From 04a61bfcd4d3e4f2c041215beb11c7014cb2ffd4 Mon Sep 17 00:00:00 2001
From: Georgii Gorbachev <georgii.gorbachev@elastic.co>
Date: Tue, 19 Oct 2021 11:03:46 +0200
Subject: [PATCH 1/8] [Security Solution][Detections] Hide building block rules
 in "Security/Overview" (#105611)

* Hide building block rules in "Security/Overview"

* Add Cypress tests for alerts generated by building block rules

Co-authored-by: Dmitry Shevchenko <dmshevch@gmail.com>
---
 .../building_block_alerts.spec.ts             | 40 +++++++++++++++++++
 .../security_solution/cypress/objects/rule.ts | 20 ++++++++++
 .../cypress/screens/overview.ts               |  2 +
 .../cypress/tasks/api_calls/rules.ts          |  1 +
 .../components/signals_by_category/index.tsx  | 15 +++++--
 .../use_filters_for_signals_by_category.ts    | 37 +++++++++++++++++
 6 files changed, 111 insertions(+), 4 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/cypress/integration/detection_alerts/building_block_alerts.spec.ts
 create mode 100644 x-pack/plugins/security_solution/public/overview/components/signals_by_category/use_filters_for_signals_by_category.ts

diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/building_block_alerts.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/building_block_alerts.spec.ts
new file mode 100644
index 0000000000000..262ffe8163e57
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/building_block_alerts.spec.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getBuildingBlockRule } from '../../objects/rule';
+import { OVERVIEW_ALERTS_HISTOGRAM } from '../../screens/overview';
+import { OVERVIEW } from '../../screens/security_header';
+import { goToRuleDetails } from '../../tasks/alerts_detection_rules';
+import { createCustomRuleActivated } from '../../tasks/api_calls/rules';
+import { cleanKibana } from '../../tasks/common';
+import { waitForAlertsToPopulate, waitForTheRuleToBeExecuted } from '../../tasks/create_new_rule';
+import { loginAndWaitForPage } from '../../tasks/login';
+import { navigateFromHeaderTo } from '../../tasks/security_header';
+import { DETECTIONS_RULE_MANAGEMENT_URL } from '../../urls/navigation';
+
+const EXPECTED_NUMBER_OF_ALERTS = 16;
+
+describe('Alerts generated by building block rules', () => {
+  beforeEach(() => {
+    cleanKibana();
+  });
+
+  it('Alerts should be visible on the Rule Detail page and not visible on the Overview page', () => {
+    createCustomRuleActivated(getBuildingBlockRule());
+    loginAndWaitForPage(DETECTIONS_RULE_MANAGEMENT_URL);
+    goToRuleDetails();
+    waitForTheRuleToBeExecuted();
+
+    // Check that generated events are visible on the Details page
+    waitForAlertsToPopulate(EXPECTED_NUMBER_OF_ALERTS);
+
+    navigateFromHeaderTo(OVERVIEW);
+
+    // Check that generated events are hidden on the Overview page
+    cy.get(OVERVIEW_ALERTS_HISTOGRAM).should('contain.text', 'No data to display');
+  });
+});
diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts
index 4b061865d632b..27973854097db 100644
--- a/x-pack/plugins/security_solution/cypress/objects/rule.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts
@@ -58,6 +58,7 @@ export interface CustomRule {
   lookBack: Interval;
   timeline: CompleteTimeline;
   maxSignals: number;
+  buildingBlockType?: string;
 }
 
 export interface ThresholdRule extends CustomRule {
@@ -188,6 +189,25 @@ export const getNewRule = (): CustomRule => ({
   maxSignals: 100,
 });
 
+export const getBuildingBlockRule = (): CustomRule => ({
+  customQuery: 'host.name: *',
+  index: getIndexPatterns(),
+  name: 'Building Block Rule Test',
+  description: 'The new rule description.',
+  severity: 'High',
+  riskScore: '17',
+  tags: ['test', 'newRule'],
+  referenceUrls: ['http://example.com/', 'https://example.com/'],
+  falsePositivesExamples: ['False1', 'False2'],
+  mitre: [getMitre1(), getMitre2()],
+  note: '# test markdown',
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+  timeline: getTimeline(),
+  maxSignals: 100,
+  buildingBlockType: 'default',
+});
+
 export const getUnmappedRule = (): CustomRule => ({
   customQuery: '*:*',
   index: ['unmapped*'],
diff --git a/x-pack/plugins/security_solution/cypress/screens/overview.ts b/x-pack/plugins/security_solution/cypress/screens/overview.ts
index 1376a39e5ee79..1945b7e3ce3e7 100644
--- a/x-pack/plugins/security_solution/cypress/screens/overview.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/overview.ts
@@ -166,3 +166,5 @@ export const OVERVIEW_RISKY_HOSTS_VIEW_DASHBOARD_BUTTON =
 export const OVERVIEW_RISKY_HOSTS_TOTAL_EVENT_COUNT = `${OVERVIEW_RISKY_HOSTS_LINKS} [data-test-subj="header-panel-subtitle"]`;
 export const OVERVIEW_RISKY_HOSTS_ENABLE_MODULE_BUTTON =
   '[data-test-subj="risky-hosts-enable-module-button"]';
+
+export const OVERVIEW_ALERTS_HISTOGRAM = '[data-test-subj="alerts-histogram-panel"]';
diff --git a/x-pack/plugins/security_solution/cypress/tasks/api_calls/rules.ts b/x-pack/plugins/security_solution/cypress/tasks/api_calls/rules.ts
index 04ff0fcabc081..fd2838e5b3caa 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/api_calls/rules.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/api_calls/rules.ts
@@ -114,6 +114,7 @@ export const createCustomRuleActivated = (
       enabled: true,
       tags: ['rule1'],
       max_signals: maxSignals,
+      building_block_type: rule.buildingBlockType,
     },
     headers: { 'kbn-xsrf': 'cypress-creds' },
     failOnStatusCode: false,
diff --git a/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
index 321e6d00b5301..cbeb1464e1b41 100644
--- a/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
@@ -7,19 +7,24 @@
 
 import React, { useCallback } from 'react';
 import { useDispatch } from 'react-redux';
+import { Filter, Query } from '@kbn/es-query';
 
 import { AlertsHistogramPanel } from '../../../detections/components/alerts_kpis/alerts_histogram_panel';
 import { useSignalIndex } from '../../../detections/containers/detection_engine/alerts/use_signal_index';
 import { setAbsoluteRangeDatePicker } from '../../../common/store/inputs/actions';
-import { Filter, Query } from '../../../../../../../src/plugins/data/public';
+
 import { InputsModelId } from '../../../common/store/inputs/constants';
-import * as i18n from '../../pages/translations';
 import { UpdateDateRange } from '../../../common/components/charts/common';
+
 import { AlertsStackByField } from '../../../detections/components/alerts_kpis/common/types';
 
+import * as i18n from '../../pages/translations';
+
+import { useFiltersForSignalsByCategory } from './use_filters_for_signals_by_category';
+
 interface Props {
   combinedQueries?: string;
-  filters?: Filter[];
+  filters: Filter[];
   headerChildren?: React.ReactNode;
   /** Override all defaults, and only display this field */
   onlyField?: AlertsStackByField;
@@ -43,6 +48,8 @@ const SignalsByCategoryComponent: React.FC<Props> = ({
 }) => {
   const dispatch = useDispatch();
   const { signalIndexName } = useSignalIndex();
+  const filtersForSignalsByCategory = useFiltersForSignalsByCategory(filters);
+
   const updateDateRangeCallback = useCallback<UpdateDateRange>(
     ({ x }) => {
       if (!x) {
@@ -63,7 +70,7 @@ const SignalsByCategoryComponent: React.FC<Props> = ({
   return (
     <AlertsHistogramPanel
       combinedQueries={combinedQueries}
-      filters={filters}
+      filters={filtersForSignalsByCategory}
       headerChildren={headerChildren}
       legendPosition={'right'}
       onlyField={onlyField}
diff --git a/x-pack/plugins/security_solution/public/overview/components/signals_by_category/use_filters_for_signals_by_category.ts b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/use_filters_for_signals_by_category.ts
new file mode 100644
index 0000000000000..6f87cb72763d3
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/use_filters_for_signals_by_category.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useMemo } from 'react';
+import { Filter } from '@kbn/es-query';
+
+import { useIsExperimentalFeatureEnabled } from '../../../common/hooks/use_experimental_features';
+import {
+  buildShowBuildingBlockFilter,
+  buildShowBuildingBlockFilterRuleRegistry,
+} from '../../../detections/components/alerts_table/default_config';
+
+// On the Overview page, in the Detection Alert Trend, we never show
+// "building block" alerts to remove noise from the Overview UI.
+// https://www.elastic.co/guide/en/security/current/building-block-rule.html
+const SHOW_BUILDING_BLOCK_ALERTS = false;
+
+export const useFiltersForSignalsByCategory = (baseFilters: Filter[]) => {
+  // TODO: Once we are past experimental phase this code should be removed
+  const ruleRegistryEnabled = useIsExperimentalFeatureEnabled('ruleRegistryEnabled');
+
+  const resultingFilters = useMemo(
+    () => [
+      ...baseFilters,
+      ...(ruleRegistryEnabled
+        ? buildShowBuildingBlockFilterRuleRegistry(SHOW_BUILDING_BLOCK_ALERTS) // TODO: Once we are past experimental phase this code should be removed
+        : buildShowBuildingBlockFilter(SHOW_BUILDING_BLOCK_ALERTS)),
+    ],
+    [baseFilters, ruleRegistryEnabled]
+  );
+
+  return resultingFilters;
+};

From b9024c6ad5561ddd5dc415c1dec786e1b534c75c Mon Sep 17 00:00:00 2001
From: Kevin Lacabane <kevin.lacabane@elastic.co>
Date: Tue, 19 Oct 2021 11:08:20 +0200
Subject: [PATCH 2/8] timepicker-url sync functional test (#115173)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../test/functional/apps/monitoring/index.js  |  2 +-
 .../functional/apps/monitoring/time_filter.js | 26 +++++++++++++++++--
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/x-pack/test/functional/apps/monitoring/index.js b/x-pack/test/functional/apps/monitoring/index.js
index 6a5b6ea813171..a67964d325164 100644
--- a/x-pack/test/functional/apps/monitoring/index.js
+++ b/x-pack/test/functional/apps/monitoring/index.js
@@ -42,7 +42,7 @@ export default function ({ loadTestFile }) {
     loadTestFile(require.resolve('./beats/listing'));
     loadTestFile(require.resolve('./beats/beat_detail'));
 
-    // loadTestFile(require.resolve('./time_filter'));
+    loadTestFile(require.resolve('./time_filter'));
     loadTestFile(require.resolve('./enable_monitoring'));
 
     loadTestFile(require.resolve('./setup/metricbeat_migration'));
diff --git a/x-pack/test/functional/apps/monitoring/time_filter.js b/x-pack/test/functional/apps/monitoring/time_filter.js
index 910b91d07039d..76e7bc5cd043d 100644
--- a/x-pack/test/functional/apps/monitoring/time_filter.js
+++ b/x-pack/test/functional/apps/monitoring/time_filter.js
@@ -12,22 +12,44 @@ export default function ({ getService, getPageObjects }) {
   const PageObjects = getPageObjects(['header', 'timePicker']);
   const testSubjects = getService('testSubjects');
   const clusterList = getService('monitoringClusterList');
+  const browser = getService('browser');
+
+  const assertTimePickerRange = async (start, end) => {
+    const timeConfig = await PageObjects.timePicker.getTimeConfig();
+    expect(timeConfig.start).to.eql(start);
+    expect(timeConfig.end).to.eql(end);
+  };
 
   describe('Timefilter', () => {
     const { setup, tearDown } = getLifecycleMethods(getService, getPageObjects);
 
+    const from = 'Aug 15, 2017 @ 21:00:00.000';
+    const to = 'Aug 16, 2017 @ 00:00:00.000';
+
     before(async () => {
       await setup('x-pack/test/functional/es_archives/monitoring/multicluster', {
-        from: 'Aug 15, 2017 @ 21:00:00.000',
-        to: 'Aug 16, 2017 @ 00:00:00.000',
+        from,
+        to,
       });
       await clusterList.assertDefaults();
+      await clusterList.closeAlertsModal();
     });
 
     after(async () => {
       await tearDown();
     });
 
+    it('syncs timepicker with url hash updates', async () => {
+      await assertTimePickerRange(from, to);
+
+      await browser.execute(() => {
+        const hash = window.location.hash;
+        window.location.hash = hash.replace(/time:\(([^)]+)\)/, 'time:(from:now-15m,to:now)');
+      });
+
+      await assertTimePickerRange('~ 15 minutes ago', 'now');
+    });
+
     // FLAKY: https://github.com/elastic/kibana/issues/48910
     it.skip('should send another request when clicking Refresh', async () => {
       await testSubjects.click('querySubmitButton');

From 5fe9a319c001444819d0f79e5ea2e3a375eb2771 Mon Sep 17 00:00:00 2001
From: mgiota <giota85@gmail.com>
Date: Tue, 19 Oct 2021 11:09:48 +0200
Subject: [PATCH 3/8] [RAC] [Metrics UI] Include group name in the reason
 message (#115171)

* [RAC] [Metrics UI] Include group name in the reason message

* remove console log

* fix i18n errors

* fix more i18n errors

* fix i18n & check errors and move group to the end of the reason text

* add empty lines at the end of translation files

* fix more i18n tests

* try to remove manually added translations

* Revert "try to remove manually added translations"

This reverts commit 6949af2f70aff46b088bab5c942497ad46081d90.

* apply i18n_check fix and reorder values in the formatted reason

* log threshold reformat reason message and move group info at the end
---
 .../server/lib/alerting/common/messages.ts    | 18 ++++++----
 .../inventory_metric_threshold_executor.ts    | 35 +++++++++++--------
 .../log_threshold/reason_formatters.ts        |  4 +--
 .../metric_threshold_executor.ts              |  9 ++---
 .../translations/translations/ja-JP.json      |  3 --
 .../translations/translations/zh-CN.json      |  3 --
 6 files changed, 40 insertions(+), 32 deletions(-)

diff --git a/x-pack/plugins/infra/server/lib/alerting/common/messages.ts b/x-pack/plugins/infra/server/lib/alerting/common/messages.ts
index 084043f357bb1..23c89abf4a7aa 100644
--- a/x-pack/plugins/infra/server/lib/alerting/common/messages.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/common/messages.ts
@@ -109,15 +109,17 @@ const thresholdToI18n = ([a, b]: Array<number | string>) => {
 };
 
 export const buildFiredAlertReason: (alertResult: {
+  group: string;
   metric: string;
   comparator: Comparator;
   threshold: Array<number | string>;
   currentValue: number | string;
-}) => string = ({ metric, comparator, threshold, currentValue }) =>
+}) => string = ({ group, metric, comparator, threshold, currentValue }) =>
   i18n.translate('xpack.infra.metrics.alerting.threshold.firedAlertReason', {
     defaultMessage:
-      '{metric} is {comparator} a threshold of {threshold} (current value is {currentValue})',
+      '{metric} is {comparator} a threshold of {threshold} (current value is {currentValue}) for {group}',
     values: {
+      group,
       metric,
       comparator: comparatorToI18n(comparator, threshold.map(toNumber), toNumber(currentValue)),
       threshold: thresholdToI18n(threshold),
@@ -126,14 +128,15 @@ export const buildFiredAlertReason: (alertResult: {
   });
 
 export const buildRecoveredAlertReason: (alertResult: {
+  group: string;
   metric: string;
   comparator: Comparator;
   threshold: Array<number | string>;
   currentValue: number | string;
-}) => string = ({ metric, comparator, threshold, currentValue }) =>
+}) => string = ({ group, metric, comparator, threshold, currentValue }) =>
   i18n.translate('xpack.infra.metrics.alerting.threshold.recoveredAlertReason', {
     defaultMessage:
-      '{metric} is now {comparator} a threshold of {threshold} (current value is {currentValue})',
+      '{metric} is now {comparator} a threshold of {threshold} (current value is {currentValue}) for {group}',
     values: {
       metric,
       comparator: recoveredComparatorToI18n(
@@ -143,19 +146,22 @@ export const buildRecoveredAlertReason: (alertResult: {
       ),
       threshold: thresholdToI18n(threshold),
       currentValue,
+      group,
     },
   });
 
 export const buildNoDataAlertReason: (alertResult: {
+  group: string;
   metric: string;
   timeSize: number;
   timeUnit: string;
-}) => string = ({ metric, timeSize, timeUnit }) =>
+}) => string = ({ group, metric, timeSize, timeUnit }) =>
   i18n.translate('xpack.infra.metrics.alerting.threshold.noDataAlertReason', {
-    defaultMessage: '{metric} has reported no data over the past {interval}',
+    defaultMessage: '{metric} has reported no data over the past {interval} for {group}',
     values: {
       metric,
       interval: `${timeSize}${timeUnit}`,
+      group,
     },
   });
 
diff --git a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
index 5cd093c6f1472..3dd702126735d 100644
--- a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
@@ -102,18 +102,18 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
       )
     );
     const inventoryItems = Object.keys(first(results)!);
-    for (const item of inventoryItems) {
+    for (const group of inventoryItems) {
       // AND logic; all criteria must be across the threshold
       const shouldAlertFire = results.every((result) => {
         // Grab the result of the most recent bucket
-        return last(result[item].shouldFire);
+        return last(result[group].shouldFire);
       });
-      const shouldAlertWarn = results.every((result) => last(result[item].shouldWarn));
+      const shouldAlertWarn = results.every((result) => last(result[group].shouldWarn));
 
       // AND logic; because we need to evaluate all criteria, if one of them reports no data then the
       // whole alert is in a No Data/Error state
-      const isNoData = results.some((result) => last(result[item].isNoData));
-      const isError = results.some((result) => result[item].isError);
+      const isNoData = results.some((result) => last(result[group].isNoData));
+      const isError = results.some((result) => result[group].isError);
 
       const nextState = isError
         ? AlertStates.ERROR
@@ -129,7 +129,8 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
         reason = results
           .map((result) =>
             buildReasonWithVerboseMetricName(
-              result[item],
+              group,
+              result[group],
               buildFiredAlertReason,
               nextState === AlertStates.WARNING
             )
@@ -142,19 +143,23 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
          */
         // } else if (nextState === AlertStates.OK && prevState?.alertState === AlertStates.ALERT) {
         // reason = results
-        //   .map((result) => buildReasonWithVerboseMetricName(result[item], buildRecoveredAlertReason))
+        //   .map((result) => buildReasonWithVerboseMetricName(group, result[group], buildRecoveredAlertReason))
         //   .join('\n');
       }
       if (alertOnNoData) {
         if (nextState === AlertStates.NO_DATA) {
           reason = results
-            .filter((result) => result[item].isNoData)
-            .map((result) => buildReasonWithVerboseMetricName(result[item], buildNoDataAlertReason))
+            .filter((result) => result[group].isNoData)
+            .map((result) =>
+              buildReasonWithVerboseMetricName(group, result[group], buildNoDataAlertReason)
+            )
             .join('\n');
         } else if (nextState === AlertStates.ERROR) {
           reason = results
-            .filter((result) => result[item].isError)
-            .map((result) => buildReasonWithVerboseMetricName(result[item], buildErrorAlertReason))
+            .filter((result) => result[group].isError)
+            .map((result) =>
+              buildReasonWithVerboseMetricName(group, result[group], buildErrorAlertReason)
+            )
             .join('\n');
         }
       }
@@ -166,7 +171,7 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
             ? WARNING_ACTIONS.id
             : FIRED_ACTIONS.id;
 
-        const alertInstance = alertInstanceFactory(`${item}`, reason);
+        const alertInstance = alertInstanceFactory(`${group}`, reason);
         alertInstance.scheduleActions(
           /**
            * TODO: We're lying to the compiler here as explicitly  calling `scheduleActions` on
@@ -174,12 +179,12 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
            */
           actionGroupId as unknown as InventoryMetricThresholdAllowedActionGroups,
           {
-            group: item,
+            group,
             alertState: stateToAlertMessage[nextState],
             reason,
             timestamp: moment().toISOString(),
             value: mapToConditionsLookup(results, (result) =>
-              formatMetric(result[item].metric, result[item].currentValue)
+              formatMetric(result[group].metric, result[group].currentValue)
             ),
             threshold: mapToConditionsLookup(criteria, (c) => c.threshold),
             metric: mapToConditionsLookup(criteria, (c) => c.metric),
@@ -190,6 +195,7 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
   });
 
 const buildReasonWithVerboseMetricName = (
+  group: string,
   resultItem: any,
   buildReason: (r: any) => string,
   useWarningThreshold?: boolean
@@ -197,6 +203,7 @@ const buildReasonWithVerboseMetricName = (
   if (!resultItem) return '';
   const resultWithVerboseMetricName = {
     ...resultItem,
+    group,
     metric:
       toMetricOpt(resultItem.metric)?.text ||
       (resultItem.metric === 'custom'
diff --git a/x-pack/plugins/infra/server/lib/alerting/log_threshold/reason_formatters.ts b/x-pack/plugins/infra/server/lib/alerting/log_threshold/reason_formatters.ts
index cd579b9965b66..f70e0a0140ce8 100644
--- a/x-pack/plugins/infra/server/lib/alerting/log_threshold/reason_formatters.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/log_threshold/reason_formatters.ts
@@ -34,7 +34,7 @@ export const getReasonMessageForGroupedCountAlert = (
 ) =>
   i18n.translate('xpack.infra.logs.alerting.threshold.groupedCountAlertReasonDescription', {
     defaultMessage:
-      '{groupName}: {actualCount, plural, one {{actualCount} log entry} other {{actualCount} log entries} } ({translatedComparator} {expectedCount}) match the conditions.',
+      '{actualCount, plural, one {{actualCount} log entry} other {{actualCount} log entries} } ({translatedComparator} {expectedCount}) match the conditions for {groupName}.',
     values: {
       actualCount,
       expectedCount,
@@ -66,7 +66,7 @@ export const getReasonMessageForGroupedRatioAlert = (
 ) =>
   i18n.translate('xpack.infra.logs.alerting.threshold.groupedRatioAlertReasonDescription', {
     defaultMessage:
-      '{groupName}: The log entries ratio is {actualRatio} ({translatedComparator} {expectedRatio}).',
+      'The log entries ratio is {actualRatio} ({translatedComparator} {expectedRatio}) for {groupName}.',
     values: {
       actualRatio,
       expectedRatio,
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
index af5f945eeb4bb..e4887e922bb66 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
@@ -143,9 +143,10 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
       if (nextState === AlertStates.ALERT || nextState === AlertStates.WARNING) {
         reason = alertResults
           .map((result) =>
-            buildFiredAlertReason(
-              formatAlertResult(result[group], nextState === AlertStates.WARNING)
-            )
+            buildFiredAlertReason({
+              ...formatAlertResult(result[group], nextState === AlertStates.WARNING),
+              group,
+            })
           )
           .join('\n');
         /*
@@ -181,7 +182,7 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
         if (nextState === AlertStates.NO_DATA) {
           reason = alertResults
             .filter((result) => result[group].isNoData)
-            .map((result) => buildNoDataAlertReason(result[group]))
+            .map((result) => buildNoDataAlertReason({ ...result[group], group }))
             .join('\n');
         } else if (nextState === AlertStates.ERROR) {
           reason = alertResults
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 59a8cdaab6413..aac0f651b8dee 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -13446,15 +13446,12 @@
     "xpack.infra.metrics.alerting.threshold.errorAlertReason": "{metric}のデータのクエリを試行しているときに、Elasticsearchが失敗しました",
     "xpack.infra.metrics.alerting.threshold.errorState": "エラー",
     "xpack.infra.metrics.alerting.threshold.fired": "アラート",
-    "xpack.infra.metrics.alerting.threshold.firedAlertReason": "{metric}は{comparator} {threshold}のしきい値です（現在の値は{currentValue}）",
     "xpack.infra.metrics.alerting.threshold.gtComparator": "より大きい",
     "xpack.infra.metrics.alerting.threshold.ltComparator": "より小さい",
-    "xpack.infra.metrics.alerting.threshold.noDataAlertReason": "{metric}は過去{interval}にデータを報告していません",
     "xpack.infra.metrics.alerting.threshold.noDataFormattedValue": "[データなし]",
     "xpack.infra.metrics.alerting.threshold.noDataState": "データなし",
     "xpack.infra.metrics.alerting.threshold.okState": "OK [回復済み]",
     "xpack.infra.metrics.alerting.threshold.outsideRangeComparator": "の間にない",
-    "xpack.infra.metrics.alerting.threshold.recoveredAlertReason": "{metric}は{comparator} {threshold}のしきい値です（現在の値は{currentValue}）",
     "xpack.infra.metrics.alerting.threshold.thresholdRange": "{a}と{b}",
     "xpack.infra.metrics.alerting.threshold.warning": "警告",
     "xpack.infra.metrics.alerting.threshold.warningState": "警告",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 4e901f51d54da..50d90f5144585 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -13634,15 +13634,12 @@
     "xpack.infra.metrics.alerting.threshold.errorAlertReason": "Elasticsearch 尝试查询 {metric} 的数据时出现故障",
     "xpack.infra.metrics.alerting.threshold.errorState": "错误",
     "xpack.infra.metrics.alerting.threshold.fired": "告警",
-    "xpack.infra.metrics.alerting.threshold.firedAlertReason": "{metric} {comparator}阈值 {threshold}（当前值为 {currentValue}）",
     "xpack.infra.metrics.alerting.threshold.gtComparator": "大于",
     "xpack.infra.metrics.alerting.threshold.ltComparator": "小于",
-    "xpack.infra.metrics.alerting.threshold.noDataAlertReason": "{metric} 在过去 {interval}中未报告数据",
     "xpack.infra.metrics.alerting.threshold.noDataFormattedValue": "[无数据]",
     "xpack.infra.metrics.alerting.threshold.noDataState": "无数据",
     "xpack.infra.metrics.alerting.threshold.okState": "正常 [已恢复]",
     "xpack.infra.metrics.alerting.threshold.outsideRangeComparator": "不介于",
-    "xpack.infra.metrics.alerting.threshold.recoveredAlertReason": "{metric} 现在{comparator}阈值 {threshold}（当前值为 {currentValue}）",
     "xpack.infra.metrics.alerting.threshold.thresholdRange": "{a} 和 {b}",
     "xpack.infra.metrics.alerting.threshold.warning": "警告",
     "xpack.infra.metrics.alerting.threshold.warningState": "警告",

From f9afe67f1e554cf3b295c4c43bf2b3f68c103120 Mon Sep 17 00:00:00 2001
From: Andrew Goldstein <andrew-goldstein@users.noreply.github.com>
Date: Tue, 19 Oct 2021 04:10:14 -0600
Subject: [PATCH 4/8] [Security Solution] Improves the formatting of array
 values and JSON in the Event and Alert Details panels (#115141)

## [Security Solution] Improves the formatting of array values and JSON in the Event and Alert Details panels

This PR improves the formatting of array values and JSON in the Event and Alert details panels by:

- in the `Table` tab, formatting array values such that each value appears on a separate line, (instead of joining the values on a single line)
- in the `JSON` tab, displaying the raw search hit JSON, instead displaying a JSON representation based on the `Fields` API

### Table value formatting

In the Event and Alert details `Table` tab, array values were joined on a single line, as shown in the _before_ screenshot below:

![event-details-value-formatting-before](https://user-images.githubusercontent.com/4459398/137524968-6450cd73-3154-457d-b850-32a3e7faaab2.png)

_Above: (before) array values were joined on a single line_

Array values are now formatted such that each value appears on a separate line, as shown in the _after_ screenshot below:

![event-details-value-formatting-after](https://user-images.githubusercontent.com/4459398/137436705-b0bec735-5a83-402e-843a-2776e1c80da9.png)

_Above: (after) array values each appear on a separte line_

### JSON formatting

The `JSON` tab previously displayed a JSON representation based on the `Fields` API. Array values were previously represented as a joined string, as shown in the _before_ screenshot below:

![event-details-json-formatting-before](https://user-images.githubusercontent.com/4459398/137525039-d1b14f21-5f9c-4201-905e-8b08f00bb5a0.png)

_Above: (before) array values were previously represented as a joined string_

The `JSON` tab now displays the raw search hit JSON, per the _after_ screenshot below:

![event-details-json-formatting-after](https://user-images.githubusercontent.com/4459398/137437257-330c5b49-a4ad-418e-a976-923f7a35c0cf.png)

_Above: (after) the `JSON` tab displays the raw search hit_

CC @monina-n @paulewing
---
 .../detection_alerts/alerts_details.spec.ts   |  20 +-
 .../detection_alerts/cti_enrichments.spec.ts  |  49 ++-
 .../cypress/screens/alerts_details.ts         |   2 +
 .../alert_summary_view.test.tsx.snap          | 120 ++++--
 .../__snapshots__/json_view.test.tsx.snap     | 343 ++++++++++++++++--
 .../event_details/event_details.test.tsx      |   3 +-
 .../event_details/event_details.tsx           |   6 +-
 .../event_details/json_view.test.tsx          |  49 +--
 .../components/event_details/json_view.tsx    |  23 +-
 .../table/field_value_cell.test.tsx           | 193 ++++++++++
 .../event_details/table/field_value_cell.tsx  |  26 +-
 .../public/common/mock/mock_detail_item.ts    | 188 ++++++++++
 .../event_details/expandable_event.tsx        |   3 +
 .../side_panel/event_details/index.tsx        |   4 +-
 .../timelines/containers/details/index.tsx    |   7 +-
 .../timeline/events/details/index.ts          |   1 +
 .../timeline/factory/events/details/index.ts  |   4 +
 17 files changed, 872 insertions(+), 169 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx

diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
index 674114188632b..7b792f8d560f1 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import { ALERT_FLYOUT, CELL_TEXT, JSON_LINES, TABLE_ROWS } from '../../screens/alerts_details';
+import { ALERT_FLYOUT, CELL_TEXT, JSON_TEXT, TABLE_ROWS } from '../../screens/alerts_details';
 
 import {
   expandFirstAlert,
   waitForAlertsIndexToBeCreated,
   waitForAlertsPanelToBeLoaded,
 } from '../../tasks/alerts';
-import { openJsonView, openTable, scrollJsonViewToBottom } from '../../tasks/alerts_details';
+import { openJsonView, openTable } from '../../tasks/alerts_details';
 import { createCustomRuleActivated } from '../../tasks/api_calls/rules';
 import { cleanKibana } from '../../tasks/common';
 import { esArchiverLoad } from '../../tasks/es_archiver';
@@ -36,20 +36,14 @@ describe('Alert details with unmapped fields', () => {
   });
 
   it('Displays the unmapped field on the JSON view', () => {
-    const expectedUnmappedField = { line: 2, text: '  "unmapped": "This is the unmapped field"' };
+    const expectedUnmappedValue = 'This is the unmapped field';
 
     openJsonView();
-    scrollJsonViewToBottom();
 
-    cy.get(ALERT_FLYOUT)
-      .find(JSON_LINES)
-      .then((elements) => {
-        const length = elements.length;
-        cy.wrap(elements)
-          .eq(length - expectedUnmappedField.line)
-          .invoke('text')
-          .should('include', expectedUnmappedField.text);
-      });
+    cy.get(JSON_TEXT).then((x) => {
+      const parsed = JSON.parse(x.text());
+      expect(parsed._source.unmapped).to.equal(expectedUnmappedValue);
+    });
   });
 
   it('Displays the unmapped field on the table', () => {
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
index b3c6abcd8e426..f15e7adbbca44 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
@@ -10,7 +10,7 @@ import { cleanKibana, reload } from '../../tasks/common';
 import { esArchiverLoad, esArchiverUnload } from '../../tasks/es_archiver';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import {
-  JSON_LINES,
+  JSON_TEXT,
   TABLE_CELL,
   TABLE_ROWS,
   THREAT_DETAILS_VIEW,
@@ -28,11 +28,7 @@ import {
   viewThreatIntelTab,
 } from '../../tasks/alerts';
 import { createCustomIndicatorRule } from '../../tasks/api_calls/rules';
-import {
-  openJsonView,
-  openThreatIndicatorDetails,
-  scrollJsonViewToBottom,
-} from '../../tasks/alerts_details';
+import { openJsonView, openThreatIndicatorDetails } from '../../tasks/alerts_details';
 
 import { ALERTS_URL } from '../../urls/navigation';
 import { addsFieldsToTimeline } from '../../tasks/rule_details';
@@ -76,26 +72,39 @@ describe('CTI Enrichment', () => {
 
   it('Displays persisted enrichments on the JSON view', () => {
     const expectedEnrichment = [
-      { line: 4, text: '  "threat": {' },
       {
-        line: 3,
-        text: '    "enrichments": "{\\"indicator\\":{\\"first_seen\\":\\"2021-03-10T08:02:14.000Z\\",\\"file\\":{\\"size\\":80280,\\"pe\\":{},\\"type\\":\\"elf\\",\\"hash\\":{\\"sha256\\":\\"a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3\\",\\"tlsh\\":\\"6D7312E017B517CC1371A8353BED205E9128223972AE35302E97528DF957703BAB2DBE\\",\\"ssdeep\\":\\"1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL\\",\\"md5\\":\\"9b6c3518a91d23ed77504b5416bfb5b3\\"}},\\"type\\":\\"file\\"},\\"matched\\":{\\"atomic\\":\\"a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3\\",\\"field\\":\\"myhash.mysha256\\",\\"id\\":\\"84cf452c1e0375c3d4412cb550bd1783358468a3b3b777da4829d72c7d6fb74f\\",\\"index\\":\\"logs-ti_abusech.malware\\",\\"type\\":\\"indicator_match_rule\\"}}"',
+        indicator: {
+          first_seen: '2021-03-10T08:02:14.000Z',
+          file: {
+            size: 80280,
+            pe: {},
+            type: 'elf',
+            hash: {
+              sha256: 'a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3',
+              tlsh: '6D7312E017B517CC1371A8353BED205E9128223972AE35302E97528DF957703BAB2DBE',
+              ssdeep:
+                '1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL',
+              md5: '9b6c3518a91d23ed77504b5416bfb5b3',
+            },
+          },
+          type: 'file',
+        },
+        matched: {
+          atomic: 'a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3',
+          field: 'myhash.mysha256',
+          id: '84cf452c1e0375c3d4412cb550bd1783358468a3b3b777da4829d72c7d6fb74f',
+          index: 'logs-ti_abusech.malware',
+          type: 'indicator_match_rule',
+        },
       },
-      { line: 2, text: '  }' },
     ];
 
     expandFirstAlert();
     openJsonView();
-    scrollJsonViewToBottom();
-
-    cy.get(JSON_LINES).then((elements) => {
-      const length = elements.length;
-      expectedEnrichment.forEach((enrichment) => {
-        cy.wrap(elements)
-          .eq(length - enrichment.line)
-          .invoke('text')
-          .should('include', enrichment.text);
-      });
+
+    cy.get(JSON_TEXT).then((x) => {
+      const parsed = JSON.parse(x.text());
+      expect(parsed._source.threat.enrichments).to.deep.equal(expectedEnrichment);
     });
   });
 
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
index c740a669d059a..584fba05452f0 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
@@ -28,6 +28,8 @@ export const JSON_LINES = '.euiCodeBlock__line';
 
 export const JSON_VIEW_TAB = '[data-test-subj="jsonViewTab"]';
 
+export const JSON_TEXT = '[data-test-subj="jsonView"]';
+
 export const TABLE_CELL = '.euiTableRowCell';
 
 export const TABLE_TAB = '[data-test-subj="tableTab"]';
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
index d367c68586be1..930e1282ebca5 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
@@ -138,12 +138,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.status"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  open
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    open
+                  </div>
                 </div>
               </div>
               <div
@@ -204,10 +209,11 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-@timestamp"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor eui-textTruncate eui-alignMiddle"
@@ -274,12 +280,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  xxx
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    xxx
+                  </div>
                 </div>
               </div>
               <div
@@ -340,12 +351,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.severity"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  low
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    low
+                  </div>
                 </div>
               </div>
               <div
@@ -406,12 +422,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.risk_score"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  21
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    21
+                  </div>
                 </div>
               </div>
               <div
@@ -472,12 +493,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-host.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  windows-native
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    windows-native
+                  </div>
                 </div>
               </div>
               <div
@@ -538,12 +564,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-user.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  administrator
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    administrator
+                  </div>
                 </div>
               </div>
               <div
@@ -604,10 +635,11 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-source.ip"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor"
@@ -800,12 +832,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.status"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  open
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    open
+                  </div>
                 </div>
               </div>
               <div
@@ -866,10 +903,11 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-@timestamp"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor eui-textTruncate eui-alignMiddle"
@@ -936,12 +974,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  xxx
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    xxx
+                  </div>
                 </div>
               </div>
               <div
@@ -1002,12 +1045,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.severity"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  low
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    low
+                  </div>
                 </div>
               </div>
               <div
@@ -1068,12 +1116,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.risk_score"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  21
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    21
+                  </div>
                 </div>
               </div>
               <div
@@ -1134,12 +1187,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-host.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  windows-native
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    windows-native
+                  </div>
                 </div>
               </div>
               <div
@@ -1200,12 +1258,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-user.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  administrator
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    administrator
+                  </div>
                 </div>
               </div>
               <div
@@ -1266,10 +1329,11 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-source.ip"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor"
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
index d4e839c4bef77..a2e4971899dcc 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
@@ -10,40 +10,325 @@ exports[`JSON View rendering should match snapshot 1`] = `
     paddingSize="m"
   >
     {
-  "_id": "pEMaMmkBUV60JmNWmWVi",
-  "_index": "filebeat-8.0.0-2019.02.19-000001",
+  "_index": ".ds-logs-endpoint.events.network-default-2021.09.28-000001",
+  "_id": "TUWyf3wBFCFU0qRJTauW",
   "_score": 1,
-  "_type": "_doc",
-  "@timestamp": "2019-02-28T16:50:54.621Z",
-  "agent": {
-    "ephemeral_id": "9d391ef2-a734-4787-8891-67031178c641",
-    "hostname": "siem-kibana",
-    "id": "5de03d5f-52f3-482e-91d4-853c7de073c3",
-    "type": "filebeat",
-    "version": "8.0.0"
-  },
-  "cloud": {
-    "availability_zone": "projects/189716325846/zones/us-east1-b",
-    "instance": {
-      "id": "5412578377715150143",
-      "name": "siem-kibana"
+  "_source": {
+    "agent": {
+      "id": "2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624",
+      "type": "endpoint",
+      "version": "8.0.0-SNAPSHOT"
     },
-    "machine": {
-      "type": "projects/189716325846/machineTypes/n1-standard-1"
+    "process": {
+      "Ext": {
+        "ancestry": [
+          "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=",
+          "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA=="
+        ]
+      },
+      "name": "filebeat",
+      "pid": 22535,
+      "entity_id": "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=",
+      "executable": "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
     },
-    "project": {
-      "id": "elastic-beats"
+    "destination": {
+      "address": "127.0.0.1",
+      "port": 9200,
+      "ip": "127.0.0.1"
     },
-    "provider": "gce"
-  },
-  "destination": {
-    "bytes": 584,
-    "ip": "10.47.8.200",
-    "packets": 4,
-    "port": 902
+    "source": {
+      "address": "127.0.0.1",
+      "port": 54146,
+      "ip": "127.0.0.1"
+    },
+    "message": "Endpoint network event",
+    "network": {
+      "transport": "tcp",
+      "type": "ipv4"
+    },
+    "@timestamp": "2021-10-14T16:45:58.0310772Z",
+    "ecs": {
+      "version": "1.11.0"
+    },
+    "data_stream": {
+      "namespace": "default",
+      "type": "logs",
+      "dataset": "endpoint.events.network"
+    },
+    "elastic": {
+      "agent": {
+        "id": "12345"
+      }
+    },
+    "host": {
+      "hostname": "test-linux-1",
+      "os": {
+        "Ext": {
+          "variant": "Debian"
+        },
+        "kernel": "4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)",
+        "name": "Linux",
+        "family": "debian",
+        "type": "linux",
+        "version": "10",
+        "platform": "debian",
+        "full": "Debian 10"
+      },
+      "ip": [
+        "127.0.0.1",
+        "::1",
+        "10.1.2.3",
+        "2001:0DB8:AC10:FE01::"
+      ],
+      "name": "test-linux-1",
+      "id": "76ea303129f249aa7382338e4263eac1",
+      "mac": [
+        "aa:bb:cc:dd:ee:ff"
+      ],
+      "architecture": "x86_64"
+    },
+    "event": {
+      "agent_id_status": "verified",
+      "sequence": 44872,
+      "ingested": "2021-10-14T16:46:04Z",
+      "created": "2021-10-14T16:45:58.0310772Z",
+      "kind": "event",
+      "module": "endpoint",
+      "action": "connection_attempted",
+      "id": "MKPXftjGeHiQzUNj++++nn6R",
+      "category": [
+        "network"
+      ],
+      "type": [
+        "start"
+      ],
+      "dataset": "endpoint.events.network",
+      "outcome": "unknown"
+    },
+    "user": {
+      "Ext": {
+        "real": {
+          "name": "root",
+          "id": 0
+        }
+      },
+      "name": "root",
+      "id": 0
+    },
+    "group": {
+      "Ext": {
+        "real": {
+          "name": "root",
+          "id": 0
+        }
+      },
+      "name": "root",
+      "id": 0
+    }
   },
-  "event": {
-    "kind": "event"
+  "fields": {
+    "host.os.full.text": [
+      "Debian 10"
+    ],
+    "event.category": [
+      "network"
+    ],
+    "process.name.text": [
+      "filebeat"
+    ],
+    "host.os.name.text": [
+      "Linux"
+    ],
+    "host.os.full": [
+      "Debian 10"
+    ],
+    "host.hostname": [
+      "test-linux-1"
+    ],
+    "process.pid": [
+      22535
+    ],
+    "host.mac": [
+      "42:01:0a:c8:00:32"
+    ],
+    "elastic.agent.id": [
+      "abcdefg-f6d5-4ce6-915d-8f1f8f413624"
+    ],
+    "host.os.version": [
+      "10"
+    ],
+    "host.os.name": [
+      "Linux"
+    ],
+    "source.ip": [
+      "127.0.0.1"
+    ],
+    "destination.address": [
+      "127.0.0.1"
+    ],
+    "host.name": [
+      "test-linux-1"
+    ],
+    "event.agent_id_status": [
+      "verified"
+    ],
+    "event.kind": [
+      "event"
+    ],
+    "event.outcome": [
+      "unknown"
+    ],
+    "group.name": [
+      "root"
+    ],
+    "user.id": [
+      "0"
+    ],
+    "host.os.type": [
+      "linux"
+    ],
+    "process.Ext.ancestry": [
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=",
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA=="
+    ],
+    "user.Ext.real.id": [
+      "0"
+    ],
+    "data_stream.type": [
+      "logs"
+    ],
+    "host.architecture": [
+      "x86_64"
+    ],
+    "process.name": [
+      "filebeat"
+    ],
+    "agent.id": [
+      "2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624"
+    ],
+    "source.port": [
+      54146
+    ],
+    "ecs.version": [
+      "1.11.0"
+    ],
+    "event.created": [
+      "2021-10-14T16:45:58.031Z"
+    ],
+    "agent.version": [
+      "8.0.0-SNAPSHOT"
+    ],
+    "host.os.family": [
+      "debian"
+    ],
+    "destination.port": [
+      9200
+    ],
+    "group.id": [
+      "0"
+    ],
+    "user.name": [
+      "root"
+    ],
+    "source.address": [
+      "127.0.0.1"
+    ],
+    "process.entity_id": [
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA="
+    ],
+    "host.ip": [
+      "127.0.0.1",
+      "::1",
+      "10.1.2.3",
+      "2001:0DB8:AC10:FE01::"
+    ],
+    "process.executable.caseless": [
+      "/opt/elastic/agent/data/elastic-agent-058c40/install/filebeat-8.0.0-snapshot-linux-x86_64/filebeat"
+    ],
+    "event.sequence": [
+      44872
+    ],
+    "agent.type": [
+      "endpoint"
+    ],
+    "process.executable.text": [
+      "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
+    ],
+    "group.Ext.real.name": [
+      "root"
+    ],
+    "event.module": [
+      "endpoint"
+    ],
+    "host.os.kernel": [
+      "4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)"
+    ],
+    "host.os.full.caseless": [
+      "debian 10"
+    ],
+    "host.id": [
+      "76ea303129f249aa7382338e4263eac1"
+    ],
+    "process.name.caseless": [
+      "filebeat"
+    ],
+    "network.type": [
+      "ipv4"
+    ],
+    "process.executable": [
+      "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
+    ],
+    "user.Ext.real.name": [
+      "root"
+    ],
+    "data_stream.namespace": [
+      "default"
+    ],
+    "message": [
+      "Endpoint network event"
+    ],
+    "destination.ip": [
+      "127.0.0.1"
+    ],
+    "network.transport": [
+      "tcp"
+    ],
+    "host.os.Ext.variant": [
+      "Debian"
+    ],
+    "group.Ext.real.id": [
+      "0"
+    ],
+    "event.ingested": [
+      "2021-10-14T16:46:04.000Z"
+    ],
+    "event.action": [
+      "connection_attempted"
+    ],
+    "@timestamp": [
+      "2021-10-14T16:45:58.031Z"
+    ],
+    "host.os.platform": [
+      "debian"
+    ],
+    "data_stream.dataset": [
+      "endpoint.events.network"
+    ],
+    "event.type": [
+      "start"
+    ],
+    "event.id": [
+      "MKPXftjGeHiQzUNj++++nn6R"
+    ],
+    "host.os.name.caseless": [
+      "linux"
+    ],
+    "event.dataset": [
+      "endpoint.events.network"
+    ],
+    "user.name.text": [
+      "root"
+    ]
   }
 }
   </EuiCodeBlock>
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
index a8ba536a75541..37ca3b0b897a6 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
@@ -11,7 +11,7 @@ import React from 'react';
 
 import '../../mock/match_media';
 import '../../mock/react_beautiful_dnd';
-import { mockDetailItemData, mockDetailItemDataId, TestProviders } from '../../mock';
+import { mockDetailItemData, mockDetailItemDataId, rawEventData, TestProviders } from '../../mock';
 
 import { EventDetails, EventsViewType } from './event_details';
 import { mockBrowserFields } from '../../containers/source/mock';
@@ -48,6 +48,7 @@ describe('EventDetails', () => {
     timelineId: 'test',
     eventView: EventsViewType.summaryView,
     hostRisk: { fields: [], loading: true },
+    rawEventData,
   };
 
   const alertsProps = {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
index e7092d9d6f466..a8305a635f157 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
@@ -61,6 +61,7 @@ interface Props {
   id: string;
   isAlert: boolean;
   isDraggable?: boolean;
+  rawEventData: object | undefined;
   timelineTabType: TimelineTabs | 'flyout';
   timelineId: string;
   hostRisk: HostRisk | null;
@@ -106,6 +107,7 @@ const EventDetailsComponent: React.FC<Props> = ({
   id,
   isAlert,
   isDraggable,
+  rawEventData,
   timelineId,
   timelineTabType,
   hostRisk,
@@ -278,12 +280,12 @@ const EventDetailsComponent: React.FC<Props> = ({
         <>
           <EuiSpacer size="m" />
           <TabContentWrapper data-test-subj="jsonViewWrapper">
-            <JsonView data={data} />
+            <JsonView rawEventData={rawEventData} />
           </TabContentWrapper>
         </>
       ),
     }),
-    [data]
+    [rawEventData]
   );
 
   const tabs = useMemo(() => {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
index 696fac6016603..b20270266602d 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
@@ -8,58 +8,15 @@
 import { shallow } from 'enzyme';
 import React from 'react';
 
-import { mockDetailItemData } from '../../mock';
+import { rawEventData } from '../../mock';
 
-import { buildJsonView, JsonView } from './json_view';
+import { JsonView } from './json_view';
 
 describe('JSON View', () => {
   describe('rendering', () => {
     test('should match snapshot', () => {
-      const wrapper = shallow(<JsonView data={mockDetailItemData} />);
+      const wrapper = shallow(<JsonView rawEventData={rawEventData} />);
       expect(wrapper).toMatchSnapshot();
     });
   });
-
-  describe('buildJsonView', () => {
-    test('should match a json', () => {
-      const expectedData = {
-        '@timestamp': '2019-02-28T16:50:54.621Z',
-        _id: 'pEMaMmkBUV60JmNWmWVi',
-        _index: 'filebeat-8.0.0-2019.02.19-000001',
-        _score: 1,
-        _type: '_doc',
-        agent: {
-          ephemeral_id: '9d391ef2-a734-4787-8891-67031178c641',
-          hostname: 'siem-kibana',
-          id: '5de03d5f-52f3-482e-91d4-853c7de073c3',
-          type: 'filebeat',
-          version: '8.0.0',
-        },
-        cloud: {
-          availability_zone: 'projects/189716325846/zones/us-east1-b',
-          instance: {
-            id: '5412578377715150143',
-            name: 'siem-kibana',
-          },
-          machine: {
-            type: 'projects/189716325846/machineTypes/n1-standard-1',
-          },
-          project: {
-            id: 'elastic-beats',
-          },
-          provider: 'gce',
-        },
-        destination: {
-          bytes: 584,
-          ip: '10.47.8.200',
-          packets: 4,
-          port: 902,
-        },
-        event: {
-          kind: 'event',
-        },
-      };
-      expect(buildJsonView(mockDetailItemData)).toEqual(expectedData);
-    });
-  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
index 0614f131bcd10..0227d44f32305 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
@@ -6,15 +6,13 @@
  */
 
 import { EuiCodeBlock } from '@elastic/eui';
-import { set } from '@elastic/safer-lodash-set/fp';
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
-import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
 import { omitTypenameAndEmpty } from '../../../timelines/components/timeline/body/helpers';
 
 interface Props {
-  data: TimelineEventsDetailsItem[];
+  rawEventData: object | undefined;
 }
 
 const EuiCodeEditorContainer = styled.div`
@@ -23,15 +21,15 @@ const EuiCodeEditorContainer = styled.div`
   }
 `;
 
-export const JsonView = React.memo<Props>(({ data }) => {
+export const JsonView = React.memo<Props>(({ rawEventData }) => {
   const value = useMemo(
     () =>
       JSON.stringify(
-        buildJsonView(data),
+        rawEventData,
         omitTypenameAndEmpty,
         2 // indent level
       ),
-    [data]
+    [rawEventData]
   );
 
   return (
@@ -50,16 +48,3 @@ export const JsonView = React.memo<Props>(({ data }) => {
 });
 
 JsonView.displayName = 'JsonView';
-
-export const buildJsonView = (data: TimelineEventsDetailsItem[]) =>
-  data
-    .sort((a, b) => a.field.localeCompare(b.field))
-    .reduce(
-      (accumulator, item) =>
-        set(
-          item.field,
-          Array.isArray(item.originalValue) ? item.originalValue.join() : item.originalValue,
-          accumulator
-        ),
-      {}
-    );
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
new file mode 100644
index 0000000000000..f6c43da2da8ac
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
@@ -0,0 +1,193 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { render, screen } from '@testing-library/react';
+import React from 'react';
+
+import { BrowserField } from '../../../containers/source';
+import { FieldValueCell } from './field_value_cell';
+import { TestProviders } from '../../../mock';
+import { EventFieldsData } from '../types';
+
+const contextId = 'test';
+
+const eventId = 'TUWyf3wBFCFU0qRJTauW';
+
+const hostIpData: EventFieldsData = {
+  aggregatable: true,
+  ariaRowindex: 35,
+  category: 'host',
+  description: 'Host ip addresses.',
+  example: '127.0.0.1',
+  field: 'host.ip',
+  fields: {},
+  format: '',
+  indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+  isObjectArray: false,
+  name: 'host.ip',
+  originalValue: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+  searchable: true,
+  type: 'ip',
+  values: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+};
+const hostIpValues = ['127.0.0.1', '::1', '10.1.2.3', 'fe80::4001:aff:fec8:32'];
+
+describe('FieldValueCell', () => {
+  describe('common behavior', () => {
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it formats multiple values such that each value is displayed on a single line', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`)).toHaveClass(
+        'euiFlexGroup--directionColumn'
+      );
+    });
+  });
+
+  describe('when `BrowserField` metadata is NOT available', () => {
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            fieldFromBrowserField={undefined} // <-- no metadata
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders each of the expected values when `fieldFromBrowserField` is undefined', () => {
+      hostIpValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+
+    test('it renders values formatted as plain text (without `eventFieldsTable__fieldValue` formatting)', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`).firstChild).not.toHaveClass(
+        'eventFieldsTable__fieldValue'
+      );
+    });
+  });
+
+  describe('`message` field formatting', () => {
+    const messageData: EventFieldsData = {
+      aggregatable: false,
+      ariaRowindex: 50,
+      category: 'base',
+      description:
+        'For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.',
+      example: 'Hello World',
+      field: 'message',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      isObjectArray: false,
+      name: 'message',
+      originalValue: ['Endpoint network event'],
+      searchable: true,
+      type: 'string',
+      values: ['Endpoint network event'],
+    };
+    const messageValues = ['Endpoint network event'];
+
+    const messageFieldFromBrowserField: BrowserField = {
+      aggregatable: false,
+      category: 'base',
+      description:
+        'For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.',
+      example: 'Hello World',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      name: 'message',
+      searchable: true,
+      type: 'string',
+    };
+
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={messageData}
+            eventId={eventId}
+            fieldFromBrowserField={messageFieldFromBrowserField}
+            values={messageValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders special formatting for the `message` field', () => {
+      expect(screen.getByTestId('event-field-message')).toBeInTheDocument();
+    });
+
+    test('it renders the expected message value', () => {
+      messageValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('when `BrowserField` metadata IS available', () => {
+    const hostIpFieldFromBrowserField: BrowserField = {
+      aggregatable: true,
+      category: 'host',
+      description: 'Host ip addresses.',
+      example: '127.0.0.1',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      name: 'host.ip',
+      searchable: true,
+      type: 'ip',
+    };
+
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            fieldFromBrowserField={hostIpFieldFromBrowserField} // <-- metadata
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders values formatted with the expected class', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`).firstChild).toHaveClass(
+        'eventFieldsTable__fieldValue'
+      );
+    });
+
+    test('it renders link buttons for each of the host ip addresses', () => {
+      expect(screen.getAllByRole('button').length).toBe(hostIpValues.length);
+    });
+
+    test('it renders each of the expected values when `fieldFromBrowserField` is provided', () => {
+      hostIpValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
index fc20f84d3650d..dc6c84b8138fe 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
@@ -6,7 +6,7 @@
  */
 
 import React from 'react';
-import { EuiText } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
 import { BrowserField } from '../../../containers/source';
 import { OverflowField } from '../../tables/helpers';
 import { FormattedFieldValue } from '../../../../timelines/components/timeline/body/renderers/formatted_field';
@@ -36,18 +36,28 @@ export const FieldValueCell = React.memo(
     values,
   }: FieldValueCellProps) => {
     return (
-      <div data-test-subj={`event-field-${data.field}`}>
+      <EuiFlexGroup
+        data-test-subj={`event-field-${data.field}`}
+        direction="column"
+        gutterSize="none"
+      >
         {values != null &&
           values.map((value, i) => {
             if (fieldFromBrowserField == null) {
               return (
-                <EuiText size="xs" key={value}>
-                  {value}
-                </EuiText>
+                <EuiFlexItem grow={false} key={`${i}-${value}`}>
+                  <EuiText size="xs" key={`${i}-${value}`}>
+                    {value}
+                  </EuiText>
+                </EuiFlexItem>
               );
             }
             return (
-              <div className="eventFieldsTable__fieldValue" key={value}>
+              <EuiFlexItem
+                className="eventFieldsTable__fieldValue"
+                grow={false}
+                key={`${i}-${value}`}
+              >
                 {data.field === MESSAGE_FIELD_NAME ? (
                   <OverflowField value={value} />
                 ) : (
@@ -63,10 +73,10 @@ export const FieldValueCell = React.memo(
                     linkValue={(getLinkValue && getLinkValue(data.field)) ?? linkValue}
                   />
                 )}
-              </div>
+              </EuiFlexItem>
             );
           })}
-      </div>
+      </EuiFlexGroup>
     );
   }
 );
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts b/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
index 3712d389edeb1..035bdbbceff88 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
@@ -139,3 +139,191 @@ export const generateMockDetailItemData = (): TimelineEventsDetailsItem[] => [
 ];
 
 export const mockDetailItemData: TimelineEventsDetailsItem[] = generateMockDetailItemData();
+
+export const rawEventData = {
+  _index: '.ds-logs-endpoint.events.network-default-2021.09.28-000001',
+  _id: 'TUWyf3wBFCFU0qRJTauW',
+  _score: 1,
+  _source: {
+    agent: {
+      id: '2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624',
+      type: 'endpoint',
+      version: '8.0.0-SNAPSHOT',
+    },
+    process: {
+      Ext: {
+        ancestry: [
+          'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=',
+          'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA==',
+        ],
+      },
+      name: 'filebeat',
+      pid: 22535,
+      entity_id: 'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=',
+      executable:
+        '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    },
+    destination: {
+      address: '127.0.0.1',
+      port: 9200,
+      ip: '127.0.0.1',
+    },
+    source: {
+      address: '127.0.0.1',
+      port: 54146,
+      ip: '127.0.0.1',
+    },
+    message: 'Endpoint network event',
+    network: {
+      transport: 'tcp',
+      type: 'ipv4',
+    },
+    '@timestamp': '2021-10-14T16:45:58.0310772Z',
+    ecs: {
+      version: '1.11.0',
+    },
+    data_stream: {
+      namespace: 'default',
+      type: 'logs',
+      dataset: 'endpoint.events.network',
+    },
+    elastic: {
+      agent: {
+        id: '12345',
+      },
+    },
+    host: {
+      hostname: 'test-linux-1',
+      os: {
+        Ext: {
+          variant: 'Debian',
+        },
+        kernel: '4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)',
+        name: 'Linux',
+        family: 'debian',
+        type: 'linux',
+        version: '10',
+        platform: 'debian',
+        full: 'Debian 10',
+      },
+      ip: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+      name: 'test-linux-1',
+      id: '76ea303129f249aa7382338e4263eac1',
+      mac: ['aa:bb:cc:dd:ee:ff'],
+      architecture: 'x86_64',
+    },
+    event: {
+      agent_id_status: 'verified',
+      sequence: 44872,
+      ingested: '2021-10-14T16:46:04Z',
+      created: '2021-10-14T16:45:58.0310772Z',
+      kind: 'event',
+      module: 'endpoint',
+      action: 'connection_attempted',
+      id: 'MKPXftjGeHiQzUNj++++nn6R',
+      category: ['network'],
+      type: ['start'],
+      dataset: 'endpoint.events.network',
+      outcome: 'unknown',
+    },
+    user: {
+      Ext: {
+        real: {
+          name: 'root',
+          id: 0,
+        },
+      },
+      name: 'root',
+      id: 0,
+    },
+    group: {
+      Ext: {
+        real: {
+          name: 'root',
+          id: 0,
+        },
+      },
+      name: 'root',
+      id: 0,
+    },
+  },
+  fields: {
+    'host.os.full.text': ['Debian 10'],
+    'event.category': ['network'],
+    'process.name.text': ['filebeat'],
+    'host.os.name.text': ['Linux'],
+    'host.os.full': ['Debian 10'],
+    'host.hostname': ['test-linux-1'],
+    'process.pid': [22535],
+    'host.mac': ['42:01:0a:c8:00:32'],
+    'elastic.agent.id': ['abcdefg-f6d5-4ce6-915d-8f1f8f413624'],
+    'host.os.version': ['10'],
+    'host.os.name': ['Linux'],
+    'source.ip': ['127.0.0.1'],
+    'destination.address': ['127.0.0.1'],
+    'host.name': ['test-linux-1'],
+    'event.agent_id_status': ['verified'],
+    'event.kind': ['event'],
+    'event.outcome': ['unknown'],
+    'group.name': ['root'],
+    'user.id': ['0'],
+    'host.os.type': ['linux'],
+    'process.Ext.ancestry': [
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=',
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA==',
+    ],
+    'user.Ext.real.id': ['0'],
+    'data_stream.type': ['logs'],
+    'host.architecture': ['x86_64'],
+    'process.name': ['filebeat'],
+    'agent.id': ['2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624'],
+    'source.port': [54146],
+    'ecs.version': ['1.11.0'],
+    'event.created': ['2021-10-14T16:45:58.031Z'],
+    'agent.version': ['8.0.0-SNAPSHOT'],
+    'host.os.family': ['debian'],
+    'destination.port': [9200],
+    'group.id': ['0'],
+    'user.name': ['root'],
+    'source.address': ['127.0.0.1'],
+    'process.entity_id': [
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=',
+    ],
+    'host.ip': ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+    'process.executable.caseless': [
+      '/opt/elastic/agent/data/elastic-agent-058c40/install/filebeat-8.0.0-snapshot-linux-x86_64/filebeat',
+    ],
+    'event.sequence': [44872],
+    'agent.type': ['endpoint'],
+    'process.executable.text': [
+      '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    ],
+    'group.Ext.real.name': ['root'],
+    'event.module': ['endpoint'],
+    'host.os.kernel': ['4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)'],
+    'host.os.full.caseless': ['debian 10'],
+    'host.id': ['76ea303129f249aa7382338e4263eac1'],
+    'process.name.caseless': ['filebeat'],
+    'network.type': ['ipv4'],
+    'process.executable': [
+      '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    ],
+    'user.Ext.real.name': ['root'],
+    'data_stream.namespace': ['default'],
+    message: ['Endpoint network event'],
+    'destination.ip': ['127.0.0.1'],
+    'network.transport': ['tcp'],
+    'host.os.Ext.variant': ['Debian'],
+    'group.Ext.real.id': ['0'],
+    'event.ingested': ['2021-10-14T16:46:04.000Z'],
+    'event.action': ['connection_attempted'],
+    '@timestamp': ['2021-10-14T16:45:58.031Z'],
+    'host.os.platform': ['debian'],
+    'data_stream.dataset': ['endpoint.events.network'],
+    'event.type': ['start'],
+    'event.id': ['MKPXftjGeHiQzUNj++++nn6R'],
+    'host.os.name.caseless': ['linux'],
+    'event.dataset': ['endpoint.events.network'],
+    'user.name.text': ['root'],
+  },
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
index 17d43d80a5a9a..6a7f0602c3675 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
@@ -33,6 +33,7 @@ interface Props {
   isDraggable?: boolean;
   loading: boolean;
   messageHeight?: number;
+  rawEventData: object | undefined;
   timelineTabType: TimelineTabs | 'flyout';
   timelineId: string;
   hostRisk: HostRisk | null;
@@ -93,6 +94,7 @@ export const ExpandableEvent = React.memo<Props>(
     loading,
     detailsData,
     hostRisk,
+    rawEventData,
   }) => {
     if (!event.eventId) {
       return <EuiTextColor color="subdued">{i18n.EVENT_DETAILS_PLACEHOLDER}</EuiTextColor>;
@@ -111,6 +113,7 @@ export const ExpandableEvent = React.memo<Props>(
             id={event.eventId}
             isAlert={isAlert}
             isDraggable={isDraggable}
+            rawEventData={rawEventData}
             timelineId={timelineId}
             timelineTabType={timelineTabType}
             hostRisk={hostRisk}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
index f8786e0706834..b9d7e0a8c024f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
@@ -79,7 +79,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
   tabType,
   timelineId,
 }) => {
-  const [loading, detailsData] = useTimelineEventsDetails({
+  const [loading, detailsData, rawEventData] = useTimelineEventsDetails({
     docValueFields,
     entityType,
     indexName: expandedEvent.indexName ?? '',
@@ -195,6 +195,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
             isAlert={isAlert}
             isDraggable={isDraggable}
             loading={loading}
+            rawEventData={rawEventData}
             timelineId={timelineId}
             timelineTabType="flyout"
             hostRisk={hostRisk}
@@ -228,6 +229,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
         isAlert={isAlert}
         isDraggable={isDraggable}
         loading={loading}
+        rawEventData={rawEventData}
         timelineId={timelineId}
         timelineTabType={tabType}
         hostRisk={hostRisk}
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
index e59eaeed4f2a6..f05966bd97870 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
@@ -42,7 +42,7 @@ export const useTimelineEventsDetails = ({
   indexName,
   eventId,
   skip,
-}: UseTimelineEventsDetailsProps): [boolean, EventsArgs['detailsData']] => {
+}: UseTimelineEventsDetailsProps): [boolean, EventsArgs['detailsData'], object | undefined] => {
   const { data } = useKibana().services;
   const refetch = useRef<inputsModel.Refetch>(noop);
   const abortCtrl = useRef(new AbortController());
@@ -55,6 +55,8 @@ export const useTimelineEventsDetails = ({
   const [timelineDetailsResponse, setTimelineDetailsResponse] =
     useState<EventsArgs['detailsData']>(null);
 
+  const [rawEventData, setRawEventData] = useState<object | undefined>(undefined);
+
   const timelineDetailsSearch = useCallback(
     (request: TimelineEventsDetailsRequestOptions | null) => {
       if (request == null || skip || isEmpty(request.eventId)) {
@@ -78,6 +80,7 @@ export const useTimelineEventsDetails = ({
               if (isCompleteResponse(response)) {
                 setLoading(false);
                 setTimelineDetailsResponse(response.data || []);
+                setRawEventData(response.rawResponse.hits.hits[0]);
                 searchSubscription$.current.unsubscribe();
               } else if (isErrorResponse(response)) {
                 setLoading(false);
@@ -125,5 +128,5 @@ export const useTimelineEventsDetails = ({
     };
   }, [timelineDetailsRequest, timelineDetailsSearch]);
 
-  return [loading, timelineDetailsResponse];
+  return [loading, timelineDetailsResponse, rawEventData];
 };
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
index 5bceb31081687..f9f6a2ea57917 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
@@ -24,6 +24,7 @@ export interface TimelineEventsDetailsItem {
 export interface TimelineEventsDetailsStrategyResponse extends IEsSearchResponse {
   data?: Maybe<TimelineEventsDetailsItem[]>;
   inspect?: Maybe<Inspect>;
+  rawEventData?: Maybe<object>;
 }
 
 export interface TimelineEventsDetailsRequestOptions
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
index c82d9af938a98..b60add2515ec9 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
@@ -57,10 +57,14 @@ export const timelineEventsDetails: TimelineFactory<TimelineEventsQueries.detail
     );
 
     const data = unionBy('field', fieldsData, sourceData);
+
+    const rawEventData = response.rawResponse.hits.hits[0];
+
     return {
       ...response,
       data,
       inspect,
+      rawEventData,
     };
   },
 };

From 5974fcfdb55ba12e2b90ebdd911004b271343fed Mon Sep 17 00:00:00 2001
From: Josh Dover <1813008+joshdover@users.noreply.github.com>
Date: Tue, 19 Oct 2021 12:14:57 +0200
Subject: [PATCH 5/8] Allow elastic/fleet-server to call appropriate Fleet APIs
 (#113932)

---
 x-pack/plugins/fleet/server/mocks/index.ts    |  12 +-
 x-pack/plugins/fleet/server/plugin.ts         |  55 ++++--
 .../fleet/server/routes/agent_policy/index.ts |  27 +--
 .../routes/enrollment_api_key/handler.ts      |   6 +-
 .../server/routes/enrollment_api_key/index.ts |  21 ++-
 .../plugins/fleet/server/routes/epm/index.ts  |  39 ++--
 .../fleet/server/routes/security.test.ts      | 175 ++++++++++++++++++
 .../plugins/fleet/server/routes/security.ts   | 135 +++++++++++---
 .../fleet/server/routes/setup/handlers.ts     |   8 +-
 .../fleet/server/routes/setup/index.ts        |  21 +--
 .../fleet/server/types/request_context.ts     |   7 +
 .../authorization/check_privileges.test.ts    | 108 +++++++++++
 .../server/authorization/check_privileges.ts  |  31 +++-
 .../check_privileges_dynamically.test.ts      |  22 ++-
 .../check_privileges_dynamically.ts           |  14 +-
 .../security/server/authorization/types.ts    |  26 ++-
 .../apis/security/privileges.ts               |   2 +-
 .../apis/security/privileges_basic.ts         |   2 +-
 .../apis/agents/services.ts                   |  26 ++-
 .../fleet_api_integration/apis/epm/setup.ts   |  45 +++++
 20 files changed, 651 insertions(+), 131 deletions(-)
 create mode 100644 x-pack/plugins/fleet/server/routes/security.test.ts

diff --git a/x-pack/plugins/fleet/server/mocks/index.ts b/x-pack/plugins/fleet/server/mocks/index.ts
index c7f6b6fefc414..e6577426974a3 100644
--- a/x-pack/plugins/fleet/server/mocks/index.ts
+++ b/x-pack/plugins/fleet/server/mocks/index.ts
@@ -23,7 +23,17 @@ import type { FleetAppContext } from '../plugin';
 // Export all mocks from artifacts
 export * from '../services/artifacts/mocks';
 
-export const createAppContextStartContractMock = (): FleetAppContext => {
+export interface MockedFleetAppContext extends FleetAppContext {
+  elasticsearch: ReturnType<typeof elasticsearchServiceMock.createStart>;
+  data: ReturnType<typeof dataPluginMock.createStartContract>;
+  encryptedSavedObjectsStart?: ReturnType<typeof encryptedSavedObjectsMock.createStart>;
+  savedObjects: ReturnType<typeof savedObjectsServiceMock.createStartContract>;
+  securitySetup?: ReturnType<typeof securityMock.createSetup>;
+  securityStart?: ReturnType<typeof securityMock.createStart>;
+  logger: ReturnType<ReturnType<typeof loggingSystemMock.create>['get']>;
+}
+
+export const createAppContextStartContractMock = (): MockedFleetAppContext => {
   const config = {
     agents: { enabled: true, elasticsearch: {} },
     enabled: true,
diff --git a/x-pack/plugins/fleet/server/plugin.ts b/x-pack/plugins/fleet/server/plugin.ts
index aaee24b39685a..8a95065380b69 100644
--- a/x-pack/plugins/fleet/server/plugin.ts
+++ b/x-pack/plugins/fleet/server/plugin.ts
@@ -80,9 +80,10 @@ import {
 } from './services/agents';
 import { registerFleetUsageCollector } from './collectors/register';
 import { getInstallation, ensureInstalledPackage } from './services/epm/packages';
-import { makeRouterEnforcingSuperuser } from './routes/security';
+import { RouterWrappers } from './routes/security';
 import { startFleetServerSetup } from './services/fleet_server';
 import { FleetArtifactsClient } from './services/artifacts';
+import type { FleetRouter } from './types/request_context';
 
 export interface FleetSetupDeps {
   licensing: LicensingPluginSetup;
@@ -206,6 +207,24 @@ export class FleetPlugin
         category: DEFAULT_APP_CATEGORIES.management,
         app: [PLUGIN_ID, INTEGRATIONS_PLUGIN_ID, 'kibana'],
         catalogue: ['fleet'],
+        reserved: {
+          description:
+            'Privilege to setup Fleet packages and configured policies. Intended for use by the elastic/fleet-server service account only.',
+          privileges: [
+            {
+              id: 'fleet-setup',
+              privilege: {
+                excludeFromBasePrivileges: true,
+                api: ['fleet-setup'],
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: [],
+              },
+            },
+          ],
+        },
         privileges: {
           all: {
             api: [`${PLUGIN_ID}-read`, `${PLUGIN_ID}-all`],
@@ -245,7 +264,7 @@ export class FleetPlugin
       })
     );
 
-    const router = core.http.createRouter<FleetRequestHandlerContext>();
+    const router: FleetRouter = core.http.createRouter<FleetRequestHandlerContext>();
 
     // Register usage collection
     registerFleetUsageCollector(core, config, deps.usageCollection);
@@ -254,24 +273,34 @@ export class FleetPlugin
     registerAppRoutes(router);
     // Allow read-only users access to endpoints necessary for Integrations UI
     // Only some endpoints require superuser so we pass a raw IRouter here
-    registerEPMRoutes(router);
 
     // For all the routes we enforce the user to have role superuser
-    const routerSuperuserOnly = makeRouterEnforcingSuperuser(router);
+    const superuserRouter = RouterWrappers.require.superuser(router);
+    const fleetSetupRouter = RouterWrappers.require.fleetSetupPrivilege(router);
+
+    // Some EPM routes use regular rbac to support integrations app
+    registerEPMRoutes({ rbac: router, superuser: superuserRouter });
+
     // Register rest of routes only if security is enabled
     if (deps.security) {
-      registerSetupRoutes(routerSuperuserOnly, config);
-      registerAgentPolicyRoutes(routerSuperuserOnly);
-      registerPackagePolicyRoutes(routerSuperuserOnly);
-      registerOutputRoutes(routerSuperuserOnly);
-      registerSettingsRoutes(routerSuperuserOnly);
-      registerDataStreamRoutes(routerSuperuserOnly);
-      registerPreconfigurationRoutes(routerSuperuserOnly);
+      registerSetupRoutes(fleetSetupRouter, config);
+      registerAgentPolicyRoutes({
+        fleetSetup: fleetSetupRouter,
+        superuser: superuserRouter,
+      });
+      registerPackagePolicyRoutes(superuserRouter);
+      registerOutputRoutes(superuserRouter);
+      registerSettingsRoutes(superuserRouter);
+      registerDataStreamRoutes(superuserRouter);
+      registerPreconfigurationRoutes(superuserRouter);
 
       // Conditional config routes
       if (config.agents.enabled) {
-        registerAgentAPIRoutes(routerSuperuserOnly, config);
-        registerEnrollmentApiKeyRoutes(routerSuperuserOnly);
+        registerAgentAPIRoutes(superuserRouter, config);
+        registerEnrollmentApiKeyRoutes({
+          fleetSetup: fleetSetupRouter,
+          superuser: superuserRouter,
+        });
       }
     }
   }
diff --git a/x-pack/plugins/fleet/server/routes/agent_policy/index.ts b/x-pack/plugins/fleet/server/routes/agent_policy/index.ts
index a66a9ab9cadc7..4c20358e15085 100644
--- a/x-pack/plugins/fleet/server/routes/agent_policy/index.ts
+++ b/x-pack/plugins/fleet/server/routes/agent_policy/index.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, AGENT_POLICY_API_ROUTES } from '../../constants';
 import {
   GetAgentPoliciesRequestSchema,
@@ -17,6 +15,7 @@ import {
   DeleteAgentPolicyRequestSchema,
   GetFullAgentPolicyRequestSchema,
 } from '../../types';
+import type { FleetRouter } from '../../types/request_context';
 
 import {
   getAgentPoliciesHandler,
@@ -29,19 +28,21 @@ import {
   downloadFullAgentPolicy,
 } from './handlers';
 
-export const registerRoutes = (router: IRouter) => {
-  // List
-  router.get(
+export const registerRoutes = (routers: { superuser: FleetRouter; fleetSetup: FleetRouter }) => {
+  // List - Fleet Server needs access to run setup
+  routers.fleetSetup.get(
     {
       path: AGENT_POLICY_API_ROUTES.LIST_PATTERN,
       validate: GetAgentPoliciesRequestSchema,
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
+      // options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getAgentPoliciesHandler
   );
 
   // Get one
-  router.get(
+  routers.superuser.get(
     {
       path: AGENT_POLICY_API_ROUTES.INFO_PATTERN,
       validate: GetOneAgentPolicyRequestSchema,
@@ -51,7 +52,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Create
-  router.post(
+  routers.superuser.post(
     {
       path: AGENT_POLICY_API_ROUTES.CREATE_PATTERN,
       validate: CreateAgentPolicyRequestSchema,
@@ -61,7 +62,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Update
-  router.put(
+  routers.superuser.put(
     {
       path: AGENT_POLICY_API_ROUTES.UPDATE_PATTERN,
       validate: UpdateAgentPolicyRequestSchema,
@@ -71,7 +72,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Copy
-  router.post(
+  routers.superuser.post(
     {
       path: AGENT_POLICY_API_ROUTES.COPY_PATTERN,
       validate: CopyAgentPolicyRequestSchema,
@@ -81,7 +82,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Delete
-  router.post(
+  routers.superuser.post(
     {
       path: AGENT_POLICY_API_ROUTES.DELETE_PATTERN,
       validate: DeleteAgentPolicyRequestSchema,
@@ -91,7 +92,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Get one full agent policy
-  router.get(
+  routers.superuser.get(
     {
       path: AGENT_POLICY_API_ROUTES.FULL_INFO_PATTERN,
       validate: GetFullAgentPolicyRequestSchema,
@@ -101,7 +102,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Download one full agent policy
-  router.get(
+  routers.superuser.get(
     {
       path: AGENT_POLICY_API_ROUTES.FULL_INFO_DOWNLOAD_PATTERN,
       validate: GetFullAgentPolicyRequestSchema,
diff --git a/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts b/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts
index 0959a9a88704a..9cb07a9050f83 100644
--- a/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts
+++ b/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts
@@ -27,7 +27,8 @@ export const getEnrollmentApiKeysHandler: RequestHandler<
   undefined,
   TypeOf<typeof GetEnrollmentAPIKeysRequestSchema.query>
 > = async (context, request, response) => {
-  const esClient = context.core.elasticsearch.client.asCurrentUser;
+  // Use kibana_system and depend on authz checks on HTTP layer to prevent abuse
+  const esClient = context.core.elasticsearch.client.asInternalUser;
 
   try {
     const { items, total, page, perPage } = await APIKeyService.listEnrollmentApiKeys(esClient, {
@@ -87,7 +88,8 @@ export const deleteEnrollmentApiKeyHandler: RequestHandler<
 export const getOneEnrollmentApiKeyHandler: RequestHandler<
   TypeOf<typeof GetOneEnrollmentAPIKeyRequestSchema.params>
 > = async (context, request, response) => {
-  const esClient = context.core.elasticsearch.client.asCurrentUser;
+  // Use kibana_system and depend on authz checks on HTTP layer to prevent abuse
+  const esClient = context.core.elasticsearch.client.asInternalUser;
   try {
     const apiKey = await APIKeyService.getEnrollmentAPIKey(esClient, request.params.keyId);
     const body: GetOneEnrollmentAPIKeyResponse = { item: apiKey };
diff --git a/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts b/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts
index b37a88e70e085..6429d4d29d5c9 100644
--- a/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts
+++ b/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, ENROLLMENT_API_KEY_ROUTES } from '../../constants';
 import {
   GetEnrollmentAPIKeysRequestSchema,
@@ -14,6 +12,7 @@ import {
   DeleteEnrollmentAPIKeyRequestSchema,
   PostEnrollmentAPIKeyRequestSchema,
 } from '../../types';
+import type { FleetRouter } from '../../types/request_context';
 
 import {
   getEnrollmentApiKeysHandler,
@@ -22,17 +21,19 @@ import {
   postEnrollmentApiKeyHandler,
 } from './handler';
 
-export const registerRoutes = (router: IRouter) => {
-  router.get(
+export const registerRoutes = (routers: { superuser: FleetRouter; fleetSetup: FleetRouter }) => {
+  routers.fleetSetup.get(
     {
       path: ENROLLMENT_API_KEY_ROUTES.INFO_PATTERN,
       validate: GetOneEnrollmentAPIKeyRequestSchema,
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
+      // options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getOneEnrollmentApiKeyHandler
   );
 
-  router.delete(
+  routers.superuser.delete(
     {
       path: ENROLLMENT_API_KEY_ROUTES.DELETE_PATTERN,
       validate: DeleteEnrollmentAPIKeyRequestSchema,
@@ -41,16 +42,18 @@ export const registerRoutes = (router: IRouter) => {
     deleteEnrollmentApiKeyHandler
   );
 
-  router.get(
+  routers.fleetSetup.get(
     {
       path: ENROLLMENT_API_KEY_ROUTES.LIST_PATTERN,
       validate: GetEnrollmentAPIKeysRequestSchema,
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
+      // options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getEnrollmentApiKeysHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: ENROLLMENT_API_KEY_ROUTES.CREATE_PATTERN,
       validate: PostEnrollmentAPIKeyRequestSchema,
diff --git a/x-pack/plugins/fleet/server/routes/epm/index.ts b/x-pack/plugins/fleet/server/routes/epm/index.ts
index 360f2ec1d446e..a2f2df4a00c55 100644
--- a/x-pack/plugins/fleet/server/routes/epm/index.ts
+++ b/x-pack/plugins/fleet/server/routes/epm/index.ts
@@ -5,10 +5,7 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, EPM_API_ROUTES } from '../../constants';
-import type { FleetRequestHandlerContext } from '../../types';
 import {
   GetCategoriesRequestSchema,
   GetPackagesRequestSchema,
@@ -21,7 +18,7 @@ import {
   GetStatsRequestSchema,
   UpdatePackageRequestSchema,
 } from '../../types';
-import { enforceSuperUser } from '../security';
+import type { FleetRouter } from '../../types/request_context';
 
 import {
   getCategoriesHandler,
@@ -39,8 +36,8 @@ import {
 
 const MAX_FILE_SIZE_BYTES = 104857600; // 100MB
 
-export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
-  router.get(
+export const registerRoutes = (routers: { rbac: FleetRouter; superuser: FleetRouter }) => {
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.CATEGORIES_PATTERN,
       validate: GetCategoriesRequestSchema,
@@ -49,7 +46,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getCategoriesHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.LIST_PATTERN,
       validate: GetPackagesRequestSchema,
@@ -58,7 +55,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getListHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.LIMITED_LIST_PATTERN,
       validate: false,
@@ -67,7 +64,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getLimitedListHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.STATS_PATTERN,
       validate: GetStatsRequestSchema,
@@ -76,7 +73,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getStatsHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.FILEPATH_PATTERN,
       validate: GetFileRequestSchema,
@@ -85,7 +82,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getFileHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.INFO_PATTERN,
       validate: GetInfoRequestSchema,
@@ -94,34 +91,34 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getInfoHandler
   );
 
-  router.put(
+  routers.superuser.put(
     {
       path: EPM_API_ROUTES.INFO_PATTERN,
       validate: UpdatePackageRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(updatePackageHandler)
+    updatePackageHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: EPM_API_ROUTES.INSTALL_FROM_REGISTRY_PATTERN,
       validate: InstallPackageFromRegistryRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(installPackageFromRegistryHandler)
+    installPackageFromRegistryHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: EPM_API_ROUTES.BULK_INSTALL_PATTERN,
       validate: BulkUpgradePackagesFromRegistryRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(bulkInstallPackagesFromRegistryHandler)
+    bulkInstallPackagesFromRegistryHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: EPM_API_ROUTES.INSTALL_BY_UPLOAD_PATTERN,
       validate: InstallPackageByUploadRequestSchema,
@@ -134,15 +131,15 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
         },
       },
     },
-    enforceSuperUser(installPackageByUploadHandler)
+    installPackageByUploadHandler
   );
 
-  router.delete(
+  routers.superuser.delete(
     {
       path: EPM_API_ROUTES.DELETE_PATTERN,
       validate: DeletePackageRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(deletePackageHandler)
+    deletePackageHandler
   );
 };
diff --git a/x-pack/plugins/fleet/server/routes/security.test.ts b/x-pack/plugins/fleet/server/routes/security.test.ts
new file mode 100644
index 0000000000000..80ea142541530
--- /dev/null
+++ b/x-pack/plugins/fleet/server/routes/security.test.ts
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IRouter, RequestHandler, RouteConfig } from '../../../../../src/core/server';
+import { coreMock } from '../../../../../src/core/server/mocks';
+import type { AuthenticatedUser } from '../../../security/server';
+import type { CheckPrivilegesDynamically } from '../../../security/server/authorization/check_privileges_dynamically';
+import { createAppContextStartContractMock } from '../mocks';
+import { appContextService } from '../services';
+
+import type { RouterWrapper } from './security';
+import { RouterWrappers } from './security';
+
+describe('RouterWrappers', () => {
+  const runTest = async ({
+    wrapper,
+    security: {
+      roles = [],
+      pluginEnabled = true,
+      licenseEnabled = true,
+      checkPrivilegesDynamically,
+    } = {},
+  }: {
+    wrapper: RouterWrapper;
+    security?: {
+      roles?: string[];
+      pluginEnabled?: boolean;
+      licenseEnabled?: boolean;
+      checkPrivilegesDynamically?: CheckPrivilegesDynamically;
+    };
+  }) => {
+    const fakeRouter = {
+      get: jest.fn(),
+    } as unknown as jest.Mocked<IRouter>;
+    const fakeHandler: RequestHandler = jest.fn((ctx, req, res) => res.ok());
+
+    const mockContext = createAppContextStartContractMock();
+    // @ts-expect-error type doesn't properly respect deeply mocked keys
+    mockContext.securityStart?.authz.actions.api.get.mockImplementation((priv) => `api:${priv}`);
+
+    if (!pluginEnabled) {
+      mockContext.securitySetup = undefined;
+      mockContext.securityStart = undefined;
+    } else {
+      mockContext.securityStart?.authc.getCurrentUser.mockReturnValue({
+        username: 'foo',
+        roles,
+      } as unknown as AuthenticatedUser);
+
+      mockContext.securitySetup?.license.isEnabled.mockReturnValue(licenseEnabled);
+      if (licenseEnabled) {
+        mockContext.securityStart?.authz.mode.useRbacForRequest.mockReturnValue(true);
+      }
+
+      if (checkPrivilegesDynamically) {
+        mockContext.securityStart?.authz.checkPrivilegesDynamicallyWithRequest.mockReturnValue(
+          checkPrivilegesDynamically
+        );
+      }
+    }
+
+    appContextService.start(mockContext);
+
+    const wrappedRouter = wrapper(fakeRouter);
+    wrappedRouter.get({} as RouteConfig<any, any, any, any>, fakeHandler);
+    const wrappedHandler = fakeRouter.get.mock.calls[0][1];
+    const resFactory = { forbidden: jest.fn(() => 'forbidden'), ok: jest.fn(() => 'ok') };
+    const res = await wrappedHandler(
+      { core: coreMock.createRequestHandlerContext() },
+      {} as any,
+      resFactory as any
+    );
+
+    return res as unknown as 'forbidden' | 'ok';
+  };
+
+  describe('require.superuser', () => {
+    it('allow users with the superuser role', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { roles: ['superuser'] },
+        })
+      ).toEqual('ok');
+    });
+
+    it('does not allow users without the superuser role', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { roles: ['foo'] },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security plugin to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { pluginEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security license to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { licenseEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+  });
+
+  describe('require.fleetSetupPrivilege', () => {
+    const mockCheckPrivileges: jest.Mock<
+      ReturnType<CheckPrivilegesDynamically>,
+      Parameters<CheckPrivilegesDynamically>
+    > = jest.fn().mockResolvedValue({ hasAllRequested: true });
+
+    it('executes custom authz check', async () => {
+      await runTest({
+        wrapper: RouterWrappers.require.fleetSetupPrivilege,
+        security: { checkPrivilegesDynamically: mockCheckPrivileges },
+      });
+      expect(mockCheckPrivileges).toHaveBeenCalledWith(
+        { kibana: ['api:fleet-setup'] },
+        {
+          requireLoginAction: false,
+        }
+      );
+    });
+
+    it('allow users with required privileges', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { checkPrivilegesDynamically: mockCheckPrivileges },
+        })
+      ).toEqual('ok');
+    });
+
+    it('does not allow users without required privileges', async () => {
+      mockCheckPrivileges.mockResolvedValueOnce({ hasAllRequested: false } as any);
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { checkPrivilegesDynamically: mockCheckPrivileges },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security plugin to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { pluginEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security license to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { licenseEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+  });
+});
diff --git a/x-pack/plugins/fleet/server/routes/security.ts b/x-pack/plugins/fleet/server/routes/security.ts
index 33a510c27f04e..8a67a7066742a 100644
--- a/x-pack/plugins/fleet/server/routes/security.ts
+++ b/x-pack/plugins/fleet/server/routes/security.ts
@@ -5,56 +5,137 @@
  * 2.0.
  */
 
-import type { IRouter, RequestHandler, RequestHandlerContext } from 'src/core/server';
+import type {
+  IRouter,
+  KibanaRequest,
+  RequestHandler,
+  RequestHandlerContext,
+} from 'src/core/server';
 
 import { appContextService } from '../services';
 
-export function enforceSuperUser<T1, T2, T3, TContext extends RequestHandlerContext>(
+const SUPERUSER_AUTHZ_MESSAGE =
+  'Access to Fleet API requires the superuser role and for stack security features to be enabled.';
+
+function checkSecurityEnabled() {
+  return appContextService.hasSecurity() && appContextService.getSecurityLicense().isEnabled();
+}
+
+function checkSuperuser(req: KibanaRequest) {
+  if (!checkSecurityEnabled()) {
+    return false;
+  }
+
+  const security = appContextService.getSecurity();
+  const user = security.authc.getCurrentUser(req);
+  if (!user) {
+    return false;
+  }
+
+  const userRoles = user.roles || [];
+  if (!userRoles.includes('superuser')) {
+    return false;
+  }
+
+  return true;
+}
+
+function enforceSuperuser<T1, T2, T3, TContext extends RequestHandlerContext>(
   handler: RequestHandler<T1, T2, T3, TContext>
 ): RequestHandler<T1, T2, T3, TContext> {
   return function enforceSuperHandler(context, req, res) {
-    if (!appContextService.hasSecurity() || !appContextService.getSecurityLicense().isEnabled()) {
+    const isSuperuser = checkSuperuser(req);
+    if (!isSuperuser) {
       return res.forbidden({
         body: {
-          message: `Access to this API requires that security is enabled`,
+          message: SUPERUSER_AUTHZ_MESSAGE,
         },
       });
     }
 
-    const security = appContextService.getSecurity();
-    const user = security.authc.getCurrentUser(req);
-    if (!user) {
-      return res.forbidden({
-        body: {
-          message:
-            'Access to Fleet API require the superuser role, and for stack security features to be enabled.',
-        },
-      });
-    }
+    return handler(context, req, res);
+  };
+}
 
-    const userRoles = user.roles || [];
-    if (!userRoles.includes('superuser')) {
-      return res.forbidden({
-        body: {
-          message: 'Access to Fleet API require the superuser role.',
-        },
-      });
+function makeRouterEnforcingSuperuser<TContext extends RequestHandlerContext>(
+  router: IRouter<TContext>
+): IRouter<TContext> {
+  return {
+    get: (options, handler) => router.get(options, enforceSuperuser(handler)),
+    delete: (options, handler) => router.delete(options, enforceSuperuser(handler)),
+    post: (options, handler) => router.post(options, enforceSuperuser(handler)),
+    put: (options, handler) => router.put(options, enforceSuperuser(handler)),
+    patch: (options, handler) => router.patch(options, enforceSuperuser(handler)),
+    handleLegacyErrors: (handler) => router.handleLegacyErrors(handler),
+    getRoutes: () => router.getRoutes(),
+    routerPath: router.routerPath,
+  };
+}
+
+async function checkFleetSetupPrivilege(req: KibanaRequest) {
+  if (!checkSecurityEnabled()) {
+    return false;
+  }
+
+  const security = appContextService.getSecurity();
+
+  if (security.authz.mode.useRbacForRequest(req)) {
+    const checkPrivileges = security.authz.checkPrivilegesDynamicallyWithRequest(req);
+    const { hasAllRequested } = await checkPrivileges(
+      { kibana: [security.authz.actions.api.get('fleet-setup')] },
+      { requireLoginAction: false } // exclude login access requirement
+    );
+
+    return !!hasAllRequested;
+  }
+
+  return true;
+}
+
+function enforceFleetSetupPrivilege<P, Q, B, TContext extends RequestHandlerContext>(
+  handler: RequestHandler<P, Q, B, TContext>
+): RequestHandler<P, Q, B, TContext> {
+  return async (context, req, res) => {
+    const hasFleetSetupPrivilege = await checkFleetSetupPrivilege(req);
+    if (!hasFleetSetupPrivilege) {
+      return res.forbidden({ body: { message: SUPERUSER_AUTHZ_MESSAGE } });
     }
+
     return handler(context, req, res);
   };
 }
 
-export function makeRouterEnforcingSuperuser<TContext extends RequestHandlerContext>(
+function makeRouterEnforcingFleetSetupPrivilege<TContext extends RequestHandlerContext>(
   router: IRouter<TContext>
 ): IRouter<TContext> {
   return {
-    get: (options, handler) => router.get(options, enforceSuperUser(handler)),
-    delete: (options, handler) => router.delete(options, enforceSuperUser(handler)),
-    post: (options, handler) => router.post(options, enforceSuperUser(handler)),
-    put: (options, handler) => router.put(options, enforceSuperUser(handler)),
-    patch: (options, handler) => router.patch(options, enforceSuperUser(handler)),
+    get: (options, handler) => router.get(options, enforceFleetSetupPrivilege(handler)),
+    delete: (options, handler) => router.delete(options, enforceFleetSetupPrivilege(handler)),
+    post: (options, handler) => router.post(options, enforceFleetSetupPrivilege(handler)),
+    put: (options, handler) => router.put(options, enforceFleetSetupPrivilege(handler)),
+    patch: (options, handler) => router.patch(options, enforceFleetSetupPrivilege(handler)),
     handleLegacyErrors: (handler) => router.handleLegacyErrors(handler),
     getRoutes: () => router.getRoutes(),
     routerPath: router.routerPath,
   };
 }
+
+export type RouterWrapper = <T extends RequestHandlerContext>(route: IRouter<T>) => IRouter<T>;
+
+interface RouterWrappersSetup {
+  require: {
+    superuser: RouterWrapper;
+    fleetSetupPrivilege: RouterWrapper;
+  };
+}
+
+export const RouterWrappers: RouterWrappersSetup = {
+  require: {
+    superuser: (router) => {
+      return makeRouterEnforcingSuperuser(router);
+    },
+    fleetSetupPrivilege: (router) => {
+      return makeRouterEnforcingFleetSetupPrivilege(router);
+    },
+  },
+};
diff --git a/x-pack/plugins/fleet/server/routes/setup/handlers.ts b/x-pack/plugins/fleet/server/routes/setup/handlers.ts
index c5b2ef0ade26f..fad5d93c3f5d5 100644
--- a/x-pack/plugins/fleet/server/routes/setup/handlers.ts
+++ b/x-pack/plugins/fleet/server/routes/setup/handlers.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import type { RequestHandler } from 'src/core/server';
-
 import { appContextService } from '../../services';
 import type { GetFleetStatusResponse, PostFleetSetupResponse } from '../../../common';
 import { setupFleet } from '../../services/setup';
@@ -14,12 +12,14 @@ import { hasFleetServers } from '../../services/fleet_server';
 import { defaultIngestErrorHandler } from '../../errors';
 import type { FleetRequestHandler } from '../../types';
 
-export const getFleetStatusHandler: RequestHandler = async (context, request, response) => {
+export const getFleetStatusHandler: FleetRequestHandler = async (context, request, response) => {
   try {
     const isApiKeysEnabled = await appContextService
       .getSecurity()
       .authc.apiKeys.areAPIKeysEnabled();
-    const isFleetServerSetup = await hasFleetServers(appContextService.getInternalUserESClient());
+    const isFleetServerSetup = await hasFleetServers(
+      context.core.elasticsearch.client.asInternalUser
+    );
 
     const missingRequirements: GetFleetStatusResponse['missing_requirements'] = [];
     if (!isApiKeysEnabled) {
diff --git a/x-pack/plugins/fleet/server/routes/setup/index.ts b/x-pack/plugins/fleet/server/routes/setup/index.ts
index 591b9c832172d..d191f1b78e9ae 100644
--- a/x-pack/plugins/fleet/server/routes/setup/index.ts
+++ b/x-pack/plugins/fleet/server/routes/setup/index.ts
@@ -5,55 +5,48 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, AGENTS_SETUP_API_ROUTES, SETUP_API_ROUTE } from '../../constants';
 import type { FleetConfigType } from '../../../common';
 
-import type { FleetRequestHandlerContext } from '../../types/request_context';
+import type { FleetRouter } from '../../types/request_context';
 
 import { getFleetStatusHandler, fleetSetupHandler } from './handlers';
 
-export const registerFleetSetupRoute = (router: IRouter<FleetRequestHandlerContext>) => {
+export const registerFleetSetupRoute = (router: FleetRouter) => {
   router.post(
     {
       path: SETUP_API_ROUTE,
       validate: false,
-      // if this route is set to `-all`, a read-only user get a 404 for this route
-      // and will see `Unable to initialize Ingest Manager` in the UI
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     fleetSetupHandler
   );
 };
 
 // That route is used by agent to setup Fleet
-export const registerCreateFleetSetupRoute = (router: IRouter<FleetRequestHandlerContext>) => {
+export const registerCreateFleetSetupRoute = (router: FleetRouter) => {
   router.post(
     {
       path: AGENTS_SETUP_API_ROUTES.CREATE_PATTERN,
       validate: false,
-      options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
     fleetSetupHandler
   );
 };
 
-export const registerGetFleetStatusRoute = (router: IRouter<FleetRequestHandlerContext>) => {
+export const registerGetFleetStatusRoute = (router: FleetRouter) => {
   router.get(
     {
       path: AGENTS_SETUP_API_ROUTES.INFO_PATTERN,
       validate: false,
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
       options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getFleetStatusHandler
   );
 };
 
-export const registerRoutes = (
-  router: IRouter<FleetRequestHandlerContext>,
-  config: FleetConfigType
-) => {
+export const registerRoutes = (router: FleetRouter, config: FleetConfigType) => {
   // Ingest manager setup
   registerFleetSetupRoute(router);
 
diff --git a/x-pack/plugins/fleet/server/types/request_context.ts b/x-pack/plugins/fleet/server/types/request_context.ts
index a3b414119b685..0d0da9145f073 100644
--- a/x-pack/plugins/fleet/server/types/request_context.ts
+++ b/x-pack/plugins/fleet/server/types/request_context.ts
@@ -11,6 +11,7 @@ import type {
   RequestHandlerContext,
   RouteMethod,
   SavedObjectsClientContract,
+  IRouter,
 } from '../../../../../src/core/server';
 
 /** @internal */
@@ -37,3 +38,9 @@ export type FleetRequestHandler<
   Method extends RouteMethod = any,
   ResponseFactory extends KibanaResponseFactory = KibanaResponseFactory
 > = RequestHandler<P, Q, B, FleetRequestHandlerContext, Method, ResponseFactory>;
+
+/**
+ * Convenience type for routers in Fleet that includes the FleetRequestHandlerContext type
+ * @internal
+ */
+export type FleetRouter = IRouter<FleetRequestHandlerContext>;
diff --git a/x-pack/plugins/security/server/authorization/check_privileges.test.ts b/x-pack/plugins/security/server/authorization/check_privileges.test.ts
index 75c8229bb37d6..d8906d91f152b 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges.test.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges.test.ts
@@ -878,6 +878,42 @@ describe('#atSpace', () => {
       `);
     });
   });
+
+  test('omits login privilege when requireLoginAction: false', async () => {
+    const { mockClusterClient, mockScopedClusterClient } = createMockClusterClient({
+      has_all_requested: true,
+      username: 'foo-username',
+      index: {},
+      application: {
+        [application]: {
+          'space:space_1': {
+            [mockActions.version]: true,
+          },
+        },
+      },
+    });
+    const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
+      mockActions,
+      () => Promise.resolve(mockClusterClient),
+      application
+    );
+    const request = httpServerMock.createKibanaRequest();
+    const checkPrivileges = checkPrivilegesWithRequest(request);
+    await checkPrivileges.atSpace('space_1', {}, { requireLoginAction: false });
+
+    expect(mockScopedClusterClient.asCurrentUser.security.hasPrivileges).toHaveBeenCalledWith({
+      body: {
+        index: [],
+        application: [
+          {
+            application,
+            resources: [`space:space_1`],
+            privileges: [mockActions.version],
+          },
+        ],
+      },
+    });
+  });
 });
 
 describe('#atSpaces', () => {
@@ -2083,6 +2119,42 @@ describe('#atSpaces', () => {
       `);
     });
   });
+
+  test('omits login privilege when requireLoginAction: false', async () => {
+    const { mockClusterClient, mockScopedClusterClient } = createMockClusterClient({
+      has_all_requested: true,
+      username: 'foo-username',
+      index: {},
+      application: {
+        [application]: {
+          'space:space_1': {
+            [mockActions.version]: true,
+          },
+        },
+      },
+    });
+    const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
+      mockActions,
+      () => Promise.resolve(mockClusterClient),
+      application
+    );
+    const request = httpServerMock.createKibanaRequest();
+    const checkPrivileges = checkPrivilegesWithRequest(request);
+    await checkPrivileges.atSpaces(['space_1'], {}, { requireLoginAction: false });
+
+    expect(mockScopedClusterClient.asCurrentUser.security.hasPrivileges).toHaveBeenCalledWith({
+      body: {
+        index: [],
+        application: [
+          {
+            application,
+            resources: [`space:space_1`],
+            privileges: [mockActions.version],
+          },
+        ],
+      },
+    });
+  });
 });
 
 describe('#globally', () => {
@@ -2937,4 +3009,40 @@ describe('#globally', () => {
       `);
     });
   });
+
+  test('omits login privilege when requireLoginAction: false', async () => {
+    const { mockClusterClient, mockScopedClusterClient } = createMockClusterClient({
+      has_all_requested: true,
+      username: 'foo-username',
+      index: {},
+      application: {
+        [application]: {
+          [GLOBAL_RESOURCE]: {
+            [mockActions.version]: true,
+          },
+        },
+      },
+    });
+    const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
+      mockActions,
+      () => Promise.resolve(mockClusterClient),
+      application
+    );
+    const request = httpServerMock.createKibanaRequest();
+    const checkPrivileges = checkPrivilegesWithRequest(request);
+    await checkPrivileges.globally({}, { requireLoginAction: false });
+
+    expect(mockScopedClusterClient.asCurrentUser.security.hasPrivileges).toHaveBeenCalledWith({
+      body: {
+        index: [],
+        application: [
+          {
+            application,
+            resources: [GLOBAL_RESOURCE],
+            privileges: [mockActions.version],
+          },
+        ],
+      },
+    });
+  });
 });
diff --git a/x-pack/plugins/security/server/authorization/check_privileges.ts b/x-pack/plugins/security/server/authorization/check_privileges.ts
index 3a35cf164ad85..36c364f1ff7da 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges.ts
@@ -13,6 +13,7 @@ import { GLOBAL_RESOURCE } from '../../common/constants';
 import { ResourceSerializer } from './resource_serializer';
 import type {
   CheckPrivileges,
+  CheckPrivilegesOptions,
   CheckPrivilegesPayload,
   CheckPrivilegesResponse,
   HasPrivilegesResponse,
@@ -41,14 +42,20 @@ export function checkPrivilegesWithRequestFactory(
   return function checkPrivilegesWithRequest(request: KibanaRequest): CheckPrivileges {
     const checkPrivilegesAtResources = async (
       resources: string[],
-      privileges: CheckPrivilegesPayload
+      privileges: CheckPrivilegesPayload,
+      { requireLoginAction = true }: CheckPrivilegesOptions = {}
     ): Promise<CheckPrivilegesResponse> => {
       const kibanaPrivileges = Array.isArray(privileges.kibana)
         ? privileges.kibana
         : privileges.kibana
         ? [privileges.kibana]
         : [];
-      const allApplicationPrivileges = uniq([actions.version, actions.login, ...kibanaPrivileges]);
+
+      const allApplicationPrivileges = uniq([
+        actions.version,
+        ...(requireLoginAction ? [actions.login] : []),
+        ...kibanaPrivileges,
+      ]);
 
       const clusterClient = await getClusterClient();
       const { body } = await clusterClient.asScoped(request).asCurrentUser.security.hasPrivileges({
@@ -135,18 +142,26 @@ export function checkPrivilegesWithRequestFactory(
     };
 
     return {
-      async atSpace(spaceId: string, privileges: CheckPrivilegesPayload) {
+      async atSpace(
+        spaceId: string,
+        privileges: CheckPrivilegesPayload,
+        options?: CheckPrivilegesOptions
+      ) {
         const spaceResource = ResourceSerializer.serializeSpaceResource(spaceId);
-        return await checkPrivilegesAtResources([spaceResource], privileges);
+        return await checkPrivilegesAtResources([spaceResource], privileges, options);
       },
-      async atSpaces(spaceIds: string[], privileges: CheckPrivilegesPayload) {
+      async atSpaces(
+        spaceIds: string[],
+        privileges: CheckPrivilegesPayload,
+        options?: CheckPrivilegesOptions
+      ) {
         const spaceResources = spaceIds.map((spaceId) =>
           ResourceSerializer.serializeSpaceResource(spaceId)
         );
-        return await checkPrivilegesAtResources(spaceResources, privileges);
+        return await checkPrivilegesAtResources(spaceResources, privileges, options);
       },
-      async globally(privileges: CheckPrivilegesPayload) {
-        return await checkPrivilegesAtResources([GLOBAL_RESOURCE], privileges);
+      async globally(privileges: CheckPrivilegesPayload, options?: CheckPrivilegesOptions) {
+        return await checkPrivilegesAtResources([GLOBAL_RESOURCE], privileges, options);
       },
     };
   };
diff --git a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts
index 547782bbd1ba1..9fd14c6d29806 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts
@@ -8,6 +8,7 @@
 import { httpServerMock } from 'src/core/server/mocks';
 
 import { checkPrivilegesDynamicallyWithRequestFactory } from './check_privileges_dynamically';
+import type { CheckPrivilegesOptions } from './types';
 
 test(`checkPrivileges.atSpace when spaces is enabled`, async () => {
   const expectedResult = Symbol();
@@ -25,13 +26,18 @@ test(`checkPrivileges.atSpace when spaces is enabled`, async () => {
       namespaceToSpaceId: jest.fn(),
     })
   )(request);
-  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges });
+  const options: CheckPrivilegesOptions = { requireLoginAction: true };
+  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges }, options);
 
   expect(result).toBe(expectedResult);
   expect(mockCheckPrivilegesWithRequest).toHaveBeenCalledWith(request);
-  expect(mockCheckPrivileges.atSpace).toHaveBeenCalledWith(spaceId, {
-    kibana: privilegeOrPrivileges,
-  });
+  expect(mockCheckPrivileges.atSpace).toHaveBeenCalledWith(
+    spaceId,
+    {
+      kibana: privilegeOrPrivileges,
+    },
+    options
+  );
 });
 
 test(`checkPrivileges.globally when spaces is disabled`, async () => {
@@ -46,9 +52,13 @@ test(`checkPrivileges.globally when spaces is disabled`, async () => {
     mockCheckPrivilegesWithRequest,
     () => undefined
   )(request);
-  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges });
+  const options: CheckPrivilegesOptions = { requireLoginAction: true };
+  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges }, options);
 
   expect(result).toBe(expectedResult);
   expect(mockCheckPrivilegesWithRequest).toHaveBeenCalledWith(request);
-  expect(mockCheckPrivileges.globally).toHaveBeenCalledWith({ kibana: privilegeOrPrivileges });
+  expect(mockCheckPrivileges.globally).toHaveBeenCalledWith(
+    { kibana: privilegeOrPrivileges },
+    options
+  );
 });
diff --git a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts
index 4ce59c8706270..d4e335ba04058 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts
@@ -9,13 +9,15 @@ import type { KibanaRequest } from 'src/core/server';
 
 import type { SpacesService } from '../plugin';
 import type {
+  CheckPrivilegesOptions,
   CheckPrivilegesPayload,
   CheckPrivilegesResponse,
   CheckPrivilegesWithRequest,
 } from './types';
 
 export type CheckPrivilegesDynamically = (
-  privileges: CheckPrivilegesPayload
+  privileges: CheckPrivilegesPayload,
+  options?: CheckPrivilegesOptions
 ) => Promise<CheckPrivilegesResponse>;
 
 export type CheckPrivilegesDynamicallyWithRequest = (
@@ -28,11 +30,15 @@ export function checkPrivilegesDynamicallyWithRequestFactory(
 ): CheckPrivilegesDynamicallyWithRequest {
   return function checkPrivilegesDynamicallyWithRequest(request: KibanaRequest) {
     const checkPrivileges = checkPrivilegesWithRequest(request);
-    return async function checkPrivilegesDynamically(privileges: CheckPrivilegesPayload) {
+
+    return async function checkPrivilegesDynamically(
+      privileges: CheckPrivilegesPayload,
+      options?: CheckPrivilegesOptions
+    ) {
       const spacesService = getSpacesService();
       return spacesService
-        ? await checkPrivileges.atSpace(spacesService.getSpaceId(request), privileges)
-        : await checkPrivileges.globally(privileges);
+        ? await checkPrivileges.atSpace(spacesService.getSpaceId(request), privileges, options)
+        : await checkPrivileges.globally(privileges, options);
     };
   };
 }
diff --git a/x-pack/plugins/security/server/authorization/types.ts b/x-pack/plugins/security/server/authorization/types.ts
index 8bfe892840637..aee059fb8becb 100644
--- a/x-pack/plugins/security/server/authorization/types.ts
+++ b/x-pack/plugins/security/server/authorization/types.ts
@@ -29,6 +29,18 @@ export interface HasPrivilegesResponse {
   };
 }
 
+/**
+ * Options to influce the privilege checks.
+ */
+export interface CheckPrivilegesOptions {
+  /**
+   * Whether or not the `login` action should be required (default: true).
+   * Setting this to false is not advised except for special circumstances, when you do not require
+   * the request to belong to a user capable of logging into Kibana.
+   */
+  requireLoginAction?: boolean;
+}
+
 export interface CheckPrivilegesResponse {
   hasAllRequested: boolean;
   username: string;
@@ -59,12 +71,20 @@ export interface CheckPrivilegesResponse {
 export type CheckPrivilegesWithRequest = (request: KibanaRequest) => CheckPrivileges;
 
 export interface CheckPrivileges {
-  atSpace(spaceId: string, privileges: CheckPrivilegesPayload): Promise<CheckPrivilegesResponse>;
+  atSpace(
+    spaceId: string,
+    privileges: CheckPrivilegesPayload,
+    options?: CheckPrivilegesOptions
+  ): Promise<CheckPrivilegesResponse>;
   atSpaces(
     spaceIds: string[],
-    privileges: CheckPrivilegesPayload
+    privileges: CheckPrivilegesPayload,
+    options?: CheckPrivilegesOptions
+  ): Promise<CheckPrivilegesResponse>;
+  globally(
+    privileges: CheckPrivilegesPayload,
+    options?: CheckPrivilegesOptions
   ): Promise<CheckPrivilegesResponse>;
-  globally(privileges: CheckPrivilegesPayload): Promise<CheckPrivilegesResponse>;
 }
 
 export interface CheckPrivilegesPayload {
diff --git a/x-pack/test/api_integration/apis/security/privileges.ts b/x-pack/test/api_integration/apis/security/privileges.ts
index 762fc1642a87a..f234855b84e17 100644
--- a/x-pack/test/api_integration/apis/security/privileges.ts
+++ b/x-pack/test/api_integration/apis/security/privileges.ts
@@ -73,7 +73,7 @@ export default function ({ getService }: FtrProviderContext) {
               'packs_read',
             ],
           },
-          reserved: ['ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
+          reserved: ['fleet-setup', 'ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
         };
 
         await supertest
diff --git a/x-pack/test/api_integration/apis/security/privileges_basic.ts b/x-pack/test/api_integration/apis/security/privileges_basic.ts
index 0efaa25ee57da..ac69bfcd9d5d4 100644
--- a/x-pack/test/api_integration/apis/security/privileges_basic.ts
+++ b/x-pack/test/api_integration/apis/security/privileges_basic.ts
@@ -45,7 +45,7 @@ export default function ({ getService }: FtrProviderContext) {
           },
           global: ['all', 'read'],
           space: ['all', 'read'],
-          reserved: ['ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
+          reserved: ['fleet-setup', 'ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
         };
 
         await supertest
diff --git a/x-pack/test/fleet_api_integration/apis/agents/services.ts b/x-pack/test/fleet_api_integration/apis/agents/services.ts
index be5d2d438f76f..0e28ad647bbc4 100644
--- a/x-pack/test/fleet_api_integration/apis/agents/services.ts
+++ b/x-pack/test/fleet_api_integration/apis/agents/services.ts
@@ -32,12 +32,30 @@ export function getEsClientForAPIKey({ getService }: FtrProviderContext, esApiKe
   });
 }
 
-export function setupFleetAndAgents({ getService }: FtrProviderContext) {
+export function setupFleetAndAgents(providerContext: FtrProviderContext) {
   before(async () => {
-    await getService('supertest').post(`/api/fleet/setup`).set('kbn-xsrf', 'xxx').send();
-    await getService('supertest')
+    // Use elastic/fleet-server service account to execute setup to verify privilege configuration
+    const es = providerContext.getService('es');
+    const {
+      body: { token },
+      // @ts-expect-error SecurityCreateServiceTokenRequest should not require `name`
+    } = await es.security.createServiceToken({
+      namespace: 'elastic',
+      service: 'fleet-server',
+    });
+    const supetestWithoutAuth = getSupertestWithoutAuth(providerContext);
+
+    await supetestWithoutAuth
+      .post(`/api/fleet/setup`)
+      .set('kbn-xsrf', 'xxx')
+      .set('Authorization', `Bearer ${token.value}`)
+      .send()
+      .expect(200);
+    await supetestWithoutAuth
       .post(`/api/fleet/agents/setup`)
       .set('kbn-xsrf', 'xxx')
-      .send({ forceRecreate: true });
+      .set('Authorization', `Bearer ${token.value}`)
+      .send({ forceRecreate: true })
+      .expect(200);
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/epm/setup.ts b/x-pack/test/fleet_api_integration/apis/epm/setup.ts
index 8567cf8069c58..051636ad11f5a 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/setup.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/setup.ts
@@ -14,7 +14,9 @@ import { setupFleetAndAgents } from '../agents/services';
 export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
   const supertest = getService('supertest');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
   const log = getService('log');
+  const es = getService('es');
 
   describe('setup api', async () => {
     skipIfNoDockerRegistry(providerContext);
@@ -47,5 +49,48 @@ export default function (providerContext: FtrProviderContext) {
         );
       });
     });
+
+    it('allows elastic/fleet-server user to call required APIs', async () => {
+      const {
+        body: { token },
+        // @ts-expect-error SecurityCreateServiceTokenRequest should not require `name`
+      } = await es.security.createServiceToken({
+        namespace: 'elastic',
+        service: 'fleet-server',
+      });
+
+      // elastic/fleet-server needs access to these APIs:
+      // POST /api/fleet/setup
+      // POST /api/fleet/agents/setup
+      // GET /api/fleet/agent_policies
+      // GET /api/fleet/enrollment-api-keys
+      // GET /api/fleet/enrollment-api-keys/<id>
+      await supertestWithoutAuth
+        .post('/api/fleet/setup')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      await supertestWithoutAuth
+        .post('/api/fleet/agents/setup')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      await supertestWithoutAuth
+        .get('/api/fleet/agent_policies')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      const response = await supertestWithoutAuth
+        .get('/api/fleet/enrollment-api-keys')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      const enrollmentApiKeyId = response.body.list[0].id;
+      await supertestWithoutAuth
+        .get(`/api/fleet/enrollment-api-keys/${enrollmentApiKeyId}`)
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+    });
   });
 }

From f6a9afea6165c6072bd0c3fdf00439b7a98de1fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Loix?= <sabee77@gmail.com>
Date: Tue, 19 Oct 2021 11:33:57 +0100
Subject: [PATCH 6/8] [Stack management apps] Deprecate "enabled" Kibana
 setting (#114768)

---
 docs/dev-tools/console/console.asciidoc       |   9 +
 docs/setup/settings.asciidoc                  |  34 +++
 src/plugins/console/public/index.ts           |   7 +-
 src/plugins/console/public/plugin.ts          | 122 ++++++-----
 src/plugins/console/public/types/config.ts    |  13 ++
 src/plugins/console/public/types/index.ts     |   2 +
 src/plugins/console/public/types/locator.ts   |  12 ++
 .../public/types/plugin_dependencies.ts       |   8 +-
 src/plugins/console/server/config.ts          | 199 ++++++++++++++----
 src/plugins/console/server/index.ts           |   1 +
 src/plugins/console/server/plugin.ts          |  10 +-
 .../components/manage_data/manage_data.tsx    |   3 +-
 .../components/details/req_code_viewer.tsx    |  12 +-
 .../common/constants/index.ts                 |   2 +
 .../server/config.ts                          |  96 ++++++++-
 .../cross_cluster_replication/server/index.ts |  13 +-
 .../common/constants/index.ts                 |   2 +
 .../server/config.ts                          |  96 ++++++++-
 .../server/index.ts                           |  13 +-
 .../plugins/index_management/public/plugin.ts |  50 +++--
 .../plugins/index_management/public/types.ts  |   6 +
 .../plugins/index_management/server/config.ts |  89 +++++++-
 .../plugins/index_management/server/index.ts  |  10 +-
 .../common/constants/index.ts                 |   2 +-
 .../common/constants/plugin.ts                |   2 +
 .../license_management/server/config.ts       |  90 +++++++-
 .../license_management/server/index.ts        |  13 +-
 .../remote_clusters/common/constants.ts       |   2 +
 .../plugins/remote_clusters/server/config.ts  |  89 +++++++-
 .../plugins/remote_clusters/server/plugin.ts  |   4 +-
 x-pack/plugins/rollup/common/index.ts         |   2 +
 x-pack/plugins/rollup/public/index.ts         |   3 +-
 x-pack/plugins/rollup/public/plugin.ts        |  57 ++---
 x-pack/plugins/rollup/public/types.ts         |  12 ++
 x-pack/plugins/rollup/server/config.ts        |  89 +++++++-
 x-pack/plugins/rollup/server/index.ts         |  10 +-
 .../snapshot_restore/common/constants.ts      |   2 +
 .../plugins/snapshot_restore/public/plugin.ts |  84 ++++----
 .../plugins/snapshot_restore/public/types.ts  |   1 +
 .../plugins/snapshot_restore/server/config.ts |  98 ++++++++-
 .../plugins/snapshot_restore/server/index.ts  |  13 +-
 .../plugins/snapshot_restore/server/plugin.ts |   9 +-
 .../client_integration/helpers/index.ts       |   2 +-
 .../helpers/setup_environment.tsx             |  12 +-
 .../overview/overview.test.tsx                |   5 +-
 .../upgrade_assistant/common/config.ts        |  20 --
 .../upgrade_assistant/common/constants.ts     |   6 +-
 .../reindex/flyout/warning_step.test.tsx      |  18 +-
 .../upgrade_assistant/public/plugin.ts        |  88 ++++----
 .../plugins/upgrade_assistant/public/types.ts |   7 +
 .../upgrade_assistant/server/config.ts        | 107 ++++++++++
 .../plugins/upgrade_assistant/server/index.ts |  13 +-
 .../server/lib/__fixtures__/version.ts        |   8 +-
 .../server/lib/es_version_precheck.test.ts    |   4 +-
 .../lib/reindexing/index_settings.test.ts     |   8 +-
 .../lib/reindexing/reindex_actions.test.ts    |   4 +-
 .../lib/reindexing/reindex_service.test.ts    |   4 +-
 57 files changed, 1279 insertions(+), 418 deletions(-)
 create mode 100644 src/plugins/console/public/types/config.ts
 create mode 100644 src/plugins/console/public/types/locator.ts
 create mode 100644 x-pack/plugins/rollup/public/types.ts
 delete mode 100644 x-pack/plugins/upgrade_assistant/common/config.ts
 create mode 100644 x-pack/plugins/upgrade_assistant/server/config.ts

diff --git a/docs/dev-tools/console/console.asciidoc b/docs/dev-tools/console/console.asciidoc
index 48fe936dd2db5..21334c31011f4 100644
--- a/docs/dev-tools/console/console.asciidoc
+++ b/docs/dev-tools/console/console.asciidoc
@@ -129,3 +129,12 @@ image::dev-tools/console/images/console-settings.png["Console Settings", width=6
 
 For a list of available keyboard
 shortcuts, click *Help*.
+
+[float]
+[[console-settings]]
+=== Disable Console
+
+If you don’t want to use *Console*, you can disable it by setting `console.ui.enabled`
+to `false` in your `kibana.yml` configuration file. Changing this setting
+causes the server to regenerate assets on the next startup,
+which might cause a delay before pages start being served.
\ No newline at end of file
diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc
index 4802a4da8182c..af22ad4ad157f 100644
--- a/docs/setup/settings.asciidoc
+++ b/docs/setup/settings.asciidoc
@@ -20,6 +20,11 @@ configuration using `${MY_ENV_VAR}` syntax.
 [cols="2*<"]
 |===
 
+| `console.ui.enabled:`
+Toggling this causes the server to regenerate assets on the next startup,
+which may cause a delay before pages start being served.
+Set to `false` to disable Console. *Default: `true`*
+
 | `csp.rules:`
  | deprecated:[7.14.0,"In 8.0 and later, this setting will no longer be supported."]
 A https://w3c.github.io/webappsec-csp/[Content Security Policy] template
@@ -681,6 +686,10 @@ out through *Advanced Settings*. *Default: `true`*
  | Set this value to true to allow Vega to use any URL to access external data
 sources and images. When false, Vega can only get data from {es}. *Default: `false`*
 
+| `xpack.ccr.ui.enabled`
+Set this value to false to disable the Cross-Cluster Replication UI.
+*Default: `true`*
+
 |[[settings-explore-data-in-context]] `xpack.discoverEnhanced.actions.`
 `exploreDataInContextMenu.enabled`
  | Enables the *Explore underlying data* option that allows you to open *Discover* from a dashboard panel and view the panel data. *Default: `false`*
@@ -689,6 +698,31 @@ sources and images. When false, Vega can only get data from {es}. *Default: `fal
 `exploreDataInChart.enabled`
  | Enables you to view the underlying documents in a data series from a dashboard panel. *Default: `false`*
 
+| `xpack.ilm.ui.enabled`
+Set this value to false to disable the Index Lifecycle Policies UI.
+*Default: `true`*
+
+| `xpack.index_management.ui.enabled`
+Set this value to false to disable the Index Management UI.
+*Default: `true`*
+
+| `xpack.license_management.ui.enabled`
+Set this value to false to disable the License Management UI.
+*Default: `true`*
+
+| `xpack.remote_clusters.ui.enabled`
+Set this value to false to disable the Remote Clusters UI.
+*Default: `true`*
+
+| `xpack.rollup.ui.enabled:`
+Set this value to false to disable the Rollup Jobs UI. *Default: true*
+
+| `xpack.snapshot_restore.ui.enabled:`
+Set this value to false to disable the Snapshot and Restore UI. *Default: true*
+
+| `xpack.upgrade_assistant.ui.enabled:`
+Set this value to false to disable the Upgrade Assistant UI. *Default: true*
+
 | `i18n.locale` {ess-icon}
  | Set this value to change the {kib} interface language.
 Valid locales are: `en`, `zh-CN`, `ja-JP`. *Default: `en`*
diff --git a/src/plugins/console/public/index.ts b/src/plugins/console/public/index.ts
index 8c4a107108565..9a9c5896cd26d 100644
--- a/src/plugins/console/public/index.ts
+++ b/src/plugins/console/public/index.ts
@@ -7,13 +7,14 @@
  */
 
 import './index.scss';
+import { PluginInitializerContext } from 'src/core/public';
 
 import { ConsoleUIPlugin } from './plugin';
 
-export type { ConsoleUILocatorParams } from './plugin';
+export type { ConsoleUILocatorParams, ConsolePluginSetup } from './types';
 
 export { ConsoleUIPlugin as Plugin };
 
-export function plugin() {
-  return new ConsoleUIPlugin();
+export function plugin(ctx: PluginInitializerContext) {
+  return new ConsoleUIPlugin(ctx);
 }
diff --git a/src/plugins/console/public/plugin.ts b/src/plugins/console/public/plugin.ts
index e3791df6a2db6..d61769c23dfe0 100644
--- a/src/plugins/console/public/plugin.ts
+++ b/src/plugins/console/public/plugin.ts
@@ -7,77 +7,87 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { SerializableRecord } from '@kbn/utility-types';
-import { Plugin, CoreSetup } from 'src/core/public';
+import { Plugin, CoreSetup, PluginInitializerContext } from 'src/core/public';
 
 import { FeatureCatalogueCategory } from '../../home/public';
-import { AppSetupUIPluginDependencies } from './types';
-
-export interface ConsoleUILocatorParams extends SerializableRecord {
-  loadFrom?: string;
-}
+import {
+  AppSetupUIPluginDependencies,
+  ClientConfigType,
+  ConsolePluginSetup,
+  ConsoleUILocatorParams,
+} from './types';
 
 export class ConsoleUIPlugin implements Plugin<void, void, AppSetupUIPluginDependencies> {
+  constructor(private ctx: PluginInitializerContext) {}
+
   public setup(
     { notifications, getStartServices, http }: CoreSetup,
     { devTools, home, share, usageCollection }: AppSetupUIPluginDependencies
-  ) {
-    if (home) {
-      home.featureCatalogue.register({
+  ): ConsolePluginSetup {
+    const {
+      ui: { enabled: isConsoleUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
+
+    if (isConsoleUiEnabled) {
+      if (home) {
+        home.featureCatalogue.register({
+          id: 'console',
+          title: i18n.translate('console.devToolsTitle', {
+            defaultMessage: 'Interact with the Elasticsearch API',
+          }),
+          description: i18n.translate('console.devToolsDescription', {
+            defaultMessage: 'Skip cURL and use a JSON interface to work with your data in Console.',
+          }),
+          icon: 'consoleApp',
+          path: '/app/dev_tools#/console',
+          showOnHomePage: false,
+          category: FeatureCatalogueCategory.ADMIN,
+        });
+      }
+
+      devTools.register({
         id: 'console',
-        title: i18n.translate('console.devToolsTitle', {
-          defaultMessage: 'Interact with the Elasticsearch API',
-        }),
-        description: i18n.translate('console.devToolsDescription', {
-          defaultMessage: 'Skip cURL and use a JSON interface to work with your data in Console.',
+        order: 1,
+        title: i18n.translate('console.consoleDisplayName', {
+          defaultMessage: 'Console',
         }),
-        icon: 'consoleApp',
-        path: '/app/dev_tools#/console',
-        showOnHomePage: false,
-        category: FeatureCatalogueCategory.ADMIN,
-      });
-    }
+        enableRouting: false,
+        mount: async ({ element }) => {
+          const [core] = await getStartServices();
 
-    devTools.register({
-      id: 'console',
-      order: 1,
-      title: i18n.translate('console.consoleDisplayName', {
-        defaultMessage: 'Console',
-      }),
-      enableRouting: false,
-      mount: async ({ element }) => {
-        const [core] = await getStartServices();
+          const {
+            i18n: { Context: I18nContext },
+            docLinks: { DOC_LINK_VERSION },
+          } = core;
 
-        const {
-          i18n: { Context: I18nContext },
-          docLinks: { DOC_LINK_VERSION },
-        } = core;
+          const { renderApp } = await import('./application');
 
-        const { renderApp } = await import('./application');
+          return renderApp({
+            http,
+            docLinkVersion: DOC_LINK_VERSION,
+            I18nContext,
+            notifications,
+            usageCollection,
+            element,
+          });
+        },
+      });
 
-        return renderApp({
-          http,
-          docLinkVersion: DOC_LINK_VERSION,
-          I18nContext,
-          notifications,
-          usageCollection,
-          element,
-        });
-      },
-    });
+      const locator = share.url.locators.create<ConsoleUILocatorParams>({
+        id: 'CONSOLE_APP_LOCATOR',
+        getLocation: async ({ loadFrom }) => {
+          return {
+            app: 'dev_tools',
+            path: `#/console${loadFrom ? `?load_from=${loadFrom}` : ''}`,
+            state: { loadFrom },
+          };
+        },
+      });
 
-    const locator = share.url.locators.create<ConsoleUILocatorParams>({
-      id: 'CONSOLE_APP_LOCATOR',
-      getLocation: async ({ loadFrom }) => {
-        return {
-          app: 'dev_tools',
-          path: `#/console${loadFrom ? `?load_from=${loadFrom}` : ''}`,
-          state: { loadFrom },
-        };
-      },
-    });
+      return { locator };
+    }
 
-    return { locator };
+    return {};
   }
 
   public start() {}
diff --git a/src/plugins/console/public/types/config.ts b/src/plugins/console/public/types/config.ts
new file mode 100644
index 0000000000000..da41eef6f5484
--- /dev/null
+++ b/src/plugins/console/public/types/config.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export interface ClientConfigType {
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/src/plugins/console/public/types/index.ts b/src/plugins/console/public/types/index.ts
index b98adbf5610cd..d8b6aaf7b12c4 100644
--- a/src/plugins/console/public/types/index.ts
+++ b/src/plugins/console/public/types/index.ts
@@ -11,3 +11,5 @@ export * from './core_editor';
 export * from './token';
 export * from './tokens_provider';
 export * from './common';
+export { ClientConfigType } from './config';
+export { ConsoleUILocatorParams } from './locator';
diff --git a/src/plugins/console/public/types/locator.ts b/src/plugins/console/public/types/locator.ts
new file mode 100644
index 0000000000000..f3a42338aaadc
--- /dev/null
+++ b/src/plugins/console/public/types/locator.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { SerializableRecord } from '@kbn/utility-types';
+
+export interface ConsoleUILocatorParams extends SerializableRecord {
+  loadFrom?: string;
+}
diff --git a/src/plugins/console/public/types/plugin_dependencies.ts b/src/plugins/console/public/types/plugin_dependencies.ts
index 444776f47ea13..afc49f9a5a986 100644
--- a/src/plugins/console/public/types/plugin_dependencies.ts
+++ b/src/plugins/console/public/types/plugin_dependencies.ts
@@ -9,7 +9,9 @@
 import { HomePublicPluginSetup } from '../../../home/public';
 import { DevToolsSetup } from '../../../dev_tools/public';
 import { UsageCollectionSetup } from '../../../usage_collection/public';
-import { SharePluginSetup } from '../../../share/public';
+import { SharePluginSetup, LocatorPublic } from '../../../share/public';
+
+import { ConsoleUILocatorParams } from './locator';
 
 export interface AppSetupUIPluginDependencies {
   home?: HomePublicPluginSetup;
@@ -17,3 +19,7 @@ export interface AppSetupUIPluginDependencies {
   share: SharePluginSetup;
   usageCollection?: UsageCollectionSetup;
 }
+
+export interface ConsolePluginSetup {
+  locator?: LocatorPublic<ConsoleUILocatorParams>;
+}
diff --git a/src/plugins/console/server/config.ts b/src/plugins/console/server/config.ts
index 6d667fed081e8..024777aa8d252 100644
--- a/src/plugins/console/server/config.ts
+++ b/src/plugins/console/server/config.ts
@@ -7,6 +7,8 @@
  */
 
 import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginConfigDescriptor } from 'kibana/server';
 
@@ -14,62 +16,171 @@ import { MAJOR_VERSION } from '../common/constants';
 
 const kibanaVersion = new SemVer(MAJOR_VERSION);
 
-const baseSettings = {
-  enabled: schema.boolean({ defaultValue: true }),
-  ssl: schema.object({ verify: schema.boolean({ defaultValue: false }) }, {}),
-};
-
-// Settings only available in 7.x
-const deprecatedSettings = {
-  proxyFilter: schema.arrayOf(schema.string(), { defaultValue: ['.*'] }),
-  proxyConfig: schema.arrayOf(
-    schema.object({
-      match: schema.object({
-        protocol: schema.string({ defaultValue: '*' }),
-        host: schema.string({ defaultValue: '*' }),
-        port: schema.string({ defaultValue: '*' }),
-        path: schema.string({ defaultValue: '*' }),
-      }),
-
-      timeout: schema.number(),
-      ssl: schema.object(
-        {
-          verify: schema.boolean(),
-          ca: schema.arrayOf(schema.string()),
-          cert: schema.string(),
-          key: schema.string(),
-        },
-        { defaultValue: undefined }
-      ),
-    }),
-    { defaultValue: [] }
-  ),
-};
-
-const configSchema = schema.object(
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
   {
-    ...baseSettings,
+    ssl: schema.object({ verify: schema.boolean({ defaultValue: false }) }, {}),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
   },
   { defaultValue: undefined }
 );
 
-const configSchema7x = schema.object(
+const configLatest: PluginConfigDescriptor<ConsoleConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type ConsoleConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
   {
-    ...baseSettings,
-    ...deprecatedSettings,
+    enabled: schema.boolean({ defaultValue: true }),
+    proxyFilter: schema.arrayOf(schema.string(), { defaultValue: ['.*'] }),
+    proxyConfig: schema.arrayOf(
+      schema.object({
+        match: schema.object({
+          protocol: schema.string({ defaultValue: '*' }),
+          host: schema.string({ defaultValue: '*' }),
+          port: schema.string({ defaultValue: '*' }),
+          path: schema.string({ defaultValue: '*' }),
+        }),
+
+        timeout: schema.number(),
+        ssl: schema.object(
+          {
+            verify: schema.boolean(),
+            ca: schema.arrayOf(schema.string()),
+            cert: schema.string(),
+            key: schema.string(),
+          },
+          { defaultValue: undefined }
+        ),
+      }),
+      { defaultValue: [] }
+    ),
+    ssl: schema.object({ verify: schema.boolean({ defaultValue: false }) }, {}),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
   },
   { defaultValue: undefined }
 );
 
-export type ConfigType = TypeOf<typeof configSchema>;
-export type ConfigType7x = TypeOf<typeof configSchema7x>;
+export type ConsoleConfig7x = TypeOf<typeof schema7x>;
 
-export const config: PluginConfigDescriptor<ConfigType | ConfigType7x> = {
-  schema: kibanaVersion.major < 8 ? configSchema7x : configSchema,
+const config7x: PluginConfigDescriptor<ConsoleConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
   deprecations: ({ deprecate, unused }) => [
-    deprecate('enabled', '8.0.0'),
-    deprecate('proxyFilter', '8.0.0'),
-    deprecate('proxyConfig', '8.0.0'),
     unused('ssl'),
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'console.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'console.enabled',
+        level: 'critical',
+        title: i18n.translate('console.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "console.enabled" is deprecated',
+        }),
+        message: i18n.translate('console.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Console UI, use the "console.ui.enabled" setting instead of "console.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('console.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('console.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage: 'Change the "console.enabled" setting to "console.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'console.proxyConfig') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'console.proxyConfig',
+        level: 'critical',
+        title: i18n.translate('console.deprecations.proxyConfigTitle', {
+          defaultMessage: 'Setting "console.proxyConfig" is deprecated',
+        }),
+        message: i18n.translate('console.deprecations.proxyConfigMessage', {
+          defaultMessage:
+            'Configuring "console.proxyConfig" is deprecated and will be removed in 8.0.0. To secure your connection between Kibana and Elasticsearch use the standard "server.ssl.*" settings instead.',
+        }),
+        documentationUrl: 'https://ela.st/encrypt-kibana-browser',
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('console.deprecations.proxyConfig.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('console.deprecations.proxyConfig.manualStepTwoMessage', {
+              defaultMessage: 'Remove the "console.proxyConfig" setting.',
+            }),
+            i18n.translate('console.deprecations.proxyConfig.manualStepThreeMessage', {
+              defaultMessage:
+                'Configure the secure connection between Kibana and Elasticsearch using the "server.ssl.*" settings.',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'console.proxyFilter') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'console.proxyFilter',
+        level: 'critical',
+        title: i18n.translate('console.deprecations.proxyFilterTitle', {
+          defaultMessage: 'Setting "console.proxyFilter" is deprecated',
+        }),
+        message: i18n.translate('console.deprecations.proxyFilterMessage', {
+          defaultMessage:
+            'Configuring "console.proxyFilter" is deprecated and will be removed in 8.0.0. To secure your connection between Kibana and Elasticsearch use the standard "server.ssl.*" settings instead.',
+        }),
+        documentationUrl: 'https://ela.st/encrypt-kibana-browser',
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('console.deprecations.proxyFilter.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('console.deprecations.proxyFilter.manualStepTwoMessage', {
+              defaultMessage: 'Remove the "console.proxyFilter" setting.',
+            }),
+            i18n.translate('console.deprecations.proxyFilter.manualStepThreeMessage', {
+              defaultMessage:
+                'Configure the secure connection between Kibana and Elasticsearch using the "server.ssl.*" settings.',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
   ],
 };
+
+export const config: PluginConfigDescriptor<ConsoleConfig | ConsoleConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/src/plugins/console/server/index.ts b/src/plugins/console/server/index.ts
index 6ae518f5dc796..b270b89a3d45a 100644
--- a/src/plugins/console/server/index.ts
+++ b/src/plugins/console/server/index.ts
@@ -11,6 +11,7 @@ import { PluginInitializerContext } from 'kibana/server';
 import { ConsoleServerPlugin } from './plugin';
 
 export { ConsoleSetup, ConsoleStart } from './types';
+
 export { config } from './config';
 
 export const plugin = (ctx: PluginInitializerContext) => new ConsoleServerPlugin(ctx);
diff --git a/src/plugins/console/server/plugin.ts b/src/plugins/console/server/plugin.ts
index 613337b286fbf..5543c40d03cb0 100644
--- a/src/plugins/console/server/plugin.ts
+++ b/src/plugins/console/server/plugin.ts
@@ -11,7 +11,7 @@ import { SemVer } from 'semver';
 
 import { ProxyConfigCollection } from './lib';
 import { SpecDefinitionsService, EsLegacyConfigService } from './services';
-import { ConfigType, ConfigType7x } from './config';
+import { ConsoleConfig, ConsoleConfig7x } from './config';
 
 import { registerRoutes } from './routes';
 
@@ -24,11 +24,11 @@ export class ConsoleServerPlugin implements Plugin<ConsoleSetup, ConsoleStart> {
 
   esLegacyConfigService = new EsLegacyConfigService();
 
-  constructor(private readonly ctx: PluginInitializerContext<ConfigType | ConfigType7x>) {
+  constructor(private readonly ctx: PluginInitializerContext<ConsoleConfig | ConsoleConfig7x>) {
     this.log = this.ctx.logger.get();
   }
 
-  setup({ http, capabilities, getStartServices, elasticsearch }: CoreSetup) {
+  setup({ http, capabilities, elasticsearch }: CoreSetup) {
     capabilities.registerProvider(() => ({
       dev_tools: {
         show: true,
@@ -43,8 +43,8 @@ export class ConsoleServerPlugin implements Plugin<ConsoleSetup, ConsoleStart> {
     let proxyConfigCollection: ProxyConfigCollection | undefined;
     if (kibanaVersion.major < 8) {
       // "pathFilters" and "proxyConfig" are only used in 7.x
-      pathFilters = (config as ConfigType7x).proxyFilter.map((str: string) => new RegExp(str));
-      proxyConfigCollection = new ProxyConfigCollection((config as ConfigType7x).proxyConfig);
+      pathFilters = (config as ConsoleConfig7x).proxyFilter.map((str: string) => new RegExp(str));
+      proxyConfigCollection = new ProxyConfigCollection((config as ConsoleConfig7x).proxyConfig);
     }
 
     this.esLegacyConfigService.setup(elasticsearch.legacy.config$);
diff --git a/src/plugins/home/public/application/components/manage_data/manage_data.tsx b/src/plugins/home/public/application/components/manage_data/manage_data.tsx
index b374bdd2e1612..0f465dfcf965f 100644
--- a/src/plugins/home/public/application/components/manage_data/manage_data.tsx
+++ b/src/plugins/home/public/application/components/manage_data/manage_data.tsx
@@ -61,7 +61,8 @@ export const ManageData: FC<Props> = ({ addBasePath, application, features }) =>
             {isDevToolsEnabled || isManagementEnabled ? (
               <EuiFlexItem className="homDataManage__actions" grow={false}>
                 <EuiFlexGroup alignItems="center" responsive={false} wrap>
-                  {isDevToolsEnabled ? (
+                  {/* Check if both the Dev Tools UI and the Console UI are enabled. */}
+                  {isDevToolsEnabled && consoleHref !== undefined ? (
                     <EuiFlexItem grow={false}>
                       <RedirectAppLinks application={application}>
                         <EuiButtonEmpty
diff --git a/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx b/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx
index 36f2f8534399f..e46910c170103 100644
--- a/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx
+++ b/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx
@@ -39,15 +39,17 @@ export const RequestCodeViewer = ({ indexPattern, json }: RequestCodeViewerProps
   const { services } = useKibana<InspectorPluginStartDeps>();
 
   const navigateToUrl = services.application?.navigateToUrl;
-  const canShowDevTools = services.application?.capabilities?.dev_tools.show;
   const devToolsDataUri = compressToEncodedURIComponent(`GET ${indexPattern}/_search\n${json}`);
-  const devToolsHref = services.share.url.locators
+  const consoleHref = services.share.url.locators
     .get('CONSOLE_APP_LOCATOR')
     ?.useUrl({ loadFrom: `data:text/plain,${devToolsDataUri}` });
+  // Check if both the Dev Tools UI and the Console UI are enabled.
+  const canShowDevTools =
+    services.application?.capabilities?.dev_tools.show && consoleHref !== undefined;
   const shouldShowDevToolsLink = !!(indexPattern && canShowDevTools);
   const handleDevToolsLinkClick = useCallback(
-    () => devToolsHref && navigateToUrl && navigateToUrl(devToolsHref),
-    [devToolsHref, navigateToUrl]
+    () => consoleHref && navigateToUrl && navigateToUrl(consoleHref),
+    [consoleHref, navigateToUrl]
   );
 
   return (
@@ -79,7 +81,7 @@ export const RequestCodeViewer = ({ indexPattern, json }: RequestCodeViewerProps
               size="xs"
               flush="right"
               iconType="wrench"
-              href={devToolsHref}
+              href={consoleHref}
               onClick={handleDevToolsLinkClick}
               data-test-subj="inspectorRequestOpenInConsoleButton"
             >
diff --git a/x-pack/plugins/cross_cluster_replication/common/constants/index.ts b/x-pack/plugins/cross_cluster_replication/common/constants/index.ts
index f1b327aed6389..a800afcf77ae4 100644
--- a/x-pack/plugins/cross_cluster_replication/common/constants/index.ts
+++ b/x-pack/plugins/cross_cluster_replication/common/constants/index.ts
@@ -19,6 +19,8 @@ export const PLUGIN = {
   minimumLicenseType: platinumLicense,
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const APPS = {
   CCR_APP: 'ccr',
   REMOTE_CLUSTER_APP: 'remote_cluster',
diff --git a/x-pack/plugins/cross_cluster_replication/server/config.ts b/x-pack/plugins/cross_cluster_replication/server/config.ts
index 50cca903f8a2b..732137e308a0d 100644
--- a/x-pack/plugins/cross_cluster_replication/server/config.ts
+++ b/x-pack/plugins/cross_cluster_replication/server/config.ts
@@ -4,14 +4,96 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<CrossClusterReplicationConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+export type CrossClusterReplicationConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type CrossClusterReplicationConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<CrossClusterReplicationConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.ccr.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.ccr.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.crossClusterReplication.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.ccr.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.crossClusterReplication.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Cross-Cluster Replication UI, use the "xpack.ccr.ui.enabled" setting instead of "xpack.ccr.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate(
+              'xpack.crossClusterReplication.deprecations.enabled.manualStepOneMessage',
+              {
+                defaultMessage: 'Open the kibana.yml config file.',
+              }
+            ),
+            i18n.translate(
+              'xpack.crossClusterReplication.deprecations.enabled.manualStepTwoMessage',
+              {
+                defaultMessage: 'Change the "xpack.ccr.enabled" setting to "xpack.ccr.ui.enabled".',
+              }
+            ),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type CrossClusterReplicationConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<
+  CrossClusterReplicationConfig | CrossClusterReplicationConfig7x
+> = kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/cross_cluster_replication/server/index.ts b/x-pack/plugins/cross_cluster_replication/server/index.ts
index a6a3ec0fe5753..7a0984a6117bf 100644
--- a/x-pack/plugins/cross_cluster_replication/server/index.ts
+++ b/x-pack/plugins/cross_cluster_replication/server/index.ts
@@ -5,17 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 import { CrossClusterReplicationServerPlugin } from './plugin';
-import { configSchema, CrossClusterReplicationConfig } from './config';
+
+export { config } from './config';
 
 export const plugin = (pluginInitializerContext: PluginInitializerContext) =>
   new CrossClusterReplicationServerPlugin(pluginInitializerContext);
-
-export const config: PluginConfigDescriptor<CrossClusterReplicationConfig> = {
-  schema: configSchema,
-  exposeToBrowser: {
-    ui: true,
-  },
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
diff --git a/x-pack/plugins/index_lifecycle_management/common/constants/index.ts b/x-pack/plugins/index_lifecycle_management/common/constants/index.ts
index 7107489f4e2ba..329f479e128e2 100644
--- a/x-pack/plugins/index_lifecycle_management/common/constants/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/common/constants/index.ts
@@ -19,6 +19,8 @@ export const PLUGIN = {
   }),
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const API_BASE_PATH = '/api/index_lifecycle_management';
 
 export { MIN_SEARCHABLE_SNAPSHOT_LICENSE, MIN_PLUGIN_LICENSE };
diff --git a/x-pack/plugins/index_lifecycle_management/server/config.ts b/x-pack/plugins/index_lifecycle_management/server/config.ts
index f3fdf59cec55b..691cc06708bb5 100644
--- a/x-pack/plugins/index_lifecycle_management/server/config.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/config.ts
@@ -4,16 +4,94 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    // Cloud requires the ability to hide internal node attributes from users.
+    filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<IndexLifecycleManagementConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+export type IndexLifecycleManagementConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-  // Cloud requires the ability to hide internal node attributes from users.
-  filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    // Cloud requires the ability to hide internal node attributes from users.
+    filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
+  },
+  { defaultValue: undefined }
+);
+
+export type IndexLifecycleManagementConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<IndexLifecycleManagementConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.ilm.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.ilm.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.ilm.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Index Lifecycle Policies UI, use the "xpack.ilm.ui.enabled" setting instead of "xpack.ilm.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage: 'Change the "xpack.ilm.enabled" setting to "xpack.ilm.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type IndexLifecycleManagementConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<
+  IndexLifecycleManagementConfig | IndexLifecycleManagementConfig7x
+> = kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/index_lifecycle_management/server/index.ts b/x-pack/plugins/index_lifecycle_management/server/index.ts
index 1f8b01913fd3e..6a74b4c80b2d3 100644
--- a/x-pack/plugins/index_lifecycle_management/server/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/index.ts
@@ -5,17 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'kibana/server';
+import { PluginInitializerContext } from 'kibana/server';
 import { IndexLifecycleManagementServerPlugin } from './plugin';
-import { configSchema, IndexLifecycleManagementConfig } from './config';
+
+export { config } from './config';
 
 export const plugin = (ctx: PluginInitializerContext) =>
   new IndexLifecycleManagementServerPlugin(ctx);
-
-export const config: PluginConfigDescriptor<IndexLifecycleManagementConfig> = {
-  schema: configSchema,
-  exposeToBrowser: {
-    ui: true,
-  },
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
diff --git a/x-pack/plugins/index_management/public/plugin.ts b/x-pack/plugins/index_management/public/plugin.ts
index 4e123b6f474f8..2394167ca61b2 100644
--- a/x-pack/plugins/index_management/public/plugin.ts
+++ b/x-pack/plugins/index_management/public/plugin.ts
@@ -13,7 +13,12 @@ import { setExtensionsService } from './application/store/selectors/extension_se
 
 import { ExtensionsService } from './services';
 
-import { IndexManagementPluginSetup, SetupDependencies, StartDependencies } from './types';
+import {
+  IndexManagementPluginSetup,
+  SetupDependencies,
+  StartDependencies,
+  ClientConfigType,
+} from './types';
 
 // avoid import from index files in plugin.ts, use specific import paths
 import { PLUGIN } from '../common/constants/plugin';
@@ -31,25 +36,30 @@ export class IndexMgmtUIPlugin {
     coreSetup: CoreSetup<StartDependencies>,
     plugins: SetupDependencies
   ): IndexManagementPluginSetup {
-    const { fleet, usageCollection, management } = plugins;
-    const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
-
-    management.sections.section.data.registerApp({
-      id: PLUGIN.id,
-      title: i18n.translate('xpack.idxMgmt.appTitle', { defaultMessage: 'Index Management' }),
-      order: 0,
-      mount: async (params) => {
-        const { mountManagementSection } = await import('./application/mount_management_section');
-        return mountManagementSection(
-          coreSetup,
-          usageCollection,
-          params,
-          this.extensionsService,
-          Boolean(fleet),
-          kibanaVersion
-        );
-      },
-    });
+    const {
+      ui: { enabled: isIndexManagementUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
+
+    if (isIndexManagementUiEnabled) {
+      const { fleet, usageCollection, management } = plugins;
+      const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
+      management.sections.section.data.registerApp({
+        id: PLUGIN.id,
+        title: i18n.translate('xpack.idxMgmt.appTitle', { defaultMessage: 'Index Management' }),
+        order: 0,
+        mount: async (params) => {
+          const { mountManagementSection } = await import('./application/mount_management_section');
+          return mountManagementSection(
+            coreSetup,
+            usageCollection,
+            params,
+            this.extensionsService,
+            Boolean(fleet),
+            kibanaVersion
+          );
+        },
+      });
+    }
 
     return {
       extensionsService: this.extensionsService.setup(),
diff --git a/x-pack/plugins/index_management/public/types.ts b/x-pack/plugins/index_management/public/types.ts
index 05c486e299c7a..e0af6b160cf11 100644
--- a/x-pack/plugins/index_management/public/types.ts
+++ b/x-pack/plugins/index_management/public/types.ts
@@ -23,3 +23,9 @@ export interface SetupDependencies {
 export interface StartDependencies {
   share: SharePluginStart;
 }
+
+export interface ClientConfigType {
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/x-pack/plugins/index_management/server/config.ts b/x-pack/plugins/index_management/server/config.ts
index 0a314c7654b16..88a714db5edca 100644
--- a/x-pack/plugins/index_management/server/config.ts
+++ b/x-pack/plugins/index_management/server/config.ts
@@ -4,11 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<IndexManagementConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type IndexManagementConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
+    enabled: schema.boolean({ defaultValue: true }),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type IndexManagementConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<IndexManagementConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.index_management.enabled') === undefined) {
+        return completeConfig;
+      }
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-});
+      addDeprecation({
+        configPath: 'xpack.index_management.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.idxMgmt.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.index_management.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.idxMgmt.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Index Management UI, use the "xpack.index_management.ui.enabled" setting instead of "xpack.index_management.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.idxMgmt.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.idxMgmt.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.index_management.enabled" setting to "xpack.index_management.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type IndexManagementConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<IndexManagementConfig | IndexManagementConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/index_management/server/index.ts b/x-pack/plugins/index_management/server/index.ts
index 14b67e2ffd581..29291116e44fc 100644
--- a/x-pack/plugins/index_management/server/index.ts
+++ b/x-pack/plugins/index_management/server/index.ts
@@ -5,17 +5,13 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 
 import { IndexMgmtServerPlugin } from './plugin';
-import { configSchema } from './config';
 
-export const plugin = (context: PluginInitializerContext) => new IndexMgmtServerPlugin(context);
+export { config } from './config';
 
-export const config: PluginConfigDescriptor = {
-  schema: configSchema,
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
+export const plugin = (context: PluginInitializerContext) => new IndexMgmtServerPlugin(context);
 
 /** @public */
 export { Dependencies } from './types';
diff --git a/x-pack/plugins/license_management/common/constants/index.ts b/x-pack/plugins/license_management/common/constants/index.ts
index 0567b0008f0c8..9735eabeb1e40 100644
--- a/x-pack/plugins/license_management/common/constants/index.ts
+++ b/x-pack/plugins/license_management/common/constants/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export { PLUGIN } from './plugin';
+export { PLUGIN, MAJOR_VERSION } from './plugin';
 export { API_BASE_PATH } from './base_path';
 export { EXTERNAL_LINKS } from './external_links';
 export { APP_PERMISSION } from './permissions';
diff --git a/x-pack/plugins/license_management/common/constants/plugin.ts b/x-pack/plugins/license_management/common/constants/plugin.ts
index ae7fd0f6e8a2e..76f4d94a0188a 100644
--- a/x-pack/plugins/license_management/common/constants/plugin.ts
+++ b/x-pack/plugins/license_management/common/constants/plugin.ts
@@ -13,3 +13,5 @@ export const PLUGIN = {
   }),
   id: 'license_management',
 };
+
+export const MAJOR_VERSION = '8.0.0';
diff --git a/x-pack/plugins/license_management/server/config.ts b/x-pack/plugins/license_management/server/config.ts
index 0e4de29b718be..e378a10191684 100644
--- a/x-pack/plugins/license_management/server/config.ts
+++ b/x-pack/plugins/license_management/server/config.ts
@@ -4,14 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<LicenseManagementConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+export type LicenseManagementConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type LicenseManagementConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<LicenseManagementConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.license_management.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.license_management.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.licenseMgmt.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.license_management.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.licenseMgmt.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the License Management UI, use the "xpack.license_management.ui.enabled" setting instead of "xpack.license_management.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.licenseMgmt.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.licenseMgmt.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.license_management.enabled" setting to "xpack.license_management.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type LicenseManagementConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<LicenseManagementConfig | LicenseManagementConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/license_management/server/index.ts b/x-pack/plugins/license_management/server/index.ts
index e78ffe07b50c0..7aa6bfb06d54d 100644
--- a/x-pack/plugins/license_management/server/index.ts
+++ b/x-pack/plugins/license_management/server/index.ts
@@ -5,17 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 
 import { LicenseManagementServerPlugin } from './plugin';
-import { configSchema, LicenseManagementConfig } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) => new LicenseManagementServerPlugin();
+export { config } from './config';
 
-export const config: PluginConfigDescriptor<LicenseManagementConfig> = {
-  schema: configSchema,
-  exposeToBrowser: {
-    ui: true,
-  },
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
+export const plugin = (ctx: PluginInitializerContext) => new LicenseManagementServerPlugin();
diff --git a/x-pack/plugins/remote_clusters/common/constants.ts b/x-pack/plugins/remote_clusters/common/constants.ts
index b11292141672d..5a36924b26433 100644
--- a/x-pack/plugins/remote_clusters/common/constants.ts
+++ b/x-pack/plugins/remote_clusters/common/constants.ts
@@ -20,6 +20,8 @@ export const PLUGIN = {
   },
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const API_BASE_PATH = '/api/remote_clusters';
 
 export const SNIFF_MODE = 'sniff';
diff --git a/x-pack/plugins/remote_clusters/server/config.ts b/x-pack/plugins/remote_clusters/server/config.ts
index 8f379ec5613c8..5b4972f0a5259 100644
--- a/x-pack/plugins/remote_clusters/server/config.ts
+++ b/x-pack/plugins/remote_clusters/server/config.ts
@@ -4,23 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
-import { PluginConfigDescriptor } from 'kibana/server';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<RemoteClustersConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type RemoteClustersConfig = TypeOf<typeof schemaLatest>;
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
 
-export type ConfigType = TypeOf<typeof configSchema>;
+export type RemoteClustersConfig7x = TypeOf<typeof schema7x>;
 
-export const config: PluginConfigDescriptor<ConfigType> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
+const config7x: PluginConfigDescriptor<RemoteClustersConfig7x> = {
   exposeToBrowser: {
     ui: true,
   },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.remote_clusters.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.remote_clusters.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.remoteClusters.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.remote_clusters.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.remoteClusters.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Remote Clusters UI, use the "xpack.remote_clusters.ui.enabled" setting instead of "xpack.remote_clusters.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.remoteClusters.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.remoteClusters.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.remote_clusters.enabled" setting to "xpack.remote_clusters.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
 };
+
+export const config: PluginConfigDescriptor<RemoteClustersConfig | RemoteClustersConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/remote_clusters/server/plugin.ts b/x-pack/plugins/remote_clusters/server/plugin.ts
index b13773c27034a..fde71677b8448 100644
--- a/x-pack/plugins/remote_clusters/server/plugin.ts
+++ b/x-pack/plugins/remote_clusters/server/plugin.ts
@@ -11,7 +11,7 @@ import { CoreSetup, Logger, Plugin, PluginInitializerContext } from 'src/core/se
 
 import { PLUGIN } from '../common/constants';
 import { Dependencies, LicenseStatus, RouteDependencies } from './types';
-import { ConfigType } from './config';
+import { RemoteClustersConfig, RemoteClustersConfig7x } from './config';
 import {
   registerGetRoute,
   registerAddRoute,
@@ -30,7 +30,7 @@ export class RemoteClustersServerPlugin
 {
   licenseStatus: LicenseStatus;
   log: Logger;
-  config: ConfigType;
+  config: RemoteClustersConfig | RemoteClustersConfig7x;
 
   constructor({ logger, config }: PluginInitializerContext) {
     this.log = logger.get();
diff --git a/x-pack/plugins/rollup/common/index.ts b/x-pack/plugins/rollup/common/index.ts
index dffbfbd182092..c912a905d061d 100644
--- a/x-pack/plugins/rollup/common/index.ts
+++ b/x-pack/plugins/rollup/common/index.ts
@@ -14,6 +14,8 @@ export const PLUGIN = {
   minimumLicenseType: basicLicense,
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const CONFIG_ROLLUPS = 'rollups:enableIndexPatterns';
 
 export const API_BASE_PATH = '/api/rollup';
diff --git a/x-pack/plugins/rollup/public/index.ts b/x-pack/plugins/rollup/public/index.ts
index b70ce86493382..f740971b4bcb0 100644
--- a/x-pack/plugins/rollup/public/index.ts
+++ b/x-pack/plugins/rollup/public/index.ts
@@ -4,7 +4,8 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { PluginInitializerContext } from 'src/core/public';
 
 import { RollupPlugin } from './plugin';
 
-export const plugin = () => new RollupPlugin();
+export const plugin = (ctx: PluginInitializerContext) => new RollupPlugin(ctx);
diff --git a/x-pack/plugins/rollup/public/plugin.ts b/x-pack/plugins/rollup/public/plugin.ts
index 0d345e326193c..e458a13ee0e0e 100644
--- a/x-pack/plugins/rollup/public/plugin.ts
+++ b/x-pack/plugins/rollup/public/plugin.ts
@@ -6,7 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
+import { CoreSetup, CoreStart, Plugin, PluginInitializerContext } from 'kibana/public';
 import { rollupBadgeExtension, rollupToggleExtension } from './extend_index_management';
 // @ts-ignore
 import { RollupIndexPatternCreationConfig } from './index_pattern_creation/rollup_index_pattern_creation_config';
@@ -23,6 +23,7 @@ import { IndexManagementPluginSetup } from '../../index_management/public';
 import { setHttp, init as initDocumentation } from './crud_app/services/index';
 import { setNotifications, setFatalErrors, setUiStatsReporter } from './kibana_services';
 import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/public';
+import { ClientConfigType } from './types';
 
 export interface RollupPluginSetupDependencies {
   home?: HomePublicPluginSetup;
@@ -32,10 +33,16 @@ export interface RollupPluginSetupDependencies {
 }
 
 export class RollupPlugin implements Plugin {
+  constructor(private ctx: PluginInitializerContext) {}
+
   setup(
     core: CoreSetup,
     { home, management, indexManagement, usageCollection }: RollupPluginSetupDependencies
   ) {
+    const {
+      ui: { enabled: isRollupUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
+
     setFatalErrors(core.fatalErrors);
     if (usageCollection) {
       setUiStatsReporter(usageCollection.reportUiCounter.bind(usageCollection, UIM_APP_NAME));
@@ -46,7 +53,7 @@ export class RollupPlugin implements Plugin {
       indexManagement.extensionsService.addToggle(rollupToggleExtension);
     }
 
-    if (home) {
+    if (home && isRollupUiEnabled) {
       home.featureCatalogue.register({
         id: 'rollup_jobs',
         title: 'Rollups',
@@ -61,33 +68,35 @@ export class RollupPlugin implements Plugin {
       });
     }
 
-    const pluginName = i18n.translate('xpack.rollupJobs.appTitle', {
-      defaultMessage: 'Rollup Jobs',
-    });
+    if (isRollupUiEnabled) {
+      const pluginName = i18n.translate('xpack.rollupJobs.appTitle', {
+        defaultMessage: 'Rollup Jobs',
+      });
 
-    management.sections.section.data.registerApp({
-      id: 'rollup_jobs',
-      title: pluginName,
-      order: 4,
-      async mount(params) {
-        const [coreStart] = await core.getStartServices();
+      management.sections.section.data.registerApp({
+        id: 'rollup_jobs',
+        title: pluginName,
+        order: 4,
+        async mount(params) {
+          const [coreStart] = await core.getStartServices();
 
-        const {
-          chrome: { docTitle },
-        } = coreStart;
+          const {
+            chrome: { docTitle },
+          } = coreStart;
 
-        docTitle.change(pluginName);
-        params.setBreadcrumbs([{ text: pluginName }]);
+          docTitle.change(pluginName);
+          params.setBreadcrumbs([{ text: pluginName }]);
 
-        const { renderApp } = await import('./application');
-        const unmountAppCallback = await renderApp(core, params);
+          const { renderApp } = await import('./application');
+          const unmountAppCallback = await renderApp(core, params);
 
-        return () => {
-          docTitle.reset();
-          unmountAppCallback();
-        };
-      },
-    });
+          return () => {
+            docTitle.reset();
+            unmountAppCallback();
+          };
+        },
+      });
+    }
   }
 
   start(core: CoreStart) {
diff --git a/x-pack/plugins/rollup/public/types.ts b/x-pack/plugins/rollup/public/types.ts
new file mode 100644
index 0000000000000..dc5e55e9268f8
--- /dev/null
+++ b/x-pack/plugins/rollup/public/types.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export interface ClientConfigType {
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/x-pack/plugins/rollup/server/config.ts b/x-pack/plugins/rollup/server/config.ts
index d20b317422107..c0cca4bbb4d33 100644
--- a/x-pack/plugins/rollup/server/config.ts
+++ b/x-pack/plugins/rollup/server/config.ts
@@ -4,11 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<RollupConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type RollupConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
+    enabled: schema.boolean({ defaultValue: true }),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type RollupConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<RollupConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.rollup.enabled') === undefined) {
+        return completeConfig;
+      }
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-});
+      addDeprecation({
+        configPath: 'xpack.rollup.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.rollupJobs.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.rollup.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.rollupJobs.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Rollup Jobs UI, use the "xpack.rollup.ui.enabled" setting instead of "xpack.rollup.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.rollupJobs.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.rollupJobs.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.rollup.enabled" setting to "xpack.rollup.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type RollupConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<RollupConfig | RollupConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/rollup/server/index.ts b/x-pack/plugins/rollup/server/index.ts
index e77e0e6f15d72..6ae1d9f24b8b9 100644
--- a/x-pack/plugins/rollup/server/index.ts
+++ b/x-pack/plugins/rollup/server/index.ts
@@ -5,14 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 import { RollupPlugin } from './plugin';
-import { configSchema, RollupConfig } from './config';
+
+export { config } from './config';
 
 export const plugin = (pluginInitializerContext: PluginInitializerContext) =>
   new RollupPlugin(pluginInitializerContext);
-
-export const config: PluginConfigDescriptor<RollupConfig> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
-};
diff --git a/x-pack/plugins/snapshot_restore/common/constants.ts b/x-pack/plugins/snapshot_restore/common/constants.ts
index b18e118dc5ff6..df13bd4c2f1f0 100644
--- a/x-pack/plugins/snapshot_restore/common/constants.ts
+++ b/x-pack/plugins/snapshot_restore/common/constants.ts
@@ -20,6 +20,8 @@ export const PLUGIN = {
   },
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const API_BASE_PATH = '/api/snapshot_restore/';
 
 export enum REPOSITORY_TYPES {
diff --git a/x-pack/plugins/snapshot_restore/public/plugin.ts b/x-pack/plugins/snapshot_restore/public/plugin.ts
index bb091a1fd1831..0351716fad5b5 100644
--- a/x-pack/plugins/snapshot_restore/public/plugin.ts
+++ b/x-pack/plugins/snapshot_restore/public/plugin.ts
@@ -42,52 +42,58 @@ export class SnapshotRestoreUIPlugin {
 
   public setup(coreSetup: CoreSetup, plugins: PluginsDependencies): void {
     const config = this.initializerContext.config.get<ClientConfigType>();
-    const { http } = coreSetup;
-    const { home, management, usageCollection } = plugins;
+    const {
+      ui: { enabled: isSnapshotRestoreUiEnabled },
+    } = config;
 
-    // Initialize services
-    this.uiMetricService.setup(usageCollection);
-    textService.setup(i18n);
-    httpService.setup(http);
+    if (isSnapshotRestoreUiEnabled) {
+      const { http } = coreSetup;
+      const { home, management, usageCollection } = plugins;
 
-    management.sections.section.data.registerApp({
-      id: PLUGIN.id,
-      title: i18n.translate('xpack.snapshotRestore.appTitle', {
-        defaultMessage: 'Snapshot and Restore',
-      }),
-      order: 3,
-      mount: async (params) => {
-        const { mountManagementSection } = await import('./application/mount_management_section');
-        const services = {
-          uiMetricService: this.uiMetricService,
-        };
-        return await mountManagementSection(coreSetup, services, config, params);
-      },
-    });
+      // Initialize services
+      this.uiMetricService.setup(usageCollection);
+      textService.setup(i18n);
+      httpService.setup(http);
 
-    if (home) {
-      home.featureCatalogue.register({
+      management.sections.section.data.registerApp({
         id: PLUGIN.id,
-        title: i18n.translate('xpack.snapshotRestore.featureCatalogueTitle', {
-          defaultMessage: 'Back up and restore',
+        title: i18n.translate('xpack.snapshotRestore.appTitle', {
+          defaultMessage: 'Snapshot and Restore',
         }),
-        description: i18n.translate('xpack.snapshotRestore.featureCatalogueDescription', {
-          defaultMessage:
-            'Save snapshots to a backup repository, and restore to recover index and cluster state.',
-        }),
-        icon: 'storage',
-        path: '/app/management/data/snapshot_restore',
-        showOnHomePage: true,
-        category: FeatureCatalogueCategory.ADMIN,
-        order: 630,
+        order: 3,
+        mount: async (params) => {
+          const { mountManagementSection } = await import('./application/mount_management_section');
+          const services = {
+            uiMetricService: this.uiMetricService,
+          };
+          return await mountManagementSection(coreSetup, services, config, params);
+        },
       });
-    }
 
-    plugins.share.url.locators.create(
-      new SnapshotRestoreLocatorDefinition({
-        managementAppLocator: plugins.management.locator,
-      })
-    );
+      if (home) {
+        home.featureCatalogue.register({
+          id: PLUGIN.id,
+          title: i18n.translate('xpack.snapshotRestore.featureCatalogueTitle', {
+            defaultMessage: 'Back up and restore',
+          }),
+          description: i18n.translate('xpack.snapshotRestore.featureCatalogueDescription', {
+            defaultMessage:
+              'Save snapshots to a backup repository, and restore to recover index and cluster state.',
+          }),
+          icon: 'storage',
+          path: '/app/management/data/snapshot_restore',
+          showOnHomePage: true,
+          category: FeatureCatalogueCategory.ADMIN,
+          order: 630,
+        });
+      }
+
+      plugins.share.url.locators.create(
+        new SnapshotRestoreLocatorDefinition({
+          managementAppLocator: plugins.management.locator,
+        })
+      );
+    }
   }
 
   public start() {}
diff --git a/x-pack/plugins/snapshot_restore/public/types.ts b/x-pack/plugins/snapshot_restore/public/types.ts
index b73170ad9d578..c58c942b4bc16 100644
--- a/x-pack/plugins/snapshot_restore/public/types.ts
+++ b/x-pack/plugins/snapshot_restore/public/types.ts
@@ -7,4 +7,5 @@
 
 export interface ClientConfigType {
   slm_ui: { enabled: boolean };
+  ui: { enabled: boolean };
 }
diff --git a/x-pack/plugins/snapshot_restore/server/config.ts b/x-pack/plugins/snapshot_restore/server/config.ts
index f0ca416ef2032..cc430f4756610 100644
--- a/x-pack/plugins/snapshot_restore/server/config.ts
+++ b/x-pack/plugins/snapshot_restore/server/config.ts
@@ -4,14 +4,98 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    slm_ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<SnapshotRestoreConfig> = {
+  exposeToBrowser: {
+    ui: true,
+    slm_ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  slm_ui: schema.object({
+export type SnapshotRestoreConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    slm_ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type SnapshotRestoreConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<SnapshotRestoreConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+    slm_ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.snapshot_restore.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.snapshot_restore.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.snapshotRestore.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.snapshot_restore.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.snapshotRestore.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Snapshot and Restore UI, use the "xpack.snapshot_restore.ui.enabled" setting instead of "xpack.snapshot_restore.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.snapshotRestore.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.snapshotRestore.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.snapshot_restore.enabled" setting to "xpack.snapshot_restore.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type SnapshotRestoreConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<SnapshotRestoreConfig | SnapshotRestoreConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/snapshot_restore/server/index.ts b/x-pack/plugins/snapshot_restore/server/index.ts
index e10bffd6073d2..1e9d2b55aa20b 100644
--- a/x-pack/plugins/snapshot_restore/server/index.ts
+++ b/x-pack/plugins/snapshot_restore/server/index.ts
@@ -5,16 +5,9 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'kibana/server';
+import { PluginInitializerContext } from 'kibana/server';
 import { SnapshotRestoreServerPlugin } from './plugin';
-import { configSchema, SnapshotRestoreConfig } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) => new SnapshotRestoreServerPlugin(ctx);
+export { config } from './config';
 
-export const config: PluginConfigDescriptor<SnapshotRestoreConfig> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
-  exposeToBrowser: {
-    slm_ui: true,
-  },
-};
+export const plugin = (ctx: PluginInitializerContext) => new SnapshotRestoreServerPlugin(ctx);
diff --git a/x-pack/plugins/snapshot_restore/server/plugin.ts b/x-pack/plugins/snapshot_restore/server/plugin.ts
index 4414e3735959b..d737807ec8dad 100644
--- a/x-pack/plugins/snapshot_restore/server/plugin.ts
+++ b/x-pack/plugins/snapshot_restore/server/plugin.ts
@@ -28,16 +28,9 @@ export class SnapshotRestoreServerPlugin implements Plugin<void, void, any, any>
     this.license = new License();
   }
 
-  public setup(
-    { http, getStartServices }: CoreSetup,
-    { licensing, features, security, cloud }: Dependencies
-  ): void {
+  public setup({ http }: CoreSetup, { licensing, features, security, cloud }: Dependencies): void {
     const pluginConfig = this.context.config.get<SnapshotRestoreConfig>();
 
-    if (!pluginConfig.enabled) {
-      return;
-    }
-
     const router = http.createRouter();
 
     this.license.setup(
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
index b19c8b3d0f082..b2a1c4e80ec7d 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
@@ -9,4 +9,4 @@ export { setup as setupOverviewPage, OverviewTestBed } from './overview.helpers'
 export { setup as setupElasticsearchPage, ElasticsearchTestBed } from './elasticsearch.helpers';
 export { setup as setupKibanaPage, KibanaTestBed } from './kibana.helpers';
 
-export { setupEnvironment } from './setup_environment';
+export { setupEnvironment, kibanaVersion } from './setup_environment';
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx
index a1cdfaa3446cb..fbbbc0e07853c 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 import axios from 'axios';
 // @ts-ignore
 import axiosXhrAdapter from 'axios/lib/adapters/xhr';
-
+import SemVer from 'semver/classes/semver';
 import {
   deprecationsServiceMock,
   docLinksServiceMock,
@@ -19,7 +19,7 @@ import {
 import { HttpSetup } from 'src/core/public';
 
 import { KibanaContextProvider } from '../../../public/shared_imports';
-import { mockKibanaSemverVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { AppContextProvider } from '../../../public/application/app_context';
 import { apiService } from '../../../public/application/lib/api';
 import { breadcrumbService } from '../../../public/application/lib/breadcrumbs';
@@ -31,6 +31,8 @@ const { GlobalFlyoutProvider } = GlobalFlyout;
 
 const mockHttpClient = axios.create({ adapter: axiosXhrAdapter });
 
+export const kibanaVersion = new SemVer(MAJOR_VERSION);
+
 export const WithAppDependencies =
   (Comp: any, overrides: Record<string, unknown> = {}) =>
   (props: Record<string, unknown>) => {
@@ -41,9 +43,9 @@ export const WithAppDependencies =
       http: mockHttpClient as unknown as HttpSetup,
       docLinks: docLinksServiceMock.createStartContract(),
       kibanaVersionInfo: {
-        currentMajor: mockKibanaSemverVersion.major,
-        prevMajor: mockKibanaSemverVersion.major - 1,
-        nextMajor: mockKibanaSemverVersion.major + 1,
+        currentMajor: kibanaVersion.major,
+        prevMajor: kibanaVersion.major - 1,
+        nextMajor: kibanaVersion.major + 1,
       },
       notifications: notificationServiceMock.createStartContract(),
       isReadOnlyMode: false,
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx
index 0acf5ae65c6cc..7831ab0110e4f 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import { mockKibanaSemverVersion } from '../../../common/constants';
-import { OverviewTestBed, setupOverviewPage, setupEnvironment } from '../helpers';
+import { OverviewTestBed, setupOverviewPage, setupEnvironment, kibanaVersion } from '../helpers';
 
 describe('Overview Page', () => {
   let testBed: OverviewTestBed;
@@ -24,7 +23,7 @@ describe('Overview Page', () => {
   describe('Documentation links', () => {
     test('Has a whatsNew link and it references nextMajor version', () => {
       const { exists, find } = testBed;
-      const nextMajor = mockKibanaSemverVersion.major + 1;
+      const nextMajor = kibanaVersion.major + 1;
 
       expect(exists('whatsNewLink')).toBe(true);
       expect(find('whatsNewLink').text()).toContain(`${nextMajor}.0`);
diff --git a/x-pack/plugins/upgrade_assistant/common/config.ts b/x-pack/plugins/upgrade_assistant/common/config.ts
deleted file mode 100644
index e74fe5cc1bf16..0000000000000
--- a/x-pack/plugins/upgrade_assistant/common/config.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { schema, TypeOf } from '@kbn/config-schema';
-
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  /*
-   * This will default to true up until the last minor before the next major.
-   * In readonly mode, the user will not be able to perform any actions in the UI
-   * and will be presented with a message indicating as such.
-   */
-  readonly: schema.boolean({ defaultValue: true }),
-});
-
-export type Config = TypeOf<typeof configSchema>;
diff --git a/x-pack/plugins/upgrade_assistant/common/constants.ts b/x-pack/plugins/upgrade_assistant/common/constants.ts
index 893d61d329534..68a6b9e9cdb83 100644
--- a/x-pack/plugins/upgrade_assistant/common/constants.ts
+++ b/x-pack/plugins/upgrade_assistant/common/constants.ts
@@ -4,15 +4,11 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import SemVer from 'semver/classes/semver';
-
 /*
- * These constants are used only in tests to add conditional logic based on Kibana version
  * On master, the version should represent the next major version (e.g., master --> 8.0.0)
  * The release branch should match the release version (e.g., 7.x --> 7.0.0)
  */
-export const mockKibanaVersion = '8.0.0';
-export const mockKibanaSemverVersion = new SemVer(mockKibanaVersion);
+export const MAJOR_VERSION = '8.0.0';
 
 /*
  * Map of 7.0 --> 8.0 index setting deprecation log messages and associated settings
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx
index ff11b9f1a8450..d2cafd69e94eb 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx
@@ -8,12 +8,20 @@
 import { I18nProvider } from '@kbn/i18n/react';
 import { mount, shallow } from 'enzyme';
 import React from 'react';
+import SemVer from 'semver/classes/semver';
 
 import { ReindexWarning } from '../../../../../../../common/types';
-import { mockKibanaSemverVersion } from '../../../../../../../common/constants';
+import { MAJOR_VERSION } from '../../../../../../../common/constants';
 
 import { idForWarning, WarningsFlyoutStep } from './warnings_step';
 
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+const mockKibanaVersionInfo = {
+  currentMajor: kibanaVersion.major,
+  prevMajor: kibanaVersion.major - 1,
+  nextMajor: kibanaVersion.major + 1,
+};
+
 jest.mock('../../../../../app_context', () => {
   const { docLinksServiceMock } = jest.requireActual(
     '../../../../../../../../../../src/core/public/doc_links/doc_links_service.mock'
@@ -23,11 +31,7 @@ jest.mock('../../../../../app_context', () => {
     useAppContext: () => {
       return {
         docLinks: docLinksServiceMock.createStartContract(),
-        kibanaVersionInfo: {
-          currentMajor: mockKibanaSemverVersion.major,
-          prevMajor: mockKibanaSemverVersion.major - 1,
-          nextMajor: mockKibanaSemverVersion.major + 1,
-        },
+        kibanaVersionInfo: mockKibanaVersionInfo,
       };
     },
   };
@@ -45,7 +49,7 @@ describe('WarningsFlyoutStep', () => {
     expect(shallow(<WarningsFlyoutStep {...defaultProps} />)).toMatchSnapshot();
   });
 
-  if (mockKibanaSemverVersion.major === 7) {
+  if (kibanaVersion.major === 7) {
     it('does not allow proceeding until all are checked', () => {
       const defaultPropsWithWarnings = {
         ...defaultProps,
diff --git a/x-pack/plugins/upgrade_assistant/public/plugin.ts b/x-pack/plugins/upgrade_assistant/public/plugin.ts
index 5edb638e1bc5b..32e825fbdc20d 100644
--- a/x-pack/plugins/upgrade_assistant/public/plugin.ts
+++ b/x-pack/plugins/upgrade_assistant/public/plugin.ts
@@ -9,59 +9,69 @@ import SemVer from 'semver/classes/semver';
 import { i18n } from '@kbn/i18n';
 import { Plugin, CoreSetup, PluginInitializerContext } from 'src/core/public';
 
-import { SetupDependencies, StartDependencies, AppServicesContext } from './types';
-import { Config } from '../common/config';
+import {
+  SetupDependencies,
+  StartDependencies,
+  AppServicesContext,
+  ClientConfigType,
+} from './types';
 
 export class UpgradeAssistantUIPlugin
   implements Plugin<void, void, SetupDependencies, StartDependencies>
 {
   constructor(private ctx: PluginInitializerContext) {}
+
   setup(coreSetup: CoreSetup<StartDependencies>, { management, cloud }: SetupDependencies) {
-    const { readonly } = this.ctx.config.get<Config>();
+    const {
+      readonly,
+      ui: { enabled: isUpgradeAssistantUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
 
-    const appRegistrar = management.sections.section.stack;
-    const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
+    if (isUpgradeAssistantUiEnabled) {
+      const appRegistrar = management.sections.section.stack;
+      const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
 
-    const kibanaVersionInfo = {
-      currentMajor: kibanaVersion.major,
-      prevMajor: kibanaVersion.major - 1,
-      nextMajor: kibanaVersion.major + 1,
-    };
+      const kibanaVersionInfo = {
+        currentMajor: kibanaVersion.major,
+        prevMajor: kibanaVersion.major - 1,
+        nextMajor: kibanaVersion.major + 1,
+      };
 
-    const pluginName = i18n.translate('xpack.upgradeAssistant.appTitle', {
-      defaultMessage: '{version} Upgrade Assistant',
-      values: { version: `${kibanaVersionInfo.nextMajor}.0` },
-    });
+      const pluginName = i18n.translate('xpack.upgradeAssistant.appTitle', {
+        defaultMessage: '{version} Upgrade Assistant',
+        values: { version: `${kibanaVersionInfo.nextMajor}.0` },
+      });
 
-    appRegistrar.registerApp({
-      id: 'upgrade_assistant',
-      title: pluginName,
-      order: 1,
-      async mount(params) {
-        const [coreStart, { discover, data }] = await coreSetup.getStartServices();
-        const services: AppServicesContext = { discover, data, cloud };
+      appRegistrar.registerApp({
+        id: 'upgrade_assistant',
+        title: pluginName,
+        order: 1,
+        async mount(params) {
+          const [coreStart, { discover, data }] = await coreSetup.getStartServices();
+          const services: AppServicesContext = { discover, data, cloud };
 
-        const {
-          chrome: { docTitle },
-        } = coreStart;
+          const {
+            chrome: { docTitle },
+          } = coreStart;
 
-        docTitle.change(pluginName);
+          docTitle.change(pluginName);
 
-        const { mountManagementSection } = await import('./application/mount_management_section');
-        const unmountAppCallback = await mountManagementSection(
-          coreSetup,
-          params,
-          kibanaVersionInfo,
-          readonly,
-          services
-        );
+          const { mountManagementSection } = await import('./application/mount_management_section');
+          const unmountAppCallback = await mountManagementSection(
+            coreSetup,
+            params,
+            kibanaVersionInfo,
+            readonly,
+            services
+          );
 
-        return () => {
-          docTitle.reset();
-          unmountAppCallback();
-        };
-      },
-    });
+          return () => {
+            docTitle.reset();
+            unmountAppCallback();
+          };
+        },
+      });
+    }
   }
 
   start() {}
diff --git a/x-pack/plugins/upgrade_assistant/public/types.ts b/x-pack/plugins/upgrade_assistant/public/types.ts
index a2b49305c32d4..cbeaf22bb095b 100644
--- a/x-pack/plugins/upgrade_assistant/public/types.ts
+++ b/x-pack/plugins/upgrade_assistant/public/types.ts
@@ -26,3 +26,10 @@ export interface StartDependencies {
   discover: DiscoverStart;
   data: DataPublicPluginStart;
 }
+
+export interface ClientConfigType {
+  readonly: boolean;
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/x-pack/plugins/upgrade_assistant/server/config.ts b/x-pack/plugins/upgrade_assistant/server/config.ts
new file mode 100644
index 0000000000000..4183ea337def1
--- /dev/null
+++ b/x-pack/plugins/upgrade_assistant/server/config.ts
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
+import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    /*
+     * This will default to true up until the last minor before the next major.
+     * In readonly mode, the user will not be able to perform any actions in the UI
+     * and will be presented with a message indicating as such.
+     */
+    readonly: schema.boolean({ defaultValue: true }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<UpgradeAssistantConfig> = {
+  exposeToBrowser: {
+    ui: true,
+    readonly: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type UpgradeAssistantConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
+    enabled: schema.boolean({ defaultValue: true }),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    /*
+     * This will default to true up until the last minor before the next major.
+     * In readonly mode, the user will not be able to perform any actions in the UI
+     * and will be presented with a message indicating as such.
+     */
+    readonly: schema.boolean({ defaultValue: true }),
+  },
+  { defaultValue: undefined }
+);
+
+export type UpgradeAssistantConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<UpgradeAssistantConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+    readonly: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.upgrade_assistant.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.upgrade_assistant.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.upgradeAssistant.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.upgrade_assistant.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.upgradeAssistant.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Upgrade Assistant UI, use the "xpack.upgrade_assistant.ui.enabled" setting instead of "xpack.upgrade_assistant.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.upgradeAssistant.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.upgradeAssistant.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.upgrade_assistant.enabled" setting to "xpack.upgrade_assistant.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
+
+export const config: PluginConfigDescriptor<UpgradeAssistantConfig | UpgradeAssistantConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/upgrade_assistant/server/index.ts b/x-pack/plugins/upgrade_assistant/server/index.ts
index 5591276b2fa34..660aa107292e8 100644
--- a/x-pack/plugins/upgrade_assistant/server/index.ts
+++ b/x-pack/plugins/upgrade_assistant/server/index.ts
@@ -5,18 +5,11 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 import { UpgradeAssistantServerPlugin } from './plugin';
-import { configSchema, Config } from '../common/config';
+
+export { config } from './config';
 
 export const plugin = (ctx: PluginInitializerContext) => {
   return new UpgradeAssistantServerPlugin(ctx);
 };
-
-export const config: PluginConfigDescriptor<Config> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
-  exposeToBrowser: {
-    readonly: true,
-  },
-};
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts b/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts
index d93fe7920f1d7..5f39e902c75d9 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts
@@ -4,14 +4,16 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { SemVer } from 'semver';
+import { MAJOR_VERSION } from '../../../common/constants';
 
-import { mockKibanaSemverVersion } from '../../../common/constants';
+const kibanaVersion = new SemVer(MAJOR_VERSION);
 
 export const getMockVersionInfo = () => {
-  const currentMajor = mockKibanaSemverVersion.major;
+  const currentMajor = kibanaVersion.major;
 
   return {
-    currentVersion: mockKibanaSemverVersion,
+    currentVersion: kibanaVersion,
     currentMajor,
     prevMajor: currentMajor - 1,
     nextMajor: currentMajor + 1,
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts
index e1817ef63927d..1785491e5da45 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts
@@ -9,7 +9,7 @@ import { SemVer } from 'semver';
 import { IScopedClusterClient, kibanaResponseFactory } from 'src/core/server';
 import { coreMock } from 'src/core/server/mocks';
 import { licensingMock } from '../../../../plugins/licensing/server/mocks';
-import { mockKibanaVersion } from '../../common/constants';
+import { MAJOR_VERSION } from '../../common/constants';
 import { getMockVersionInfo } from './__fixtures__/version';
 
 import {
@@ -98,7 +98,7 @@ describe('verifyAllMatchKibanaVersion', () => {
 
 describe('EsVersionPrecheck', () => {
   beforeEach(() => {
-    versionService.setup(mockKibanaVersion);
+    versionService.setup(MAJOR_VERSION);
   });
 
   it('returns a 403 when callCluster fails with a 403', async () => {
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts
index 30093a9fb6e50..957198cde8da9 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { mockKibanaSemverVersion, mockKibanaVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { versionService } from '../version';
 import { getMockVersionInfo } from '../__fixtures__/version';
 
@@ -131,7 +131,7 @@ describe('transformFlatSettings', () => {
 
   describe('sourceNameForIndex', () => {
     beforeEach(() => {
-      versionService.setup(mockKibanaVersion);
+      versionService.setup(MAJOR_VERSION);
     });
 
     it('parses internal indices', () => {
@@ -152,7 +152,7 @@ describe('transformFlatSettings', () => {
 
   describe('generateNewIndexName', () => {
     beforeEach(() => {
-      versionService.setup(mockKibanaVersion);
+      versionService.setup(MAJOR_VERSION);
     });
 
     it('parses internal indices', () => {
@@ -186,7 +186,7 @@ describe('transformFlatSettings', () => {
       ).toEqual([]);
     });
 
-    if (mockKibanaSemverVersion.major === 7) {
+    if (currentMajor === 7) {
       describe('[7.x] customTypeName warning', () => {
         it('returns customTypeName warning for non-_doc mapping types', () => {
           expect(
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts
index 3cfdb1fdd3167..ce1e8e11eb2d1 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts
@@ -19,7 +19,7 @@ import {
   ReindexStatus,
   ReindexStep,
 } from '../../../common/types';
-import { mockKibanaVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { versionService } from '../version';
 import { LOCK_WINDOW, ReindexActions, reindexActionsFactory } from './reindex_actions';
 import { getMockVersionInfo } from '../__fixtures__/version';
@@ -54,7 +54,7 @@ describe('ReindexActions', () => {
 
   describe('createReindexOp', () => {
     beforeEach(() => {
-      versionService.setup(mockKibanaVersion);
+      versionService.setup(MAJOR_VERSION);
       client.create.mockResolvedValue();
     });
 
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts
index 7a5bf1c187698..6017691a9328d 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts
@@ -20,7 +20,7 @@ import {
   ReindexStatus,
   ReindexStep,
 } from '../../../common/types';
-import { mockKibanaVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { licensingMock } from '../../../../licensing/server/mocks';
 import { LicensingPluginSetup } from '../../../../licensing/server';
 
@@ -89,7 +89,7 @@ describe('reindexService', () => {
       licensingPluginSetup
     );
 
-    versionService.setup(mockKibanaVersion);
+    versionService.setup(MAJOR_VERSION);
   });
 
   describe('hasRequiredPrivileges', () => {

From c1b0565acdbbcf7432a46a0664a91c34f299dab3 Mon Sep 17 00:00:00 2001
From: Tre <wayne.seymour@elastic.co>
Date: Tue, 19 Oct 2021 06:56:35 -0400
Subject: [PATCH 7/8] [QA][refactor] Use ui settings - sample data (#114530)

---
 test/functional/apps/home/_sample_data.ts   | 21 +++++++++------------
 test/functional/page_objects/common_page.ts |  9 +++++++++
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/test/functional/apps/home/_sample_data.ts b/test/functional/apps/home/_sample_data.ts
index 3cf387133bc9c..e0a96940337e2 100644
--- a/test/functional/apps/home/_sample_data.ts
+++ b/test/functional/apps/home/_sample_data.ts
@@ -31,6 +31,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     after(async () => {
       await security.testUser.restoreDefaults();
+      await PageObjects.common.unsetTime();
     });
 
     it('should display registered flights sample data sets', async () => {
@@ -74,6 +75,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     describe('dashboard', () => {
       beforeEach(async () => {
+        await time();
         await PageObjects.common.navigateToUrl('home', '/tutorial_directory/sampleData', {
           useActualUrl: true,
         });
@@ -84,10 +86,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('flights');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(17);
       });
@@ -112,10 +110,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('logs');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(13);
       });
@@ -124,10 +118,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('ecommerce');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(15);
       });
@@ -160,5 +150,12 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         expect(isInstalled).to.be(false);
       });
     });
+
+    async function time() {
+      const today = moment().format('MMM D, YYYY');
+      const from = `${today} @ 00:00:00.000`;
+      const to = `${today} @ 23:59:59.999`;
+      await PageObjects.common.setTime({ from, to });
+    }
   });
 }
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index 64fb184f40e48..a40465b00dbeb 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -30,6 +30,7 @@ export class CommonPageObject extends FtrService {
   private readonly globalNav = this.ctx.getService('globalNav');
   private readonly testSubjects = this.ctx.getService('testSubjects');
   private readonly loginPage = this.ctx.getPageObject('login');
+  private readonly kibanaServer = this.ctx.getService('kibanaServer');
 
   private readonly defaultTryTimeout = this.config.get('timeouts.try');
   private readonly defaultFindTimeout = this.config.get('timeouts.find');
@@ -500,4 +501,12 @@ export class CommonPageObject extends FtrService {
       await this.testSubjects.exists(validator);
     }
   }
+
+  async setTime(time: { from: string; to: string }) {
+    await this.kibanaServer.uiSettings.replace({ 'timepicker:timeDefaults': JSON.stringify(time) });
+  }
+
+  async unsetTime() {
+    await this.kibanaServer.uiSettings.unset('timepicker:timeDefaults');
+  }
 }

From f8041e6005a10b73fd771b9b8e2c8d9a22bfce84 Mon Sep 17 00:00:00 2001
From: Pete Harverson <peteharverson@users.noreply.github.com>
Date: Tue, 19 Oct 2021 11:57:10 +0100
Subject: [PATCH 8/8] [ML] Delete annotation directly from the index it is
 stored in (#115328)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../ml/common/constants/index_patterns.ts     |  1 -
 .../ml/server/lib/check_annotations/index.ts  | 11 ++-----
 .../annotation_service/annotation.test.ts     |  3 +-
 .../models/annotation_service/annotation.ts   | 33 ++++++++++++++++---
 4 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/x-pack/plugins/ml/common/constants/index_patterns.ts b/x-pack/plugins/ml/common/constants/index_patterns.ts
index d7d6c343e282b..9a8e5c1b8ae78 100644
--- a/x-pack/plugins/ml/common/constants/index_patterns.ts
+++ b/x-pack/plugins/ml/common/constants/index_patterns.ts
@@ -7,7 +7,6 @@
 
 export const ML_ANNOTATIONS_INDEX_ALIAS_READ = '.ml-annotations-read';
 export const ML_ANNOTATIONS_INDEX_ALIAS_WRITE = '.ml-annotations-write';
-export const ML_ANNOTATIONS_INDEX_PATTERN = '.ml-annotations-6';
 
 export const ML_RESULTS_INDEX_PATTERN = '.ml-anomalies-*';
 export const ML_NOTIFICATION_INDEX_PATTERN = '.ml-notifications*';
diff --git a/x-pack/plugins/ml/server/lib/check_annotations/index.ts b/x-pack/plugins/ml/server/lib/check_annotations/index.ts
index a388a24d082a6..e64b4658588cb 100644
--- a/x-pack/plugins/ml/server/lib/check_annotations/index.ts
+++ b/x-pack/plugins/ml/server/lib/check_annotations/index.ts
@@ -11,22 +11,15 @@ import { mlLog } from '../../lib/log';
 import {
   ML_ANNOTATIONS_INDEX_ALIAS_READ,
   ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
-  ML_ANNOTATIONS_INDEX_PATTERN,
 } from '../../../common/constants/index_patterns';
 
 // Annotations Feature is available if:
-// - ML_ANNOTATIONS_INDEX_PATTERN index is present
 // - ML_ANNOTATIONS_INDEX_ALIAS_READ alias is present
 // - ML_ANNOTATIONS_INDEX_ALIAS_WRITE alias is present
+// Note there is no need to check for the existence of the indices themselves as aliases are stored
+// in the metadata of the indices they point to, so it's impossible to have an alias that doesn't point to any index.
 export async function isAnnotationsFeatureAvailable({ asInternalUser }: IScopedClusterClient) {
   try {
-    const indexParams = { index: ML_ANNOTATIONS_INDEX_PATTERN };
-
-    const { body: annotationsIndexExists } = await asInternalUser.indices.exists(indexParams);
-    if (!annotationsIndexExists) {
-      return false;
-    }
-
     const { body: annotationsReadAliasExists } = await asInternalUser.indices.existsAlias({
       index: ML_ANNOTATIONS_INDEX_ALIAS_READ,
       name: ML_ANNOTATIONS_INDEX_ALIAS_READ,
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
index 725e0ac494944..975070e92a7ec 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
@@ -9,7 +9,6 @@ import getAnnotationsRequestMock from './__mocks__/get_annotations_request.json'
 import getAnnotationsResponseMock from './__mocks__/get_annotations_response.json';
 
 import { ANNOTATION_TYPE } from '../../../common/constants/annotations';
-import { ML_ANNOTATIONS_INDEX_ALIAS_WRITE } from '../../../common/constants/index_patterns';
 import { Annotation, isAnnotations } from '../../../common/types/annotations';
 
 import { DeleteParams, GetResponse, IndexAnnotationArgs } from './annotation';
@@ -42,7 +41,7 @@ describe('annotation_service', () => {
 
       const annotationMockId = 'mockId';
       const deleteParamsMock: DeleteParams = {
-        index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
+        index: '.ml-annotations-6',
         id: annotationMockId,
         refresh: 'wait_for',
       };
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
index c6ed72de18d05..5807d181cc566 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
@@ -71,6 +71,7 @@ export interface IndexParams {
   index: string;
   body: Annotation;
   refresh: boolean | 'wait_for' | undefined;
+  require_alias?: boolean;
   id?: string;
 }
 
@@ -99,6 +100,7 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
       index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
       body: annotation,
       refresh: 'wait_for',
+      require_alias: true,
     };
 
     if (typeof annotation._id !== 'undefined') {
@@ -407,14 +409,37 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
   }
 
   async function deleteAnnotation(id: string) {
-    const params: DeleteParams = {
-      index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
+    // Find the index the annotation is stored in.
+    const searchParams: estypes.SearchRequest = {
+      index: ML_ANNOTATIONS_INDEX_ALIAS_READ,
+      size: 1,
+      body: {
+        query: {
+          ids: {
+            values: [id],
+          },
+        },
+      },
+    };
+
+    const { body } = await asInternalUser.search(searchParams);
+    const totalCount =
+      typeof body.hits.total === 'number' ? body.hits.total : body.hits.total.value;
+
+    if (totalCount === 0) {
+      throw Boom.notFound(`Cannot find annotation with ID ${id}`);
+    }
+
+    const index = body.hits.hits[0]._index;
+
+    const deleteParams: DeleteParams = {
+      index,
       id,
       refresh: 'wait_for',
     };
 
-    const { body } = await asInternalUser.delete(params);
-    return body;
+    const { body: deleteResponse } = await asInternalUser.delete(deleteParams);
+    return deleteResponse;
   }
 
   return {