections_role.json
index 07827069dbc73..be082e380211a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/detections_role.json
@@ -6,6 +6,7 @@
       {
         "names": [
           "apm-*-transaction*",
+          "traces-apm*",
           "auditbeat-*",
           "endgame-*",
           "filebeat-*",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t2_analyst/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t2_analyst/detections_role.json
index f554c916c6684..f9e069f174a91 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t2_analyst/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t2_analyst/detections_role.json
@@ -8,6 +8,7 @@
           ".lists*",
           ".items*",
           "apm-*-transaction*",
+          "traces-apm*",
           "auditbeat-*",
           "endgame-*",
           "filebeat-*",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/patches/simplest_updated_name.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/patches/simplest_updated_name.json
index bec88bcb0e30e..3e5a5c274f1ba 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/patches/simplest_updated_name.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/patches/simplest_updated_name.json
@@ -8,6 +8,7 @@
   "from": "now-360s",
   "index": [
     "apm-*-transaction*",
+    "traces-apm*",
     "auditbeat-*",
     "endgame-*",
     "filebeat-*",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/queries/query_with_mappings.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/queries/query_with_mappings.json
index f0d7cb4ec914b..2508c9a6a3e37 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/queries/query_with_mappings.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/queries/query_with_mappings.json
@@ -3,6 +3,7 @@
   "enabled": false,
   "index": [
     "apm-*-transaction*",
+    "traces-apm*",
     "auditbeat-*",
     "endgame-*",
     "filebeat-*",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/test_cases/queries/action_without_meta.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/test_cases/queries/action_without_meta.json
index 6569a641de3a2..f0ddced46d52e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/test_cases/queries/action_without_meta.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/test_cases/queries/action_without_meta.json
@@ -2,6 +2,7 @@
   "type": "query",
   "index": [
     "apm-*-transaction*",
+    "traces-apm*",
     "auditbeat-*",
     "endgame-*",
     "filebeat-*",
diff --git a/x-pack/plugins/security_solution/server/lib/source_status/elasticsearch_adapter.ts b/x-pack/plugins/security_solution/server/lib/source_status/elasticsearch_adapter.ts
index b2058a91c0413..3da0c1675e81e 100644
--- a/x-pack/plugins/security_solution/server/lib/source_status/elasticsearch_adapter.ts
+++ b/x-pack/plugins/security_solution/server/lib/source_status/elasticsearch_adapter.ts
@@ -12,6 +12,7 @@ import { ApmServiceNameAgg } from './types';
 import { ENDPOINT_METADATA_INDEX } from '../../../common/constants';
 
 const APM_INDEX_NAME = 'apm-*-transaction*';
+const APM_DATA_STREAM = 'traces-apm*';
 
 export class ElasticsearchSourceStatusAdapter implements SourceStatusAdapter {
   constructor(private readonly framework: FrameworkAdapter) {}
@@ -23,7 +24,9 @@ export class ElasticsearchSourceStatusAdapter implements SourceStatusAdapter {
       // Add endpoint metadata index to indices to check
       indexNames.push(ENDPOINT_METADATA_INDEX);
       // Remove APM index if exists, and only query if length > 0 in case it's the only index provided
-      const nonApmIndexNames = indexNames.filter((name) => name !== APM_INDEX_NAME);
+      const nonApmIndexNames = indexNames.filter(
+        (name) => name !== APM_INDEX_NAME && name !== APM_DATA_STREAM
+      );
       const indexCheckResponse = await (nonApmIndexNames.length > 0
         ? this.framework.callWithRequest(request, 'search', {
             index: nonApmIndexNames,
@@ -39,7 +42,8 @@ export class ElasticsearchSourceStatusAdapter implements SourceStatusAdapter {
 
       // Note: Additional check necessary for APM-specific index. For details see: https://github.com/elastic/kibana/issues/56363
       // Only verify if APM data exists if indexNames includes `apm-*-transaction*` (default included apm index)
-      const includesApmIndex = indexNames.includes(APM_INDEX_NAME);
+      const includesApmIndex =
+        indexNames.includes(APM_INDEX_NAME) || indexNames.includes(APM_DATA_STREAM);
       const hasApmDataResponse = await (includesApmIndex
         ? this.framework.callWithRequest<{}, ApmServiceNameAgg>(
             request,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts
index b6a5435a0e046..0369f182a4c75 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts
@@ -18,6 +18,7 @@ import {
 export const mockOptions: HostsRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -613,6 +614,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -822,6 +824,7 @@ export const expectedDsl = {
   ignoreUnavailable: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
index f29bb58da2f79..1dd3dc8ee4cff 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
@@ -17,6 +17,7 @@ import {
 export const mockOptions: HostAuthenticationsRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -2151,6 +2152,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -2372,6 +2374,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts
index 9dfff5e11715d..cc97a5f0cacef 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts
@@ -17,6 +17,7 @@ import {
 export const mockOptions: HostDetailsRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -1303,6 +1304,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -1416,6 +1418,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/__mocks__/index.ts
index b492bf57f94a6..443e7e96a3c7f 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/__mocks__/index.ts
@@ -14,6 +14,7 @@ import {
 export const mockOptions: HostFirstLastSeenRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -126,6 +127,7 @@ export const formattedSearchStrategyFirstResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -191,6 +193,7 @@ export const formattedSearchStrategyLastResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -225,6 +228,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts
index 987754420430d..2b4e4b8291401 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts
@@ -15,6 +15,7 @@ import {
 export const mockOptions: HostOverviewRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -119,6 +120,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -331,6 +333,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts
index 258e72a5e9b8e..0ad976a0f498c 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts
@@ -10,6 +10,7 @@ import { HostsQueries, SortField } from '../../../../../../../common/search_stra
 export const mockOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -4302,6 +4303,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -4436,6 +4438,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
index c33ca75aa26e1..7f36e3551e5be 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
@@ -33,6 +33,7 @@ export const formattedAlertsSearchStrategyResponse: MatrixHistogramStrategyRespo
         {
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -166,6 +167,7 @@ export const expectedDsl = {
   ignoreUnavailable: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -199,6 +201,7 @@ export const formattedAnomaliesSearchStrategyResponse: MatrixHistogramStrategyRe
         {
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -381,6 +384,7 @@ export const formattedAuthenticationsSearchStrategyResponse: MatrixHistogramStra
         {
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -947,6 +951,7 @@ export const formattedEventsSearchStrategyResponse: MatrixHistogramStrategyRespo
         {
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -1925,6 +1930,7 @@ export const formattedDnsSearchStrategyResponse: MatrixHistogramStrategyResponse
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
index 86006c3155447..82531f35b09ab 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
@@ -10,6 +10,7 @@ import { MatrixHistogramType } from '../../../../../../../common/search_strategy
 export const mockOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -27,6 +28,7 @@ export const mockOptions = {
 export const expectedDsl = {
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
index 81da78a132084..ab76d54dee11f 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
@@ -10,6 +10,7 @@ import { MatrixHistogramType } from '../../../../../../../common/search_strategy
 export const mockOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -27,6 +28,7 @@ export const mockOptions = {
 export const expectedDsl = {
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
index 5cf667a0085fa..1fd7b85242df6 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
@@ -10,6 +10,7 @@ import { MatrixHistogramType } from '../../../../../../../common/search_strategy
 export const mockOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -26,6 +27,7 @@ export const mockOptions = {
 export const expectedDsl = {
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
index 9b8dfb139d9f4..4d97fba3cb80c 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
@@ -10,6 +10,7 @@ import { MatrixHistogramType } from '../../../../../../../common/search_strategy
 export const mockOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -28,6 +29,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
index c361db38a6caa..5dab2bcd5cf9d 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
@@ -14,6 +14,7 @@ import {
 export const mockOptions: MatrixHistogramRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -31,6 +32,7 @@ export const mockOptions: MatrixHistogramRequestOptions = {
 export const expectedDsl = {
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -85,6 +87,7 @@ export const expectedDsl = {
 export const expectedThresholdDsl = {
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -141,6 +144,7 @@ export const expectedThresholdDsl = {
 export const expectedThresholdMissingFieldDsl = {
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -243,6 +247,7 @@ export const expectedThresholdWithCardinalityDsl = {
   ignoreUnavailable: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -256,6 +261,7 @@ export const expectedThresholdWithCardinalityDsl = {
 export const expectedThresholdWithGroupFieldsAndCardinalityDsl = {
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -362,6 +368,7 @@ export const expectedThresholdGroupWithCardinalityDsl = {
   ignoreUnavailable: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -375,6 +382,7 @@ export const expectedThresholdGroupWithCardinalityDsl = {
 export const expectedIpIncludingMissingDataDsl = {
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -437,6 +445,7 @@ export const expectedIpIncludingMissingDataDsl = {
 export const expectedIpNotIncludingMissingDataDsl = {
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/__mocks__/index.ts
index fb11069f9c834..7f71906bcaa97 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/__mocks__/index.ts
@@ -15,6 +15,7 @@ import {
 export const mockOptions: NetworkDetailsRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -306,6 +307,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -447,6 +449,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts
index 3252a7c249d72..cc01450e5bec5 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts
@@ -17,6 +17,7 @@ import {
 export const mockOptions: NetworkDnsRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -133,6 +134,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -204,6 +206,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
index aaf29f07537b5..b34027338e2ba 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
@@ -18,6 +18,7 @@ import {
 export const mockOptions: NetworkHttpRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -621,6 +622,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -678,6 +680,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts
index fcb30be7a403d..74b201e9a2294 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts
@@ -15,6 +15,7 @@ import {
 export const mockOptions: NetworkOverviewRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -103,6 +104,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -208,6 +210,7 @@ export const expectedDsl = {
   ignoreUnavailable: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts
index 16750acc5adee..8616a2ef14856 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts
@@ -18,6 +18,7 @@ import {
 export const mockOptions: NetworkTlsRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -61,6 +62,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -115,6 +117,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts
index 9f95dbe9c1c4f..ba5db90df8245 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts
@@ -18,6 +18,7 @@ import {
 export const mockOptions: NetworkTopCountriesRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -60,6 +61,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -119,6 +121,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts
index c815ed22f2b54..e881a9ef93949 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts
@@ -19,6 +19,7 @@ import {
 export const mockOptions: NetworkTopNFlowRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -812,6 +813,7 @@ export const formattedSearchStrategyResponse: NetworkTopNFlowStrategyResponse =
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -879,6 +881,7 @@ export const expectedDsl = {
   allowNoIndices: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts
index 3837afabe5799..686730dbe7927 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts
@@ -18,6 +18,7 @@ import {
 export const mockOptions: NetworkUsersRequestOptions = {
   defaultIndex: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
@@ -121,6 +122,7 @@ export const formattedSearchStrategyResponse = {
           allowNoIndices: true,
           index: [
             'apm-*-transaction*',
+            'traces-apm*',
             'auditbeat-*',
             'endgame-*',
             'filebeat-*',
@@ -210,6 +212,7 @@ export const expectedDsl = {
   ignoreUnavailable: true,
   index: [
     'apm-*-transaction*',
+    'traces-apm*',
     'auditbeat-*',
     'endgame-*',
     'filebeat-*',
diff --git a/x-pack/plugins/spaces/public/nav_control/nav_control_popover.tsx b/x-pack/plugins/spaces/public/nav_control/nav_control_popover.tsx
index 6f743b3a308e2..1653506c550f6 100644
--- a/x-pack/plugins/spaces/public/nav_control/nav_control_popover.tsx
+++ b/x-pack/plugins/spaces/public/nav_control/nav_control_popover.tsx
@@ -140,7 +140,7 @@ export class NavControlPopover extends Component<Props, State> {
     }
 
     return this.getButton(
-      <Suspense fallback={<EuiLoadingSpinner />}>
+      <Suspense fallback={<EuiLoadingSpinner size="m" />}>
         <LazySpaceAvatar space={activeSpace} size={'s'} />
       </Suspense>,
       (activeSpace as Space).name
diff --git a/x-pack/plugins/timelines/public/components/t_grid/body/column_headers/__snapshots__/index.test.tsx.snap b/x-pack/plugins/timelines/public/components/t_grid/body/column_headers/__snapshots__/index.test.tsx.snap
index 9ee08bcd966f3..e6e56818bcc84 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/body/column_headers/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/timelines/public/components/t_grid/body/column_headers/__snapshots__/index.test.tsx.snap
@@ -367,6 +367,7 @@ exports[`ColumnHeaders rendering renders correctly against snapshot 1`] = `
             "format": "",
             "indexes": Array [
               "apm-*-transaction*",
+              "traces-apm*",
               "auditbeat-*",
               "endgame-*",
               "filebeat-*",
diff --git a/x-pack/plugins/timelines/public/mock/browser_fields.ts b/x-pack/plugins/timelines/public/mock/browser_fields.ts
index 1581175e32904..6ab06e1be018a 100644
--- a/x-pack/plugins/timelines/public/mock/browser_fields.ts
+++ b/x-pack/plugins/timelines/public/mock/browser_fields.ts
@@ -10,6 +10,7 @@ import type { BrowserFields } from '../../common/search_strategy/index_fields';
 
 const DEFAULT_INDEX_PATTERN = [
   'apm-*-transaction*',
+  'traces-apm*',
   'auditbeat-*',
   'endgame-*',
   'filebeat-*',
diff --git a/x-pack/plugins/timelines/public/mock/global_state.ts b/x-pack/plugins/timelines/public/mock/global_state.ts
index bb7bee3d1552a..f7d3297738373 100644
--- a/x-pack/plugins/timelines/public/mock/global_state.ts
+++ b/x-pack/plugins/timelines/public/mock/global_state.ts
@@ -24,6 +24,7 @@ export const mockGlobalState: TimelineState = {
       id: 'test',
       indexNames: [
         'apm-*-transaction*',
+        'traces-apm*',
         'auditbeat-*',
         'endgame-*',
         'filebeat-*',
diff --git a/x-pack/plugins/timelines/server/search_strategy/index_fields/index.test.ts b/x-pack/plugins/timelines/server/search_strategy/index_fields/index.test.ts
index f6d78f2f1259f..cb2b097d78701 100644
--- a/x-pack/plugins/timelines/server/search_strategy/index_fields/index.test.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/index_fields/index.test.ts
@@ -845,7 +845,7 @@ describe('Fields Provider', () => {
     });
 
     it('should search apm index fields', async () => {
-      const indices = ['apm-*-transaction*'];
+      const indices = ['apm-*-transaction*', 'traces-apm*'];
       const request = {
         indices,
         onlyCheckIfIndicesExist: false,
@@ -861,13 +861,13 @@ describe('Fields Provider', () => {
     });
 
     it('should check apm index exists with data', async () => {
-      const indices = ['apm-*-transaction*'];
+      const indices = ['apm-*-transaction*', 'traces-apm*'];
       const request = {
         indices,
         onlyCheckIfIndicesExist: true,
       };
 
-      esClientSearchMock.mockResolvedValueOnce({
+      esClientSearchMock.mockResolvedValue({
         body: { hits: { total: { value: 1 } } },
       });
       const response = await requestIndexFieldSearch(request, deps, beatFields);
@@ -876,6 +876,10 @@ describe('Fields Provider', () => {
         index: indices[0],
         body: { query: { match_all: {} }, size: 0 },
       });
+      expect(esClientSearchMock).toHaveBeenCalledWith({
+        index: indices[1],
+        body: { query: { match_all: {} }, size: 0 },
+      });
       expect(getFieldsForWildcardMock).not.toHaveBeenCalled();
 
       expect(response.indexFields).toHaveLength(0);
@@ -883,13 +887,13 @@ describe('Fields Provider', () => {
     });
 
     it('should check apm index exists with no data', async () => {
-      const indices = ['apm-*-transaction*'];
+      const indices = ['apm-*-transaction*', 'traces-apm*'];
       const request = {
         indices,
         onlyCheckIfIndicesExist: true,
       };
 
-      esClientSearchMock.mockResolvedValueOnce({
+      esClientSearchMock.mockResolvedValue({
         body: { hits: { total: { value: 0 } } },
       });
 
@@ -899,6 +903,10 @@ describe('Fields Provider', () => {
         index: indices[0],
         body: { query: { match_all: {} }, size: 0 },
       });
+      expect(esClientSearchMock).toHaveBeenCalledWith({
+        index: indices[1],
+        body: { query: { match_all: {} }, size: 0 },
+      });
       expect(getFieldsForWildcardMock).not.toHaveBeenCalled();
 
       expect(response.indexFields).toHaveLength(0);
diff --git a/x-pack/plugins/timelines/server/search_strategy/index_fields/index.ts b/x-pack/plugins/timelines/server/search_strategy/index_fields/index.ts
index d100e8db21493..b6cf4af1561c3 100644
--- a/x-pack/plugins/timelines/server/search_strategy/index_fields/index.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/index_fields/index.ts
@@ -25,6 +25,7 @@ import {
 } from '../../../common/search_strategy/index_fields';
 
 const apmIndexPattern = 'apm-*-transaction*';
+const apmDataStreamsPattern = 'traces-apm*';
 
 export const indexFieldsProvider = (): ISearchStrategy<
   IndexFieldsStrategyRequest,
@@ -51,7 +52,10 @@ export const requestIndexFieldSearch = async (
   const responsesIndexFields = await Promise.all(
     dedupeIndices
       .map(async (index) => {
-        if (request.onlyCheckIfIndicesExist && index.includes(apmIndexPattern)) {
+        if (
+          request.onlyCheckIfIndicesExist &&
+          (index.includes(apmIndexPattern) || index.includes(apmDataStreamsPattern))
+        ) {
           // for apm index pattern check also if there's data https://github.com/elastic/kibana/issues/90661
           const searchResponse = await esClient.asCurrentUser.search({
             index,
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/helpers.test.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/helpers.test.ts
index 9197917ad764f..c9be6582015f1 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/helpers.test.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/helpers.test.ts
@@ -141,7 +141,7 @@ describe('#formatTimelineData', () => {
           parent: {
             depth: 0,
             index:
-              'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*',
+              'apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*',
             id: '0268af90-d8da-576a-9747-2a191519416a',
             type: 'event',
           },
@@ -180,6 +180,7 @@ describe('#formatTimelineData', () => {
             query: '_id :*',
             index: [
               'apm-*-transaction*',
+              'traces-apm*',
               'auditbeat-*',
               'endgame-*',
               'filebeat-*',
@@ -246,7 +247,7 @@ describe('#formatTimelineData', () => {
             {
               depth: 0,
               index:
-                'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*',
+                'apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*',
               id: '0268af90-d8da-576a-9747-2a191519416a',
               type: 'event',
             },
@@ -255,7 +256,7 @@ describe('#formatTimelineData', () => {
             {
               depth: 0,
               index:
-                'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*',
+                'apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*',
               id: '0268af90-d8da-576a-9747-2a191519416a',
               type: 'event',
             },
@@ -279,6 +280,7 @@ describe('#formatTimelineData', () => {
         'signal.rule.version': ['1'],
         'signal.rule.index': [
           'apm-*-transaction*',
+          'traces-apm*',
           'auditbeat-*',
           'endgame-*',
           'filebeat-*',
@@ -332,6 +334,7 @@ describe('#formatTimelineData', () => {
               id: ['696c24e0-526d-11eb-836c-e1620268b945'],
               index: [
                 'apm-*-transaction*',
+                'traces-apm*',
                 'auditbeat-*',
                 'endgame-*',
                 'filebeat-*',
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 2b1088d8c11ae..f12f93b8ee7b0 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -673,6 +673,7 @@
     "dashboard.topNav.options.syncColorsBetweenPanelsSwitchLabel": "パネル全体でカラーパレットを同期",
     "dashboard.topNav.options.useMarginsBetweenPanelsSwitchLabel": "パネルの間に余白を使用",
     "dashboard.topNav.saveModal.descriptionFormRowLabel": "説明",
+    "dashboard.topNav.saveModal.objectType": "dashboard",
     "dashboard.topNav.saveModal.storeTimeWithDashboardFormRowHelpText": "有効化すると、ダッシュボードが読み込まれるごとに現在選択された時刻の時間フィルターが変更されます。",
     "dashboard.topNav.saveModal.storeTimeWithDashboardFormRowLabel": "ダッシュボードに時刻を保存",
     "dashboard.topNav.showCloneModal.dashboardCopyTitle": "{title}のコピー",
@@ -1698,6 +1699,7 @@
     "discover.localMenu.openTitle": "開く",
     "discover.localMenu.optionsDescription": "オプション",
     "discover.localMenu.saveSaveSearchDescription": "ビジュアライゼーションとダッシュボードで使用できるように Discover の検索を保存します",
+    "discover.localMenu.saveSaveSearchObjectType": "discover",
     "discover.localMenu.saveSearchDescription": "検索を保存します",
     "discover.localMenu.saveTitle": "保存",
     "discover.localMenu.shareSearchDescription": "検索を共有します",
@@ -5138,6 +5140,7 @@
     "visualize.topNavMenu.saveVisualizationButtonAriaLabel": "ビジュアライゼーションを保存",
     "visualize.topNavMenu.saveVisualizationButtonLabel": "保存",
     "visualize.topNavMenu.saveVisualizationDisabledButtonTooltip": "保存する前に変更を適用または破棄",
+    "visualize.topNavMenu.saveVisualizationObjectType": "visualize",
     "visualize.topNavMenu.saveVisualizationToLibraryButtonLabel": "ライブラリに保存",
     "visualize.topNavMenu.shareVisualizationButtonAriaLabel": "ビジュアライゼーションを共有",
     "visualize.topNavMenu.shareVisualizationButtonLabel": "共有",
@@ -9207,7 +9210,6 @@
     "xpack.fleet.setupPage.gettingStartedText": "詳細については、{link}ガイドをお読みください。",
     "xpack.fleet.setupPage.missingRequirementsCalloutDescription": "Elasticエージェントの集中管理を使用するには、次のElasticsearchのセキュリティ機能を有効にする必要があります。",
     "xpack.fleet.setupPage.missingRequirementsCalloutTitle": "不足しているセキュリティ要件",
-    "xpack.fleet.setupPage.missingRequirementsElasticsearchTitle": "Elasticsearchポリシーでは、次のことができます。",
     "xpack.fleet.unenrollAgents.cancelButtonLabel": "キャンセル",
     "xpack.fleet.unenrollAgents.confirmMultipleButtonLabel": "{count}個のエージェントを登録解除",
     "xpack.fleet.unenrollAgents.confirmSingleButtonLabel": "エージェントの登録解除",
@@ -17158,7 +17160,6 @@
     "xpack.observability.feedbackMenu.appName": "オブザーバビリティ",
     "xpack.observability.fieldValueSelection.apply": "適用",
     "xpack.observability.fieldValueSelection.placeholder": "{label}をフィルタリング",
-    "xpack.observability.fleet.beta": "ベータ",
     "xpack.observability.fleet.button": "Fleet ベータを試す",
     "xpack.observability.fleet.text": "Elastic エージェントでは、シンプルかつ統合された方法で、ログ、メトリック、他の種類のデータの監視をホストに追加することができます。複数の Beats と他のエージェントをインストールする必要はありません。このため、インフラストラクチャ全体での構成のデプロイが簡単で高速になりました。",
     "xpack.observability.fleet.title": "新しい Fleet をご覧になりましたか。",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 04394a1ac1704..3a64cee69b177 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -676,6 +676,7 @@
     "dashboard.topNav.options.syncColorsBetweenPanelsSwitchLabel": "在面板之间同步调色板",
     "dashboard.topNav.options.useMarginsBetweenPanelsSwitchLabel": "在面板间使用边距",
     "dashboard.topNav.saveModal.descriptionFormRowLabel": "描述",
+    "dashboard.topNav.saveModal.objectType": "dashboard",
     "dashboard.topNav.saveModal.storeTimeWithDashboardFormRowHelpText": "每次加载此仪表板时，都会将时间筛选更改为当前选定的时间。",
     "dashboard.topNav.saveModal.storeTimeWithDashboardFormRowLabel": "将时间随仪表板保存",
     "dashboard.topNav.showCloneModal.dashboardCopyTitle": "{title} 副本",
@@ -1708,6 +1709,7 @@
     "discover.localMenu.openTitle": "打开",
     "discover.localMenu.optionsDescription": "选项",
     "discover.localMenu.saveSaveSearchDescription": "保存您的 Discover 搜索，以便可以在可视化和仪表板中使用该搜索",
+    "discover.localMenu.saveSaveSearchObjectType": "discover",
     "discover.localMenu.saveSearchDescription": "保存搜索",
     "discover.localMenu.saveTitle": "保存",
     "discover.localMenu.shareSearchDescription": "共享搜索",
@@ -5166,6 +5168,7 @@
     "visualize.topNavMenu.saveVisualizationButtonAriaLabel": "保存可视化",
     "visualize.topNavMenu.saveVisualizationButtonLabel": "保存",
     "visualize.topNavMenu.saveVisualizationDisabledButtonTooltip": "保存前应用或放弃所做更改",
+    "visualize.topNavMenu.saveVisualizationObjectType": "visualize",
     "visualize.topNavMenu.saveVisualizationToLibraryButtonLabel": "保存到库",
     "visualize.topNavMenu.shareVisualizationButtonAriaLabel": "共享可视化",
     "visualize.topNavMenu.shareVisualizationButtonLabel": "共享",
@@ -9293,7 +9296,6 @@
     "xpack.fleet.setupPage.gettingStartedText": "有关更多信息，请阅读我们的{link}指南。",
     "xpack.fleet.setupPage.missingRequirementsCalloutDescription": "要对 Elastic 代理使用集中管理，请启用下面的 Elasticsearch 安全功能。",
     "xpack.fleet.setupPage.missingRequirementsCalloutTitle": "缺失安全性要求",
-    "xpack.fleet.setupPage.missingRequirementsElasticsearchTitle": "在 Elasticsearch 策略中，启用：",
     "xpack.fleet.unenrollAgents.cancelButtonLabel": "取消",
     "xpack.fleet.unenrollAgents.confirmMultipleButtonLabel": "取消注册 {count} 个代理",
     "xpack.fleet.unenrollAgents.confirmSingleButtonLabel": "取消注册代理",
@@ -17394,7 +17396,6 @@
     "xpack.observability.feedbackMenu.appName": "可观测性",
     "xpack.observability.fieldValueSelection.apply": "应用",
     "xpack.observability.fieldValueSelection.placeholder": "筛选 {label}",
-    "xpack.observability.fleet.beta": "公测版",
     "xpack.observability.fleet.button": "试用 Fleet 公测版",
     "xpack.observability.fleet.text": "通过 Elastic 代理，可以简单统一的方式将日志、指标和其他类型数据的监测添加到主机。您无需安装多个 Beats 和其他代理，以令其更为方便快捷地在基础结构中部署配置。",
     "xpack.observability.fleet.title": "您是否了解我们的全新 Fleet？",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/swimlane/steps/swimlane_connection.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/swimlane/steps/swimlane_connection.tsx
index 2bf99ec9d62b6..e81b607f55971 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/swimlane/steps/swimlane_connection.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/swimlane/steps/swimlane_connection.tsx
@@ -4,7 +4,15 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { EuiCallOut, EuiFieldText, EuiFormRow, EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
+import {
+  EuiCallOut,
+  EuiFieldText,
+  EuiFormRow,
+  EuiLink,
+  EuiSpacer,
+  EuiText,
+  EuiFieldPassword,
+} from '@elastic/eui';
 import React, { useCallback } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import * as i18n from '../translations';
@@ -141,7 +149,7 @@ const SwimlaneConnectionComponent: React.FunctionComponent<Props> = ({
               <EuiSpacer size="m" />
             </>
           )}
-          <EuiFieldText
+          <EuiFieldPassword
             fullWidth
             isInvalid={isApiTokenInvalid}
             readOnly={readOnly}
diff --git a/x-pack/plugins/uptime/public/components/common/header/action_menu_content.tsx b/x-pack/plugins/uptime/public/components/common/header/action_menu_content.tsx
index 479a512b7238a..9f00dd2e8f061 100644
--- a/x-pack/plugins/uptime/public/components/common/header/action_menu_content.tsx
+++ b/x-pack/plugins/uptime/public/components/common/header/action_menu_content.tsx
@@ -6,7 +6,7 @@
  */
 
 import React from 'react';
-import { EuiButtonEmpty, EuiHeaderLinks, EuiHeaderSectionItem, EuiToolTip } from '@elastic/eui';
+import { EuiHeaderLinks, EuiToolTip, EuiHeaderLink } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { useHistory } from 'react-router-dom';
@@ -51,53 +51,45 @@ export function ActionMenuContent(): React.ReactElement {
 
   return (
     <EuiHeaderLinks gutterSize="xs">
-      <EuiHeaderSectionItem>
-        <EuiButtonEmpty
-          size="xs"
-          aria-label={i18n.translate('xpack.uptime.page_header.settingsLink.label', {
-            defaultMessage: 'Navigate to the Uptime settings page',
+      <EuiHeaderLink
+        aria-label={i18n.translate('xpack.uptime.page_header.settingsLink.label', {
+          defaultMessage: 'Navigate to the Uptime settings page',
+        })}
+        color="text"
+        data-test-subj="settings-page-link"
+        href={history.createHref({
+          pathname: SETTINGS_ROUTE,
+          search: stringifyUrlParams(params, true),
+        })}
+      >
+        <FormattedMessage id="xpack.uptime.page_header.settingsLink" defaultMessage="Settings" />
+      </EuiHeaderLink>
+
+      <ToggleAlertFlyoutButton />
+
+      <EuiToolTip position="top" content={<p>{ANALYZE_MESSAGE}</p>}>
+        <EuiHeaderLink
+          aria-label={i18n.translate('xpack.uptime.page_header.analyzeData.label', {
+            defaultMessage: 'Navigate to the "Analyze Data" view to visualize Synthetics/User data',
           })}
+          href={syntheticExploratoryViewLink}
           color="text"
-          data-test-subj="settings-page-link"
-          href={history.createHref({
-            pathname: SETTINGS_ROUTE,
-            search: stringifyUrlParams(params, true),
-          })}
+          iconType="visBarVerticalStacked"
         >
-          <FormattedMessage id="xpack.uptime.page_header.settingsLink" defaultMessage="Settings" />
-        </EuiButtonEmpty>
-      </EuiHeaderSectionItem>
-      <EuiHeaderSectionItem>
-        <ToggleAlertFlyoutButton />
-      </EuiHeaderSectionItem>
-      <EuiHeaderSectionItem>
-        <EuiToolTip position="top" content={<p>{ANALYZE_MESSAGE}</p>}>
-          <EuiButtonEmpty
-            size="xs"
-            aria-label={i18n.translate('xpack.uptime.page_header.analyzeData.label', {
-              defaultMessage:
-                'Navigate to the "Analyze Data" view to visualize Synthetics/User data',
-            })}
-            href={syntheticExploratoryViewLink}
-            color="text"
-            iconType="visBarVerticalStacked"
-          >
-            {ANALYZE_DATA}
-          </EuiButtonEmpty>
-        </EuiToolTip>
-      </EuiHeaderSectionItem>
-      <EuiHeaderSectionItem>
-        <EuiButtonEmpty
-          aria-label={i18n.translate('xpack.uptime.page_header.addDataLink.label', {
-            defaultMessage: 'Navigate to a tutorial about adding Uptime data',
-          })}
-          href={kibana.services?.application?.getUrlForApp('/home#/tutorial/uptimeMonitors')}
-          color="primary"
-          iconType="indexOpen"
-        >
-          {ADD_DATA_LABEL}
-        </EuiButtonEmpty>
-      </EuiHeaderSectionItem>
+          {ANALYZE_DATA}
+        </EuiHeaderLink>
+      </EuiToolTip>
+
+      <EuiHeaderLink
+        aria-label={i18n.translate('xpack.uptime.page_header.addDataLink.label', {
+          defaultMessage: 'Navigate to a tutorial about adding Uptime data',
+        })}
+        href={kibana.services?.application?.getUrlForApp('/home#/tutorial/uptimeMonitors')}
+        color="primary"
+        iconType="indexOpen"
+      >
+        {ADD_DATA_LABEL}
+      </EuiHeaderLink>
     </EuiHeaderLinks>
   );
 }
diff --git a/x-pack/plugins/uptime/public/components/monitor/monitor_title.test.tsx b/x-pack/plugins/uptime/public/components/monitor/monitor_title.test.tsx
index 4fd6335c3d3ca..726ad235f7f49 100644
--- a/x-pack/plugins/uptime/public/components/monitor/monitor_title.test.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/monitor_title.test.tsx
@@ -11,7 +11,7 @@ import { screen } from '@testing-library/react';
 import { render } from '../../lib/helper/rtl_helpers';
 import * as reactRouterDom from 'react-router-dom';
 import { Ping } from '../../../common/runtime_types';
-import { MonitorPageTitle } from './monitor_title';
+import { MonitorPageTitle, MonitorPageTitleContent } from './monitor_title';
 
 jest.mock('react-router-dom', () => {
   const originalModule = jest.requireActual('react-router-dom');
@@ -77,11 +77,17 @@ describe('MonitorTitle component', () => {
   });
 
   it('renders the monitor heading and EnableMonitorAlert toggle', () => {
-    render(<MonitorPageTitle />, {
-      state: { monitorStatus: { status: monitorStatusWithName, loading: false } },
-    });
-    expect(screen.getByRole('heading', { level: 1, name: monitorName })).toBeInTheDocument();
-    expect(screen.getByTestId('uptimeDisplayDefineConnector')).toBeInTheDocument();
+    render(
+      <>
+        <MonitorPageTitle />
+        <MonitorPageTitleContent />
+      </>,
+      {
+        state: { monitorStatus: { status: monitorStatusWithName, loading: false } },
+      }
+    );
+    expect(screen.getByText(monitorName));
+    expect(screen.getByRole('switch')).toBeInTheDocument();
   });
 
   it('renders the user provided monitorId when the name is not present', () => {
@@ -89,21 +95,24 @@ describe('MonitorTitle component', () => {
     render(<MonitorPageTitle />, {
       state: { monitorStatus: { status: defaultMonitorStatus, loading: false } },
     });
-    expect(screen.getByRole('heading', { level: 1, name: defaultMonitorId })).toBeInTheDocument();
+    expect(screen.getByText(defaultMonitorId));
   });
 
   it('renders the url when the monitorId is auto generated and the monitor name is not present', () => {
     mockReactRouterDomHooks({ useParamsResponse: { monitorId: autoGeneratedMonitorIdEncoded } });
-    render(<MonitorPageTitle />, {
-      state: { monitorStatus: { status: defaultMonitorStatus, loading: false } },
-    });
-    expect(
-      screen.getByRole('heading', { level: 1, name: defaultMonitorStatus.url?.full })
-    ).toBeInTheDocument();
+    render(
+      <div>
+        <MonitorPageTitle />
+      </div>,
+      {
+        state: { monitorStatus: { status: defaultMonitorStatus, loading: false } },
+      }
+    );
+    expect(screen.getByText(defaultMonitorStatus!.url!.full!));
   });
 
   it('renders beta disclaimer for synthetics monitors', () => {
-    render(<MonitorPageTitle />, {
+    render(<MonitorPageTitleContent />, {
       state: { monitorStatus: { status: defaultBrowserMonitorStatus, loading: false } },
     });
     const betaLink = screen.getByRole('link', {
diff --git a/x-pack/plugins/uptime/public/components/monitor/monitor_title.tsx b/x-pack/plugins/uptime/public/components/monitor/monitor_title.tsx
index 2112af0653669..aa68e2aa7fc4b 100644
--- a/x-pack/plugins/uptime/public/components/monitor/monitor_title.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/monitor_title.tsx
@@ -5,15 +5,7 @@
  * 2.0.
  */
 
-import {
-  EuiBadge,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-  EuiTitle,
-  EuiLink,
-  EuiText,
-} from '@elastic/eui';
+import { EuiBadge, EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiLink, EuiText } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React from 'react';
 import { useSelector } from 'react-redux';
@@ -40,18 +32,11 @@ const getPageTitle = (monitorId: string, selectedMonitor: Ping | null) => {
   return monitorId;
 };
 
-export const MonitorPageTitle: React.FC = () => {
+export const MonitorPageTitleContent: React.FC = () => {
   const monitorId = useMonitorId();
-
   const selectedMonitor = useSelector(monitorStatusSelector);
-
-  const nameOrId = selectedMonitor?.monitor?.name || getPageTitle(monitorId, selectedMonitor);
-
   const type = selectedMonitor?.monitor?.type;
   const isBrowser = type === 'browser';
-
-  useBreadcrumbs([{ text: nameOrId }]);
-
   const renderMonitorType = (monitorType: string) => {
     switch (monitorType) {
       case 'http':
@@ -86,12 +71,13 @@ export const MonitorPageTitle: React.FC = () => {
         return '';
     }
   };
-
   return (
     <>
-      <EuiTitle>
-        <h1 className="eui-textNoWrap">{nameOrId}</h1>
-      </EuiTitle>
+      <EuiFlexGroup wrap={false} data-test-subj="monitorTitle">
+        <EuiFlexItem grow={false} style={{ justifyContent: 'center' }}>
+          <EnableMonitorAlert monitorId={monitorId} selectedMonitor={selectedMonitor!} />
+        </EuiFlexItem>
+      </EuiFlexGroup>
       <EuiSpacer size="s" />
       <EuiFlexGroup wrap={false} gutterSize="s" alignItems="center">
         <EuiFlexItem grow={false}>
@@ -118,7 +104,18 @@ export const MonitorPageTitle: React.FC = () => {
           </EuiFlexItem>
         )}
       </EuiFlexGroup>
-      <EnableMonitorAlert monitorId={monitorId} selectedMonitor={selectedMonitor!} />
     </>
   );
 };
+
+export const MonitorPageTitle: React.FC = () => {
+  const monitorId = useMonitorId();
+
+  const selectedMonitor = useSelector(monitorStatusSelector);
+
+  const nameOrId = selectedMonitor?.monitor?.name || getPageTitle(monitorId, selectedMonitor);
+
+  useBreadcrumbs([{ text: nameOrId }]);
+
+  return <span className="eui-textNoWrap">{nameOrId}</span>;
+};
diff --git a/x-pack/plugins/uptime/public/components/monitor/synthetics/step_detail/step_detail_container.tsx b/x-pack/plugins/uptime/public/components/monitor/synthetics/step_detail/step_detail_container.tsx
index 610107f406306..c24ecd9183865 100644
--- a/x-pack/plugins/uptime/public/components/monitor/synthetics/step_detail/step_detail_container.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/synthetics/step_detail/step_detail_container.tsx
@@ -16,7 +16,7 @@ import { useUiSetting$ } from '../../../../../../../../src/plugins/kibana_react/
 import { useMonitorBreadcrumb } from './use_monitor_breadcrumb';
 import { ClientPluginsStart } from '../../../../apps/plugin';
 import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
-import { StepPageTitle } from './step_page_title';
+import { StepPageTitleContent } from './step_page_title';
 import { StepPageNavigation } from './step_page_nav';
 import { WaterfallChartContainer } from './waterfall/waterfall_chart_container';
 
@@ -78,10 +78,11 @@ export const StepDetailContainer: React.FC<Props> = ({ checkGroup, stepIndex })
   return (
     <PageTemplateComponent
       pageHeader={{
-        pageTitle:
+        pageTitle: journey && activeStep && activeStep.synthetics?.step?.name,
+        children:
           journey && activeStep ? (
-            <StepPageTitle
-              stepName={activeStep.synthetics?.step?.name}
+            <StepPageTitleContent
+              stepName={activeStep.synthetics?.step?.name ?? ''}
               stepIndex={stepIndex}
               totalSteps={journey.steps.length}
               hasPreviousStep={hasPreviousStep}
diff --git a/x-pack/plugins/uptime/public/components/monitor/synthetics/step_detail/step_page_title.tsx b/x-pack/plugins/uptime/public/components/monitor/synthetics/step_detail/step_page_title.tsx
index 083f2f1533e2e..c9e3dc8c3c44f 100644
--- a/x-pack/plugins/uptime/public/components/monitor/synthetics/step_detail/step_page_title.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/synthetics/step_detail/step_page_title.tsx
@@ -6,11 +6,11 @@
  */
 
 import React from 'react';
-import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem, EuiText, EuiTitle } from '@elastic/eui';
+import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 interface Props {
-  stepName?: string;
+  stepName: string;
   stepIndex: number;
   totalSteps: number;
   hasPreviousStep: boolean;
@@ -18,8 +18,8 @@ interface Props {
   handlePreviousStep: () => void;
   handleNextStep: () => void;
 }
-export const StepPageTitle = ({
-  stepName,
+
+export const StepPageTitleContent = ({
   stepIndex,
   totalSteps,
   handleNextStep,
@@ -29,11 +29,6 @@ export const StepPageTitle = ({
 }: Props) => {
   return (
     <EuiFlexGroup alignItems="center" responsive={false}>
-      <EuiFlexItem grow={false}>
-        <EuiTitle size="s">
-          <h1>{stepName}</h1>
-        </EuiTitle>
-      </EuiFlexItem>
       <EuiFlexItem>
         <EuiFlexGroup alignItems="center" responsive={false}>
           <EuiFlexItem grow={false}>
diff --git a/x-pack/plugins/uptime/public/components/overview/alerts/toggle_alert_flyout_button.tsx b/x-pack/plugins/uptime/public/components/overview/alerts/toggle_alert_flyout_button.tsx
index 278958bd1987b..22193fe4623d6 100644
--- a/x-pack/plugins/uptime/public/components/overview/alerts/toggle_alert_flyout_button.tsx
+++ b/x-pack/plugins/uptime/public/components/overview/alerts/toggle_alert_flyout_button.tsx
@@ -6,7 +6,7 @@
  */
 
 import {
-  EuiButtonEmpty,
+  EuiHeaderLink,
   EuiContextMenu,
   EuiContextMenuPanelDescriptor,
   EuiContextMenuPanelItemDescriptor,
@@ -123,8 +123,7 @@ export const ToggleAlertFlyoutButtonComponent: React.FC<Props> = ({
   return (
     <EuiPopover
       button={
-        <EuiButtonEmpty
-          size="xs"
+        <EuiHeaderLink
           color="text"
           aria-label={ToggleFlyoutTranslations.toggleButtonAriaLabel}
           data-test-subj="xpack.uptime.alertsPopover.toggleButton"
@@ -136,7 +135,7 @@ export const ToggleAlertFlyoutButtonComponent: React.FC<Props> = ({
             id="xpack.uptime.alerts.toggleAlertFlyoutButtonText"
             defaultMessage="Alerts and rules"
           />
-        </EuiButtonEmpty>
+        </EuiHeaderLink>
       }
       closePopover={() => setIsOpen(false)}
       isOpen={isOpen}
diff --git a/x-pack/plugins/uptime/public/components/overview/synthetics_callout.test.tsx b/x-pack/plugins/uptime/public/components/overview/synthetics_callout.test.tsx
index 5f6f9d7a7207e..ec9e5f958ec3a 100644
--- a/x-pack/plugins/uptime/public/components/overview/synthetics_callout.test.tsx
+++ b/x-pack/plugins/uptime/public/components/overview/synthetics_callout.test.tsx
@@ -67,9 +67,6 @@ describe('SyntheticsCallout', () => {
             </EuiFlexItem>
           </EuiFlexGroup>
         </EuiCallOut>
-        <EuiSpacer
-          size="s"
-        />
       </Fragment>
     `);
   });
@@ -128,9 +125,6 @@ describe('SyntheticsCallout', () => {
             </EuiFlexItem>
           </EuiFlexGroup>
         </EuiCallOut>
-        <EuiSpacer
-          size="s"
-        />
       </Fragment>
     `);
     wrapper.find('EuiButton').simulate('click');
diff --git a/x-pack/plugins/uptime/public/components/overview/synthetics_callout.tsx b/x-pack/plugins/uptime/public/components/overview/synthetics_callout.tsx
index fa28e42d7d0c1..4e9c3256f1578 100644
--- a/x-pack/plugins/uptime/public/components/overview/synthetics_callout.tsx
+++ b/x-pack/plugins/uptime/public/components/overview/synthetics_callout.tsx
@@ -5,14 +5,7 @@
  * 2.0.
  */
 
-import {
-  EuiButton,
-  EuiButtonEmpty,
-  EuiCallOut,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-} from '@elastic/eui';
+import { EuiButton, EuiButtonEmpty, EuiCallOut, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import React, { useState } from 'react';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -74,7 +67,6 @@ export const SyntheticsCallout = () => {
           </EuiFlexItem>
         </EuiFlexGroup>
       </EuiCallOut>
-      <EuiSpacer size="s" />
     </>
   );
 };
diff --git a/x-pack/plugins/uptime/public/routes.tsx b/x-pack/plugins/uptime/public/routes.tsx
index e3c558cee2c32..2b0cc4dc5e5c2 100644
--- a/x-pack/plugins/uptime/public/routes.tsx
+++ b/x-pack/plugins/uptime/public/routes.tsx
@@ -23,7 +23,7 @@ import { UptimePage, useUptimeTelemetry } from './hooks';
 import { OverviewPageComponent } from './pages/overview';
 import { SyntheticsCheckSteps } from './pages/synthetics/synthetics_checks';
 import { ClientPluginsStart } from './apps/plugin';
-import { MonitorPageTitle } from './components/monitor/monitor_title';
+import { MonitorPageTitle, MonitorPageTitleContent } from './components/monitor/monitor_title';
 import { UptimeDatePicker } from './components/common/uptime_date_picker';
 import { useKibana } from '../../../../src/plugins/kibana_react/public';
 import { CertRefreshBtn } from './components/certificates/cert_refresh_btn';
@@ -36,10 +36,16 @@ interface RouteProps {
   dataTestSubj: string;
   title: string;
   telemetryId: UptimePage;
-  pageHeader?: { pageTitle: string | JSX.Element; rightSideItems?: JSX.Element[] };
+  pageHeader?: {
+    children?: JSX.Element;
+    pageTitle: string | JSX.Element;
+    rightSideItems?: JSX.Element[];
+  };
 }
 
-const baseTitle = 'Uptime - Kibana';
+const baseTitle = i18n.translate('xpack.uptime.routes.baseTitle', {
+  defaultMessage: 'Uptime - Kibana',
+});
 
 export const MONITORING_OVERVIEW_LABEL = i18n.translate('xpack.uptime.overview.heading', {
   defaultMessage: 'Monitors',
@@ -47,18 +53,25 @@ export const MONITORING_OVERVIEW_LABEL = i18n.translate('xpack.uptime.overview.h
 
 const Routes: RouteProps[] = [
   {
-    title: `Monitor | ${baseTitle}`,
+    title: i18n.translate('xpack.uptime.monitorRoute.title', {
+      defaultMessage: 'Monitor | {baseTitle}',
+      values: { baseTitle },
+    }),
     path: MONITOR_ROUTE,
     component: MonitorPage,
     dataTestSubj: 'uptimeMonitorPage',
     telemetryId: UptimePage.Monitor,
     pageHeader: {
+      children: <MonitorPageTitleContent />,
       pageTitle: <MonitorPageTitle />,
       rightSideItems: [<UptimeDatePicker />],
     },
   },
   {
-    title: `Settings | ${baseTitle}`,
+    title: i18n.translate('xpack.uptime.settingsRoute.title', {
+      defaultMessage: `Settings | {baseTitle}`,
+      values: { baseTitle },
+    }),
     path: SETTINGS_ROUTE,
     component: SettingsPage,
     dataTestSubj: 'uptimeSettingsPage',
@@ -70,7 +83,10 @@ const Routes: RouteProps[] = [
     },
   },
   {
-    title: `Certificates | ${baseTitle}`,
+    title: i18n.translate('xpack.uptime.certificatesRoute.title', {
+      defaultMessage: `Certificates | {baseTitle}`,
+      values: { baseTitle },
+    }),
     path: CERTIFICATES_ROUTE,
     component: CertificatesPage,
     dataTestSubj: 'uptimeCertificatesPage',
@@ -81,7 +97,10 @@ const Routes: RouteProps[] = [
     },
   },
   {
-    title: baseTitle,
+    title: i18n.translate('xpack.uptime.stepDetailRoute.title', {
+      defaultMessage: 'Synthetics detail | {baseTitle}',
+      values: { baseTitle },
+    }),
     path: STEP_DETAIL_ROUTE,
     component: StepDetailPage,
     dataTestSubj: 'uptimeStepDetailPage',
diff --git a/x-pack/plugins/uptime/server/lib/alerts/status_check.test.ts b/x-pack/plugins/uptime/server/lib/alerts/status_check.test.ts
index 29f2f0cca82bc..743e9f6bc75ac 100644
--- a/x-pack/plugins/uptime/server/lib/alerts/status_check.test.ts
+++ b/x-pack/plugins/uptime/server/lib/alerts/status_check.test.ts
@@ -4,7 +4,6 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
 import {
   generateFilterDSL,
   hasFilters,
@@ -62,7 +61,12 @@ const mockOptions = (
     shouldCheckStatus: true,
   },
   services = alertsMock.createAlertServices(),
-  state = {}
+  state = {},
+  rule = {
+    schedule: {
+      interval: '5m',
+    },
+  }
 ): any => {
   services.scopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
   services.scopedClusterClient.asCurrentUser = (jest.fn() as unknown) as any;
@@ -77,13 +81,16 @@ const mockOptions = (
     params,
     services,
     state,
+    rule,
   };
 };
 
 describe('status check alert', () => {
   let toISOStringSpy: jest.SpyInstance<string, []>;
+  const mockDate = new Date('2021-05-13T12:33:37.000Z');
   beforeEach(() => {
     toISOStringSpy = jest.spyOn(Date.prototype, 'toISOString');
+    Date.now = jest.fn().mockReturnValue(mockDate);
   });
 
   afterEach(() => {
@@ -108,10 +115,14 @@ describe('status check alert', () => {
             "filters": undefined,
             "locations": Array [],
             "numTimes": 5,
-            "timerange": Object {
+            "timespanRange": Object {
               "from": "now-15m",
               "to": "now",
             },
+            "timestampRange": Object {
+              "from": 1620821917000,
+              "to": "now",
+            },
             "uptimeEsClient": Object {
               "baseESClient": [MockFunction],
               "count": [Function],
@@ -163,10 +174,14 @@ describe('status check alert', () => {
             "filters": undefined,
             "locations": Array [],
             "numTimes": 5,
-            "timerange": Object {
+            "timespanRange": Object {
               "from": "now-15m",
               "to": "now",
             },
+            "timestampRange": Object {
+              "from": 1620821917000,
+              "to": "now",
+            },
             "uptimeEsClient": Object {
               "baseESClient": [MockFunction],
               "count": [Function],
@@ -476,10 +491,14 @@ describe('status check alert', () => {
             },
             "locations": Array [],
             "numTimes": 3,
-            "timerange": Object {
+            "timespanRange": Object {
               "from": "now-15m",
               "to": "now",
             },
+            "timestampRange": Object {
+              "from": 1620821917000,
+              "to": "now",
+            },
             "uptimeEsClient": Object {
               "baseESClient": [MockFunction],
               "count": [Function],
@@ -583,10 +602,14 @@ describe('status check alert', () => {
             },
             "locations": Array [],
             "numTimes": 20,
-            "timerange": Object {
+            "timespanRange": Object {
               "from": "now-30h",
               "to": "now",
             },
+            "timestampRange": Object {
+              "from": 1620714817000,
+              "to": "now",
+            },
             "uptimeEsClient": Object {
               "baseESClient": [MockFunction],
               "count": [Function],
@@ -900,6 +923,85 @@ describe('status check alert', () => {
     });
   });
 
+  it('generates timespan and @timestamp ranges appropriately', async () => {
+    const mockGetter = jest.fn();
+    mockGetter.mockReturnValue([]);
+    const { server, libs, plugins } = bootstrapDependencies({
+      getIndexPattern: jest.fn(),
+      getMonitorStatus: mockGetter,
+    });
+    const alert = statusCheckAlertFactory(server, libs, plugins);
+    const options = mockOptions({
+      numTimes: 20,
+      timerangeCount: 30,
+      timerangeUnit: 'h',
+      filters: {
+        'monitor.type': ['http'],
+        'observer.geo.name': [],
+        tags: [],
+        'url.port': [],
+      },
+      search: 'url.full: *',
+    });
+    await alert.executor(options);
+
+    expect(mockGetter).toHaveBeenCalledTimes(1);
+    expect(mockGetter.mock.calls[0][0]).toEqual(
+      expect.objectContaining({
+        timespanRange: {
+          from: 'now-30h',
+          to: 'now',
+        },
+        timestampRange: {
+          from: mockDate.setHours(mockDate.getHours() - 54).valueOf(), // now minus the timerange (30h), plus an additional 24 hour buffer
+          to: 'now',
+        },
+      })
+    );
+  });
+
+  it('uses the larger of alert interval and timerange when defining timestampRange', async () => {
+    const mockGetter = jest.fn();
+    mockGetter.mockReturnValue([]);
+    const { server, libs, plugins } = bootstrapDependencies({
+      getIndexPattern: jest.fn(),
+      getMonitorStatus: mockGetter,
+    });
+    const alert = statusCheckAlertFactory(server, libs, plugins);
+    const options = mockOptions(
+      {
+        numTimes: 20,
+        timerangeCount: 30,
+        timerangeUnit: 'h',
+        filters: {
+          'monitor.type': ['http'],
+          'observer.geo.name': [],
+          tags: [],
+          'url.port': [],
+        },
+        search: 'url.full: *',
+      },
+      undefined,
+      undefined,
+      { schedule: { interval: '60h' } }
+    );
+    await alert.executor(options);
+
+    expect(mockGetter).toHaveBeenCalledTimes(1);
+    expect(mockGetter.mock.calls[0][0]).toEqual(
+      expect.objectContaining({
+        timespanRange: {
+          from: 'now-30h',
+          to: 'now',
+        },
+        timestampRange: {
+          from: mockDate.setHours(mockDate.getHours() - 60).valueOf(), // 60h rule schedule interval is larger than 30h timerange, so use now - 60h to define timestamp range
+          to: 'now',
+        },
+      })
+    );
+  });
+
   describe('hasFilters', () => {
     it('returns false for undefined filters', () => {
       expect(hasFilters()).toBe(false);
diff --git a/x-pack/plugins/uptime/server/lib/alerts/status_check.ts b/x-pack/plugins/uptime/server/lib/alerts/status_check.ts
index 6f3e3303f6bdc..364518bba720a 100644
--- a/x-pack/plugins/uptime/server/lib/alerts/status_check.ts
+++ b/x-pack/plugins/uptime/server/lib/alerts/status_check.ts
@@ -4,7 +4,8 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import datemath from '@elastic/datemath';
+import { min } from 'lodash';
 import { schema } from '@kbn/config-schema';
 import { i18n } from '@kbn/i18n';
 import Mustache from 'mustache';
@@ -31,6 +32,34 @@ import { UMServerLibs, UptimeESClient } from '../lib';
 
 export type ActionGroupIds = ActionGroupIdsOf<typeof MONITOR_STATUS>;
 
+/**
+ * Returns the appropriate range for filtering the documents by `@timestamp`.
+ *
+ * We check monitor status by `monitor.timespan`, but need to first cut down on the number of documents
+ * searched by filtering by `@timestamp`. To ensure that we catch as many documents as possible which could
+ * likely contain a down monitor with a `monitor.timespan` in the given timerange, we create a filter
+ * range for `@timestamp` that is the greater of either: from now to now - timerange interval - 24 hours
+ * OR from now to now - rule interval
+ * @param ruleScheduleLookback - string representing now minus the interval at which the rule is ran
+ * @param timerangeLookback - string representing now minus the timerange configured by the user for checking down monitors
+ */
+export function getTimestampRange({
+  ruleScheduleLookback,
+  timerangeLookback,
+}: Record<'ruleScheduleLookback' | 'timerangeLookback', string>) {
+  const scheduleIntervalAbsoluteTime = datemath.parse(ruleScheduleLookback)?.valueOf();
+  const defaultIntervalAbsoluteTime = datemath
+    .parse(timerangeLookback)
+    ?.subtract('24', 'hours')
+    .valueOf();
+  const from = min([scheduleIntervalAbsoluteTime, defaultIntervalAbsoluteTime]) ?? 'now-24h';
+
+  return {
+    to: 'now',
+    from,
+  };
+}
+
 const getMonIdByLoc = (monitorId: string, location: string) => {
   return monitorId + '-' + location;
 };
@@ -264,6 +293,9 @@ export const statusCheckAlertFactory: UptimeAlertTypeFactory<ActionGroupIds> = (
         params: rawParams,
         state,
         services: { alertInstanceFactory },
+        rule: {
+          schedule: { interval },
+        },
       },
       uptimeEsClient,
     }) {
@@ -279,14 +311,22 @@ export const statusCheckAlertFactory: UptimeAlertTypeFactory<ActionGroupIds> = (
         isAutoGenerated,
         timerange: oldVersionTimeRange,
       } = rawParams;
-
       const filterString = await formatFilterString(uptimeEsClient, filters, search, libs);
 
-      const timerange = oldVersionTimeRange || {
-        from: `now-${String(timerangeCount) + timerangeUnit}`,
+      const timespanInterval = `${String(timerangeCount)}${timerangeUnit}`;
+
+      // Range filter for `monitor.timespan`, the range of time the ping is valid
+      const timespanRange = oldVersionTimeRange || {
+        from: `now-${timespanInterval}`,
         to: 'now',
       };
 
+      // Range filter for `@timestamp`, the time the document was indexed
+      const timestampRange = getTimestampRange({
+        ruleScheduleLookback: `now-${interval}`,
+        timerangeLookback: timespanRange.from,
+      });
+
       let downMonitorsByLocation: GetMonitorStatusResult[] = [];
 
       // if oldVersionTimeRange present means it's 7.7 format and
@@ -294,7 +334,8 @@ export const statusCheckAlertFactory: UptimeAlertTypeFactory<ActionGroupIds> = (
       if (!(!oldVersionTimeRange && shouldCheckStatus === false)) {
         downMonitorsByLocation = await libs.requests.getMonitorStatus({
           uptimeEsClient,
-          timerange,
+          timespanRange,
+          timestampRange,
           numTimes,
           locations: [],
           filters: filterString,
diff --git a/x-pack/plugins/uptime/server/lib/requests/get_certs.test.ts b/x-pack/plugins/uptime/server/lib/requests/get_certs.test.ts
index 333824df174a6..6e06dea0436db 100644
--- a/x-pack/plugins/uptime/server/lib/requests/get_certs.test.ts
+++ b/x-pack/plugins/uptime/server/lib/requests/get_certs.test.ts
@@ -173,7 +173,7 @@ describe('getCerts', () => {
                   "filter": Array [
                     Object {
                       "exists": Object {
-                        "field": "tls.server",
+                        "field": "tls.server.hash.sha256",
                       },
                     },
                     Object {
diff --git a/x-pack/plugins/uptime/server/lib/requests/get_certs.ts b/x-pack/plugins/uptime/server/lib/requests/get_certs.ts
index 1b20ed9085fef..86a9825f8a485 100644
--- a/x-pack/plugins/uptime/server/lib/requests/get_certs.ts
+++ b/x-pack/plugins/uptime/server/lib/requests/get_certs.ts
@@ -64,7 +64,7 @@ export const getCerts: UMElasticsearchQueryFn<GetCertsParams, CertResult> = asyn
         filter: [
           {
             exists: {
-              field: 'tls.server',
+              field: 'tls.server.hash.sha256',
             },
           },
           {
@@ -138,7 +138,6 @@ export const getCerts: UMElasticsearchQueryFn<GetCertsParams, CertResult> = asyn
     searchBody.query.bool.filter.push(validityFilters);
   }
 
-  // console.log(JSON.stringify(params, null, 2));
   const { body: result } = await uptimeEsClient.search({
     body: searchBody,
   });
diff --git a/x-pack/plugins/uptime/server/lib/requests/get_monitor_status.test.ts b/x-pack/plugins/uptime/server/lib/requests/get_monitor_status.test.ts
index 6d88ccb9a9eff..08b675576a5d2 100644
--- a/x-pack/plugins/uptime/server/lib/requests/get_monitor_status.test.ts
+++ b/x-pack/plugins/uptime/server/lib/requests/get_monitor_status.test.ts
@@ -85,10 +85,14 @@ describe('getMonitorStatus', () => {
       filters: exampleFilter,
       locations: [],
       numTimes: 5,
-      timerange: {
+      timespanRange: {
         from: 'now-10m',
         to: 'now-1m',
       },
+      timestampRange: {
+        from: 'now-24h',
+        to: 'now',
+      },
     });
     expect(esMock.search).toHaveBeenCalledTimes(1);
     const [params] = esMock.search.mock.calls[0];
@@ -144,6 +148,14 @@ describe('getMonitorStatus', () => {
                 Object {
                   "range": Object {
                     "@timestamp": Object {
+                      "gte": "now-24h",
+                      "lte": "now",
+                    },
+                  },
+                },
+                Object {
+                  "range": Object {
+                    "monitor.timespan": Object {
                       "gte": "now-10m",
                       "lte": "now-1m",
                     },
@@ -202,10 +214,14 @@ describe('getMonitorStatus', () => {
       uptimeEsClient,
       locations: ['fairbanks', 'harrisburg'],
       numTimes: 1,
-      timerange: {
+      timespanRange: {
         from: 'now-2m',
         to: 'now',
       },
+      timestampRange: {
+        from: 'now-24h',
+        to: 'now',
+      },
     });
     expect(esMock.search).toHaveBeenCalledTimes(1);
     const [params] = esMock.search.mock.calls[0];
@@ -261,6 +277,14 @@ describe('getMonitorStatus', () => {
                 Object {
                   "range": Object {
                     "@timestamp": Object {
+                      "gte": "now-24h",
+                      "lte": "now",
+                    },
+                  },
+                },
+                Object {
+                  "range": Object {
+                    "monitor.timespan": Object {
                       "gte": "now-2m",
                       "lte": "now",
                     },
@@ -298,10 +322,14 @@ describe('getMonitorStatus', () => {
       genBucketItem
     );
     const clientParameters = {
-      timerange: {
+      timespanRange: {
         from: 'now-15m',
         to: 'now',
       },
+      timestampRange: {
+        from: 'now-24h',
+        to: 'now',
+      },
       numTimes: 5,
       locations: [],
       filters: {
@@ -415,6 +443,14 @@ describe('getMonitorStatus', () => {
                 Object {
                   "range": Object {
                     "@timestamp": Object {
+                      "gte": "now-24h",
+                      "lte": "now",
+                    },
+                  },
+                },
+                Object {
+                  "range": Object {
+                    "monitor.timespan": Object {
                       "gte": "now-15m",
                       "lte": "now",
                     },
@@ -485,10 +521,14 @@ describe('getMonitorStatus', () => {
       genBucketItem
     );
     const clientParameters = {
-      timerange: {
+      timespanRange: {
         from: 'now-15m',
         to: 'now',
       },
+      timestampRange: {
+        from: 'now-24h',
+        to: 'now',
+      },
       numTimes: 5,
       locations: [],
       filters: {
@@ -562,6 +602,14 @@ describe('getMonitorStatus', () => {
                 Object {
                   "range": Object {
                     "@timestamp": Object {
+                      "gte": "now-24h",
+                      "lte": "now",
+                    },
+                  },
+                },
+                Object {
+                  "range": Object {
+                    "monitor.timespan": Object {
                       "gte": "now-15m",
                       "lte": "now",
                     },
@@ -618,10 +666,14 @@ describe('getMonitorStatus', () => {
       filters: undefined,
       locations: [],
       numTimes: 5,
-      timerange: {
+      timespanRange: {
         from: 'now-12m',
         to: 'now-2m',
       },
+      timestampRange: {
+        from: 'now-24h',
+        to: 'now',
+      },
     };
 
     const { uptimeEsClient } = getUptimeESMockClient(esMock);
@@ -684,6 +736,14 @@ describe('getMonitorStatus', () => {
                 Object {
                   "range": Object {
                     "@timestamp": Object {
+                      "gte": "now-24h",
+                      "lte": "now",
+                    },
+                  },
+                },
+                Object {
+                  "range": Object {
+                    "monitor.timespan": Object {
                       "gte": "now-12m",
                       "lte": "now-2m",
                     },
@@ -810,10 +870,14 @@ describe('getMonitorStatus', () => {
       uptimeEsClient,
       locations: [],
       numTimes: 5,
-      timerange: {
+      timespanRange: {
         from: 'now-10m',
         to: 'now-1m',
       },
+      timestampRange: {
+        from: 'now-24h',
+        to: 'now',
+      },
     });
     expect(result.length).toBe(8);
     expect(result).toMatchInlineSnapshot(`
diff --git a/x-pack/plugins/uptime/server/lib/requests/get_monitor_status.ts b/x-pack/plugins/uptime/server/lib/requests/get_monitor_status.ts
index 07047bd0be7bc..15e6fe30db186 100644
--- a/x-pack/plugins/uptime/server/lib/requests/get_monitor_status.ts
+++ b/x-pack/plugins/uptime/server/lib/requests/get_monitor_status.ts
@@ -15,7 +15,8 @@ export interface GetMonitorStatusParams {
   filters?: JsonObject;
   locations: string[];
   numTimes: number;
-  timerange: { from: string; to: string };
+  timespanRange: { from: string; to: string };
+  timestampRange: { from: string | number; to: string };
 }
 
 export interface GetMonitorStatusResult {
@@ -43,7 +44,7 @@ export type AfterKey = Record<string, string | number | null> | undefined;
 export const getMonitorStatus: UMElasticsearchQueryFn<
   GetMonitorStatusParams,
   GetMonitorStatusResult[]
-> = async ({ uptimeEsClient, filters, locations, numTimes, timerange: { from, to } }) => {
+> = async ({ uptimeEsClient, filters, locations, numTimes, timespanRange, timestampRange }) => {
   let afterKey: AfterKey;
 
   const STATUS = 'down';
@@ -63,8 +64,16 @@ export const getMonitorStatus: UMElasticsearchQueryFn<
             {
               range: {
                 '@timestamp': {
-                  gte: from,
-                  lte: to,
+                  gte: timestampRange.from,
+                  lte: timestampRange.to,
+                },
+              },
+            },
+            {
+              range: {
+                'monitor.timespan': {
+                  gte: timespanRange.from,
+                  lte: timespanRange.to,
                 },
               },
             },
diff --git a/x-pack/test/api_integration/apis/lens/field_stats.ts b/x-pack/test/api_integration/apis/lens/field_stats.ts
index 5dcb749f54b31..5090fe14576d5 100644
--- a/x-pack/test/api_integration/apis/lens/field_stats.ts
+++ b/x-pack/test/api_integration/apis/lens/field_stats.ts
@@ -427,6 +427,38 @@ export default ({ getService }: FtrProviderContext) => {
 
         expect(body.totalDocuments).to.eql(425);
       });
+
+      it('should allow filtering on a runtime field other than the field in use', async () => {
+        const { body } = await supertest
+          .post('/api/lens/index_stats/logstash-2015.09.22/field')
+          .set(COMMON_HEADERS)
+          .send({
+            dslQuery: {
+              bool: {
+                filter: [{ exists: { field: 'runtime_string_field' } }],
+              },
+            },
+            fromDate: TEST_START_TIME,
+            toDate: TEST_END_TIME,
+            fieldName: 'runtime_number_field',
+          })
+          .expect(200);
+
+        expect(body).to.eql({
+          totalDocuments: 4634,
+          sampledDocuments: 4634,
+          sampledValues: 4634,
+          topValues: {
+            buckets: [
+              {
+                count: 4634,
+                key: 5,
+              },
+            ],
+          },
+          histogram: { buckets: [] },
+        });
+      });
     });
 
     describe('histogram', () => {
diff --git a/x-pack/test/api_integration/apis/ml/data_visualizer/get_overall_stats.ts b/x-pack/test/api_integration/apis/ml/data_visualizer/get_overall_stats.ts
index 4ce9d4871246c..7987875a75519 100644
--- a/x-pack/test/api_integration/apis/ml/data_visualizer/get_overall_stats.ts
+++ b/x-pack/test/api_integration/apis/ml/data_visualizer/get_overall_stats.ts
@@ -52,6 +52,7 @@ export default ({ getService }: FtrProviderContext) => {
           aggregatableNotExistsFields: [{ fieldName: 'sourcetype', existsInDocs: false }],
           nonAggregatableExistsFields: [{ fieldName: 'type', existsInDocs: true, stats: {} }],
           nonAggregatableNotExistsFields: [],
+          errors: [],
         },
       },
     },
@@ -98,6 +99,7 @@ export default ({ getService }: FtrProviderContext) => {
           aggregatableNotExistsFields: [{ fieldName: 'sourcetype', existsInDocs: false }],
           nonAggregatableExistsFields: [{ fieldName: 'type', existsInDocs: true, stats: {} }],
           nonAggregatableNotExistsFields: [],
+          errors: [],
         },
       },
     },
diff --git a/x-pack/test/apm_api_integration/tests/correlations/latency_ml.ts b/x-pack/test/apm_api_integration/tests/correlations/latency_ml.ts
new file mode 100644
index 0000000000000..cc8f48fb58944
--- /dev/null
+++ b/x-pack/test/apm_api_integration/tests/correlations/latency_ml.ts
@@ -0,0 +1,266 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import request from 'superagent';
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+import { registry } from '../../common/registry';
+
+import { PartialSearchRequest } from '../../../../plugins/apm/server/lib/search_strategies/correlations/search_strategy';
+
+function parseBfetchResponse(resp: request.Response): Array<Record<string, any>> {
+  return resp.text
+    .trim()
+    .split('\n')
+    .map((item) => JSON.parse(item));
+}
+
+export default function ApiTest({ getService }: FtrProviderContext) {
+  const retry = getService('retry');
+  const supertest = getService('supertest');
+
+  const getRequestBody = () => {
+    const partialSearchRequest: PartialSearchRequest = {
+      params: {
+        index: 'apm-*',
+        environment: 'ENVIRONMENT_ALL',
+        start: '2020',
+        end: '2021',
+        percentileThreshold: 95,
+      },
+    };
+
+    return {
+      batch: [
+        {
+          request: partialSearchRequest,
+          options: { strategy: 'apmCorrelationsSearchStrategy' },
+        },
+      ],
+    };
+  };
+
+  registry.when(
+    'correlations latency_ml overall without data',
+    { config: 'trial', archives: [] },
+    () => {
+      it('handles the empty state', async () => {
+        const intialResponse = await supertest
+          .post(`/internal/bsearch`)
+          .set('kbn-xsrf', 'foo')
+          .send(getRequestBody());
+
+        expect(intialResponse.status).to.eql(
+          200,
+          `Expected status to be '200', got '${intialResponse.status}'`
+        );
+        expect(intialResponse.body).to.eql(
+          {},
+          `Expected response body to be an empty object, actual response is in the text attribute. Got: '${JSON.stringify(
+            intialResponse.body
+          )}'`
+        );
+
+        const body = parseBfetchResponse(intialResponse)[0];
+
+        expect(typeof body.result).to.be('object');
+        const { result } = body;
+
+        expect(typeof result?.id).to.be('string');
+
+        // pass on id for follow up queries
+        const searchStrategyId = result.id;
+
+        // follow up request body including search strategy ID
+        const reqBody = getRequestBody();
+        reqBody.batch[0].request.id = searchStrategyId;
+
+        let followUpResponse: Record<string, any> = {};
+
+        // continues querying until the search strategy finishes
+        await retry.waitForWithTimeout(
+          'search strategy eventually completes and returns full results',
+          5000,
+          async () => {
+            const response = await supertest
+              .post(`/internal/bsearch`)
+              .set('kbn-xsrf', 'foo')
+              .send(reqBody);
+
+            followUpResponse = parseBfetchResponse(response)[0];
+
+            return (
+              followUpResponse?.result?.isRunning === false || followUpResponse?.error !== undefined
+            );
+          }
+        );
+
+        expect(followUpResponse?.error).to.eql(
+          undefined,
+          `search strategy should not return an error, got: ${JSON.stringify(
+            followUpResponse?.error
+          )}`
+        );
+
+        const followUpResult = followUpResponse.result;
+        expect(followUpResult?.isRunning).to.eql(false, 'search strategy should not be running');
+        expect(followUpResult?.isPartial).to.eql(
+          false,
+          'search strategy result should not be partial'
+        );
+        expect(followUpResult?.id).to.eql(
+          searchStrategyId,
+          'search strategy id should match original id'
+        );
+        expect(followUpResult?.isRestored).to.eql(
+          true,
+          'search strategy response should be restored'
+        );
+        expect(followUpResult?.loaded).to.eql(100, 'loaded state should be 100');
+        expect(followUpResult?.total).to.eql(100, 'total state should be 100');
+
+        expect(typeof followUpResult?.rawResponse).to.be('object');
+
+        const { rawResponse: finalRawResponse } = followUpResult;
+
+        expect(typeof finalRawResponse?.took).to.be('number');
+        expect(finalRawResponse?.percentileThresholdValue).to.be(undefined);
+        expect(finalRawResponse?.overallHistogram).to.be(undefined);
+        expect(finalRawResponse?.values.length).to.be(0);
+        expect(finalRawResponse?.log.map((d: string) => d.split(': ')[1])).to.eql([
+          'Fetched 95th percentile value of undefined based on 0 documents.',
+          'Abort service since percentileThresholdValue could not be determined.',
+        ]);
+      });
+    }
+  );
+
+  registry.when(
+    'Correlations latency_ml with data and opbeans-node args',
+    { config: 'trial', archives: ['ml_8.0.0'] },
+    () => {
+      // putting this into a single `it` because the responses depend on each other
+      it('queries the search strategy and returns results', async () => {
+        const intialResponse = await supertest
+          .post(`/internal/bsearch`)
+          .set('kbn-xsrf', 'foo')
+          .send(getRequestBody());
+
+        expect(intialResponse.status).to.eql(
+          200,
+          `Expected status to be '200', got '${intialResponse.status}'`
+        );
+        expect(intialResponse.body).to.eql(
+          {},
+          `Expected response body to be an empty object, actual response is in the text attribute. Got: '${JSON.stringify(
+            intialResponse.body
+          )}'`
+        );
+
+        const body = parseBfetchResponse(intialResponse)[0];
+
+        expect(typeof body?.result).to.be('object');
+        const { result } = body;
+
+        expect(typeof result?.id).to.be('string');
+
+        // pass on id for follow up queries
+        const searchStrategyId = result.id;
+
+        expect(result?.loaded).to.be(0);
+        expect(result?.total).to.be(100);
+        expect(result?.isRunning).to.be(true);
+        expect(result?.isPartial).to.be(true);
+        expect(result?.isRestored).to.eql(
+          false,
+          `Expected response result to be not restored. Got: '${result?.isRestored}'`
+        );
+        expect(typeof result?.rawResponse).to.be('object');
+
+        const { rawResponse } = result;
+
+        expect(typeof rawResponse?.took).to.be('number');
+        expect(rawResponse?.values).to.eql([]);
+
+        // follow up request body including search strategy ID
+        const reqBody = getRequestBody();
+        reqBody.batch[0].request.id = searchStrategyId;
+
+        let followUpResponse: Record<string, any> = {};
+
+        // continues querying until the search strategy finishes
+        await retry.waitForWithTimeout(
+          'search strategy eventually completes and returns full results',
+          5000,
+          async () => {
+            const response = await supertest
+              .post(`/internal/bsearch`)
+              .set('kbn-xsrf', 'foo')
+              .send(reqBody);
+            followUpResponse = parseBfetchResponse(response)[0];
+
+            return (
+              followUpResponse?.result?.isRunning === false || followUpResponse?.error !== undefined
+            );
+          }
+        );
+
+        expect(followUpResponse?.error).to.eql(
+          undefined,
+          `Finished search strategy should not return an error, got: ${JSON.stringify(
+            followUpResponse?.error
+          )}`
+        );
+
+        const followUpResult = followUpResponse.result;
+        expect(followUpResult?.isRunning).to.eql(
+          false,
+          `Expected finished result not to be running. Got: ${followUpResult?.isRunning}`
+        );
+        expect(followUpResult?.isPartial).to.eql(
+          false,
+          `Expected finished result not to be partial. Got: ${followUpResult?.isPartial}`
+        );
+        expect(followUpResult?.id).to.be(searchStrategyId);
+        expect(followUpResult?.isRestored).to.be(true);
+        expect(followUpResult?.loaded).to.be(100);
+        expect(followUpResult?.total).to.be(100);
+
+        expect(typeof followUpResult?.rawResponse).to.be('object');
+
+        const { rawResponse: finalRawResponse } = followUpResult;
+
+        expect(typeof finalRawResponse?.took).to.be('number');
+        expect(finalRawResponse?.percentileThresholdValue).to.be(1404927.875);
+        expect(finalRawResponse?.overallHistogram.length).to.be(101);
+
+        expect(finalRawResponse?.values.length).to.eql(
+          1,
+          `Expected 1 identified correlations, got ${finalRawResponse?.values.length}.`
+        );
+        expect(finalRawResponse?.log.map((d: string) => d.split(': ')[1])).to.eql([
+          'Fetched 95th percentile value of 1404927.875 based on 989 documents.',
+          'Loaded histogram range steps.',
+          'Loaded overall histogram chart data.',
+          'Loaded percentiles.',
+          'Identified 67 fieldCandidates.',
+          'Identified 339 fieldValuePairs.',
+          'Loaded fractions and totalDocCount of 989.',
+          'Identified 1 significant correlations out of 339 field/value pairs.',
+        ]);
+
+        const correlation = finalRawResponse?.values[0];
+        expect(typeof correlation).to.be('object');
+        expect(correlation?.field).to.be('transaction.result');
+        expect(correlation?.value).to.be('success');
+        expect(correlation?.correlation).to.be(0.37418510688551887);
+        expect(correlation?.ksTest).to.be(1.1238496968312214e-10);
+        expect(correlation?.histogram.length).to.be(101);
+      });
+    }
+  );
+}
diff --git a/x-pack/test/apm_api_integration/tests/index.ts b/x-pack/test/apm_api_integration/tests/index.ts
index 813e0e4f3cdb8..a00fa1723fa3e 100644
--- a/x-pack/test/apm_api_integration/tests/index.ts
+++ b/x-pack/test/apm_api_integration/tests/index.ts
@@ -32,6 +32,10 @@ export default function apmApiIntegrationTests(providerContext: FtrProviderConte
       loadTestFile(require.resolve('./correlations/latency_slow_transactions'));
     });
 
+    describe('correlations/latency_ml', function () {
+      loadTestFile(require.resolve('./correlations/latency_ml'));
+    });
+
     describe('correlations/latency_overall', function () {
       loadTestFile(require.resolve('./correlations/latency_overall'));
     });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
index 05b097cc87b61..e2251b0b8af08 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
@@ -47,9 +47,10 @@ import {
   getSignalsByIds,
   findImmutableRuleById,
   getPrePackagedRulesStatus,
-  getRuleForSignalTesting,
   getOpenSignals,
   createRuleWithExceptionEntries,
+  getEqlRuleForSignalTesting,
+  getThresholdRuleForSignalTesting,
 } from '../../utils';
 import { ROLES } from '../../../../plugins/security_solution/common/test';
 import { createUserAndRole, deleteUserAndRole } from '../roles_users_utils';
@@ -615,10 +616,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('generates no signals when an exception is added for an EQL rule', async () => {
           const rule: EqlCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: 'eql-rule',
-            type: 'eql',
-            language: 'eql',
+            ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'configuration where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
           };
           const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
@@ -637,11 +635,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('generates no signals when an exception is added for a threshold rule', async () => {
           const rule: ThresholdCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: 'threshold-rule',
-            type: 'threshold',
-            language: 'kuery',
-            query: '*:*',
+            ...getThresholdRuleForSignalTesting(['auditbeat-*']),
             threshold: {
               field: 'host.id',
               value: 700,
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
index a1a97ac8bfd35..4972b485be06c 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
@@ -21,11 +21,13 @@ import {
   createSignalsIndex,
   deleteAllAlerts,
   deleteSignalsIndex,
+  getEqlRuleForSignalTesting,
   getOpenSignals,
   getRuleForSignalTesting,
   getSignalsByIds,
   getSignalsByRuleIds,
   getSimpleRule,
+  getThresholdRuleForSignalTesting,
   waitForRuleSuccessOrStatus,
   waitForSignalsToBePresent,
 } from '../../utils';
@@ -273,16 +275,13 @@ export default ({ getService }: FtrProviderContext) => {
       describe('EQL Rules', () => {
         it('generates a correctly formatted signal from EQL non-sequence queries', async () => {
           const rule: EqlCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: 'eql-rule',
-            type: 'eql',
-            language: 'eql',
+            ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'configuration where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
           };
           const { id } = await createRule(supertest, rule);
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signals = await getSignalsByRuleIds(supertest, ['eql-rule']);
+          const signals = await getSignalsByIds(supertest, [id]);
           expect(signals.hits.hits.length).eql(1);
           const fullSignal = signals.hits.hits[0]._source;
 
@@ -393,13 +392,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('generates up to max_signals for non-sequence EQL queries', async () => {
-          const rule: EqlCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: 'eql-rule',
-            type: 'eql',
-            language: 'eql',
-            query: 'any where true',
-          };
+          const rule: EqlCreateSchema = getEqlRuleForSignalTesting(['auditbeat-*']);
           const { id } = await createRule(supertest, rule);
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 100, [id]);
@@ -412,17 +405,14 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('uses the provided event_category_override', async () => {
           const rule: EqlCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: 'eql-rule',
-            type: 'eql',
-            language: 'eql',
+            ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'config_change where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
             event_category_override: 'auditd.message_type',
           };
           const { id } = await createRule(supertest, rule);
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signals = await getSignalsByRuleIds(supertest, ['eql-rule']);
+          const signals = await getSignalsByIds(supertest, [id]);
           expect(signals.hits.hits.length).eql(1);
           const fullSignal = signals.hits.hits[0]._source;
 
@@ -534,16 +524,13 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('generates building block signals from EQL sequences in the expected form', async () => {
           const rule: EqlCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: 'eql-rule',
-            type: 'eql',
-            language: 'eql',
+            ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'sequence by host.name [anomoly where true] [any where true]',
           };
           const { id } = await createRule(supertest, rule);
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signals = await getSignalsByRuleIds(supertest, ['eql-rule']);
+          const signals = await getSignalsByIds(supertest, [id]);
           const buildingBlock = signals.hits.hits.find(
             (signal) =>
               signal._source.signal.depth === 1 &&
@@ -699,16 +686,13 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('generates shell signals from EQL sequences in the expected form', async () => {
           const rule: EqlCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: 'eql-rule',
-            type: 'eql',
-            language: 'eql',
+            ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'sequence by host.name [anomoly where true] [any where true]',
           };
           const { id } = await createRule(supertest, rule);
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsByRuleIds(supertest, ['eql-rule']);
+          const signalsOpen = await getSignalsByIds(supertest, [id]);
           const sequenceSignal = signalsOpen.hits.hits.find(
             (signal) => signal._source.signal.depth === 2
           );
@@ -802,10 +786,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('generates up to max_signals with an EQL rule', async () => {
           const rule: EqlCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: 'eql-rule',
-            type: 'eql',
-            language: 'eql',
+            ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'sequence by host.name [any where true] [any where true]',
           };
           const { id } = await createRule(supertest, rule);
@@ -829,13 +810,8 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('Threshold Rules', () => {
         it('generates 1 signal from Threshold rules when threshold is met', async () => {
-          const ruleId = 'threshold-rule';
           const rule: ThresholdCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: ruleId,
-            type: 'threshold',
-            language: 'kuery',
-            query: '*:*',
+            ...getThresholdRuleForSignalTesting(['auditbeat-*']),
             threshold: {
               field: 'host.id',
               value: 700,
@@ -844,7 +820,7 @@ export default ({ getService }: FtrProviderContext) => {
           const { id } = await createRule(supertest, rule);
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          const signalsOpen = await getSignalsByIds(supertest, [id]);
           expect(signalsOpen.hits.hits.length).eql(1);
           const fullSignal = signalsOpen.hits.hits[0]._source;
           const eventIds = fullSignal.signal.parents.map((event) => event.id);
@@ -895,13 +871,8 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('generates 2 signals from Threshold rules when threshold is met', async () => {
-          const ruleId = 'threshold-rule';
           const rule: ThresholdCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: ruleId,
-            type: 'threshold',
-            language: 'kuery',
-            query: '*:*',
+            ...getThresholdRuleForSignalTesting(['auditbeat-*']),
             threshold: {
               field: 'host.id',
               value: 100,
@@ -910,17 +881,13 @@ export default ({ getService }: FtrProviderContext) => {
           const { id } = await createRule(supertest, rule);
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          const signalsOpen = await getSignalsByIds(supertest, [id]);
           expect(signalsOpen.hits.hits.length).eql(2);
         });
 
         it('applies the provided query before bucketing ', async () => {
-          const ruleId = 'threshold-rule';
           const rule: ThresholdCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: ruleId,
-            type: 'threshold',
-            language: 'kuery',
+            ...getThresholdRuleForSignalTesting(['auditbeat-*']),
             query: 'host.id:"2ab45fc1c41e4c84bbd02202a7e5761f"',
             threshold: {
               field: 'process.name',
@@ -930,18 +897,13 @@ export default ({ getService }: FtrProviderContext) => {
           const { id } = await createRule(supertest, rule);
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          const signalsOpen = await getSignalsByIds(supertest, [id]);
           expect(signalsOpen.hits.hits.length).eql(1);
         });
 
         it('generates no signals from Threshold rules when threshold is met and cardinality is not met', async () => {
-          const ruleId = 'threshold-rule';
           const rule: ThresholdCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: ruleId,
-            type: 'threshold',
-            language: 'kuery',
-            query: '*:*',
+            ...getThresholdRuleForSignalTesting(['auditbeat-*']),
             threshold: {
               field: 'host.id',
               value: 100,
@@ -959,13 +921,8 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('generates no signals from Threshold rules when cardinality is met and threshold is not met', async () => {
-          const ruleId = 'threshold-rule';
           const rule: ThresholdCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: ruleId,
-            type: 'threshold',
-            language: 'kuery',
-            query: '*:*',
+            ...getThresholdRuleForSignalTesting(['auditbeat-*']),
             threshold: {
               field: 'host.id',
               value: 1000,
@@ -983,13 +940,8 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('generates signals from Threshold rules when threshold and cardinality are both met', async () => {
-          const ruleId = 'threshold-rule';
           const rule: ThresholdCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: ruleId,
-            type: 'threshold',
-            language: 'kuery',
-            query: '*:*',
+            ...getThresholdRuleForSignalTesting(['auditbeat-*']),
             threshold: {
               field: 'host.id',
               value: 100,
@@ -1059,13 +1011,8 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should not generate signals if only one field meets the threshold requirement', async () => {
-          const ruleId = 'threshold-rule';
           const rule: ThresholdCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: ruleId,
-            type: 'threshold',
-            language: 'kuery',
-            query: '*:*',
+            ...getThresholdRuleForSignalTesting(['auditbeat-*']),
             threshold: {
               field: ['host.id', 'process.name'],
               value: 22,
@@ -1077,13 +1024,8 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('generates signals from Threshold rules when bucketing by multiple fields', async () => {
-          const ruleId = 'threshold-rule';
           const rule: ThresholdCreateSchema = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
-            rule_id: ruleId,
-            type: 'threshold',
-            language: 'kuery',
-            query: '*:*',
+            ...getThresholdRuleForSignalTesting(['auditbeat-*']),
             threshold: {
               field: ['host.id', 'process.name', 'event.module'],
               value: 21,
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts
index b793fc635843e..7d1a4d01fe27c 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts
@@ -17,8 +17,10 @@ import {
   createSignalsIndex,
   deleteAllAlerts,
   deleteSignalsIndex,
+  getEqlRuleForSignalTesting,
   getRuleForSignalTesting,
   getSignalsById,
+  getThresholdRuleForSignalTesting,
   waitForRuleSuccessOrStatus,
   waitForSignalsToBePresent,
 } from '../../../utils';
@@ -84,10 +86,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"eql" rule type', () => {
       it('should detect the "dataset_name_1" from "event.dataset" and have 4 signals', async () => {
         const rule: EqlCreateSchema = {
-          ...getRuleForSignalTesting(['const_keyword']),
-          rule_id: 'eql-rule',
-          type: 'eql',
-          language: 'eql',
+          ...getEqlRuleForSignalTesting(['const_keyword']),
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
@@ -100,10 +99,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should copy the "dataset_name_1" from "event.dataset"', async () => {
         const rule: EqlCreateSchema = {
-          ...getRuleForSignalTesting(['const_keyword']),
-          rule_id: 'eql-rule',
-          type: 'eql',
-          language: 'eql',
+          ...getEqlRuleForSignalTesting(['const_keyword']),
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
@@ -126,11 +122,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"threshold" rule type', async () => {
       it('should detect the "dataset_name_1" from "event.dataset"', async () => {
         const rule: ThresholdCreateSchema = {
-          ...getRuleForSignalTesting(['const_keyword']),
-          rule_id: 'threshold-rule',
-          type: 'threshold',
-          language: 'kuery',
-          query: '*:*',
+          ...getThresholdRuleForSignalTesting(['const_keyword']),
           threshold: {
             field: 'event.dataset',
             value: 1,
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts
index d2d2898587ee2..fba13c95c66ac 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts
@@ -13,13 +13,16 @@ import {
   createSignalsIndex,
   deleteAllAlerts,
   deleteSignalsIndex,
+  getEqlRuleForSignalTesting,
   getRuleForSignalTesting,
   getSignalsById,
+  getThresholdRuleForSignalTesting,
   waitForRuleSuccessOrStatus,
   waitForSignalsToBePresent,
 } from '../../../utils';
 import {
   EqlCreateSchema,
+  QueryCreateSchema,
   ThresholdCreateSchema,
 } from '../../../../../plugins/security_solution/common/detection_engine/schemas/request';
 
@@ -47,7 +50,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"kql" rule type', () => {
       it('should detect the "dataset_name_1" from "event.dataset"', async () => {
-        const rule = {
+        const rule: QueryCreateSchema = {
           ...getRuleForSignalTesting(['keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
@@ -70,10 +73,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"eql" rule type', () => {
       it('should detect the "dataset_name_1" from "event.dataset"', async () => {
         const rule: EqlCreateSchema = {
-          ...getRuleForSignalTesting(['keyword']),
-          rule_id: 'eql-rule',
-          type: 'eql',
-          language: 'eql',
+          ...getEqlRuleForSignalTesting(['keyword']),
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
@@ -96,11 +96,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"threshold" rule type', async () => {
       it('should detect the "dataset_name_1" from "event.dataset"', async () => {
         const rule: ThresholdCreateSchema = {
-          ...getRuleForSignalTesting(['keyword']),
-          rule_id: 'threshold-rule',
-          type: 'threshold',
-          language: 'kuery',
-          query: '*:*',
+          ...getThresholdRuleForSignalTesting(['keyword']),
           threshold: {
             field: 'event.dataset',
             value: 1,
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts
index 2ce88da13afab..2a354a83a10ae 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts
@@ -17,6 +17,7 @@ import {
   createSignalsIndex,
   deleteAllAlerts,
   deleteSignalsIndex,
+  getEqlRuleForSignalTesting,
   getRuleForSignalTesting,
   getSignalsById,
   waitForRuleSuccessOrStatus,
@@ -90,10 +91,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"eql" rule type', () => {
       it('should detect the "dataset_name_1" from "event.dataset" and have 8 signals, 4 from each index', async () => {
         const rule: EqlCreateSchema = {
-          ...getRuleForSignalTesting(['keyword', 'const_keyword']),
-          rule_id: 'eql-rule',
-          type: 'eql',
-          language: 'eql',
+          ...getEqlRuleForSignalTesting(['keyword', 'const_keyword']),
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
@@ -106,10 +104,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should copy the "dataset_name_1" from "event.dataset"', async () => {
         const rule: EqlCreateSchema = {
-          ...getRuleForSignalTesting(['keyword', 'const_keyword']),
-          rule_id: 'eql-rule',
-          type: 'eql',
-          language: 'eql',
+          ...getEqlRuleForSignalTesting(['keyword', 'const_keyword']),
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts
index 8645fec287b07..2c304803ded89 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts
@@ -7,7 +7,10 @@
 
 import expect from '@kbn/expect';
 import { orderBy } from 'lodash';
-import { QueryCreateSchema } from '../../../../plugins/security_solution/common/detection_engine/schemas/request';
+import {
+  EqlCreateSchema,
+  QueryCreateSchema,
+} from '../../../../plugins/security_solution/common/detection_engine/schemas/request';
 
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 import {
@@ -19,6 +22,7 @@ import {
   waitForSignalsToBePresent,
   getRuleForSignalTesting,
   getSignalsByIds,
+  getEqlRuleForSignalTesting,
 } from '../../utils';
 
 // eslint-disable-next-line import/no-default-export
@@ -54,27 +58,54 @@ export default ({ getService }: FtrProviderContext) => {
         );
       });
 
-      it('should convert the @timestamp which is epoch_seconds into the correct ISO format', async () => {
-        const rule = getRuleForSignalTesting(['timestamp_in_seconds']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.signal.original_time).sort();
-        expect(hits).to.eql(['2021-06-02T23:33:15.000Z']);
+      describe('KQL query', () => {
+        it('should convert the @timestamp which is epoch_seconds into the correct ISO format', async () => {
+          const rule = getRuleForSignalTesting(['timestamp_in_seconds']);
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source.signal.original_time).sort();
+          expect(hits).to.eql(['2021-06-02T23:33:15.000Z']);
+        });
+
+        it('should still use the @timestamp field even with an override field. It should never use the override field', async () => {
+          const rule: QueryCreateSchema = {
+            ...getRuleForSignalTesting(['myfakeindex-5']),
+            timestamp_override: 'event.ingested',
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source.signal.original_time).sort();
+          expect(hits).to.eql(['2020-12-16T15:16:18.000Z']);
+        });
       });
 
-      it('should still use the @timestamp field even with an override field. It should never use the override field', async () => {
-        const rule: QueryCreateSchema = {
-          ...getRuleForSignalTesting(['myfakeindex-5']),
-          timestamp_override: 'event.ingested',
-        };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.signal.original_time).sort();
-        expect(hits).to.eql(['2020-12-16T15:16:18.000Z']);
+      describe('EQL query', () => {
+        it('should convert the @timestamp which is epoch_seconds into the correct ISO format for EQL', async () => {
+          const rule = getEqlRuleForSignalTesting(['timestamp_in_seconds']);
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source.signal.original_time).sort();
+          expect(hits).to.eql(['2021-06-02T23:33:15.000Z']);
+        });
+
+        it('should still use the @timestamp field even with an override field. It should never use the override field', async () => {
+          const rule: EqlCreateSchema = {
+            ...getEqlRuleForSignalTesting(['myfakeindex-5']),
+            timestamp_override: 'event.ingested',
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source.signal.original_time).sort();
+          expect(hits).to.eql(['2020-12-16T15:16:18.000Z']);
+        });
       });
     });
 
@@ -119,73 +150,91 @@ export default ({ getService }: FtrProviderContext) => {
         );
       });
 
-      it('should generate signals with event.ingested, @timestamp and (event.ingested + timestamp)', async () => {
-        const rule: QueryCreateSchema = {
-          ...getRuleForSignalTesting(['myfa*']),
-          timestamp_override: 'event.ingested',
-        };
+      describe('KQL', () => {
+        it('should generate signals with event.ingested, @timestamp and (event.ingested + timestamp)', async () => {
+          const rule: QueryCreateSchema = {
+            ...getRuleForSignalTesting(['myfa*']),
+            timestamp_override: 'event.ingested',
+          };
 
-        const { id } = await createRule(supertest, rule);
+          const { id } = await createRule(supertest, rule);
 
-        await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsResponse = await getSignalsByIds(supertest, [id], 3);
-        const signals = signalsResponse.hits.hits.map((hit) => hit._source);
-        const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
+          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForSignalsToBePresent(supertest, 3, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, [id], 3);
+          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
+          const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
 
-        expect(signalsOrderedByEventId.length).equal(3);
-      });
+          expect(signalsOrderedByEventId.length).equal(3);
+        });
 
-      it('should generate 2 signals with @timestamp', async () => {
-        const rule: QueryCreateSchema = getRuleForSignalTesting(['myfa*']);
+        it('should generate 2 signals with @timestamp', async () => {
+          const rule: QueryCreateSchema = getRuleForSignalTesting(['myfa*']);
 
-        const { id } = await createRule(supertest, rule);
+          const { id } = await createRule(supertest, rule);
 
-        await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsResponse = await getSignalsByIds(supertest, [id]);
-        const signals = signalsResponse.hits.hits.map((hit) => hit._source);
-        const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
+          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForSignalsToBePresent(supertest, 2, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, [id]);
+          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
+          const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
 
-        expect(signalsOrderedByEventId.length).equal(2);
-      });
+          expect(signalsOrderedByEventId.length).equal(2);
+        });
+
+        it('should generate 2 signals when timestamp override does not exist', async () => {
+          const rule: QueryCreateSchema = {
+            ...getRuleForSignalTesting(['myfa*']),
+            timestamp_override: 'event.fakeingestfield',
+          };
+          const { id } = await createRule(supertest, rule);
 
-      it('should generate 2 signals when timestamp override does not exist', async () => {
-        const rule: QueryCreateSchema = {
-          ...getRuleForSignalTesting(['myfa*']),
-          timestamp_override: 'event.fakeingestfield',
-        };
-        const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForSignalsToBePresent(supertest, 2, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, [id, id]);
+          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
+          const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
 
-        await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsResponse = await getSignalsByIds(supertest, [id, id]);
-        const signals = signalsResponse.hits.hits.map((hit) => hit._source);
-        const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
+          expect(signalsOrderedByEventId.length).equal(2);
+        });
 
-        expect(signalsOrderedByEventId.length).equal(2);
+        /**
+         * We should not use the timestamp override as the "original_time" as that can cause
+         * confusion if you have both a timestamp and an override in the source event. Instead the "original_time"
+         * field should only be overridden by the "timestamp" since when we generate a signal
+         * and we add a new timestamp to the signal.
+         */
+        it('should NOT use the timestamp override as the "original_time"', async () => {
+          const rule: QueryCreateSchema = {
+            ...getRuleForSignalTesting(['myfakeindex-2']),
+            timestamp_override: 'event.ingested',
+          };
+          const { id } = await createRule(supertest, rule);
+
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 1, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, [id, id]);
+          const hits = signalsResponse.hits.hits
+            .map((hit) => hit._source.signal.original_time)
+            .sort();
+          expect(hits).to.eql([undefined]);
+        });
       });
 
-      /**
-       * We should not use the timestamp override as the "original_time" as that can cause
-       * confusion if you have both a timestamp and an override in the source event. Instead the "original_time"
-       * field should only be overridden by the "timestamp" since when we generate a signal
-       * and we add a new timestamp to the signal.
-       */
-      it('should NOT use the timestamp override as the "original_time"', async () => {
-        const rule: QueryCreateSchema = {
-          ...getRuleForSignalTesting(['myfakeindex-2']),
-          timestamp_override: 'event.ingested',
-        };
-        const { id } = await createRule(supertest, rule);
-
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsResponse = await getSignalsByIds(supertest, [id, id]);
-        const hits = signalsResponse.hits.hits
-          .map((hit) => hit._source.signal.original_time)
-          .sort();
-        expect(hits).to.eql([undefined]);
+      describe('EQL', () => {
+        it('should generate 2 signals with @timestamp', async () => {
+          const rule: EqlCreateSchema = getEqlRuleForSignalTesting(['myfa*']);
+
+          const { id } = await createRule(supertest, rule);
+
+          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForSignalsToBePresent(supertest, 2, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, [id]);
+          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
+          const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
+
+          expect(signalsOrderedByEventId.length).equal(2);
+        });
       });
     });
 
@@ -201,31 +250,33 @@ export default ({ getService }: FtrProviderContext) => {
         await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
       });
 
-      /**
-       * This represents our worst case scenario where this field is not mapped on any index
-       * We want to check that our logic continues to function within the constraints of search after
-       * Elasticsearch returns java's long.MAX_VALUE for unmapped date fields
-       * Javascript does not support numbers this large, but without passing in a number of this size
-       * The search_after will continue to return the same results and not iterate to the next set
-       * So to circumvent this limitation of javascript we return the stringified version of Java's
-       * Long.MAX_VALUE so that search_after does not enter into an infinite loop.
-       *
-       * ref: https://github.com/elastic/elasticsearch/issues/28806#issuecomment-369303620
-       */
-      it('should generate 200 signals when timestamp override does not exist', async () => {
-        const rule: QueryCreateSchema = {
-          ...getRuleForSignalTesting(['auditbeat-*']),
-          timestamp_override: 'event.fakeingested',
-          max_signals: 200,
-        };
-
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
-        await waitForSignalsToBePresent(supertest, 200, [id]);
-        const signalsResponse = await getSignalsByIds(supertest, [id], 200);
-        const signals = signalsResponse.hits.hits.map((hit) => hit._source);
-
-        expect(signals.length).equal(200);
+      describe('KQL', () => {
+        /**
+         * This represents our worst case scenario where this field is not mapped on any index
+         * We want to check that our logic continues to function within the constraints of search after
+         * Elasticsearch returns java's long.MAX_VALUE for unmapped date fields
+         * Javascript does not support numbers this large, but without passing in a number of this size
+         * The search_after will continue to return the same results and not iterate to the next set
+         * So to circumvent this limitation of javascript we return the stringified version of Java's
+         * Long.MAX_VALUE so that search_after does not enter into an infinite loop.
+         *
+         * ref: https://github.com/elastic/elasticsearch/issues/28806#issuecomment-369303620
+         */
+        it('should generate 200 signals when timestamp override does not exist', async () => {
+          const rule: QueryCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            timestamp_override: 'event.fakeingested',
+            max_signals: 200,
+          };
+
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForSignalsToBePresent(supertest, 200, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, [id], 200);
+          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
+
+          expect(signals.length).equal(200);
+        });
       });
     });
   });
diff --git a/x-pack/test/detection_engine_api_integration/utils.ts b/x-pack/test/detection_engine_api_integration/utils.ts
index 54252b19fc940..ac11dd31c15e8 100644
--- a/x-pack/test/detection_engine_api_integration/utils.ts
+++ b/x-pack/test/detection_engine_api_integration/utils.ts
@@ -27,6 +27,8 @@ import {
   UpdateRulesSchema,
   FullResponseSchema,
   QueryCreateSchema,
+  EqlCreateSchema,
+  ThresholdCreateSchema,
 } from '../../plugins/security_solution/common/detection_engine/schemas/request';
 import { Signal } from '../../plugins/security_solution/server/lib/detection_engine/signals/types';
 import { signalsMigrationType } from '../../plugins/security_solution/server/lib/detection_engine/migrations/saved_objects';
@@ -123,6 +125,46 @@ export const getRuleForSignalTesting = (
   from: '1900-01-01T00:00:00.000Z',
 });
 
+/**
+ * This is a typical signal testing rule that is easy for most basic testing of output of EQL signals.
+ * It starts out in an enabled true state. The from is set very far back to test the basics of signal
+ * creation for EQL and testing by getting all the signals at once.
+ * @param ruleId The optional ruleId which is eql-rule by default.
+ * @param enabled Enables the rule on creation or not. Defaulted to true.
+ */
+export const getEqlRuleForSignalTesting = (
+  index: string[],
+  ruleId = 'eql-rule',
+  enabled = true
+): EqlCreateSchema => ({
+  ...getRuleForSignalTesting(index, ruleId, enabled),
+  type: 'eql',
+  language: 'eql',
+  query: 'any where true',
+});
+
+/**
+ * This is a typical signal testing rule that is easy for most basic testing of output of Threshold signals.
+ * It starts out in an enabled true state. The from is set very far back to test the basics of signal
+ * creation for Threshold and testing by getting all the signals at once.
+ * @param ruleId The optional ruleId which is threshold-rule by default.
+ * @param enabled Enables the rule on creation or not. Defaulted to true.
+ */
+export const getThresholdRuleForSignalTesting = (
+  index: string[],
+  ruleId = 'threshold-rule',
+  enabled = true
+): ThresholdCreateSchema => ({
+  ...getRuleForSignalTesting(index, ruleId, enabled),
+  type: 'threshold',
+  language: 'kuery',
+  query: '*:*',
+  threshold: {
+    field: 'process.name',
+    value: 21,
+  },
+});
+
 export const getRuleForSignalTestingWithTimestampOverride = (
   index: string[],
   ruleId = 'rule-1',
diff --git a/x-pack/test/functional/apps/discover/async_scripted_fields.js b/x-pack/test/functional/apps/discover/async_scripted_fields.js
index 427d8c21635c4..2c18051405964 100644
--- a/x-pack/test/functional/apps/discover/async_scripted_fields.js
+++ b/x-pack/test/functional/apps/discover/async_scripted_fields.js
@@ -19,8 +19,7 @@ export default function ({ getService, getPageObjects }) {
   const queryBar = getService('queryBar');
   const security = getService('security');
 
-  // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/104362
-  describe.skip('async search with scripted fields', function () {
+  describe('async search with scripted fields', function () {
     this.tags(['skipFirefox']);
 
     before(async function () {
diff --git a/x-pack/test/functional/apps/discover/visualize_field.ts b/x-pack/test/functional/apps/discover/visualize_field.ts
index de0dc459b6395..650d67f05129c 100644
--- a/x-pack/test/functional/apps/discover/visualize_field.ts
+++ b/x-pack/test/functional/apps/discover/visualize_field.ts
@@ -28,8 +28,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     await PageObjects.timePicker.setDefaultAbsoluteRange();
   }
 
-  // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/104469
-  describe.skip('discover field visualize button', () => {
+  describe('discover field visualize button', () => {
     beforeEach(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
diff --git a/x-pack/test/functional/apps/lens/dashboard.ts b/x-pack/test/functional/apps/lens/dashboard.ts
index 6e4c20744c5fc..095b1ae7c2f0f 100644
--- a/x-pack/test/functional/apps/lens/dashboard.ts
+++ b/x-pack/test/functional/apps/lens/dashboard.ts
@@ -27,6 +27,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const filterBar = getService('filterBar');
   const security = getService('security');
   const panelActions = getService('dashboardPanelActions');
+  const inspector = getService('inspector');
 
   async function clickInChart(x: number, y: number) {
     const el = await elasticChart.getCanvas();
@@ -158,6 +159,56 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await testSubjects.existOrFail(ACTION_TEST_SUBJ);
     });
 
+    it('should show all data from all layers in the inspector', async () => {
+      await PageObjects.common.navigateToApp('dashboard');
+      await PageObjects.dashboard.clickNewDashboard();
+      await dashboardAddPanel.clickCreateNewLink();
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.lens.goToTimeRange();
+      await PageObjects.lens.configureDimension({
+        dimension: 'lnsXY_xDimensionPanel > lns-empty-dimension',
+        operation: 'date_histogram',
+        field: '@timestamp',
+      });
+
+      await PageObjects.lens.configureDimension({
+        dimension: 'lnsXY_yDimensionPanel > lns-empty-dimension',
+        operation: 'average',
+        field: 'bytes',
+      });
+
+      await PageObjects.lens.createLayer();
+
+      expect(await PageObjects.lens.hasChartSwitchWarning('line')).to.eql(false);
+
+      await PageObjects.lens.switchToVisualization('line');
+      await PageObjects.lens.configureDimension(
+        {
+          dimension: 'lnsXY_xDimensionPanel > lns-empty-dimension',
+          operation: 'date_histogram',
+          field: '@timestamp',
+        },
+        1
+      );
+
+      await PageObjects.lens.configureDimension(
+        {
+          dimension: 'lnsXY_yDimensionPanel > lns-empty-dimension',
+          operation: 'median',
+          field: 'bytes',
+        },
+        1
+      );
+      await PageObjects.lens.saveAndReturn();
+
+      await panelActions.openContextMenu();
+      await panelActions.clickContextMenuMoreItem();
+      await testSubjects.click('embeddablePanelAction-openInspector');
+      await inspector.openInspectorRequestsView();
+      const requests = await inspector.getRequestNames();
+      expect(requests.split(',').length).to.be(2);
+    });
+
     it('unlink lens panel from embeddable library', async () => {
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.clickNewDashboard();
diff --git a/x-pack/test/functional/apps/lens/formula.ts b/x-pack/test/functional/apps/lens/formula.ts
index 6148215d8b6d2..7662b32b8aee6 100644
--- a/x-pack/test/functional/apps/lens/formula.ts
+++ b/x-pack/test/functional/apps/lens/formula.ts
@@ -15,9 +15,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const browser = getService('browser');
   const testSubjects = getService('testSubjects');
   const fieldEditor = getService('fieldEditor');
+  const retry = getService('retry');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/105016
-  describe.skip('lens formula', () => {
+  describe('lens formula', () => {
     it('should transition from count to formula', async () => {
       await PageObjects.visualize.gotoVisualizationLandingPage();
       await listingTable.searchForItemWithName('lnsXYvis');
@@ -55,8 +55,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       const input = await find.activeElement();
       await input.type('*');
 
-      await PageObjects.header.waitUntilLoadingHasFinished();
-      expect(await PageObjects.lens.getDatatableCellText(0, 0)).to.eql('14,005');
+      await retry.try(async () => {
+        expect(await PageObjects.lens.getDatatableCellText(0, 0)).to.eql('14,005');
+      });
     });
 
     it('should insert single quotes and escape when needed to create valid KQL', async () => {
@@ -79,15 +80,14 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       await PageObjects.common.sleep(100);
 
-      let element = await find.byCssSelector('.monaco-editor');
-      expect(await element.getVisibleText()).to.equal(`count(kql='Men\\'s Clothing ')`);
+      PageObjects.lens.expectFormulaText(`count(kql='Men\\'s Clothing ')`);
 
       await PageObjects.lens.typeFormula('count(kql=');
+
       input = await find.activeElement();
       await input.type(`Men\'s Clothing`);
 
-      element = await find.byCssSelector('.monaco-editor');
-      expect(await element.getVisibleText()).to.equal(`count(kql='Men\\'s Clothing')`);
+      PageObjects.lens.expectFormulaText(`count(kql='Men\\'s Clothing')`);
     });
 
     it('should insert single quotes and escape when needed to create valid field name', async () => {
@@ -109,20 +109,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
 
       await PageObjects.lens.switchToFormula();
-      let element = await find.byCssSelector('.monaco-editor');
-      expect(await element.getVisibleText()).to.equal(`unique_count('*\\' "\\'')`);
+      PageObjects.lens.expectFormulaText(`unique_count('*\\' "\\'')`);
 
+      await PageObjects.lens.typeFormula('unique_count(');
       const input = await find.activeElement();
-      await input.clearValueWithKeyboard({ charByChar: true });
-      await input.type('unique_count(');
-      await PageObjects.common.sleep(100);
       await input.type('*');
       await input.pressKeys(browser.keys.ENTER);
 
       await PageObjects.common.sleep(100);
 
-      element = await find.byCssSelector('.monaco-editor');
-      expect(await element.getVisibleText()).to.equal(`unique_count('*\\' "\\'')`);
+      PageObjects.lens.expectFormulaText(`unique_count('*\\' "\\'')`);
     });
 
     it('should persist a broken formula on close', async () => {
diff --git a/x-pack/test/functional/apps/reporting/reporting.ts b/x-pack/test/functional/apps/reporting/reporting.ts
index 9896e3371a282..8a0d9937fc213 100644
--- a/x-pack/test/functional/apps/reporting/reporting.ts
+++ b/x-pack/test/functional/apps/reporting/reporting.ts
@@ -12,9 +12,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const pageObjects = getPageObjects(['dashboard', 'common', 'reporting']);
   const es = getService('es');
   const esArchiver = getService('esArchiver');
+  const retry = getService('retry');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/102722
-  describe.skip('Reporting', function () {
+  describe('Reporting', function () {
     this.tags(['smoke', 'ciGroup2']);
     before(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/packaging');
@@ -33,6 +33,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       this.timeout(180000);
 
       await pageObjects.common.navigateToApp('dashboards');
+      await retry.waitFor('dashboard landing page', async () => {
+        return await pageObjects.dashboard.onDashboardLandingPage();
+      });
       await pageObjects.dashboard.loadSavedDashboard('dashboard');
       await pageObjects.reporting.openPdfReportingPanel();
       await pageObjects.reporting.clickGenerateReportButton();
diff --git a/x-pack/test/functional/es_archives/visualize/default/data.json b/x-pack/test/functional/es_archives/visualize/default/data.json
index 7d0ad0c25f96d..a16e1676611ce 100644
--- a/x-pack/test/functional/es_archives/visualize/default/data.json
+++ b/x-pack/test/functional/es_archives/visualize/default/data.json
@@ -157,7 +157,7 @@
         "timeFieldName": "@timestamp",
         "title": "logstash-2015.09.22",
         "fields":"[{\"name\":\"scripted_date\",\"type\":\"date\",\"count\":0,\"scripted\":true,\"script\":\"1234\",\"lang\":\"painless\",\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"scripted_string\",\"type\":\"string\",\"count\":0,\"scripted\":true,\"script\":\"return 'hello'\",\"lang\":\"painless\",\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false}]",
-        "runtimeFieldMap":"{\"runtime_string_field\":{\"type\":\"keyword\",\"script\":{\"source\":\"emit('hello world!')\"}}}"
+        "runtimeFieldMap":"{\"runtime_string_field\":{\"type\":\"keyword\",\"script\":{\"source\":\"emit('hello world!')\"}},\"runtime_number_field\":{\"type\":\"double\",\"script\":{\"source\":\"emit(5)\"}}}"
       },
       "migrationVersion": {
         "index-pattern": "7.11.0"
diff --git a/x-pack/test/functional/page_objects/lens_page.ts b/x-pack/test/functional/page_objects/lens_page.ts
index e256d5cd651cc..1acddd4641ff4 100644
--- a/x-pack/test/functional/page_objects/lens_page.ts
+++ b/x-pack/test/functional/page_objects/lens_page.ts
@@ -139,6 +139,8 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
       }
 
       if (opts.formula) {
+        // Formula takes time to open
+        await PageObjects.common.sleep(500);
         await this.typeFormula(opts.formula);
       }
 
@@ -1067,13 +1069,18 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
     },
 
     async typeFormula(formula: string) {
-      // Formula takes time to open
-      await PageObjects.common.sleep(500);
       await find.byCssSelector('.monaco-editor');
       await find.clickByCssSelectorWhenNotDisabled('.monaco-editor');
       const input = await find.activeElement();
       await input.clearValueWithKeyboard({ charByChar: true });
       await input.type(formula);
+      // Debounce time for formula
+      await PageObjects.common.sleep(300);
+    },
+
+    async expectFormulaText(formula: string) {
+      const element = await find.byCssSelector('.monaco-editor');
+      expect(await element.getVisibleText()).to.equal(formula);
     },
 
     async filterLegend(value: string) {
diff --git a/x-pack/test/stack_functional_integration/apps/ccs/ccs_discover.js b/x-pack/test/stack_functional_integration/apps/ccs/ccs_discover.js
index a22e4438c7dbd..588ff9a6e9f92 100644
--- a/x-pack/test/stack_functional_integration/apps/ccs/ccs_discover.js
+++ b/x-pack/test/stack_functional_integration/apps/ccs/ccs_discover.js
@@ -5,16 +5,7 @@
  * 2.0.
  */
 
-import fs from 'fs';
-import { resolve } from 'path';
 import expect from '@kbn/expect';
-import { Client as EsClient } from '@elastic/elasticsearch';
-import { KbnClient } from '@kbn/test';
-import { EsArchiver } from '@kbn/es-archiver';
-import { CA_CERT_PATH, REPO_ROOT } from '@kbn/dev-utils';
-
-const INTEGRATION_TEST_ROOT = process.env.WORKSPACE || resolve(REPO_ROOT, '../integration-test');
-const ARCHIVE = resolve(INTEGRATION_TEST_ROOT, 'test/es_archives/metricbeat');
 
 export default ({ getService, getPageObjects }) => {
   describe('Cross cluster search test in discover', async () => {
@@ -212,151 +203,5 @@ export default ({ getService, getPageObjects }) => {
         expect(hitCount).to.be.lessThan(originalHitCount);
       });
     });
-
-    describe('Detection engine', async function () {
-      const supertest = getService('supertest');
-      const esSupertest = getService('esSupertest');
-      const config = getService('config');
-
-      const esClient = new EsClient({
-        ssl: {
-          ca: fs.readFileSync(CA_CERT_PATH, 'utf-8'),
-        },
-        nodes: [process.env.TEST_ES_URLDATA],
-        requestTimeout: config.get('timeouts.esRequestTimeout'),
-      });
-
-      const kbnClient = new KbnClient({
-        log,
-        url: process.env.TEST_KIBANA_URLDATA,
-        certificateAuthorities: config.get('servers.kibana.certificateAuthorities'),
-        uiSettingDefaults: kibanaServer.uiSettings,
-      });
-
-      const esArchiver = new EsArchiver({
-        log,
-        client: esClient,
-        kbnClient,
-      });
-
-      let signalsId;
-      let dataId;
-      let ruleId;
-
-      before('Prepare .siem-signal-*', async function () {
-        log.info('Create index');
-        // visit app/security so to create .siem-signals-* as side effect
-        await PageObjects.common.navigateToApp('security', { insertTimestamp: false });
-
-        log.info('Create index pattern');
-        signalsId = await supertest
-          .post('/api/index_patterns/index_pattern')
-          .set('kbn-xsrf', 'true')
-          .send({
-            index_pattern: {
-              title: '.siem-signals-*',
-            },
-            override: true,
-          })
-          .expect(200)
-          .then((res) => JSON.parse(res.text).index_pattern.id);
-        log.debug('id: ' + signalsId);
-      });
-
-      before('Prepare data:metricbeat-*', async function () {
-        log.info('Create index');
-        await esArchiver.load(ARCHIVE);
-
-        log.info('Create index pattern');
-        dataId = await supertest
-          .post('/api/index_patterns/index_pattern')
-          .set('kbn-xsrf', 'true')
-          .send({
-            index_pattern: {
-              title: 'data:metricbeat-*',
-            },
-            override: true,
-          })
-          .expect(200)
-          .then((res) => JSON.parse(res.text).index_pattern.id);
-        log.debug('id: ' + dataId);
-      });
-
-      before('Add detection rule', async function () {
-        ruleId = await supertest
-          .post('/api/detection_engine/rules')
-          .set('kbn-xsrf', 'true')
-          .send({
-            description: 'This is the description of the rule',
-            risk_score: 17,
-            severity: 'low',
-            interval: '10s',
-            name: 'CCS_Detection_test',
-            type: 'query',
-            from: 'now-1y',
-            index: ['data:metricbeat-*'],
-            query: '*:*',
-            language: 'kuery',
-            enabled: true,
-          })
-          .expect(200)
-          .then((res) => JSON.parse(res.text).id);
-        log.debug('id: ' + ruleId);
-      });
-
-      after('Clean up detection rule', async function () {
-        if (ruleId !== undefined) {
-          log.debug('id: ' + ruleId);
-          await supertest
-            .delete('/api/detection_engine/rules?id=' + ruleId)
-            .set('kbn-xsrf', 'true')
-            .expect(200);
-        }
-      });
-
-      after('Clean up data:metricbeat-*', async function () {
-        if (dataId !== undefined) {
-          log.info('Delete index pattern');
-          log.debug('id: ' + dataId);
-          await supertest
-            .delete('/api/index_patterns/index_pattern/' + dataId)
-            .set('kbn-xsrf', 'true')
-            .expect(200);
-        }
-
-        log.info('Delete index');
-        await esArchiver.unload(ARCHIVE);
-      });
-
-      after('Clean up .siem-signal-*', async function () {
-        if (signalsId !== undefined) {
-          log.info('Delete index pattern: .siem-signals-*');
-          log.debug('id: ' + signalsId);
-          await supertest
-            .delete('/api/index_patterns/index_pattern/' + signalsId)
-            .set('kbn-xsrf', 'true')
-            .expect(200);
-        }
-
-        log.info('Delete index alias: .siem-signals-default');
-        await esSupertest
-          .delete('/.siem-signals-default-000001/_alias/.siem-signals-default')
-          .expect(200);
-
-        log.info('Delete index: .siem-signals-default-000001');
-        await esSupertest.delete('/.siem-signals-default-000001').expect(200);
-      });
-
-      it('Should generate alerts based on remote events', async function () {
-        log.info('Check if any alert got to .siem-signals-*');
-        await PageObjects.common.navigateToApp('discover', { insertTimestamp: false });
-        await PageObjects.discover.selectIndexPattern('.siem-signals-*');
-        await retry.tryForTime(30000, async () => {
-          const hitCount = await PageObjects.discover.getHitCount();
-          log.debug('### hit count = ' + hitCount);
-          expect(hitCount).to.be('100');
-        });
-      });
-    });
   });
 };
diff --git a/x-pack/test/stack_functional_integration/apps/monitoring/_monitoring_metricbeat.js b/x-pack/test/stack_functional_integration/apps/monitoring/_monitoring_metricbeat.js
index d8341c56aa25c..9dcc18b3c3f20 100644
--- a/x-pack/test/stack_functional_integration/apps/monitoring/_monitoring_metricbeat.js
+++ b/x-pack/test/stack_functional_integration/apps/monitoring/_monitoring_metricbeat.js
@@ -12,6 +12,7 @@ export default ({ getService, getPageObjects }) => {
     const log = getService('log');
     const testSubjects = getService('testSubjects');
     const isSaml = !!process.env.VM.includes('saml') || !!process.env.VM.includes('oidc');
+    const clusterOverview = getService('monitoringClusterOverview');
 
     before(async () => {
       await browser.setWindowSize(1200, 800);
@@ -25,6 +26,7 @@ export default ({ getService, getPageObjects }) => {
       }
       // navigateToApp without a username and password will default to the superuser
       await PageObjects.common.navigateToApp('monitoring', { insertTimestamp: false });
+      await clusterOverview.closeAlertsModal();
     });
 
     it('should have Monitoring already enabled', async () => {
diff --git a/x-pack/test/tsconfig.json b/x-pack/test/tsconfig.json
index 0424891064cd3..cd43e7108b06d 100644
--- a/x-pack/test/tsconfig.json
+++ b/x-pack/test/tsconfig.json
@@ -55,7 +55,6 @@
     { "path": "../plugins/banners/tsconfig.json" },
     { "path": "../plugins/cases/tsconfig.json" },
     { "path": "../plugins/cloud/tsconfig.json" },
-    { "path": "../plugins/console_extensions/tsconfig.json" },
     { "path": "../plugins/dashboard_mode/tsconfig.json" },
     { "path": "../plugins/enterprise_search/tsconfig.json" },
     { "path": "../plugins/fleet/tsconfig.json" },
diff --git a/x-pack/test/upgrade/apps/dashboard/dashboard_smoke_tests.ts b/x-pack/test/upgrade/apps/dashboard/dashboard_smoke_tests.ts
index 73819b5bac695..0bc3cd7c2610e 100644
--- a/x-pack/test/upgrade/apps/dashboard/dashboard_smoke_tests.ts
+++ b/x-pack/test/upgrade/apps/dashboard/dashboard_smoke_tests.ts
@@ -16,6 +16,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const renderable = getService('renderable');
   const dashboardExpect = getService('dashboardExpect');
   const PageObjects = getPageObjects(['common', 'header', 'home', 'dashboard', 'timePicker']);
+  const kibanaServer = getService('kibanaServer');
+  const browser = getService('browser');
 
   describe('dashboard smoke tests', function describeIndexTests() {
     const spaces = [
@@ -36,6 +38,14 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
             basePath,
           });
           await PageObjects.header.waitUntilLoadingHasFinished();
+          await kibanaServer.uiSettings.update(
+            {
+              'visualization:visualize:legacyChartsLibrary': true,
+              'visualization:visualize:legacyPieChartsLibrary': true,
+            },
+            { space }
+          );
+          await browser.refresh();
         });
         dashboardTests.forEach(({ name, numPanels }) => {
           it('should launch sample ' + name + ' data set dashboard', async () => {
@@ -56,9 +66,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
           await renderable.waitForRender();
           log.debug('Checking pie charts rendered');
           await pieChart.expectPieSliceCount(4);
-          // https://github.com/elastic/kibana/issues/92887
-          // log.debug('Checking area, bar and heatmap charts rendered');
-          // await dashboardExpect.seriesElementCount(15);
+          log.debug('Checking area, bar and heatmap charts rendered');
+          await dashboardExpect.seriesElementCount(15);
           log.debug('Checking saved searches rendered');
           await dashboardExpect.savedSearchRowCount(49);
           log.debug('Checking input controls rendered');
diff --git a/x-pack/test/upgrade/apps/reporting/reporting_smoke_tests.ts b/x-pack/test/upgrade/apps/reporting/reporting_smoke_tests.ts
index c00e761d54226..20fc34f77dbf8 100644
--- a/x-pack/test/upgrade/apps/reporting/reporting_smoke_tests.ts
+++ b/x-pack/test/upgrade/apps/reporting/reporting_smoke_tests.ts
@@ -69,6 +69,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             if (type === 'pdf_optimize') {
               await testSubjects.click('usePrintLayout');
             }
+            const advOpt = await find.byXPath(`//button[descendant::*[text()='Advanced options']]`);
+            await advOpt.click();
             const postUrl = await find.byXPath(`//button[descendant::*[text()='Copy POST URL']]`);
             await postUrl.click();
             const url = await browser.getClipboardValue();
diff --git a/yarn.lock b/yarn.lock
index dccbd8f91a429..7a70953379f54 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1389,10 +1389,10 @@
   dependencies:
     object-hash "^1.3.0"
 
-"@elastic/charts@31.1.0":
-  version "31.1.0"
-  resolved "https://registry.yarnpkg.com/@elastic/charts/-/charts-31.1.0.tgz#cebfd45e672ab19d7d6c5a7f7e3115a6eaa41e8f"
-  integrity sha512-D2zPT7CRweRdbfhO9gd1+YBm0ETdJsEkh+Su0I6tleINqKKuSB+kPOG6t+fm0+HsR72pX4dKvT60ikZJZ3fRhg==
+"@elastic/charts@32.0.0":
+  version "32.0.0"
+  resolved "https://registry.yarnpkg.com/@elastic/charts/-/charts-32.0.0.tgz#f747b8fa931027ba7476a6284be03383cd6a6dab"
+  integrity sha512-3cvX0Clezocd6/T2R5h3+nilPdIgWrO+it043giyW5U0pAtFC5P+5VyNEjn22LlD3zzbndxAbXHSj0QDvHXOBw==
   dependencies:
     "@popperjs/core" "^2.4.0"
     chroma-js "^2.1.0"