diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/authentications/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/authentications/index.ts
index 0fb0609b60ba5..efdc96b33562a 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/authentications/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/authentications/index.ts
@@ -19,14 +19,14 @@ import {
 } from '../../../common';
 import { RequestOptionsPaginated } from '../../';
 
-export interface AuthenticationsStrategyResponse extends IEsSearchResponse {
+export interface HostAuthenticationsStrategyResponse extends IEsSearchResponse {
   edges: AuthenticationsEdges[];
   totalCount: number;
   pageInfo: PageInfoPaginated;
   inspect?: Maybe<Inspect>;
 }
 
-export interface AuthenticationsRequestOptions extends RequestOptionsPaginated {
+export interface HostAuthenticationsRequestOptions extends RequestOptionsPaginated {
   defaultIndex: string[];
 }
 
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts
index 8ae41a101cee2..902e9909cf728 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts
@@ -6,7 +6,7 @@
 
 import { CloudEcs } from '../../../../ecs/cloud';
 import { HostEcs, OsEcs } from '../../../../ecs/host';
-import { Maybe, SearchHit, TotalValue } from '../../../common';
+import { Hit, Hits, Maybe, SearchHit, StringOrNumber, TotalValue } from '../../../common';
 
 export enum HostPolicyResponseActionStatus {
   success = 'success',
@@ -98,3 +98,15 @@ export interface HostAggEsData extends SearchHit {
   sort: string[];
   aggregations: HostAggEsItem;
 }
+
+export interface HostHit extends Hit {
+  _source: {
+    '@timestamp'?: string;
+    host: HostEcs;
+  };
+  cursor?: string;
+  firstSeen?: string;
+  sort?: StringOrNumber[];
+}
+
+export type HostHits = Hits<number, HostHit>;
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts
index 9cb43c91adfd9..f5d46078fcea4 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts
@@ -9,10 +9,12 @@ export * from './all';
 export * from './common';
 export * from './overview';
 export * from './first_last_seen';
+export * from './uncommon_processes';
 
 export enum HostsQueries {
   authentications = 'authentications',
   firstLastSeen = 'firstLastSeen',
   hosts = 'hosts',
   hostOverview = 'hostOverview',
+  uncommonProcesses = 'uncommonProcesses',
 }
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/uncommon_processes/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/uncommon_processes/index.ts
new file mode 100644
index 0000000000000..28c0ccb7f6f4f
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/uncommon_processes/index.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+
+import { HostEcs } from '../../../../ecs/host';
+import { UserEcs } from '../../../../ecs/user';
+import {
+  RequestOptionsPaginated,
+  SortField,
+  CursorType,
+  Inspect,
+  Maybe,
+  PageInfoPaginated,
+  Hit,
+  TotalHit,
+  StringOrNumber,
+  Hits,
+} from '../../..';
+
+export interface HostUncommonProcessesRequestOptions extends RequestOptionsPaginated {
+  sort: SortField;
+  defaultIndex: string[];
+}
+
+export interface HostUncommonProcessesStrategyResponse extends IEsSearchResponse {
+  edges: UncommonProcessesEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface UncommonProcessesEdges {
+  node: UncommonProcessItem;
+  cursor: CursorType;
+}
+
+export interface UncommonProcessItem {
+  _id: string;
+  instances: number;
+  process: ProcessEcsFields;
+  hosts: HostEcs[];
+  user?: Maybe<UserEcs>;
+}
+
+export interface ProcessEcsFields {
+  hash?: Maybe<ProcessHashData>;
+  pid?: Maybe<number[]>;
+  name?: Maybe<string[]>;
+  ppid?: Maybe<number[]>;
+  args?: Maybe<string[]>;
+  entity_id?: Maybe<string[]>;
+  executable?: Maybe<string[]>;
+  title?: Maybe<string[]>;
+  thread?: Maybe<Thread>;
+  working_directory?: Maybe<string[]>;
+}
+
+export interface ProcessHashData {
+  md5?: Maybe<string[]>;
+  sha1?: Maybe<string[]>;
+  sha256?: Maybe<string[]>;
+}
+
+export interface Thread {
+  id?: Maybe<number[]>;
+  start?: Maybe<string[]>;
+}
+
+export interface UncommonProcessHit extends Hit {
+  total: TotalHit;
+  host: Array<{
+    id: string[] | undefined;
+    name: string[] | undefined;
+  }>;
+  _source: {
+    '@timestamp': string;
+    process: ProcessEcsFields;
+  };
+  cursor: string;
+  sort: StringOrNumber[];
+}
+
+export type ProcessHits = Hits<TotalHit, UncommonProcessHit>;
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
index 85ffc6aa4c734..17adf38559a9e 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
@@ -8,17 +8,17 @@ import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
 import { ESQuery } from '../../typed_json';
 import {
   HostOverviewStrategyResponse,
+  HostAuthenticationsRequestOptions,
+  HostAuthenticationsStrategyResponse,
   HostOverviewRequestOptions,
   HostFirstLastSeenStrategyResponse,
   HostFirstLastSeenRequestOptions,
   HostsQueries,
   HostsRequestOptions,
   HostsStrategyResponse,
+  HostUncommonProcessesStrategyResponse,
+  HostUncommonProcessesRequestOptions,
 } from './hosts';
-import {
-  AuthenticationsRequestOptions,
-  AuthenticationsStrategyResponse,
-} from './hosts/authentications';
 import {
   NetworkQueries,
   NetworkTlsStrategyResponse,
@@ -66,9 +66,11 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   : T extends HostsQueries.hostOverview
   ? HostOverviewStrategyResponse
   : T extends HostsQueries.authentications
-  ? AuthenticationsStrategyResponse
+  ? HostAuthenticationsStrategyResponse
   : T extends HostsQueries.firstLastSeen
   ? HostFirstLastSeenStrategyResponse
+  : T extends HostsQueries.uncommonProcesses
+  ? HostUncommonProcessesStrategyResponse
   : T extends NetworkQueries.tls
   ? NetworkTlsStrategyResponse
   : T extends NetworkQueries.http
@@ -82,9 +84,11 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   : T extends HostsQueries.hostOverview
   ? HostOverviewRequestOptions
   : T extends HostsQueries.authentications
-  ? AuthenticationsRequestOptions
+  ? HostAuthenticationsRequestOptions
   : T extends HostsQueries.firstLastSeen
   ? HostFirstLastSeenRequestOptions
+  : T extends HostsQueries.uncommonProcesses
+  ? HostUncommonProcessesRequestOptions
   : T extends NetworkQueries.tls
   ? NetworkTlsRequestOptions
   : T extends NetworkQueries.http
diff --git a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts
index 759b34cd258d5..9e60c35b746da 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts
+++ b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { SearchResponse } from 'elasticsearch';
-import { AuthenticationsStrategyResponse } from '../../../../common/search_strategy/security_solution/hosts/authentications';
+import { HostAuthenticationsStrategyResponse } from '../../../../common/search_strategy/security_solution/hosts/authentications';
 
-export const mockData: { Authentications: AuthenticationsStrategyResponse } = {
+export const mockData: { Authentications: HostAuthenticationsStrategyResponse } = {
   Authentications: {
     rawResponse: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/authentications/index.tsx b/x-pack/plugins/security_solution/public/hosts/containers/authentications/index.tsx
index 79d83404f8c4a..5436469409194 100644
--- a/x-pack/plugins/security_solution/public/hosts/containers/authentications/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/containers/authentications/index.tsx
@@ -12,15 +12,14 @@ import deepEqual from 'fast-deep-equal';
 import { AbortError } from '../../../../../../../src/plugins/data/common';
 
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
+import { HostsQueries } from '../../../../common/search_strategy/security_solution';
 import {
-  Direction,
-  DocValueFields,
-  HostPolicyResponseActionStatus,
-  HostsQueries,
-  PageInfoPaginated,
-  AuthenticationsRequestOptions,
-  AuthenticationsStrategyResponse,
+  HostAuthenticationsRequestOptions,
+  HostAuthenticationsStrategyResponse,
   AuthenticationsEdges,
+  PageInfoPaginated,
+  DocValueFields,
+  SortField,
 } from '../../../../common/search_strategy';
 import { ESTermQuery } from '../../../../common/typed_json';
 
@@ -75,7 +74,7 @@ export const useAuthentications = ({
   const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
   const [loading, setLoading] = useState(false);
   const [authenticationsRequest, setAuthenticationsRequest] = useState<
-    AuthenticationsRequestOptions
+    HostAuthenticationsRequestOptions
   >({
     defaultIndex,
     docValueFields: docValueFields ?? [],
@@ -87,10 +86,7 @@ export const useAuthentications = ({
       from: startDate,
       to: endDate,
     },
-    sort: {
-      direction: Direction.desc,
-      field: HostPolicyResponseActionStatus.success,
-    },
+    sort: {} as SortField,
   });
 
   const wrappedLoadMore = useCallback(
@@ -125,14 +121,14 @@ export const useAuthentications = ({
   });
 
   const authenticationsSearch = useCallback(
-    (request: AuthenticationsRequestOptions) => {
+    (request: HostAuthenticationsRequestOptions) => {
       let didCancel = false;
       const asyncSearch = async () => {
         abortCtrl.current = new AbortController();
         setLoading(true);
 
         const searchSubscription$ = data.search
-          .search<AuthenticationsRequestOptions, AuthenticationsStrategyResponse>(request, {
+          .search<HostAuthenticationsRequestOptions, HostAuthenticationsStrategyResponse>(request, {
             strategy: 'securitySolutionSearchStrategy',
             abortSignal: abortCtrl.current.signal,
           })
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/index.tsx b/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/index.tsx
index f8e5b1bed73cd..82f5a97e9e413 100644
--- a/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/index.tsx
@@ -4,36 +4,39 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect, ConnectedProps } from 'react-redux';
-import { compose } from 'redux';
+import deepEqual from 'fast-deep-equal';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { useSelector } from 'react-redux';
+
+import { AbortError } from '../../../../../../../src/plugins/data/common';
 
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import {
-  GetUncommonProcessesQuery,
-  PageInfoPaginated,
-  UncommonProcessesEdges,
-} from '../../../graphql/types';
-import { inputsModel, State, inputsSelectors } from '../../../common/store';
-import { withKibana, WithKibanaProps } from '../../../common/lib/kibana';
+import { PageInfoPaginated, UncommonProcessesEdges } from '../../../graphql/types';
+import { inputsModel, State } from '../../../common/store';
+import { useKibana } from '../../../common/lib/kibana';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
-import {
-  QueryTemplatePaginated,
-  QueryTemplatePaginatedProps,
-} from '../../../common/containers/query_template_paginated';
+import { createFilter } from '../../../common/containers/helpers';
+
 import { hostsModel, hostsSelectors } from '../../store';
-import { uncommonProcessesQuery } from './index.gql_query';
+import {
+  HostUncommonProcessesRequestOptions,
+  HostUncommonProcessesStrategyResponse,
+} from '../../../../common/search_strategy/security_solution/hosts/uncommon_processes';
+import { HostsQueries } from '../../../../common/search_strategy/security_solution/hosts';
+import { DocValueFields, SortField } from '../../../../common/search_strategy';
+
+import * as i18n from './translations';
+import { ESTermQuery } from '../../../../common/typed_json';
+import { getInspectResponse } from '../../../helpers';
+import { InspectResponse } from '../../../types';
 
 const ID = 'uncommonProcessesQuery';
 
 export interface UncommonProcessesArgs {
   id: string;
-  inspect: inputsModel.InspectQuery;
+  inspect: InspectResponse;
   isInspected: boolean;
-  loading: boolean;
   loadPage: (newActivePage: number) => void;
   pageInfo: PageInfoPaginated;
   refetch: inputsModel.Refetch;
@@ -41,111 +44,164 @@ export interface UncommonProcessesArgs {
   uncommonProcesses: UncommonProcessesEdges[];
 }
 
-export interface OwnProps extends QueryTemplatePaginatedProps {
-  children: (args: UncommonProcessesArgs) => React.ReactNode;
+interface UseUncommonProcesses {
+  docValueFields?: DocValueFields[];
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  skip?: boolean;
+  startDate: string;
   type: hostsModel.HostsType;
 }
 
-type UncommonProcessesProps = OwnProps & PropsFromRedux & WithKibanaProps;
-
-class UncommonProcessesComponentQuery extends QueryTemplatePaginated<
-  UncommonProcessesProps,
-  GetUncommonProcessesQuery.Query,
-  GetUncommonProcessesQuery.Variables
-> {
-  public render() {
-    const {
-      activePage,
-      children,
-      endDate,
-      filterQuery,
-      id = ID,
-      isInspected,
-      kibana,
-      limit,
-      skip,
-      sourceId,
-      startDate,
-    } = this.props;
-    const variables: GetUncommonProcessesQuery.Variables = {
-      defaultIndex: kibana.services.uiSettings.get<string[]>(DEFAULT_INDEX_KEY),
-      filterQuery: createFilter(filterQuery),
-      inspect: isInspected,
-      pagination: generateTablePaginationOptions(activePage, limit),
-      sourceId,
-      timerange: {
-        interval: '12h',
-        from: startDate!,
-        to: endDate!,
+export const useUncommonProcesses = ({
+  docValueFields,
+  filterQuery,
+  endDate,
+  skip = false,
+  startDate,
+  type,
+}: UseUncommonProcesses): [boolean, UncommonProcessesArgs] => {
+  const getUncommonProcessesSelector = hostsSelectors.uncommonProcessesSelector();
+  const { activePage, limit } = useSelector((state: State) =>
+    getUncommonProcessesSelector(state, type)
+  );
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [uncommonProcessesRequest, setUncommonProcessesRequest] = useState<
+    HostUncommonProcessesRequestOptions
+  >({
+    defaultIndex,
+    docValueFields: docValueFields ?? [],
+    factoryQueryType: HostsQueries.uncommonProcesses,
+    filterQuery: createFilter(filterQuery),
+    pagination: generateTablePaginationOptions(activePage, limit),
+    timerange: {
+      interval: '12h',
+      from: startDate!,
+      to: endDate!,
+    },
+    sort: {} as SortField,
+  });
+
+  const wrappedLoadMore = useCallback(
+    (newActivePage: number) => {
+      setUncommonProcessesRequest((prevRequest) => {
+        return {
+          ...prevRequest,
+          pagination: generateTablePaginationOptions(newActivePage, limit),
+        };
+      });
+    },
+    [limit]
+  );
+
+  const [uncommonProcessesResponse, setUncommonProcessesResponse] = useState<UncommonProcessesArgs>(
+    {
+      uncommonProcesses: [],
+      id: ID,
+      inspect: {
+        dsl: [],
+        response: [],
       },
-    };
-    return (
-      <Query<GetUncommonProcessesQuery.Query, GetUncommonProcessesQuery.Variables>
-        query={uncommonProcessesQuery}
-        fetchPolicy={getDefaultFetchPolicy()}
-        notifyOnNetworkStatusChange
-        skip={skip}
-        variables={variables}
-      >
-        {({ data, loading, fetchMore, networkStatus, refetch }) => {
-          const uncommonProcesses = getOr([], 'source.UncommonProcesses.edges', data);
-          this.setFetchMore(fetchMore);
-          this.setFetchMoreOptions((newActivePage: number) => ({
-            variables: {
-              pagination: generateTablePaginationOptions(newActivePage, limit),
+      isInspected: false,
+      loadPage: wrappedLoadMore,
+      pageInfo: {
+        activePage: 0,
+        fakeTotalCount: 0,
+        showMorePagesIndicator: false,
+      },
+      refetch: refetch.current,
+      totalCount: -1,
+    }
+  );
+
+  const uncommonProcessesSearch = useCallback(
+    (request: HostUncommonProcessesRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<HostUncommonProcessesRequestOptions, HostUncommonProcessesStrategyResponse>(
+            request,
+            {
+              strategy: 'securitySolutionSearchStrategy',
+              abortSignal: abortCtrl.current.signal,
+            }
+          )
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setUncommonProcessesResponse((prevResponse) => ({
+                    ...prevResponse,
+                    uncommonProcesses: response.edges,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    pageInfo: response.pageInfo,
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                notifications.toasts.addWarning(i18n.ERROR_UNCOMMON_PROCESSES);
+                searchSubscription$.unsubscribe();
+              }
             },
-            updateQuery: (prev, { fetchMoreResult }) => {
-              if (!fetchMoreResult) {
-                return prev;
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_UNCOMMON_PROCESSES,
+                  text: msg.message,
+                });
               }
-              return {
-                ...fetchMoreResult,
-                source: {
-                  ...fetchMoreResult.source,
-                  UncommonProcesses: {
-                    ...fetchMoreResult.source.UncommonProcesses,
-                    edges: [...fetchMoreResult.source.UncommonProcesses.edges],
-                  },
-                },
-              };
             },
-          }));
-          const isLoading = this.isItAValidLoading(loading, variables, networkStatus);
-          return children({
-            id,
-            inspect: getOr(null, 'source.UncommonProcesses.inspect', data),
-            isInspected,
-            loading: isLoading,
-            loadPage: this.wrappedLoadMore,
-            pageInfo: getOr({}, 'source.UncommonProcesses.pageInfo', data),
-            refetch: this.memoizedRefetchQuery(variables, limit, refetch),
-            totalCount: getOr(-1, 'source.UncommonProcesses.totalCount', data),
-            uncommonProcesses,
           });
-        }}
-      </Query>
-    );
-  }
-}
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
-const makeMapStateToProps = () => {
-  const getUncommonProcessesSelector = hostsSelectors.uncommonProcessesSelector();
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  const mapStateToProps = (state: State, { type, id = ID }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      ...getUncommonProcessesSelector(state, type),
-      isInspected,
-    };
-  };
-  return mapStateToProps;
-};
+  useEffect(() => {
+    setUncommonProcessesRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        docValueFields: docValueFields ?? [],
+        filterQuery: createFilter(filterQuery),
+        pagination: generateTablePaginationOptions(activePage, limit),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+        sort: {} as SortField,
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [activePage, defaultIndex, docValueFields, endDate, filterQuery, limit, skip, startDate]);
 
-const connector = connect(makeMapStateToProps);
+  useEffect(() => {
+    uncommonProcessesSearch(uncommonProcessesRequest);
+  }, [uncommonProcessesRequest, uncommonProcessesSearch]);
 
-type PropsFromRedux = ConnectedProps<typeof connector>;
-
-export const UncommonProcessesQuery = compose<React.ComponentClass<OwnProps>>(
-  connector,
-  withKibana
-)(UncommonProcessesComponentQuery);
+  return [loading, uncommonProcessesResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/translations.ts b/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/translations.ts
new file mode 100644
index 0000000000000..d563d90dfb262
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_UNCOMMON_PROCESSES = i18n.translate(
+  'xpack.securitySolution.uncommonProcesses.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on uncommon processes search`,
+  }
+);
+
+export const FAIL_UNCOMMON_PROCESSES = i18n.translate(
+  'xpack.securitySolution.uncommonProcesses.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on uncommon processes`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/uncommon_process_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/uncommon_process_query_tab_body.tsx
index f1691dbaa04b4..713958f05a3da 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/uncommon_process_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/uncommon_process_query_tab_body.tsx
@@ -6,7 +6,7 @@
 
 import { getOr } from 'lodash/fp';
 import React from 'react';
-import { UncommonProcessesQuery } from '../../containers/uncommon_processes';
+import { useUncommonProcesses } from '../../containers/uncommon_processes';
 import { HostsComponentsQueryProps } from './types';
 import { UncommonProcessTable } from '../../components/uncommon_process_table';
 import { manageQuery } from '../../../common/components/page/manage_query';
@@ -15,49 +15,35 @@ const UncommonProcessTableManage = manageQuery(UncommonProcessTable);
 
 export const UncommonProcessQueryTabBody = ({
   deleteQuery,
+  docValueFields,
   endDate,
   filterQuery,
   skip,
   setQuery,
   startDate,
   type,
-}: HostsComponentsQueryProps) => (
-  <UncommonProcessesQuery
-    endDate={endDate}
-    filterQuery={filterQuery}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={type}
-  >
-    {({
-      uncommonProcesses,
-      totalCount,
-      loading,
-      pageInfo,
-      loadPage,
-      id,
-      inspect,
-      isInspected,
-      refetch,
-    }) => (
-      <UncommonProcessTableManage
-        deleteQuery={deleteQuery}
-        data={uncommonProcesses}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        id={id}
-        inspect={inspect}
-        isInspect={isInspected}
-        loading={loading}
-        loadPage={loadPage}
-        refetch={refetch}
-        setQuery={setQuery}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        totalCount={totalCount}
-        type={type}
-      />
-    )}
-  </UncommonProcessesQuery>
-);
+}: HostsComponentsQueryProps) => {
+  const [
+    loading,
+    { uncommonProcesses, totalCount, pageInfo, loadPage, id, inspect, isInspected, refetch },
+  ] = useUncommonProcesses({ docValueFields, endDate, filterQuery, skip, startDate, type });
+  return (
+    <UncommonProcessTableManage
+      deleteQuery={deleteQuery}
+      data={uncommonProcesses}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      id={id}
+      inspect={inspect}
+      isInspect={isInspected}
+      loading={loading}
+      loadPage={loadPage}
+      refetch={refetch}
+      setQuery={setQuery}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      totalCount={totalCount}
+      type={type}
+    />
+  );
+};
 
 UncommonProcessQueryTabBody.dispalyName = 'UncommonProcessQueryTabBody';
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts
index 5c29d2747f68d..3550824028478 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts
@@ -5,8 +5,8 @@
  */
 import { set } from '@elastic/safer-lodash-set/fp';
 import { get, has, head } from 'lodash/fp';
+import { hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
 import { HostsEdges } from '../../../../../../common/search_strategy/security_solution/hosts';
-import { hostFieldsMap } from '../../../../../lib/ecs_fields';
 
 import { HostAggEsItem, HostBuckets, HostValue } from '../../../../../lib/hosts/types';
 
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts
index 35e4d2cc8e1fe..df300c85e300f 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts
@@ -6,14 +6,14 @@
 
 import { isEmpty } from 'lodash/fp';
 
-import { AuthenticationsRequestOptions } from '../../../../../../../common/search_strategy/security_solution/hosts/authentications';
+import { HostAuthenticationsRequestOptions } from '../../../../../../../common/search_strategy/security_solution/hosts/authentications';
 import { sourceFieldsMap, hostFieldsMap } from '../../../../../../../common/ecs/ecs_fields';
 
 import { createQueryFilterClauses } from '../../../../../../utils/build_query';
 import { reduceFields } from '../../../../../../utils/build_query/reduce_fields';
-import { extendMap } from '../../../../../../lib/ecs_fields/extend_map';
 
 import { authenticationFields } from '../helpers';
+import { extendMap } from '../../../../../../../common/ecs/ecs_fields/extend_map';
 
 export const auditdFieldsMap: Readonly<Record<string, string>> = {
   latest: '@timestamp',
@@ -31,7 +31,7 @@ export const buildQuery = ({
   pagination: { querySize },
   defaultIndex,
   docValueFields,
-}: AuthenticationsRequestOptions) => {
+}: HostAuthenticationsRequestOptions) => {
   const esFields = reduceFields(authenticationFields, { ...hostFieldsMap, ...sourceFieldsMap });
 
   const filter = [
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx
index 200818c40dec5..ded9a7917d921 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx
@@ -12,8 +12,8 @@ import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants
 import {
   HostsQueries,
   AuthenticationsEdges,
-  AuthenticationsRequestOptions,
-  AuthenticationsStrategyResponse,
+  HostAuthenticationsRequestOptions,
+  HostAuthenticationsStrategyResponse,
   AuthenticationHit,
 } from '../../../../../../common/search_strategy/security_solution/hosts';
 
@@ -23,7 +23,7 @@ import { auditdFieldsMap, buildQuery as buildAuthenticationQuery } from './dsl/q
 import { formatAuthenticationData, getHits } from './helpers';
 
 export const authentications: SecuritySolutionFactory<HostsQueries.authentications> = {
-  buildDsl: (options: AuthenticationsRequestOptions) => {
+  buildDsl: (options: HostAuthenticationsRequestOptions) => {
     if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
       throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
     }
@@ -31,9 +31,9 @@ export const authentications: SecuritySolutionFactory<HostsQueries.authenticatio
     return buildAuthenticationQuery(options);
   },
   parse: async (
-    options: AuthenticationsRequestOptions,
+    options: HostAuthenticationsRequestOptions,
     response: IEsSearchResponse<unknown>
-  ): Promise<AuthenticationsStrategyResponse> => {
+  ): Promise<HostAuthenticationsStrategyResponse> => {
     const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
     const totalCount = getOr(0, 'aggregations.user_count.value', response.rawResponse);
 
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/helpers.ts
index 48e210d822918..56f7aec2327a5 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/helpers.ts
@@ -5,11 +5,11 @@
  */
 import { set } from '@elastic/safer-lodash-set/fp';
 import { get, has, head } from 'lodash/fp';
+import { hostFieldsMap } from '../../../../../common/ecs/ecs_fields';
 import {
   HostsEdges,
   HostItem,
 } from '../../../../../common/search_strategy/security_solution/hosts';
-import { hostFieldsMap } from '../../../../lib/ecs_fields';
 
 import { HostAggEsItem, HostBuckets, HostValue } from '../../../../lib/hosts/types';
 
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/index.ts
index 6585abde60281..38d81c229ac5f 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/index.ts
@@ -13,11 +13,13 @@ import { SecuritySolutionFactory } from '../types';
 import { allHosts } from './all';
 import { overviewHost } from './overview';
 import { firstLastSeenHost } from './last_first_seen';
+import { uncommonProcesses } from './uncommon_processes';
 import { authentications } from './authentications';
 
 export const hostsFactory: Record<HostsQueries, SecuritySolutionFactory<FactoryQueryTypes>> = {
   [HostsQueries.hosts]: allHosts,
   [HostsQueries.hostOverview]: overviewHost,
   [HostsQueries.firstLastSeen]: firstLastSeenHost,
+  [HostsQueries.uncommonProcesses]: uncommonProcesses,
   [HostsQueries.authentications]: authentications,
 };
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/helpers.ts
index c7b0d8acc8782..ed705e7f6ad56 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/helpers.ts
@@ -5,8 +5,8 @@
  */
 import { set } from '@elastic/safer-lodash-set/fp';
 import { get, has, head } from 'lodash/fp';
+import { hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
 import { HostItem } from '../../../../../../common/search_strategy/security_solution/hosts';
-import { hostFieldsMap } from '../../../../../lib/ecs_fields';
 
 import { HostAggEsItem, HostBuckets, HostValue } from '../../../../../lib/hosts/types';
 
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.host_overview.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.host_overview.dsl.ts
index 913bc90df04be..85cc87414c38e 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.host_overview.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.host_overview.dsl.ts
@@ -5,8 +5,8 @@
  */
 
 import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common';
+import { cloudFieldsMap, hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
 import { HostOverviewRequestOptions } from '../../../../../../common/search_strategy/security_solution';
-import { cloudFieldsMap, hostFieldsMap } from '../../../../../lib/ecs_fields';
 import { buildFieldsTermAggregation } from '../../../../../lib/hosts/helpers';
 import { reduceFields } from '../../../../../utils/build_query/reduce_fields';
 import { HOST_FIELDS } from './helpers';
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts
new file mode 100644
index 0000000000000..2e2d889dda116
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts
@@ -0,0 +1,226 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createQueryFilterClauses } from '../../../../../../utils/build_query';
+import { reduceFields } from '../../../../../../utils/build_query/reduce_fields';
+import {
+  hostFieldsMap,
+  processFieldsMap,
+  userFieldsMap,
+} from '../../../../../../../common/ecs/ecs_fields';
+import { RequestOptionsPaginated } from '../../../../../../../common/search_strategy/security_solution';
+import { uncommonProcessesFields } from '../helpers';
+
+export const buildQuery = ({
+  defaultIndex,
+  filterQuery,
+  pagination: { querySize },
+  timerange: { from, to },
+}: RequestOptionsPaginated) => {
+  const processUserFields = reduceFields(uncommonProcessesFields, {
+    ...processFieldsMap,
+    ...userFieldsMap,
+  });
+  const hostFields = reduceFields(uncommonProcessesFields, hostFieldsMap);
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const agg = {
+    process_count: {
+      cardinality: {
+        field: 'process.name',
+      },
+    },
+  };
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        ...agg,
+        group_by_process: {
+          terms: {
+            size: querySize,
+            field: 'process.name',
+            order: [
+              {
+                host_count: 'asc',
+              },
+              {
+                _count: 'asc',
+              },
+              {
+                _key: 'asc',
+              },
+            ],
+          },
+          aggregations: {
+            process: {
+              top_hits: {
+                size: 1,
+                sort: [{ '@timestamp': { order: 'desc' } }],
+                _source: processUserFields,
+              },
+            },
+            host_count: {
+              cardinality: {
+                field: 'host.name',
+              },
+            },
+            hosts: {
+              terms: {
+                field: 'host.name',
+              },
+              aggregations: {
+                host: {
+                  top_hits: {
+                    size: 1,
+                    _source: hostFields,
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      query: {
+        bool: {
+          should: [
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'agent.type': 'auditbeat',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.module': 'auditd',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.action': 'executed',
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'agent.type': 'auditbeat',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.module': 'system',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.dataset': 'process',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.action': 'process_started',
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'agent.type': 'winlogbeat',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.code': '4688',
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'winlog.event_id': 1,
+                    },
+                  },
+                  {
+                    term: {
+                      'winlog.channel': 'Microsoft-Windows-Sysmon/Operational',
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'event.type': 'process_start',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.category': 'process',
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'event.category': 'process',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.type': 'start',
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+          minimum_should_match: 1,
+          filter,
+        },
+      },
+    },
+    size: 0,
+    track_total_hits: false,
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/helpers.ts
new file mode 100644
index 0000000000000..5c3d76175b7e4
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/helpers.ts
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { get, getOr } from 'lodash/fp';
+import { set } from '@elastic/safer-lodash-set/fp';
+
+import { mergeFieldsWithHit } from '../../../../../utils/build_query';
+import {
+  ProcessHits,
+  UncommonProcessesEdges,
+  UncommonProcessHit,
+} from '../../../../../../common/search_strategy/security_solution/hosts/uncommon_processes';
+import { toArray } from '../../../../helpers/to_array';
+import { HostHits } from '../../../../../../common/search_strategy';
+
+export const uncommonProcessesFields = [
+  '_id',
+  'instances',
+  'process.args',
+  'process.name',
+  'user.id',
+  'user.name',
+  'hosts.name',
+];
+
+export const getHits = (buckets: readonly UncommonProcessBucket[]): readonly UncommonProcessHit[] =>
+  buckets.map((bucket: Readonly<UncommonProcessBucket>) => ({
+    _id: bucket.process.hits.hits[0]._id,
+    _index: bucket.process.hits.hits[0]._index,
+    _type: bucket.process.hits.hits[0]._type,
+    _score: bucket.process.hits.hits[0]._score,
+    _source: bucket.process.hits.hits[0]._source,
+    sort: bucket.process.hits.hits[0].sort,
+    cursor: bucket.process.hits.hits[0].cursor,
+    total: bucket.process.hits.total,
+    host: getHosts(bucket.hosts.buckets),
+  }));
+
+export interface UncommonProcessBucket {
+  key: string;
+  hosts: {
+    buckets: Array<{ key: string; host: HostHits }>;
+  };
+  process: ProcessHits;
+}
+
+export const getHosts = (buckets: ReadonlyArray<{ key: string; host: HostHits }>) =>
+  buckets.map((bucket) => {
+    const source = get('host.hits.hits[0]._source', bucket);
+    return {
+      id: [bucket.key],
+      name: get('host.name', source),
+    };
+  });
+
+export const formatUncommonProcessesData = (
+  fields: readonly string[],
+  hit: UncommonProcessHit,
+  fieldMap: Readonly<Record<string, string>>
+): UncommonProcessesEdges =>
+  fields.reduce<UncommonProcessesEdges>(
+    (flattenedFields, fieldName) => {
+      flattenedFields.node._id = hit._id;
+      flattenedFields.node.instances = getOr(0, 'total.value', hit);
+      flattenedFields.node.hosts = hit.host;
+
+      if (hit.cursor) {
+        flattenedFields.cursor.value = hit.cursor;
+      }
+
+      const mergedResult = mergeFieldsWithHit(fieldName, flattenedFields, fieldMap, hit);
+      let fieldPath = `node.${fieldName}`;
+      let fieldValue = get(fieldPath, mergedResult);
+      if (fieldPath === 'node.hosts.name') {
+        fieldPath = `node.hosts.0.name`;
+        fieldValue = get(fieldPath, mergedResult);
+      }
+      return set(fieldPath, toArray(fieldValue), mergedResult);
+    },
+    {
+      node: {
+        _id: '',
+        instances: 0,
+        process: {},
+        hosts: [],
+      },
+      cursor: {
+        value: '',
+        tiebreaker: null,
+      },
+    }
+  );
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts
new file mode 100644
index 0000000000000..fcc76eebe4cf5
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import { HostsQueries } from '../../../../../../common/search_strategy/security_solution';
+import { processFieldsMap, userFieldsMap } from '../../../../../../common/ecs/ecs_fields';
+import {
+  HostUncommonProcessesRequestOptions,
+  HostUncommonProcessesStrategyResponse,
+} from '../../../../../../common/search_strategy/security_solution/hosts/uncommon_processes';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+
+import { SecuritySolutionFactory } from '../../types';
+import { buildQuery } from './dsl/query.dsl';
+import { formatUncommonProcessesData, getHits, uncommonProcessesFields } from './helpers';
+
+export const uncommonProcesses: SecuritySolutionFactory<HostsQueries.uncommonProcesses> = {
+  buildDsl: (options: HostUncommonProcessesRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+    return buildQuery(options);
+  },
+  parse: async (
+    options: HostUncommonProcessesRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<HostUncommonProcessesStrategyResponse> => {
+    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
+    const totalCount = getOr(0, 'aggregations.process_count.value', response.rawResponse);
+    const buckets = getOr([], 'aggregations.group_by_process.buckets', response.rawResponse);
+    const hits = getHits(buckets);
+
+    const uncommonProcessesEdges = hits.map((hit) =>
+      formatUncommonProcessesData(uncommonProcessesFields, hit, {
+        ...processFieldsMap,
+        ...userFieldsMap,
+      })
+    );
+
+    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
+    const edges = uncommonProcessesEdges.splice(cursorStart, querySize - cursorStart);
+    const inspect = {
+      dsl: [inspectStringifyObject(buildQuery(options))],
+      response: [inspectStringifyObject(response)],
+    };
+
+    const showMorePagesIndicator = totalCount > fakeTotalCount;
+    return {
+      ...response,
+      edges,
+      inspect,
+      pageInfo: {
+        activePage: activePage ? activePage : 0,
+        fakeTotalCount,
+        showMorePagesIndicator,
+      },
+      totalCount,
+    };
+  },
+};