From b02e2d9de4c6b0932e5f5426e5ac1c878387dfa9 Mon Sep 17 00:00:00 2001
From: Matthew Kime <matt@mattki.me>
Date: Thu, 25 Jun 2020 09:21:41 -0500
Subject: [PATCH 01/78] Index pattern serialize and de-serialize (#68844)

* serialize and deserialize index patterns
---
 ...a-plugin-plugins-data-public.ifieldtype.md |   1 +
 ...n-plugins-data-public.ifieldtype.tospec.md |  11 +
 ...plugins-data-public.indexpattern.fields.md |   4 +-
 ...s-data-public.indexpattern.initfromspec.md |  22 +
 ...plugin-plugins-data-public.indexpattern.md |   5 +-
 ...lugins-data-public.indexpattern.tospec.md} |  10 +-
 ...-public.indexpatternfield._constructor_.md |   4 +-
 ....indexpatternfield.conflictdescriptions.md |   2 +-
 ...n-plugins-data-public.indexpatternfield.md |   3 +-
 ...ns-data-public.indexpatternfield.tospec.md |  11 +
 ...a-plugin-plugins-data-server.ifieldtype.md |   1 +
 ...n-plugins-data-server.ifieldtype.tospec.md |  11 +
 .../stubbed_saved_object_index_pattern.js     |   1 +
 .../fields/__snapshots__/field.test.ts.snap   |  40 ++
 .../index_patterns/fields/field.test.ts       |  24 +-
 .../common/index_patterns/fields/field.ts     |  37 +-
 .../index_patterns/fields/field_list.ts       |   8 +-
 .../common/index_patterns/fields/types.ts     |   6 +-
 .../__snapshots__/index_pattern.test.ts.snap  | 503 ++++++++++++++++++
 .../index_patterns/index_patterns/index.ts    |   1 -
 .../index_patterns/index_pattern.test.ts      |  27 +
 .../index_patterns/index_pattern.ts           |  64 ++-
 .../index_patterns/index_patterns.ts          |  23 +-
 .../index_patterns/index_patterns/types.ts    |  35 --
 .../data/common/index_patterns/types.ts       |  64 +++
 src/plugins/data/public/index.ts              |   4 +-
 .../data/public/index_patterns/index.ts       |   9 +-
 src/plugins/data/public/public.api.md         |  27 +-
 src/plugins/data/server/server.api.md         |   4 +
 .../sidebar/discover_field.test.tsx           |   2 +
 30 files changed, 868 insertions(+), 96 deletions(-)
 create mode 100644 docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.tospec.md
 create mode 100644 docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.initfromspec.md
 rename docs/development/plugins/data/public/{kibana-plugin-plugins-data-public.indexpattern.type.md => kibana-plugin-plugins-data-public.indexpattern.tospec.md} (53%)
 create mode 100644 docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.tospec.md
 create mode 100644 docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.tospec.md
 create mode 100644 src/plugins/data/common/index_patterns/index_patterns/__snapshots__/index_pattern.test.ts.snap
 delete mode 100644 src/plugins/data/common/index_patterns/index_patterns/types.ts

diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md
index be6af335f20c..6f42fb32fdb7 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md
@@ -28,6 +28,7 @@ export interface IFieldType
 |  [searchable](./kibana-plugin-plugins-data-public.ifieldtype.searchable.md) | <code>boolean</code> |  |
 |  [sortable](./kibana-plugin-plugins-data-public.ifieldtype.sortable.md) | <code>boolean</code> |  |
 |  [subType](./kibana-plugin-plugins-data-public.ifieldtype.subtype.md) | <code>IFieldSubType</code> |  |
+|  [toSpec](./kibana-plugin-plugins-data-public.ifieldtype.tospec.md) | <code>() =&gt; FieldSpec</code> |  |
 |  [type](./kibana-plugin-plugins-data-public.ifieldtype.type.md) | <code>string</code> |  |
 |  [visualizable](./kibana-plugin-plugins-data-public.ifieldtype.visualizable.md) | <code>boolean</code> |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.tospec.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.tospec.md
new file mode 100644
index 000000000000..1fb4084c25d3
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.tospec.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IFieldType](./kibana-plugin-plugins-data-public.ifieldtype.md) &gt; [toSpec](./kibana-plugin-plugins-data-public.ifieldtype.tospec.md)
+
+## IFieldType.toSpec property
+
+<b>Signature:</b>
+
+```typescript
+toSpec?: () => FieldSpec;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.fields.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.fields.md
index 9a93148e4a46..d4dca48c7cd7 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.fields.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.fields.md
@@ -7,5 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-fields: IIndexPatternFieldList;
+fields: IIndexPatternFieldList & {
+        toSpec: () => FieldSpec[];
+    };
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.initfromspec.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.initfromspec.md
new file mode 100644
index 000000000000..764dd1163822
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.initfromspec.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPattern](./kibana-plugin-plugins-data-public.indexpattern.md) &gt; [initFromSpec](./kibana-plugin-plugins-data-public.indexpattern.initfromspec.md)
+
+## IndexPattern.initFromSpec() method
+
+<b>Signature:</b>
+
+```typescript
+initFromSpec(spec: IndexPatternSpec): this;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  spec | <code>IndexPatternSpec</code> |  |
+
+<b>Returns:</b>
+
+`this`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.md
index 8ffa7b6b36f5..d39b384c538f 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.md
@@ -21,7 +21,7 @@ export declare class IndexPattern implements IIndexPattern
 |  Property | Modifiers | Type | Description |
 |  --- | --- | --- | --- |
 |  [fieldFormatMap](./kibana-plugin-plugins-data-public.indexpattern.fieldformatmap.md) |  | <code>any</code> |  |
-|  [fields](./kibana-plugin-plugins-data-public.indexpattern.fields.md) |  | <code>IIndexPatternFieldList</code> |  |
+|  [fields](./kibana-plugin-plugins-data-public.indexpattern.fields.md) |  | <code>IIndexPatternFieldList &amp; {</code><br/><code>        toSpec: () =&gt; FieldSpec[];</code><br/><code>    }</code> |  |
 |  [fieldsFetcher](./kibana-plugin-plugins-data-public.indexpattern.fieldsfetcher.md) |  | <code>any</code> |  |
 |  [flattenHit](./kibana-plugin-plugins-data-public.indexpattern.flattenhit.md) |  | <code>any</code> |  |
 |  [formatField](./kibana-plugin-plugins-data-public.indexpattern.formatfield.md) |  | <code>any</code> |  |
@@ -30,7 +30,6 @@ export declare class IndexPattern implements IIndexPattern
 |  [metaFields](./kibana-plugin-plugins-data-public.indexpattern.metafields.md) |  | <code>string[]</code> |  |
 |  [timeFieldName](./kibana-plugin-plugins-data-public.indexpattern.timefieldname.md) |  | <code>string &#124; undefined</code> |  |
 |  [title](./kibana-plugin-plugins-data-public.indexpattern.title.md) |  | <code>string</code> |  |
-|  [type](./kibana-plugin-plugins-data-public.indexpattern.type.md) |  | <code>string</code> |  |
 |  [typeMeta](./kibana-plugin-plugins-data-public.indexpattern.typemeta.md) |  | <code>TypeMeta</code> |  |
 
 ## Methods
@@ -49,6 +48,7 @@ export declare class IndexPattern implements IIndexPattern
 |  [getSourceFiltering()](./kibana-plugin-plugins-data-public.indexpattern.getsourcefiltering.md) |  |  |
 |  [getTimeField()](./kibana-plugin-plugins-data-public.indexpattern.gettimefield.md) |  |  |
 |  [init(forceFieldRefresh)](./kibana-plugin-plugins-data-public.indexpattern.init.md) |  |  |
+|  [initFromSpec(spec)](./kibana-plugin-plugins-data-public.indexpattern.initfromspec.md) |  |  |
 |  [isTimeBased()](./kibana-plugin-plugins-data-public.indexpattern.istimebased.md) |  |  |
 |  [isTimeBasedWildcard()](./kibana-plugin-plugins-data-public.indexpattern.istimebasedwildcard.md) |  |  |
 |  [isTimeNanosBased()](./kibana-plugin-plugins-data-public.indexpattern.istimenanosbased.md) |  |  |
@@ -59,5 +59,6 @@ export declare class IndexPattern implements IIndexPattern
 |  [removeScriptedField(field)](./kibana-plugin-plugins-data-public.indexpattern.removescriptedfield.md) |  |  |
 |  [save(saveAttempts)](./kibana-plugin-plugins-data-public.indexpattern.save.md) |  |  |
 |  [toJSON()](./kibana-plugin-plugins-data-public.indexpattern.tojson.md) |  |  |
+|  [toSpec()](./kibana-plugin-plugins-data-public.indexpattern.tospec.md) |  |  |
 |  [toString()](./kibana-plugin-plugins-data-public.indexpattern.tostring.md) |  |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.type.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.tospec.md
similarity index 53%
rename from docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.type.md
rename to docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.tospec.md
index 58047d9e27ac..d1a78eea660c 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.type.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.tospec.md
@@ -1,11 +1,15 @@
 <!-- Do not edit this file. It is automatically generated by API Documenter. -->
 
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPattern](./kibana-plugin-plugins-data-public.indexpattern.md) &gt; [type](./kibana-plugin-plugins-data-public.indexpattern.type.md)
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPattern](./kibana-plugin-plugins-data-public.indexpattern.md) &gt; [toSpec](./kibana-plugin-plugins-data-public.indexpattern.tospec.md)
 
-## IndexPattern.type property
+## IndexPattern.toSpec() method
 
 <b>Signature:</b>
 
 ```typescript
-type?: string;
+toSpec(): IndexPatternSpec;
 ```
+<b>Returns:</b>
+
+`IndexPatternSpec`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield._constructor_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield._constructor_.md
index e1e0d58ce38c..7a195702b6f1 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield._constructor_.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield._constructor_.md
@@ -9,7 +9,7 @@ Constructs a new instance of the `Field` class
 <b>Signature:</b>
 
 ```typescript
-constructor(indexPattern: IIndexPattern, spec: FieldSpec | Field, shortDotsEnable: boolean, { fieldFormats, onNotification }: FieldDependencies);
+constructor(indexPattern: IIndexPattern, spec: FieldSpecExportFmt | FieldSpec | Field, shortDotsEnable: boolean, { fieldFormats, onNotification }: FieldDependencies);
 ```
 
 ## Parameters
@@ -17,7 +17,7 @@ constructor(indexPattern: IIndexPattern, spec: FieldSpec | Field, shortDotsEnabl
 |  Parameter | Type | Description |
 |  --- | --- | --- |
 |  indexPattern | <code>IIndexPattern</code> |  |
-|  spec | <code>FieldSpec &#124; Field</code> |  |
+|  spec | <code>FieldSpecExportFmt &#124; FieldSpec &#124; Field</code> |  |
 |  shortDotsEnable | <code>boolean</code> |  |
 |  { fieldFormats, onNotification } | <code>FieldDependencies</code> |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.conflictdescriptions.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.conflictdescriptions.md
index ca2552aeb1b4..ec19a4854bf0 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.conflictdescriptions.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.conflictdescriptions.md
@@ -7,5 +7,5 @@
 <b>Signature:</b>
 
 ```typescript
-conflictDescriptions?: Record<string, string[]>;
+conflictDescriptions?: FieldSpecConflictDescriptions;
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.md
index 8fa1ee0d72e5..d82999e7a96a 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.md
@@ -22,7 +22,7 @@ export declare class Field implements IFieldType
 |  --- | --- | --- | --- |
 |  [$$spec](./kibana-plugin-plugins-data-public.indexpatternfield.__spec.md) |  | <code>FieldSpec</code> |  |
 |  [aggregatable](./kibana-plugin-plugins-data-public.indexpatternfield.aggregatable.md) |  | <code>boolean</code> |  |
-|  [conflictDescriptions](./kibana-plugin-plugins-data-public.indexpatternfield.conflictdescriptions.md) |  | <code>Record&lt;string, string[]&gt;</code> |  |
+|  [conflictDescriptions](./kibana-plugin-plugins-data-public.indexpatternfield.conflictdescriptions.md) |  | <code>FieldSpecConflictDescriptions</code> |  |
 |  [count](./kibana-plugin-plugins-data-public.indexpatternfield.count.md) |  | <code>number</code> |  |
 |  [displayName](./kibana-plugin-plugins-data-public.indexpatternfield.displayname.md) |  | <code>string</code> |  |
 |  [esTypes](./kibana-plugin-plugins-data-public.indexpatternfield.estypes.md) |  | <code>string[]</code> |  |
@@ -37,6 +37,7 @@ export declare class Field implements IFieldType
 |  [searchable](./kibana-plugin-plugins-data-public.indexpatternfield.searchable.md) |  | <code>boolean</code> |  |
 |  [sortable](./kibana-plugin-plugins-data-public.indexpatternfield.sortable.md) |  | <code>boolean</code> |  |
 |  [subType](./kibana-plugin-plugins-data-public.indexpatternfield.subtype.md) |  | <code>IFieldSubType</code> |  |
+|  [toSpec](./kibana-plugin-plugins-data-public.indexpatternfield.tospec.md) |  | <code>() =&gt; FieldSpecExportFmt</code> |  |
 |  [type](./kibana-plugin-plugins-data-public.indexpatternfield.type.md) |  | <code>string</code> |  |
 |  [visualizable](./kibana-plugin-plugins-data-public.indexpatternfield.visualizable.md) |  | <code>boolean</code> |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.tospec.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.tospec.md
new file mode 100644
index 000000000000..35714faa03bc
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.tospec.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPatternField](./kibana-plugin-plugins-data-public.indexpatternfield.md) &gt; [toSpec](./kibana-plugin-plugins-data-public.indexpatternfield.tospec.md)
+
+## IndexPatternField.toSpec property
+
+<b>Signature:</b>
+
+```typescript
+toSpec: () => FieldSpecExportFmt;
+```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md
index 5375cf2a2ef4..77a2954428f8 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md
@@ -28,6 +28,7 @@ export interface IFieldType
 |  [searchable](./kibana-plugin-plugins-data-server.ifieldtype.searchable.md) | <code>boolean</code> |  |
 |  [sortable](./kibana-plugin-plugins-data-server.ifieldtype.sortable.md) | <code>boolean</code> |  |
 |  [subType](./kibana-plugin-plugins-data-server.ifieldtype.subtype.md) | <code>IFieldSubType</code> |  |
+|  [toSpec](./kibana-plugin-plugins-data-server.ifieldtype.tospec.md) | <code>() =&gt; FieldSpec</code> |  |
 |  [type](./kibana-plugin-plugins-data-server.ifieldtype.type.md) | <code>string</code> |  |
 |  [visualizable](./kibana-plugin-plugins-data-server.ifieldtype.visualizable.md) | <code>boolean</code> |  |
 
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.tospec.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.tospec.md
new file mode 100644
index 000000000000..d1863bebce4f
--- /dev/null
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.tospec.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [IFieldType](./kibana-plugin-plugins-data-server.ifieldtype.md) &gt; [toSpec](./kibana-plugin-plugins-data-server.ifieldtype.tospec.md)
+
+## IFieldType.toSpec property
+
+<b>Signature:</b>
+
+```typescript
+toSpec?: () => FieldSpec;
+```
diff --git a/src/fixtures/stubbed_saved_object_index_pattern.js b/src/fixtures/stubbed_saved_object_index_pattern.js
index 15e47b40eb20..8e0e230ef33d 100644
--- a/src/fixtures/stubbed_saved_object_index_pattern.js
+++ b/src/fixtures/stubbed_saved_object_index_pattern.js
@@ -27,6 +27,7 @@ export function stubbedSavedObjectIndexPattern(id) {
     id,
     type: 'index-pattern',
     attributes: {
+      timeFieldName: 'timestamp',
       customFormats: '{}',
       fields: mockLogstashFields,
     },
diff --git a/src/plugins/data/common/index_patterns/fields/__snapshots__/field.test.ts.snap b/src/plugins/data/common/index_patterns/fields/__snapshots__/field.test.ts.snap
index 4593349a408a..e61593f6bfb2 100644
--- a/src/plugins/data/common/index_patterns/fields/__snapshots__/field.test.ts.snap
+++ b/src/plugins/data/common/index_patterns/fields/__snapshots__/field.test.ts.snap
@@ -33,3 +33,43 @@ Object {
   "type": "type",
 }
 `;
+
+exports[`Field spec snapshot 1`] = `
+Object {
+  "aggregatable": true,
+  "conflictDescriptions": Object {
+    "a": Array [
+      "b",
+      "c",
+    ],
+    "d": Array [
+      "e",
+    ],
+  },
+  "count": 1,
+  "esTypes": Array [
+    "type",
+  ],
+  "format": Object {
+    "id": "number",
+    "params": Object {
+      "pattern": "$0,0.[00]",
+    },
+  },
+  "lang": "lang",
+  "name": "name",
+  "readFromDocValues": false,
+  "script": "script",
+  "scripted": true,
+  "searchable": true,
+  "subType": Object {
+    "multi": Object {
+      "parent": "parent",
+    },
+    "nested": Object {
+      "path": "path",
+    },
+  },
+  "type": "type",
+}
+`;
diff --git a/src/plugins/data/common/index_patterns/fields/field.test.ts b/src/plugins/data/common/index_patterns/fields/field.test.ts
index 711c176fed9c..910f22088f43 100644
--- a/src/plugins/data/common/index_patterns/fields/field.test.ts
+++ b/src/plugins/data/common/index_patterns/fields/field.test.ts
@@ -20,7 +20,7 @@
 import { Field } from './field';
 import { IndexPattern } from '../index_patterns';
 import { FieldFormatsStartCommon } from '../..';
-import { KBN_FIELD_TYPES } from '../../../common';
+import { KBN_FIELD_TYPES, FieldSpec, FieldSpecExportFmt } from '../../../common';
 
 describe('Field', function () {
   function flatten(obj: Record<string, any>) {
@@ -59,8 +59,9 @@ describe('Field', function () {
       fieldFormatMap: { name: {}, _source: {}, _score: {}, _id: {} },
     } as unknown) as IndexPattern,
     format: { name: 'formatName' },
-    $$spec: {},
+    $$spec: ({} as unknown) as FieldSpec,
     conflictDescriptions: { a: ['b', 'c'], d: ['e'] },
+    toSpec: () => (({} as unknown) as FieldSpecExportFmt),
   } as Field;
 
   it('the correct properties are writable', () => {
@@ -145,7 +146,7 @@ describe('Field', function () {
     }).toThrow();
 
     expect(() => {
-      field.$$spec = { a: 'b' };
+      field.$$spec = ({ a: 'b' } as unknown) as FieldSpec;
     }).toThrow();
   });
 
@@ -219,4 +220,21 @@ describe('Field', function () {
     });
     expect(flatten(field)).toMatchSnapshot();
   });
+
+  it('spec snapshot', () => {
+    const field = new Field(
+      {
+        fieldFormatMap: {
+          name: { toJSON: () => ({ id: 'number', params: { pattern: '$0,0.[00]' } }) },
+        },
+      } as IndexPattern,
+      fieldValues,
+      false,
+      {
+        fieldFormats: {} as FieldFormatsStartCommon,
+        onNotification: () => {},
+      }
+    );
+    expect(field.toSpec()).toMatchSnapshot();
+  });
 });
diff --git a/src/plugins/data/common/index_patterns/fields/field.ts b/src/plugins/data/common/index_patterns/fields/field.ts
index c53e3f2b1f62..81c7aff8a0fa 100644
--- a/src/plugins/data/common/index_patterns/fields/field.ts
+++ b/src/plugins/data/common/index_patterns/fields/field.ts
@@ -28,11 +28,14 @@ import {
   FieldFormat,
   shortenDottedString,
 } from '../../../common';
-import { OnNotification } from '../types';
+import {
+  OnNotification,
+  FieldSpec,
+  FieldSpecConflictDescriptions,
+  FieldSpecExportFmt,
+} from '../types';
 import { FieldFormatsStartCommon } from '../../field_formats';
 
-export type FieldSpec = Record<string, any>;
-
 interface FieldDependencies {
   fieldFormats: FieldFormatsStartCommon;
   onNotification: OnNotification;
@@ -59,11 +62,11 @@ export class Field implements IFieldType {
   readFromDocValues?: boolean;
   format: any;
   $$spec: FieldSpec;
-  conflictDescriptions?: Record<string, string[]>;
+  conflictDescriptions?: FieldSpecConflictDescriptions;
 
   constructor(
     indexPattern: IIndexPattern,
-    spec: FieldSpec | Field,
+    spec: FieldSpecExportFmt | FieldSpec | Field,
     shortDotsEnable: boolean,
     { fieldFormats, onNotification }: FieldDependencies
   ) {
@@ -95,7 +98,7 @@ export class Field implements IFieldType {
 
     if (!type) type = getKbnFieldType('unknown');
 
-    let format = spec.format;
+    let format: any = spec.format;
 
     if (!FieldFormat.isInstanceOfFieldFormat(format)) {
       format =
@@ -148,6 +151,26 @@ export class Field implements IFieldType {
     // multi info
     obj.fact('subType');
 
-    return obj.create();
+    const newObj = obj.create();
+    newObj.toSpec = function () {
+      return {
+        count: this.count,
+        script: this.script,
+        lang: this.lang,
+        conflictDescriptions: this.conflictDescriptions,
+        name: this.name,
+        type: this.type,
+        esTypes: this.esTypes,
+        scripted: this.scripted,
+        searchable: this.searchable,
+        aggregatable: this.aggregatable,
+        readFromDocValues: this.readFromDocValues,
+        subType: this.subType,
+        format: this.indexPattern?.fieldFormatMap[this.name]?.toJSON() || undefined,
+      };
+    };
+    return newObj;
   }
+  // only providing type info as constructor returns new object instead of `this`
+  toSpec = () => (({} as unknown) as FieldSpecExportFmt);
 }
diff --git a/src/plugins/data/common/index_patterns/fields/field_list.ts b/src/plugins/data/common/index_patterns/fields/field_list.ts
index 173a629863a7..c1ca5341328c 100644
--- a/src/plugins/data/common/index_patterns/fields/field_list.ts
+++ b/src/plugins/data/common/index_patterns/fields/field_list.ts
@@ -20,8 +20,8 @@
 import { findIndex } from 'lodash';
 import { IIndexPattern } from '../../types';
 import { IFieldType } from '../../../common';
-import { Field, FieldSpec } from './field';
-import { OnNotification } from '../types';
+import { Field } from './field';
+import { OnNotification, FieldSpec } from '../types';
 import { FieldFormatsStartCommon } from '../../field_formats';
 
 type FieldMap = Map<Field['name'], Field>;
@@ -102,6 +102,10 @@ export const getIndexPatternFieldListCreator = ({
       this.removeByGroup(newField);
       this.setByGroup(newField);
     };
+
+    toSpec = () => {
+      return [...this.map((field) => field.toSpec())];
+    };
   }
 
   return new FieldList(...fieldListParams);
diff --git a/src/plugins/data/common/index_patterns/fields/types.ts b/src/plugins/data/common/index_patterns/fields/types.ts
index c336472a1e7d..558b5b57dce4 100644
--- a/src/plugins/data/common/index_patterns/fields/types.ts
+++ b/src/plugins/data/common/index_patterns/fields/types.ts
@@ -17,10 +17,7 @@
  * under the License.
  */
 
-export interface IFieldSubType {
-  multi?: { parent: string };
-  nested?: { path: string };
-}
+import { FieldSpec, IFieldSubType } from '../types';
 
 export interface IFieldType {
   name: string;
@@ -41,4 +38,5 @@ export interface IFieldType {
   subType?: IFieldSubType;
   displayName?: string;
   format?: any;
+  toSpec?: () => FieldSpec;
 }
diff --git a/src/plugins/data/common/index_patterns/index_patterns/__snapshots__/index_pattern.test.ts.snap b/src/plugins/data/common/index_patterns/index_patterns/__snapshots__/index_pattern.test.ts.snap
new file mode 100644
index 000000000000..047ac836a87d
--- /dev/null
+++ b/src/plugins/data/common/index_patterns/index_patterns/__snapshots__/index_pattern.test.ts.snap
@@ -0,0 +1,503 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`IndexPattern toSpec should match snapshot 1`] = `
+Object {
+  "fields": Array [
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 10,
+      "esTypes": Array [
+        "long",
+      ],
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
+      "lang": undefined,
+      "name": "bytes",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "number",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 20,
+      "esTypes": Array [
+        "boolean",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "ssl",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "boolean",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 30,
+      "esTypes": Array [
+        "date",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "@timestamp",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "date",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 30,
+      "esTypes": Array [
+        "date",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "time",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "date",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "keyword",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "@tags",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "string",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "date",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "utc_time",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "date",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "integer",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "phpmemory",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "number",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "ip",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "ip",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "ip",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "attachment",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "request_body",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "attachment",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "geo_point",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "point",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "geo_point",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "geo_shape",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "area",
+      "readFromDocValues": false,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "geo_shape",
+    },
+    Object {
+      "aggregatable": false,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "murmur3",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "hashed",
+      "readFromDocValues": false,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "murmur3",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "geo_point",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "geo.coordinates",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "geo_point",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "text",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "extension",
+      "readFromDocValues": false,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "string",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "keyword",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "extension.keyword",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": Object {
+        "multi": Object {
+          "parent": "extension",
+        },
+      },
+      "type": "string",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "text",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "machine.os",
+      "readFromDocValues": false,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "string",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "keyword",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "machine.os.raw",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": Object {
+        "multi": Object {
+          "parent": "machine.os",
+        },
+      },
+      "type": "string",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "keyword",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "geo.src",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "string",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "_id",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "_id",
+      "readFromDocValues": false,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "string",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "_type",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "_type",
+      "readFromDocValues": false,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "string",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "_source",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "_source",
+      "readFromDocValues": false,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "_source",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "text",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "non-filterable",
+      "readFromDocValues": false,
+      "script": undefined,
+      "scripted": false,
+      "searchable": false,
+      "subType": undefined,
+      "type": "string",
+    },
+    Object {
+      "aggregatable": false,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "text",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "non-sortable",
+      "readFromDocValues": false,
+      "script": undefined,
+      "scripted": false,
+      "searchable": false,
+      "subType": undefined,
+      "type": "string",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "conflict",
+      ],
+      "format": undefined,
+      "lang": undefined,
+      "name": "custom_user_field",
+      "readFromDocValues": true,
+      "script": undefined,
+      "scripted": false,
+      "searchable": true,
+      "subType": undefined,
+      "type": "conflict",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "text",
+      ],
+      "format": undefined,
+      "lang": "expression",
+      "name": "script string",
+      "readFromDocValues": false,
+      "script": "'i am a string'",
+      "scripted": true,
+      "searchable": true,
+      "subType": undefined,
+      "type": "string",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "long",
+      ],
+      "format": undefined,
+      "lang": "expression",
+      "name": "script number",
+      "readFromDocValues": false,
+      "script": "1234",
+      "scripted": true,
+      "searchable": true,
+      "subType": undefined,
+      "type": "number",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "date",
+      ],
+      "format": undefined,
+      "lang": "painless",
+      "name": "script date",
+      "readFromDocValues": false,
+      "script": "1234",
+      "scripted": true,
+      "searchable": true,
+      "subType": undefined,
+      "type": "date",
+    },
+    Object {
+      "aggregatable": true,
+      "conflictDescriptions": undefined,
+      "count": 0,
+      "esTypes": Array [
+        "murmur3",
+      ],
+      "format": undefined,
+      "lang": "expression",
+      "name": "script murmur3",
+      "readFromDocValues": false,
+      "script": "1234",
+      "scripted": true,
+      "searchable": true,
+      "subType": undefined,
+      "type": "murmur3",
+    },
+  ],
+  "id": "test-pattern",
+  "sourceFilters": undefined,
+  "timeFieldName": "timestamp",
+  "title": "test-pattern",
+  "typeMeta": undefined,
+  "version": 2,
+}
+`;
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index.ts b/src/plugins/data/common/index_patterns/index_patterns/index.ts
index 5fae08f3bb77..77527857ed0c 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index.ts
@@ -18,7 +18,6 @@
  */
 
 export * from './index_patterns_api_client';
-export * from './types';
 export * from './_pattern_cache';
 export * from './flatten_hit';
 export * from './format_hit';
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts
index cea476781ad3..ba8e4f6fb369 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts
@@ -30,6 +30,10 @@ import { Field } from '../fields';
 
 import { fieldFormatsMock } from '../../field_formats/mocks';
 
+class MockFieldFormatter {}
+
+fieldFormatsMock.getType = jest.fn().mockImplementation(() => MockFieldFormatter);
+
 jest.mock('../../field_mapping', () => {
   const originalModule = jest.requireActual('../../field_mapping');
 
@@ -303,6 +307,29 @@ describe('IndexPattern', () => {
     });
   });
 
+  describe('toSpec', () => {
+    test('should match snapshot', () => {
+      indexPattern.fieldFormatMap.bytes = {
+        toJSON: () => ({ id: 'number', params: { pattern: '$0,0.[00]' } }),
+      };
+      expect(indexPattern.toSpec()).toMatchSnapshot();
+    });
+
+    test('can restore from spec', async () => {
+      indexPattern.fieldFormatMap.bytes = {
+        toJSON: () => ({ id: 'number', params: { pattern: '$0,0.[00]' } }),
+      };
+      const spec = indexPattern.toSpec();
+      const restoredPattern = await create(spec.id as string);
+      restoredPattern.initFromSpec(spec);
+      expect(restoredPattern.id).toEqual(indexPattern.id);
+      expect(restoredPattern.title).toEqual(indexPattern.title);
+      expect(restoredPattern.timeFieldName).toEqual(indexPattern.timeFieldName);
+      expect(restoredPattern.fields.length).toEqual(indexPattern.fields.length);
+      expect(restoredPattern.fieldFormatMap.bytes instanceof MockFieldFormatter).toEqual(true);
+    });
+  });
+
   describe('popularizeField', () => {
     test('should increment the popularity count by default', () => {
       // const saveSpy = sinon.stub(indexPattern, 'save');
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts
index cd39a965ae6f..e9ac5a09b9db 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts
@@ -20,6 +20,7 @@
 import _, { each, reject } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { SavedObjectsClientContract } from 'src/core/public';
+import { SavedObjectAttributes } from 'src/core/public';
 import { DuplicateField, SavedObjectNotFound } from '../../../../kibana_utils/common';
 
 import {
@@ -36,11 +37,12 @@ import { createFieldsFetcher } from './_fields_fetcher';
 import { formatHitProvider } from './format_hit';
 import { flattenHitWrapper } from './flatten_hit';
 import { IIndexPatternsApiClient } from '.';
-import { TypeMeta } from '.';
 import { OnNotification, OnError } from '../types';
 import { FieldFormatsStartCommon } from '../../field_formats';
 import { PatternCache } from './_pattern_cache';
 import { expandShorthand, FieldMappingSpec, MappingObject } from '../../field_mapping';
+import { IndexPatternSpec, TypeMeta, FieldSpec, SourceFilter } from '../types';
+import { SerializedFieldFormat } from '../../../../expressions/common';
 
 const MAX_ATTEMPTS_TO_RESOLVE_CONFLICTS = 3;
 const type = 'index-pattern';
@@ -60,10 +62,9 @@ export class IndexPattern implements IIndexPattern {
 
   public id?: string;
   public title: string = '';
-  public type?: string;
   public fieldFormatMap: any;
   public typeMeta?: TypeMeta;
-  public fields: IIndexPatternFieldList;
+  public fields: IIndexPatternFieldList & { toSpec: () => FieldSpec[] };
   public timeFieldName: string | undefined;
   public formatHit: any;
   public formatField: any;
@@ -74,7 +75,7 @@ export class IndexPattern implements IIndexPattern {
   private savedObjectsClient: SavedObjectsClientContract;
   private patternCache: PatternCache;
   private getConfig: any;
-  private sourceFilters?: [];
+  private sourceFilters?: SourceFilter[];
   private originalBody: { [key: string]: any } = {};
   public fieldsFetcher: any; // probably want to factor out any direct usage and change to private
   private shortDotsEnable: boolean = false;
@@ -196,6 +197,35 @@ export class IndexPattern implements IIndexPattern {
     this.initFields();
   }
 
+  public initFromSpec(spec: IndexPatternSpec) {
+    // create fieldFormatMap from field list
+    const fieldFormatMap: Record<string, SerializedFieldFormat> = {};
+    if (_.isArray(spec.fields)) {
+      spec.fields.forEach((field: FieldSpec) => {
+        if (field.format) {
+          fieldFormatMap[field.name as string] = { ...field.format };
+        }
+      });
+    }
+
+    this.version = spec.version;
+
+    this.title = spec.title || '';
+    this.timeFieldName = spec.timeFieldName;
+    this.sourceFilters = spec.sourceFilters;
+
+    // ignoring this because the same thing happens elsewhere but via _.assign
+    // @ts-ignore
+    this.fields = spec.fields || [];
+    this.typeMeta = spec.typeMeta;
+    this.fieldFormatMap = _.mapValues(fieldFormatMap, (mapping) => {
+      return this.deserializeFieldFormatMap(mapping);
+    });
+
+    this.initFields();
+    return this;
+  }
+
   private updateFromElasticSearch(response: any, forceFieldRefresh: boolean = false) {
     if (!response.found) {
       throw new SavedObjectNotFound(type, this.id, 'management/kibana/indexPatterns');
@@ -206,15 +236,16 @@ export class IndexPattern implements IIndexPattern {
         return;
       }
 
-      response._source[name] = fieldMapping._deserialize(response._source[name]);
+      response[name] = fieldMapping._deserialize(response[name]);
     });
 
-    // give index pattern all of the values in _source
-    _.assign(this, response._source);
+    // give index pattern all of the values
+    _.assign(this, response);
 
     if (!this.title && this.id) {
       this.title = this.id;
     }
+    this.version = response.version;
 
     return this.indexFields(forceFieldRefresh);
   }
@@ -266,13 +297,11 @@ export class IndexPattern implements IIndexPattern {
     }
 
     const savedObject = await this.savedObjectsClient.get(type, this.id);
-    this.version = savedObject._version;
 
     const response = {
-      _id: savedObject.id,
-      _type: savedObject.type,
-      _source: _.cloneDeep(savedObject.attributes),
+      version: savedObject._version,
       found: savedObject._version ? true : false,
+      ...(_.cloneDeep(savedObject.attributes) as SavedObjectAttributes),
     };
     // Do this before we attempt to update from ES since that call can potentially perform a save
     this.originalBody = this.prepBody();
@@ -283,6 +312,19 @@ export class IndexPattern implements IIndexPattern {
     return this;
   }
 
+  public toSpec(): IndexPatternSpec {
+    return {
+      id: this.id,
+      version: this.version,
+
+      title: this.title,
+      timeFieldName: this.timeFieldName,
+      sourceFilters: this.sourceFilters,
+      fields: this.fields.toSpec(),
+      typeMeta: this.typeMeta,
+    };
+  }
+
   // Get the source filtering configuration for that index.
   getSourceFiltering() {
     return {
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
index 22d1765d7934..5e51897d1337 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
@@ -32,12 +32,8 @@ import {
   createEnsureDefaultIndexPattern,
   EnsureDefaultIndexPattern,
 } from './ensure_default_index_pattern';
-import {
-  getIndexPatternFieldListCreator,
-  CreateIndexPatternFieldList,
-  Field,
-  FieldSpec,
-} from '../fields';
+import { getIndexPatternFieldListCreator, CreateIndexPatternFieldList, Field } from '../fields';
+import { IndexPatternSpec, FieldSpec } from '../types';
 import { OnNotification, OnError } from '../types';
 import { FieldFormatsStartCommon } from '../../field_formats';
 
@@ -195,6 +191,21 @@ export class IndexPatternsService {
     return indexPatternCache.set(id, indexPattern);
   };
 
+  specToIndexPattern(spec: IndexPatternSpec) {
+    const indexPattern = new IndexPattern(spec.id, {
+      getConfig: (cfg: any) => this.config.get(cfg),
+      savedObjectsClient: this.savedObjectsClient,
+      apiClient: this.apiClient,
+      patternCache: indexPatternCache,
+      fieldFormats: this.fieldFormats,
+      onNotification: this.onNotification,
+      onError: this.onError,
+    });
+
+    indexPattern.initFromSpec(spec);
+    return indexPattern;
+  }
+
   make = (id?: string): Promise<IndexPattern> => {
     const indexPattern = new IndexPattern(id, {
       getConfig: (cfg: any) => this.config.get(cfg),
diff --git a/src/plugins/data/common/index_patterns/index_patterns/types.ts b/src/plugins/data/common/index_patterns/index_patterns/types.ts
deleted file mode 100644
index b2060dd1d48b..000000000000
--- a/src/plugins/data/common/index_patterns/index_patterns/types.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export type AggregationRestrictions = Record<
-  string,
-  {
-    agg?: string;
-    interval?: number;
-    fixed_interval?: string;
-    calendar_interval?: string;
-    delay?: string;
-    time_zone?: string;
-  }
->;
-
-export interface TypeMeta {
-  aggs?: Record<string, AggregationRestrictions>;
-  [key: string]: any;
-}
diff --git a/src/plugins/data/common/index_patterns/types.ts b/src/plugins/data/common/index_patterns/types.ts
index 7399bbbc10a7..94121a274d68 100644
--- a/src/plugins/data/common/index_patterns/types.ts
+++ b/src/plugins/data/common/index_patterns/types.ts
@@ -19,6 +19,8 @@
 
 import { ToastInputFields, ErrorToastOptions } from 'src/core/public/notifications';
 import { IFieldType } from './fields';
+import { SerializedFieldFormat } from '../../../expressions/common';
+import { KBN_FIELD_TYPES } from '..';
 
 export interface IIndexPattern {
   [key: string]: any;
@@ -51,3 +53,65 @@ export interface IndexPatternAttributes {
 
 export type OnNotification = (toastInputFields: ToastInputFields) => void;
 export type OnError = (error: Error, toastInputFields: ErrorToastOptions) => void;
+
+export type AggregationRestrictions = Record<
+  string,
+  {
+    agg?: string;
+    interval?: number;
+    fixed_interval?: string;
+    calendar_interval?: string;
+    delay?: string;
+    time_zone?: string;
+  }
+>;
+
+export interface IFieldSubType {
+  multi?: { parent: string };
+  nested?: { path: string };
+}
+
+export interface TypeMeta {
+  aggs?: Record<string, AggregationRestrictions>;
+  [key: string]: any;
+}
+
+export type FieldSpecConflictDescriptions = Record<string, string[]>;
+
+// This should become FieldSpec once types are cleaned up
+export interface FieldSpecExportFmt {
+  count?: number;
+  script?: string;
+  lang?: string;
+  conflictDescriptions?: FieldSpecConflictDescriptions;
+  name: string;
+  type: KBN_FIELD_TYPES;
+  esTypes?: string[];
+  scripted: boolean;
+  searchable: boolean;
+  aggregatable: boolean;
+  readFromDocValues?: boolean;
+  subType?: IFieldSubType;
+  format?: SerializedFieldFormat;
+  indexed?: boolean;
+}
+
+export interface FieldSpec {
+  [key: string]: any;
+  format?: SerializedFieldFormat;
+}
+
+export interface IndexPatternSpec {
+  id?: string;
+  version?: string;
+
+  title: string;
+  timeFieldName?: string;
+  sourceFilters?: SourceFilter[];
+  fields?: FieldSpec[];
+  typeMeta?: TypeMeta;
+}
+
+export interface SourceFilter {
+  value: string;
+}
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index 984ce18aa4d8..3665d9dc2b46 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -249,8 +249,6 @@ export {
   IndexPattern,
   IIndexPatternFieldList,
   Field as IndexPatternField,
-  TypeMeta as IndexPatternTypeMeta,
-  AggregationRestrictions as IndexPatternAggRestrictions,
   // TODO: exported only in stub_index_pattern test. Move into data plugin and remove export.
   getIndexPatternFieldListCreator,
 } from './index_patterns';
@@ -263,6 +261,8 @@ export {
   KBN_FIELD_TYPES,
   IndexPatternAttributes,
   UI_SETTINGS,
+  TypeMeta as IndexPatternTypeMeta,
+  AggregationRestrictions as IndexPatternAggRestrictions,
 } from '../common';
 
 /*
diff --git a/src/plugins/data/public/index_patterns/index.ts b/src/plugins/data/public/index_patterns/index.ts
index 0a8397467807..2c540527f468 100644
--- a/src/plugins/data/public/index_patterns/index.ts
+++ b/src/plugins/data/public/index_patterns/index.ts
@@ -34,11 +34,4 @@ export {
   IIndexPatternFieldList,
 } from '../../common/index_patterns';
 
-// TODO: figure out how to replace IndexPatterns in get_inner_angular.
-export {
-  IndexPatternsService,
-  IndexPatternsContract,
-  IndexPattern,
-  TypeMeta,
-  AggregationRestrictions,
-} from './index_patterns';
+export { IndexPatternsService, IndexPatternsContract, IndexPattern } from './index_patterns';
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index 31dc5b51a06f..25c9b0718050 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -902,6 +902,10 @@ export interface IFieldType {
     sortable?: boolean;
     // (undocumented)
     subType?: IFieldSubType;
+    // Warning: (ae-forgotten-export) The symbol "FieldSpec" needs to be exported by the entry point index.d.ts
+    //
+    // (undocumented)
+    toSpec?: () => FieldSpec;
     // (undocumented)
     type: string;
     // (undocumented)
@@ -937,8 +941,6 @@ export interface IIndexPattern {
 //
 // @public (undocumented)
 export interface IIndexPatternFieldList extends Array<IndexPatternField> {
-    // Warning: (ae-forgotten-export) The symbol "FieldSpec" needs to be exported by the entry point index.d.ts
-    //
     // (undocumented)
     add(field: FieldSpec): void;
     // (undocumented)
@@ -993,7 +995,9 @@ export class IndexPattern implements IIndexPattern {
     // (undocumented)
     fieldFormatMap: any;
     // (undocumented)
-    fields: IIndexPatternFieldList;
+    fields: IIndexPatternFieldList & {
+        toSpec: () => FieldSpec[];
+    };
     // (undocumented)
     fieldsFetcher: any;
     // (undocumented)
@@ -1036,6 +1040,10 @@ export class IndexPattern implements IIndexPattern {
     id?: string;
     // (undocumented)
     init(forceFieldRefresh?: boolean): Promise<this>;
+    // Warning: (ae-forgotten-export) The symbol "IndexPatternSpec" needs to be exported by the entry point index.d.ts
+    //
+    // (undocumented)
+    initFromSpec(spec: IndexPatternSpec): this;
     // (undocumented)
     isTimeBased(): boolean;
     // (undocumented)
@@ -1065,9 +1073,9 @@ export class IndexPattern implements IIndexPattern {
     // (undocumented)
     toJSON(): string | undefined;
     // (undocumented)
-    toString(): string;
+    toSpec(): IndexPatternSpec;
     // (undocumented)
-    type?: string;
+    toString(): string;
     // (undocumented)
     typeMeta?: IndexPatternTypeMeta;
     }
@@ -1106,12 +1114,15 @@ export interface IndexPatternAttributes {
 export class IndexPatternField implements IFieldType {
     // (undocumented)
     $$spec: FieldSpec;
+    // Warning: (ae-forgotten-export) The symbol "FieldSpecExportFmt" needs to be exported by the entry point index.d.ts
     // Warning: (ae-forgotten-export) The symbol "FieldDependencies" needs to be exported by the entry point index.d.ts
-    constructor(indexPattern: IIndexPattern, spec: FieldSpec | IndexPatternField, shortDotsEnable: boolean, { fieldFormats, onNotification }: FieldDependencies);
+    constructor(indexPattern: IIndexPattern, spec: FieldSpecExportFmt | FieldSpec | IndexPatternField, shortDotsEnable: boolean, { fieldFormats, onNotification }: FieldDependencies);
     // (undocumented)
     aggregatable?: boolean;
+    // Warning: (ae-forgotten-export) The symbol "FieldSpecConflictDescriptions" needs to be exported by the entry point index.d.ts
+    //
     // (undocumented)
-    conflictDescriptions?: Record<string, string[]>;
+    conflictDescriptions?: FieldSpecConflictDescriptions;
     // (undocumented)
     count?: number;
     // (undocumented)
@@ -1141,6 +1152,8 @@ export class IndexPatternField implements IFieldType {
     // (undocumented)
     subType?: IFieldSubType;
     // (undocumented)
+    toSpec: () => FieldSpecExportFmt;
+    // (undocumented)
     type: string;
     // (undocumented)
     visualizable?: boolean;
diff --git a/src/plugins/data/server/server.api.md b/src/plugins/data/server/server.api.md
index 2ab0644f7237..136d960b52c3 100644
--- a/src/plugins/data/server/server.api.md
+++ b/src/plugins/data/server/server.api.md
@@ -392,6 +392,10 @@ export interface IFieldType {
     sortable?: boolean;
     // (undocumented)
     subType?: IFieldSubType;
+    // Warning: (ae-forgotten-export) The symbol "FieldSpec" needs to be exported by the entry point index.d.ts
+    //
+    // (undocumented)
+    toSpec?: () => FieldSpec;
     // (undocumented)
     type: string;
     // (undocumented)
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_field.test.tsx b/src/plugins/discover/public/application/components/sidebar/discover_field.test.tsx
index 8c527475b748..099ec2e5b1ff 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_field.test.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_field.test.tsx
@@ -28,6 +28,7 @@ import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { DiscoverField } from './discover_field';
 import { coreMock } from '../../../../../../core/public/mocks';
 import { IndexPatternField } from '../../../../../data/public';
+import { FieldSpecExportFmt } from '../../../../../data/common';
 
 jest.mock('../../../kibana_services', () => ({
   getServices: () => ({
@@ -74,6 +75,7 @@ function getComponent(selected = false, showDetails = false, useShortDots = fals
     format: null,
     routes: {},
     $$spec: {},
+    toSpec: () => (({} as unknown) as FieldSpecExportFmt),
   } as IndexPatternField;
 
   const props = {

From 14ac056be96f424e97ff610509dbb1ea663d021c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez?=
 <alejandro.fernandez@elastic.co>
Date: Thu, 25 Jun 2020 16:27:17 +0200
Subject: [PATCH 02/78] [Logs UI] Logs ui context menu (#69915)

---
 .../log_entry_actions_column.tsx              | 120 ------------------
 .../log_entry_context_menu.tsx                |  94 ++++++++++++++
 .../logging/log_text_stream/log_entry_row.tsx |  60 +++++++--
 3 files changed, 143 insertions(+), 131 deletions(-)
 delete mode 100644 x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_actions_column.tsx
 create mode 100644 x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_context_menu.tsx

diff --git a/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_actions_column.tsx b/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_actions_column.tsx
deleted file mode 100644
index e27de7fd6b5a..000000000000
--- a/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_actions_column.tsx
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { useCallback } from 'react';
-import { EuiButtonIcon, EuiPopover, EuiContextMenuPanel, EuiContextMenuItem } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-
-import { LogEntryColumnContent } from './log_entry_column';
-import { euiStyled } from '../../../../../observability/public';
-
-interface LogEntryActionsColumnProps {
-  isHovered: boolean;
-  isMenuOpen: boolean;
-  onOpenMenu: () => void;
-  onCloseMenu: () => void;
-  onViewDetails?: () => void;
-  onViewLogInContext?: () => void;
-}
-
-const MENU_LABEL = i18n.translate('xpack.infra.logEntryItemView.logEntryActionsMenuToolTip', {
-  defaultMessage: 'View actions for line',
-});
-
-const LOG_DETAILS_LABEL = i18n.translate('xpack.infra.logs.logEntryActionsDetailsButton', {
-  defaultMessage: 'View details',
-});
-
-const LOG_VIEW_IN_CONTEXT_LABEL = i18n.translate(
-  'xpack.infra.lobs.logEntryActionsViewInContextButton',
-  {
-    defaultMessage: 'View in context',
-  }
-);
-
-export const LogEntryActionsColumn: React.FC<LogEntryActionsColumnProps> = ({
-  isHovered,
-  isMenuOpen,
-  onOpenMenu,
-  onCloseMenu,
-  onViewDetails,
-  onViewLogInContext,
-}) => {
-  const handleClickViewDetails = useCallback(() => {
-    onCloseMenu();
-
-    // Function might be `undefined` and the linter doesn't like that.
-    // eslint-disable-next-line no-unused-expressions
-    onViewDetails?.();
-  }, [onCloseMenu, onViewDetails]);
-
-  const handleClickViewInContext = useCallback(() => {
-    onCloseMenu();
-
-    // Function might be `undefined` and the linter doesn't like that.
-    // eslint-disable-next-line no-unused-expressions
-    onViewLogInContext?.();
-  }, [onCloseMenu, onViewLogInContext]);
-
-  const button = (
-    <ButtonWrapper>
-      <EuiButtonIcon
-        aria-label={MENU_LABEL}
-        color="ghost"
-        iconType="boxesHorizontal"
-        onClick={onOpenMenu}
-      />
-    </ButtonWrapper>
-  );
-
-  const items = [
-    <EuiContextMenuItem key="log_details" onClick={handleClickViewDetails}>
-      {LOG_DETAILS_LABEL}
-    </EuiContextMenuItem>,
-  ];
-
-  if (onViewLogInContext !== undefined) {
-    items.push(
-      <EuiContextMenuItem key="view_in_context" onClick={handleClickViewInContext}>
-        {LOG_VIEW_IN_CONTEXT_LABEL}
-      </EuiContextMenuItem>
-    );
-  }
-
-  return (
-    <ActionsColumnContent>
-      {isHovered || isMenuOpen ? (
-        <AbsoluteWrapper>
-          <EuiPopover
-            closePopover={onCloseMenu}
-            isOpen={isMenuOpen}
-            button={button}
-            ownFocus={true}
-          >
-            <EuiContextMenuPanel items={items} />
-          </EuiPopover>
-        </AbsoluteWrapper>
-      ) : null}
-    </ActionsColumnContent>
-  );
-};
-
-const ActionsColumnContent = euiStyled(LogEntryColumnContent)`
-  overflow: hidden;
-  user-select: none;
-`;
-
-const ButtonWrapper = euiStyled.div`
-  background: ${(props) => props.theme.eui.euiColorPrimary};
-  border-radius: 50%;
-  padding: 4px;
-  transform: translateY(-6px);
-`;
-
-// this prevents the button from influencing the line height
-const AbsoluteWrapper = euiStyled.div`
-  position: absolute;
-`;
diff --git a/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_context_menu.tsx b/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_context_menu.tsx
new file mode 100644
index 000000000000..4aa81846d90e
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_context_menu.tsx
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useMemo } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiButtonIcon, EuiPopover, EuiContextMenuPanel, EuiContextMenuItem } from '@elastic/eui';
+
+import { euiStyled } from '../../../../../observability/public';
+import { LogEntryColumnContent } from './log_entry_column';
+
+interface LogEntryContextMenuItem {
+  label: string;
+  onClick: () => void;
+}
+
+interface LogEntryContextMenuProps {
+  'aria-label'?: string;
+  isOpen: boolean;
+  onOpen: () => void;
+  onClose: () => void;
+  items: LogEntryContextMenuItem[];
+}
+
+const DEFAULT_MENU_LABEL = i18n.translate(
+  'xpack.infra.logEntryItemView.logEntryActionsMenuToolTip',
+  {
+    defaultMessage: 'View actions for line',
+  }
+);
+
+export const LogEntryContextMenu: React.FC<LogEntryContextMenuProps> = ({
+  'aria-label': ariaLabel,
+  isOpen,
+  onOpen,
+  onClose,
+  items,
+}) => {
+  const closeMenuAndCall = useMemo(() => {
+    return (callback: LogEntryContextMenuItem['onClick']) => {
+      return () => {
+        onClose();
+        callback();
+      };
+    };
+  }, [onClose]);
+
+  const button = (
+    <ButtonWrapper>
+      <EuiButtonIcon
+        aria-label={ariaLabel || DEFAULT_MENU_LABEL}
+        color="ghost"
+        iconType="boxesHorizontal"
+        onClick={onOpen}
+      />
+    </ButtonWrapper>
+  );
+
+  const wrappedItems = useMemo(() => {
+    return items.map((item, i) => (
+      <EuiContextMenuItem key={i} onClick={closeMenuAndCall(item.onClick)}>
+        {item.label}
+      </EuiContextMenuItem>
+    ));
+  }, [items, closeMenuAndCall]);
+
+  return (
+    <LogEntryContextMenuContent>
+      <AbsoluteWrapper>
+        <EuiPopover closePopover={onClose} isOpen={isOpen} button={button} ownFocus={true}>
+          <EuiContextMenuPanel items={wrappedItems} />
+        </EuiPopover>
+      </AbsoluteWrapper>
+    </LogEntryContextMenuContent>
+  );
+};
+
+const LogEntryContextMenuContent = euiStyled(LogEntryColumnContent)`
+  overflow: hidden;
+  user-select: none;
+`;
+
+const AbsoluteWrapper = euiStyled.div`
+  position: absolute;
+`;
+
+const ButtonWrapper = euiStyled.div`
+  background: ${(props) => props.theme.eui.euiColorPrimary};
+  border-radius: 50%;
+  padding: 4px;
+  transform: translateY(-6px);
+`;
diff --git a/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_row.tsx b/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_row.tsx
index 0d971151dd95..2d53203a60e4 100644
--- a/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_row.tsx
+++ b/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_row.tsx
@@ -5,6 +5,7 @@
  */
 
 import React, { memo, useState, useCallback, useMemo } from 'react';
+import { i18n } from '@kbn/i18n';
 import { isEmpty } from 'lodash';
 
 import { euiStyled } from '../../../../../observability/public';
@@ -18,11 +19,26 @@ import {
 import { TextScale } from '../../../../common/log_text_scale';
 import { LogEntryColumn, LogEntryColumnWidths, iconColumnId } from './log_entry_column';
 import { LogEntryFieldColumn } from './log_entry_field_column';
-import { LogEntryActionsColumn } from './log_entry_actions_column';
 import { LogEntryMessageColumn } from './log_entry_message_column';
 import { LogEntryTimestampColumn } from './log_entry_timestamp_column';
 import { monospaceTextStyle, hoveredContentStyle, highlightedContentStyle } from './text_styles';
 import { LogEntry, LogColumn } from '../../../../common/http_api';
+import { LogEntryContextMenu } from './log_entry_context_menu';
+
+const MENU_LABEL = i18n.translate('xpack.infra.logEntryItemView.logEntryActionsMenuToolTip', {
+  defaultMessage: 'View actions for line',
+});
+
+const LOG_DETAILS_LABEL = i18n.translate('xpack.infra.logs.logEntryActionsDetailsButton', {
+  defaultMessage: 'View details',
+});
+
+const LOG_VIEW_IN_CONTEXT_LABEL = i18n.translate(
+  'xpack.infra.lobs.logEntryActionsViewInContextButton',
+  {
+    defaultMessage: 'View in context',
+  }
+);
 
 interface LogEntryRowProps {
   boundingBoxRef?: React.Ref<Element>;
@@ -76,6 +92,29 @@ export const LogEntryRow = memo(
     const hasActionViewLogInContext = hasContext && openViewLogInContext !== undefined;
     const hasActionsMenu = hasActionFlyoutWithItem || hasActionViewLogInContext;
 
+    const menuItems = useMemo(() => {
+      const items = [];
+      if (hasActionFlyoutWithItem) {
+        items.push({
+          label: LOG_DETAILS_LABEL,
+          onClick: openFlyout,
+        });
+      }
+      if (hasActionViewLogInContext) {
+        items.push({
+          label: LOG_VIEW_IN_CONTEXT_LABEL,
+          onClick: handleOpenViewLogInContext,
+        });
+      }
+
+      return items;
+    }, [
+      hasActionFlyoutWithItem,
+      hasActionViewLogInContext,
+      openFlyout,
+      handleOpenViewLogInContext,
+    ]);
+
     const logEntryColumnsById = useMemo(
       () =>
         logEntry.columns.reduce<{
@@ -183,16 +222,15 @@ export const LogEntryRow = memo(
             key="logColumn iconLogColumn iconLogColumn:details"
             {...columnWidths[iconColumnId]}
           >
-            <LogEntryActionsColumn
-              isHovered={isHovered}
-              isMenuOpen={isMenuOpen}
-              onOpenMenu={openMenu}
-              onCloseMenu={closeMenu}
-              onViewDetails={hasActionFlyoutWithItem ? openFlyout : undefined}
-              onViewLogInContext={
-                hasActionViewLogInContext ? handleOpenViewLogInContext : undefined
-              }
-            />
+            {isHovered || isMenuOpen ? (
+              <LogEntryContextMenu
+                aria-label={MENU_LABEL}
+                isOpen={isMenuOpen}
+                onOpen={openMenu}
+                onClose={closeMenu}
+                items={menuItems}
+              />
+            ) : null}
           </LogEntryColumn>
         ) : null}
       </LogEntryRowWrapper>

From 8ff45caa76660f3c9c6ffefc32647b353c7b10d1 Mon Sep 17 00:00:00 2001
From: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
Date: Thu, 25 Jun 2020 10:51:05 -0400
Subject: [PATCH 03/78] [Endpoint][Ingest Manager] minor code cleanup (#69844)

* Ingest: Rename datasource Layout prop to `onCancel`
* Endpoint: Policy list - swap use of endpoint package hook for redux middleware
* Endpoint: Add tests cases for `sendGetEndpointSecurityPackage()` method
* Endpoint: add policy list store tests for new action
---
 .../components/layout.tsx                     |  6 +-
 .../create_datasource_page/index.tsx          |  2 +-
 .../pages/policy/store/policy_list/action.ts  | 13 ++-
 .../policy/store/policy_list/index.test.ts    | 17 ++++
 .../policy/store/policy_list/middleware.ts    | 22 ++++-
 .../pages/policy/store/policy_list/reducer.ts |  8 ++
 .../policy/store/policy_list/selectors.ts     | 14 +++
 .../store/policy_list/services/ingest.test.ts | 93 ++++++++++++++++++-
 .../store/policy_list/services/ingest.ts      |  2 +-
 .../store/policy_list/test_mock_utils.ts      | 79 +++++++++++++++-
 .../public/management/pages/policy/types.ts   |  3 +
 .../pages/policy/view/ingest_hooks.ts         | 44 ---------
 .../pages/policy/view/policy_list.tsx         | 11 +--
 13 files changed, 254 insertions(+), 60 deletions(-)
 delete mode 100644 x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_hooks.ts

diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/components/layout.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/components/layout.tsx
index 7939feed8014..6f23c0ce6085 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/components/layout.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/components/layout.tsx
@@ -23,14 +23,14 @@ import { CreateDatasourceFrom } from '../types';
 export const CreateDatasourcePageLayout: React.FunctionComponent<{
   from: CreateDatasourceFrom;
   cancelUrl: string;
-  cancelOnClick?: React.ReactEventHandler;
+  onCancel?: React.ReactEventHandler;
   agentConfig?: AgentConfig;
   packageInfo?: PackageInfo;
   'data-test-subj'?: string;
 }> = ({
   from,
   cancelUrl,
-  cancelOnClick,
+  onCancel,
   agentConfig,
   packageInfo,
   children,
@@ -45,7 +45,7 @@ export const CreateDatasourcePageLayout: React.FunctionComponent<{
           iconType="arrowLeft"
           flush="left"
           href={cancelUrl}
-          onClick={cancelOnClick}
+          onClick={onCancel}
           data-test-subj={`${dataTestSubj}_cancelBackLink`}
         >
           <FormattedMessage
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/index.tsx
index 876383770aa7..18c4f2f82ac0 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/index.tsx
@@ -256,7 +256,7 @@ export const CreateDatasourcePage: React.FunctionComponent = () => {
   const layoutProps = {
     from,
     cancelUrl,
-    cancelOnClick: cancelClickHandler,
+    onCancel: cancelClickHandler,
     agentConfig,
     packageInfo,
   };
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/action.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/action.ts
index e14e39bf45c9..b04b2f085689 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/action.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/action.ts
@@ -6,7 +6,10 @@
 
 import { PolicyData } from '../../../../../../common/endpoint/types';
 import { ServerApiError } from '../../../../../common/types';
-import { GetAgentStatusResponse } from '../../../../../../../ingest_manager/common/types/rest_spec';
+import {
+  GetAgentStatusResponse,
+  GetPackagesResponse,
+} from '../../../../../../../ingest_manager/common';
 
 interface ServerReturnedPolicyListData {
   type: 'serverReturnedPolicyListData';
@@ -53,6 +56,11 @@ interface ServerReturnedPolicyAgentsSummaryForDelete {
   payload: { agentStatusSummary: GetAgentStatusResponse['results'] };
 }
 
+interface ServerReturnedEndpointPackageInfo {
+  type: 'serverReturnedEndpointPackageInfo';
+  payload: GetPackagesResponse['response'][0];
+}
+
 export type PolicyListAction =
   | ServerReturnedPolicyListData
   | ServerFailedToReturnPolicyListData
@@ -61,4 +69,5 @@ export type PolicyListAction =
   | ServerDeletedPolicy
   | UserOpenedPolicyListDeleteModal
   | ServerReturnedPolicyAgentsSummaryForDeleteFailure
-  | ServerReturnedPolicyAgentsSummaryForDelete;
+  | ServerReturnedPolicyAgentsSummaryForDelete
+  | ServerReturnedEndpointPackageInfo;
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/index.test.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/index.test.ts
index c24c47becc0b..f454061055e9 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/index.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/index.test.ts
@@ -18,6 +18,7 @@ import {
   selectIsLoading,
   urlSearchParams,
   selectIsDeleting,
+  endpointPackageVersion,
 } from './selectors';
 import { DepsStartMock, depsStartMock } from '../../../../../common/mock/endpoint';
 import { setPolicyListApiMockImplementation } from './test_mock_utils';
@@ -254,5 +255,21 @@ describe('policy list store concerns', () => {
         page_size: 50,
       });
     });
+
+    it('should load package information only if not already in state', async () => {
+      dispatchUserChangedUrl('?page_size=10&page_index=10');
+      await waitForAction('serverReturnedEndpointPackageInfo');
+      expect(endpointPackageVersion(store.getState())).toEqual('0.5.0');
+      fakeCoreStart.http.get.mockClear();
+      dispatchUserChangedUrl('?page_size=10&page_index=11');
+      expect(fakeCoreStart.http.get).toHaveBeenCalledWith(INGEST_API_DATASOURCES, {
+        query: {
+          kuery: `${DATASOURCE_SAVED_OBJECT_TYPE}.package.name: endpoint`,
+          page: 12,
+          perPage: 10,
+        },
+      });
+      expect(endpointPackageVersion(store.getState())).toEqual('0.5.0');
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/middleware.ts
index 39c685da3ec4..7d8620a5831d 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/middleware.ts
@@ -9,8 +9,9 @@ import {
   sendGetEndpointSpecificDatasources,
   sendDeleteDatasource,
   sendGetFleetAgentStatusForConfig,
+  sendGetEndpointSecurityPackage,
 } from './services/ingest';
-import { isOnPolicyListPage, urlSearchParams } from './selectors';
+import { endpointPackageInfo, isOnPolicyListPage, urlSearchParams } from './selectors';
 import { ImmutableMiddlewareFactory } from '../../../../../common/store';
 import { initialPolicyListState } from './reducer';
 import {
@@ -32,6 +33,25 @@ export const policyListMiddlewareFactory: ImmutableMiddlewareFactory<PolicyListS
       (action.type === 'userChangedUrl' && isOnPolicyListPage(state)) ||
       action.type === 'serverDeletedPolicy'
     ) {
+      if (!endpointPackageInfo(state)) {
+        // We only need the package information to retrieve the version number,
+        // and even if we don't have the version, the UI is still ok because we
+        // handle that condition. Because of this, we retrieve the package information
+        // in a non-blocking way here and also ignore any API failures (only log it
+        // to the console)
+        sendGetEndpointSecurityPackage(http)
+          .then((packageInfo) => {
+            dispatch({
+              type: 'serverReturnedEndpointPackageInfo',
+              payload: packageInfo,
+            });
+          })
+          .catch((error) => {
+            // eslint-disable-next-line no-console
+            console.error(error);
+          });
+      }
+
       const { page_index: pageIndex, page_size: pageSize } = urlSearchParams(state);
       let response: GetPolicyListResponse;
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/reducer.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/reducer.ts
index a8a2ad3e7cc2..52bed8d850ef 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/reducer.ts
@@ -16,6 +16,7 @@ import { PolicyListState } from '../../types';
  */
 export const initialPolicyListState: () => Immutable<PolicyListState> = () => ({
   policyItems: [],
+  endpointPackageInfo: undefined,
   isLoading: false,
   isDeleting: false,
   deleteStatus: undefined,
@@ -95,6 +96,13 @@ export const policyListReducer: ImmutableReducer<PolicyListState, AppAction> = (
     };
   }
 
+  if (action.type === 'serverReturnedEndpointPackageInfo') {
+    return {
+      ...state,
+      endpointPackageInfo: action.payload,
+    };
+  }
+
   if (action.type === 'userChangedUrl') {
     const newState: Immutable<PolicyListState> = {
       ...state,
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/selectors.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/selectors.ts
index 089c97b5520a..ce57d238d758 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/selectors.ts
@@ -84,3 +84,17 @@ export const urlSearchParams: (
 
   return searchParams;
 });
+
+/**
+ * Returns package information for Endpoint
+ * @param state
+ */
+export const endpointPackageInfo = (state: Immutable<PolicyListState>) => state.endpointPackageInfo;
+
+/**
+ * Returns the version number for the endpoint package.
+ */
+export const endpointPackageVersion = createSelector(
+  endpointPackageInfo,
+  (info) => info?.version ?? undefined
+);
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.test.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.test.ts
index cbbc5c3c6fdb..2270c65fb149 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.test.ts
@@ -4,7 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { sendGetDatasource, sendGetEndpointSpecificDatasources } from './ingest';
+import {
+  sendGetDatasource,
+  sendGetEndpointSecurityPackage,
+  sendGetEndpointSpecificDatasources,
+} from './ingest';
 import { httpServiceMock } from '../../../../../../../../../../src/core/public/mocks';
 import { DATASOURCE_SAVED_OBJECT_TYPE } from '../../../../../../../../ingest_manager/common';
 
@@ -37,6 +41,7 @@ describe('ingest service', () => {
       });
     });
   });
+
   describe('sendGetDatasource()', () => {
     it('builds correct API path', async () => {
       await sendGetDatasource(http, '123');
@@ -51,4 +56,90 @@ describe('ingest service', () => {
       });
     });
   });
+
+  describe('sendGetEndpointSecurityPackage()', () => {
+    it('should query EPM with category=security', async () => {
+      http.get.mockResolvedValue({
+        response: [
+          {
+            name: 'endpoint',
+            title: 'Elastic Endpoint',
+            version: '0.5.0',
+            description: 'This is the Elastic Endpoint package.',
+            type: 'solution',
+            download: '/epr/endpoint/endpoint-0.5.0.tar.gz',
+            path: '/package/endpoint/0.5.0',
+            icons: [
+              {
+                src: '/package/endpoint/0.5.0/img/logo-endpoint-64-color.svg',
+                size: '16x16',
+                type: 'image/svg+xml',
+              },
+            ],
+            status: 'installed',
+            savedObject: {
+              type: 'epm-packages',
+              id: 'endpoint',
+              attributes: {
+                installed: [
+                  { id: '826759f0-7074-11ea-9bc8-6b38f4d29a16', type: 'dashboard' },
+                  { id: '1cfceda0-728b-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                  { id: '1e525190-7074-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                  { id: '55387750-729c-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                  { id: '92b1edc0-706a-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                  { id: 'a3a3bd10-706b-11ea-9bc8-6b38f4d29a16', type: 'map' },
+                  { id: 'logs-endpoint.alerts', type: 'index-template' },
+                  { id: 'events-endpoint', type: 'index-template' },
+                  { id: 'logs-endpoint.events.file', type: 'index-template' },
+                  { id: 'logs-endpoint.events.library', type: 'index-template' },
+                  { id: 'metrics-endpoint.metadata', type: 'index-template' },
+                  { id: 'metrics-endpoint.metadata_mirror', type: 'index-template' },
+                  { id: 'logs-endpoint.events.network', type: 'index-template' },
+                  { id: 'metrics-endpoint.policy', type: 'index-template' },
+                  { id: 'logs-endpoint.events.process', type: 'index-template' },
+                  { id: 'logs-endpoint.events.registry', type: 'index-template' },
+                  { id: 'logs-endpoint.events.security', type: 'index-template' },
+                  { id: 'metrics-endpoint.telemetry', type: 'index-template' },
+                ],
+                es_index_patterns: {
+                  alerts: 'logs-endpoint.alerts-*',
+                  events: 'events-endpoint-*',
+                  file: 'logs-endpoint.events.file-*',
+                  library: 'logs-endpoint.events.library-*',
+                  metadata: 'metrics-endpoint.metadata-*',
+                  metadata_mirror: 'metrics-endpoint.metadata_mirror-*',
+                  network: 'logs-endpoint.events.network-*',
+                  policy: 'metrics-endpoint.policy-*',
+                  process: 'logs-endpoint.events.process-*',
+                  registry: 'logs-endpoint.events.registry-*',
+                  security: 'logs-endpoint.events.security-*',
+                  telemetry: 'metrics-endpoint.telemetry-*',
+                },
+                name: 'endpoint',
+                version: '0.5.0',
+                internal: false,
+                removable: false,
+              },
+              references: [],
+              updated_at: '2020-06-24T14:41:23.098Z',
+              version: 'Wzc0LDFd',
+              score: 0,
+            },
+          },
+        ],
+        success: true,
+      });
+      await sendGetEndpointSecurityPackage(http);
+      expect(http.get).toHaveBeenCalledWith('/api/ingest_manager/epm/packages', {
+        query: { category: 'security' },
+      });
+    });
+
+    it('should throw if package is not found', async () => {
+      http.get.mockResolvedValue({ response: [], success: true });
+      await expect(async () => {
+        await sendGetEndpointSecurityPackage(http);
+      }).rejects.toThrow();
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.ts
index 66e98aa51601..cbdd67261739 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.ts
@@ -20,7 +20,7 @@ const INGEST_API_ROOT = `/api/ingest_manager`;
 export const INGEST_API_DATASOURCES = `${INGEST_API_ROOT}/datasources`;
 const INGEST_API_FLEET = `${INGEST_API_ROOT}/fleet`;
 const INGEST_API_FLEET_AGENT_STATUS = `${INGEST_API_FLEET}/agent-status`;
-const INGEST_API_EPM_PACKAGES = `${INGEST_API_ROOT}/epm/packages`;
+export const INGEST_API_EPM_PACKAGES = `${INGEST_API_ROOT}/epm/packages`;
 const INGEST_API_DELETE_DATASOURCE = `${INGEST_API_DATASOURCES}/delete`;
 
 /**
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts
index 2c495202dc75..0f0d1cb1b559 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts
@@ -5,9 +5,14 @@
  */
 
 import { HttpStart } from 'kibana/public';
-import { INGEST_API_DATASOURCES } from './services/ingest';
+import { INGEST_API_DATASOURCES, INGEST_API_EPM_PACKAGES } from './services/ingest';
 import { EndpointDocGenerator } from '../../../../../../common/endpoint/generate_data';
 import { GetPolicyListResponse } from '../../types';
+import {
+  AssetReference,
+  GetPackagesResponse,
+  InstallationStatus,
+} from '../../../../../../../ingest_manager/common';
 
 const generator = new EndpointDocGenerator('policy-list');
 
@@ -32,6 +37,78 @@ export const setPolicyListApiMockImplementation = (
           success: true,
         });
       }
+
+      if (path === INGEST_API_EPM_PACKAGES) {
+        return Promise.resolve<GetPackagesResponse>({
+          response: [
+            {
+              name: 'endpoint',
+              title: 'Elastic Endpoint',
+              version: '0.5.0',
+              description: 'This is the Elastic Endpoint package.',
+              type: 'solution',
+              download: '/epr/endpoint/endpoint-0.5.0.tar.gz',
+              path: '/package/endpoint/0.5.0',
+              icons: [
+                {
+                  src: '/package/endpoint/0.5.0/img/logo-endpoint-64-color.svg',
+                  size: '16x16',
+                  type: 'image/svg+xml',
+                },
+              ],
+              status: 'installed' as InstallationStatus,
+              savedObject: {
+                type: 'epm-packages',
+                id: 'endpoint',
+                attributes: {
+                  installed: [
+                    { id: '826759f0-7074-11ea-9bc8-6b38f4d29a16', type: 'dashboard' },
+                    { id: '1cfceda0-728b-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                    { id: '1e525190-7074-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                    { id: '55387750-729c-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                    { id: '92b1edc0-706a-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                    { id: 'a3a3bd10-706b-11ea-9bc8-6b38f4d29a16', type: 'map' },
+                    { id: 'logs-endpoint.alerts', type: 'index-template' },
+                    { id: 'events-endpoint', type: 'index-template' },
+                    { id: 'logs-endpoint.events.file', type: 'index-template' },
+                    { id: 'logs-endpoint.events.library', type: 'index-template' },
+                    { id: 'metrics-endpoint.metadata', type: 'index-template' },
+                    { id: 'metrics-endpoint.metadata_mirror', type: 'index-template' },
+                    { id: 'logs-endpoint.events.network', type: 'index-template' },
+                    { id: 'metrics-endpoint.policy', type: 'index-template' },
+                    { id: 'logs-endpoint.events.process', type: 'index-template' },
+                    { id: 'logs-endpoint.events.registry', type: 'index-template' },
+                    { id: 'logs-endpoint.events.security', type: 'index-template' },
+                    { id: 'metrics-endpoint.telemetry', type: 'index-template' },
+                  ] as AssetReference[],
+                  es_index_patterns: {
+                    alerts: 'logs-endpoint.alerts-*',
+                    events: 'events-endpoint-*',
+                    file: 'logs-endpoint.events.file-*',
+                    library: 'logs-endpoint.events.library-*',
+                    metadata: 'metrics-endpoint.metadata-*',
+                    metadata_mirror: 'metrics-endpoint.metadata_mirror-*',
+                    network: 'logs-endpoint.events.network-*',
+                    policy: 'metrics-endpoint.policy-*',
+                    process: 'logs-endpoint.events.process-*',
+                    registry: 'logs-endpoint.events.registry-*',
+                    security: 'logs-endpoint.events.security-*',
+                    telemetry: 'metrics-endpoint.telemetry-*',
+                  },
+                  name: 'endpoint',
+                  version: '0.5.0',
+                  internal: false,
+                  removable: false,
+                },
+                references: [],
+                updated_at: '2020-06-24T14:41:23.098Z',
+                version: 'Wzc0LDFd',
+              },
+            },
+          ],
+          success: true,
+        });
+      }
     }
     return Promise.reject(new Error(`MOCK: unknown policy list api: ${path}`));
   });
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/types.ts b/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
index 4d798d3717ce..a3a0983331ac 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
@@ -16,6 +16,7 @@ import {
   GetAgentStatusResponse,
   GetDatasourcesResponse,
   GetOneDatasourceResponse,
+  GetPackagesResponse,
   UpdateDatasourceResponse,
 } from '../../../../../ingest_manager/common';
 
@@ -25,6 +26,8 @@ import {
 export interface PolicyListState {
   /** Array of policy items  */
   policyItems: PolicyData[];
+  /** Information about the latest endpoint package */
+  endpointPackageInfo?: GetPackagesResponse['response'][0];
   /** API error if loading data failed */
   apiError?: ServerApiError;
   /** total number of policies */
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_hooks.ts b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_hooks.ts
deleted file mode 100644
index 75e1556ff0bb..000000000000
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_hooks.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { useEffect, useState } from 'react';
-import { Immutable } from '../../../../../common/endpoint/types';
-import { GetPackagesResponse } from '../../../../../../ingest_manager/common/types/rest_spec';
-import { sendGetEndpointSecurityPackage } from '../store/policy_list/services/ingest';
-import { useKibana } from '../../../../common/lib/kibana';
-
-type UseEndpointPackageInfo = [
-  /** The Package Info. will be undefined while it is being fetched */
-  Immutable<GetPackagesResponse['response'][0]> | undefined,
-  /** Boolean indicating if fetching is underway */
-  boolean,
-  /** Any error encountered during fetch */
-  Error | undefined
-];
-
-/**
- * Hook that fetches the endpoint package info
- *
- * @example
- * const [packageInfo, isFetching, fetchError] = useEndpointPackageInfo();
- */
-export const useEndpointPackageInfo = (): UseEndpointPackageInfo => {
-  const {
-    services: { http },
-  } = useKibana();
-  const [endpointPackage, setEndpointPackage] = useState<UseEndpointPackageInfo[0]>();
-  const [isFetching, setIsFetching] = useState<UseEndpointPackageInfo[1]>(true);
-  const [error, setError] = useState<UseEndpointPackageInfo[2]>();
-
-  useEffect(() => {
-    sendGetEndpointSecurityPackage(http)
-      .then((packageInfo) => setEndpointPackage(packageInfo))
-      .catch((apiError) => setError(apiError))
-      .finally(() => setIsFetching(false));
-  }, [http]);
-
-  return [endpointPackage, isFetching, error];
-};
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx
index 4532408332d6..26b6ecb540cd 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx
@@ -48,7 +48,6 @@ import { useFormatUrl } from '../../../../common/components/link_to';
 import { getPolicyDetailPath, getPoliciesPath } from '../../../common/routing';
 import { useNavigateToAppEventHandler } from '../../../../common/hooks/endpoint/use_navigate_to_app_event_handler';
 import { CreateDatasourceRouteState } from '../../../../../../ingest_manager/public';
-import { useEndpointPackageInfo } from './ingest_hooks';
 
 interface TableChangeCallbackArguments {
   page: { index: number; size: number };
@@ -135,7 +134,6 @@ export const PolicyList = React.memo(() => {
   const [policyIdToDelete, setPolicyIdToDelete] = useState<string>('');
 
   const dispatch = useDispatch<(action: PolicyListAction) => void>();
-  const [packageInfo, isFetchingPackageInfo] = useEndpointPackageInfo();
   const {
     selectPolicyItems: policyItems,
     selectPageIndex: pageIndex,
@@ -146,6 +144,7 @@ export const PolicyList = React.memo(() => {
     selectIsDeleting: isDeleting,
     selectDeleteStatus: deleteStatus,
     selectAgentStatusSummary: agentStatusSummary,
+    endpointPackageVersion,
   } = usePolicyListSelector(selector);
 
   const handleCreatePolicyClick = useNavigateToAppEventHandler<CreateDatasourceRouteState>(
@@ -156,7 +155,9 @@ export const PolicyList = React.memo(() => {
       // Also,
       // We pass along soem state information so that the Ingest page can change the behaviour
       // of the cancel and submit buttons and redirect the user back to endpoint policy
-      path: `#/integrations${packageInfo ? `/endpoint-${packageInfo.version}/add-datasource` : ''}`,
+      path: `#/integrations${
+        endpointPackageVersion ? `/endpoint-${endpointPackageVersion}/add-datasource` : ''
+      }`,
       state: {
         onCancelNavigateTo: ['securitySolution:management', { path: getPoliciesPath() }],
         onCancelUrl: formatUrl(getPoliciesPath()),
@@ -401,7 +402,6 @@ export const PolicyList = React.memo(() => {
           <EuiButton
             iconType="plusInCircle"
             onClick={handleCreatePolicyClick}
-            isDisabled={isFetchingPackageInfo}
             data-test-subj="headerCreateNewPolicyButton"
           >
             <FormattedMessage
@@ -440,7 +440,7 @@ export const PolicyList = React.memo(() => {
                 <EmptyPolicyTable
                   loading={loading}
                   onActionClick={handleCreatePolicyClick}
-                  actionDisabled={isFetchingPackageInfo}
+                  actionDisabled={false}
                   dataTestSubj="emptyPolicyTable"
                 />
               )}
@@ -449,7 +449,6 @@ export const PolicyList = React.memo(() => {
         }, [
           policyItems,
           loading,
-          isFetchingPackageInfo,
           columns,
           handleCreatePolicyClick,
           handleTableChange,

From 589d6ffd228ea9099b0c2c098b80353f47c07493 Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Thu, 25 Jun 2020 16:55:46 +0200
Subject: [PATCH 04/78] [APM] Catch annotations index permission error and log
 warning (#69881)

Relates to #69642. If the user doesn't have the appropriate privileges for the annotations index, instead of failing with a 500, we now catch the error and log a warning to the console.
---
 .../services/annotations/get_stored_annotations.ts   | 12 +++++++++++-
 .../apm/server/lib/services/annotations/index.ts     |  5 ++++-
 x-pack/plugins/apm/server/routes/services.ts         |  1 +
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/apm/server/lib/services/annotations/get_stored_annotations.ts b/x-pack/plugins/apm/server/lib/services/annotations/get_stored_annotations.ts
index 2409da59d66a..e77307a3f9db 100644
--- a/x-pack/plugins/apm/server/lib/services/annotations/get_stored_annotations.ts
+++ b/x-pack/plugins/apm/server/lib/services/annotations/get_stored_annotations.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { APICaller } from 'kibana/server';
+import { APICaller, Logger } from 'kibana/server';
 import { SERVICE_NAME } from '../../../../common/elasticsearch_fieldnames';
 import { ESSearchResponse } from '../../../../typings/elasticsearch';
 import { ScopedAnnotationsClient } from '../../../../../observability/server';
@@ -19,12 +19,14 @@ export async function getStoredAnnotations({
   environment,
   apiCaller,
   annotationsClient,
+  logger,
 }: {
   setup: Setup & SetupTimeRange;
   serviceName: string;
   environment?: string;
   apiCaller: APICaller;
   annotationsClient: ScopedAnnotationsClient;
+  logger: Logger;
 }): Promise<Annotation[]> {
   try {
     const environmentFilter = getEnvironmentUiFilterES(environment);
@@ -71,6 +73,14 @@ export async function getStoredAnnotations({
     if (error.body?.error?.type === 'index_not_found_exception') {
       return [];
     }
+
+    if (error.body?.error?.type === 'security_exception') {
+      logger.warn(
+        `Unable to get stored annotations due to a security exception. Please make sure that the user has 'indices:data/read/search' permissions for ${annotationsClient.index}`
+      );
+      return [];
+    }
+
     throw error;
   }
 }
diff --git a/x-pack/plugins/apm/server/lib/services/annotations/index.ts b/x-pack/plugins/apm/server/lib/services/annotations/index.ts
index 9365213a87f6..e2b6e74d4d65 100644
--- a/x-pack/plugins/apm/server/lib/services/annotations/index.ts
+++ b/x-pack/plugins/apm/server/lib/services/annotations/index.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { APICaller } from 'kibana/server';
+import { APICaller, Logger } from 'kibana/server';
 import { ScopedAnnotationsClient } from '../../../../../observability/server';
 import { getDerivedServiceAnnotations } from './get_derived_service_annotations';
 import { Setup, SetupTimeRange } from '../../helpers/setup_request';
@@ -15,12 +15,14 @@ export async function getServiceAnnotations({
   environment,
   annotationsClient,
   apiCaller,
+  logger,
 }: {
   serviceName: string;
   environment?: string;
   setup: Setup & SetupTimeRange;
   annotationsClient?: ScopedAnnotationsClient;
   apiCaller: APICaller;
+  logger: Logger;
 }) {
   // start fetching derived annotations (based on transactions), but don't wait on it
   // it will likely be significantly slower than the stored annotations
@@ -37,6 +39,7 @@ export async function getServiceAnnotations({
         environment,
         annotationsClient,
         apiCaller,
+        logger,
       })
     : [];
 
diff --git a/x-pack/plugins/apm/server/routes/services.ts b/x-pack/plugins/apm/server/routes/services.ts
index 8672c6c108c4..08eba00251e2 100644
--- a/x-pack/plugins/apm/server/routes/services.ts
+++ b/x-pack/plugins/apm/server/routes/services.ts
@@ -105,6 +105,7 @@ export const serviceAnnotationsRoute = createRoute(() => ({
       environment,
       annotationsClient,
       apiCaller: context.core.elasticsearch.legacy.client.callAsCurrentUser,
+      logger: context.logger,
     });
   },
 }));

From 1d60c35a3f12b277986cbcd616d91693d5997d6c Mon Sep 17 00:00:00 2001
From: Michail Yasonik <michail.yasonik@elastic.co>
Date: Thu, 25 Jun 2020 11:06:00 -0400
Subject: [PATCH 05/78] Fixes special clicks and 3rd party icon sizes in nav
 (#69767)

---
 .../chrome/ui/header/collapsible_nav.tsx      | 22 ++++++++++---------
 src/core/public/chrome/ui/header/nav_link.tsx | 22 +++++++++----------
 2 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/src/core/public/chrome/ui/header/collapsible_nav.tsx b/src/core/public/chrome/ui/header/collapsible_nav.tsx
index 07541b1adff1..5abd14312f4a 100644
--- a/src/core/public/chrome/ui/header/collapsible_nav.tsx
+++ b/src/core/public/chrome/ui/header/collapsible_nav.tsx
@@ -38,7 +38,7 @@ import { AppCategory } from '../../../../types';
 import { InternalApplicationStart } from '../../../application/types';
 import { HttpStart } from '../../../http';
 import { OnIsLockedUpdate } from './';
-import { createEuiListItem, createRecentNavLink } from './nav_link';
+import { createEuiListItem, createRecentNavLink, isModifiedOrPrevented } from './nav_link';
 
 function getAllCategories(allCategorizedLinks: Record<string, ChromeNavLink[]>) {
   const allCategories = {} as Record<string, AppCategory | undefined>;
@@ -184,17 +184,13 @@ export function CollapsibleNav({
                 label: 'Home',
                 iconType: 'home',
                 href: homeHref,
-                onClick: (event: React.MouseEvent<HTMLButtonElement, MouseEvent>) => {
-                  closeNav();
-                  if (
-                    event.isDefaultPrevented() ||
-                    event.altKey ||
-                    event.metaKey ||
-                    event.ctrlKey
-                  ) {
+                onClick: (event) => {
+                  if (isModifiedOrPrevented(event)) {
                     return;
                   }
+
                   event.preventDefault();
+                  closeNav();
                   navigateToApp('home');
                 },
               },
@@ -230,7 +226,13 @@ export function CollapsibleNav({
               return {
                 ...hydratedLink,
                 'data-test-subj': 'collapsibleNavAppLink--recent',
-                onClick: closeNav,
+                onClick: (event) => {
+                  if (isModifiedOrPrevented(event)) {
+                    return;
+                  }
+
+                  closeNav();
+                },
               };
             })}
             maxWidth="none"
diff --git a/src/core/public/chrome/ui/header/nav_link.tsx b/src/core/public/chrome/ui/header/nav_link.tsx
index 6b5cecd13837..c70a40f49643 100644
--- a/src/core/public/chrome/ui/header/nav_link.tsx
+++ b/src/core/public/chrome/ui/header/nav_link.tsx
@@ -17,20 +17,15 @@
  * under the License.
  */
 
-import { EuiImage } from '@elastic/eui';
+import { EuiIcon } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { ChromeNavLink, ChromeRecentlyAccessedHistoryItem, CoreStart } from '../../..';
 import { HttpStart } from '../../../http';
 import { relativeToAbsolute } from '../../nav_links/to_nav_link';
 
-function isModifiedEvent(event: React.MouseEvent<HTMLButtonElement, MouseEvent>) {
-  return !!(event.metaKey || event.altKey || event.ctrlKey || event.shiftKey);
-}
-
-function LinkIcon({ url }: { url: string }) {
-  return <EuiImage size="s" alt="" aria-hidden={true} url={url} />;
-}
+export const isModifiedOrPrevented = (event: React.MouseEvent<HTMLButtonElement, MouseEvent>) =>
+  event.metaKey || event.altKey || event.ctrlKey || event.shiftKey || event.defaultPrevented;
 
 interface Props {
   link: ChromeNavLink;
@@ -69,14 +64,16 @@ export function createEuiListItem({
     href,
     /* Use href and onClick to support "open in new tab" and SPA navigation in the same link */
     onClick(event: React.MouseEvent<HTMLButtonElement, MouseEvent>) {
-      onClick();
+      if (!isModifiedOrPrevented(event)) {
+        onClick();
+      }
+
       if (
         !externalLink && // ignore external links
         !legacyMode && // ignore when in legacy mode
         !legacy && // ignore links to legacy apps
-        !event.defaultPrevented && // onClick prevented default
         event.button === 0 && // ignore everything but left clicks
-        !isModifiedEvent(event) // ignore clicks with modifier keys
+        !isModifiedOrPrevented(event)
       ) {
         event.preventDefault();
         navigateToApp(id);
@@ -88,7 +85,8 @@ export function createEuiListItem({
     'data-test-subj': dataTestSubj,
     ...(basePath && {
       iconType: euiIconType,
-      icon: !euiIconType && icon ? <LinkIcon url={basePath.prepend(`/${icon}`)} /> : undefined,
+      icon:
+        !euiIconType && icon ? <EuiIcon type={basePath.prepend(`/${icon}`)} size="m" /> : undefined,
     }),
   };
 }

From 1daa2f4a545b02215621164dd5d74249016d5283 Mon Sep 17 00:00:00 2001
From: Candace Park <56409205+parkiino@users.noreply.github.com>
Date: Thu, 25 Jun 2020 11:10:39 -0400
Subject: [PATCH 06/78] [SECURITY SOLUTION][INGEST] Task/endpoint list tests
 (#69419)

endpoint func tests for endpoint details to ingest, edit datasource to policy, bug fix for security link
---
 .../edit_datasource_page/index.tsx            |  2 +-
 .../sections/fleet/agent_list_page/index.tsx  |  1 +
 .../configure_datasource.tsx                  |  8 +-
 x-pack/test/api_integration/services/index.ts |  2 +-
 x-pack/test/common/services/index.ts          |  2 +
 .../services/ingest_manager.ts                |  0
 .../apps/endpoint/endpoint_list.ts            | 84 ++++++++++---------
 .../apps/endpoint/policy_details.ts           | 41 ++++++++-
 .../ingest_manager_create_datasource_page.ts  | 22 ++++-
 .../services/index.ts                         |  4 +-
 10 files changed, 119 insertions(+), 47 deletions(-)
 rename x-pack/test/{api_integration => common}/services/ingest_manager.ts (100%)

diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/edit_datasource_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/edit_datasource_page/index.tsx
index d47eea80da8b..af39cb87f18c 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/edit_datasource_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/edit_datasource_page/index.tsx
@@ -242,7 +242,7 @@ export const EditDatasourcePage: React.FunctionComponent = () => {
   };
 
   return (
-    <CreateDatasourcePageLayout {...layoutProps}>
+    <CreateDatasourcePageLayout {...layoutProps} data-test-subj="editDataSource">
       {isLoadingData ? (
         <Loading />
       ) : loadingError || !agentConfig || !packageInfo ? (
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
index 281a8d3a9745..75d055675514 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
@@ -489,6 +489,7 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
       <EuiSpacer size="m" />
       <EuiBasicTable<Agent>
         className="fleet__agentList__table"
+        data-test-subj="fleetAgentListTable"
         loading={isLoading && agentsRequest.isInitialRequest}
         hasActions={true}
         noItemsMessage={
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx
index 20346cb720ac..7b4dc36def13 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx
@@ -35,9 +35,13 @@ export const ConfigureEndpointDatasource = memo<CustomConfigureDatasourceContent
             <p>
               {from === 'edit' ? (
                 <LinkToApp
-                  appId="securitySolution"
+                  data-test-subj="editLinkToPolicyDetails"
+                  appId="securitySolution:management"
                   appPath={policyUrl}
-                  href={`${services.application.getUrlForApp('securitySolution')}${policyUrl}`}
+                  // Cannot use formalUrl here since the code is called in Ingest, which does not use redux
+                  href={`${services.application.getUrlForApp(
+                    'securitySolution:management'
+                  )}${policyUrl}`}
                 >
                   <FormattedMessage
                     id="xpack.securitySolution.endpoint.ingestManager.editDatasource.stepConfigure"
diff --git a/x-pack/test/api_integration/services/index.ts b/x-pack/test/api_integration/services/index.ts
index 2a0327ff5710..d135c43e2302 100644
--- a/x-pack/test/api_integration/services/index.ts
+++ b/x-pack/test/api_integration/services/index.ts
@@ -26,7 +26,7 @@ import {
 import { InfraOpsSourceConfigurationProvider } from './infraops_source_configuration';
 import { InfraLogSourceConfigurationProvider } from './infra_log_source_configuration';
 import { MachineLearningProvider } from './ml';
-import { IngestManagerProvider } from './ingest_manager';
+import { IngestManagerProvider } from '../../common/services/ingest_manager';
 import { ResolverGeneratorProvider } from './resolver';
 import { TransformProvider } from './transform';
 
diff --git a/x-pack/test/common/services/index.ts b/x-pack/test/common/services/index.ts
index 079687577c3e..41b01bffbd88 100644
--- a/x-pack/test/common/services/index.ts
+++ b/x-pack/test/common/services/index.ts
@@ -5,11 +5,13 @@
  */
 
 import { services as kibanaCommonServices } from '../../../../test/common/services';
+import { services as kibanaApiIntegrationServices } from '../../../../test/api_integration/services';
 
 import { SpacesServiceProvider } from './spaces';
 
 export const services = {
   ...kibanaCommonServices,
+  supertest: kibanaApiIntegrationServices.supertest,
 
   spaces: SpacesServiceProvider,
 };
diff --git a/x-pack/test/api_integration/services/ingest_manager.ts b/x-pack/test/common/services/ingest_manager.ts
similarity index 100%
rename from x-pack/test/api_integration/services/ingest_manager.ts
rename to x-pack/test/common/services/ingest_manager.ts
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts
index bbc78cf399f7..730beb914340 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts
@@ -6,6 +6,7 @@
 
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
+import { deleteMetadataStream } from '../../../api_integration/apis/endpoint/data_stream_helper';
 
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const pageObjects = getPageObjects(['common', 'endpoint', 'header', 'endpointPageUtils']);
@@ -17,11 +18,11 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
     this.tags('ciGroup7');
     const sleep = (ms = 100) => new Promise((resolve) => setTimeout(resolve, ms));
     before(async () => {
-      await esArchiver.load('endpoint/metadata/api_feature');
+      await esArchiver.load('endpoint/metadata/api_feature', { useCreate: true });
       await pageObjects.endpoint.navigateToEndpointList();
     });
 
-    it('finds title', async () => {
+    it('finds page title', async () => {
       const title = await testSubjects.getVisibleText('pageViewHeaderLeftTitle');
       expect(title).to.equal('Endpoints');
     });
@@ -77,54 +78,61 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       expect(tableData).to.eql(expectedData);
     });
 
-    it('no details flyout when endpoint page displayed', async () => {
+    it('does not show the details flyout initially', async () => {
       await testSubjects.missingOrFail('hostDetailsFlyout');
     });
 
-    it('display details flyout when the hostname is clicked on', async () => {
-      await (await testSubjects.find('hostnameCellLink')).click();
-      await testSubjects.existOrFail('hostDetailsUpperList');
-      await testSubjects.existOrFail('hostDetailsLowerList');
-    });
+    describe('when the hostname is clicked on,', () => {
+      it('display the details flyout', async () => {
+        await (await testSubjects.find('hostnameCellLink')).click();
+        await testSubjects.existOrFail('hostDetailsUpperList');
+        await testSubjects.existOrFail('hostDetailsLowerList');
+      });
 
-    it('update details flyout when new hostname is clicked on', async () => {
-      // display flyout for the first host in the list
-      await (await testSubjects.findAll('hostnameCellLink'))[0].click();
-      await testSubjects.existOrFail('hostDetailsFlyoutTitle');
-      const hostDetailTitle0 = await testSubjects.getVisibleText('hostDetailsFlyoutTitle');
-      // select the 2nd host in the host list
-      await (await testSubjects.findAll('hostnameCellLink'))[1].click();
-      await pageObjects.endpoint.waitForVisibleTextToChange(
-        'hostDetailsFlyoutTitle',
-        hostDetailTitle0
-      );
-      const hostDetailTitle1 = await testSubjects.getVisibleText('hostDetailsFlyoutTitle');
-      expect(hostDetailTitle1).to.not.eql(hostDetailTitle0);
-    });
+      it('updates the details flyout when a new hostname is selected from the list', async () => {
+        // display flyout for the first host in the list
+        await (await testSubjects.findAll('hostnameCellLink'))[0].click();
+        await testSubjects.existOrFail('hostDetailsFlyoutTitle');
+        const hostDetailTitle0 = await testSubjects.getVisibleText('hostDetailsFlyoutTitle');
+        // select the 2nd host in the host list
+        await (await testSubjects.findAll('hostnameCellLink'))[1].click();
+        await pageObjects.endpoint.waitForVisibleTextToChange(
+          'hostDetailsFlyoutTitle',
+          hostDetailTitle0
+        );
+        const hostDetailTitle1 = await testSubjects.getVisibleText('hostDetailsFlyoutTitle');
+        expect(hostDetailTitle1).to.not.eql(hostDetailTitle0);
+      });
+
+      it('has the same flyout info when the same hostname is selected', async () => {
+        // display flyout for the first host in the list
+        await (await testSubjects.findAll('hostnameCellLink'))[1].click();
+        await testSubjects.existOrFail('hostDetailsFlyoutTitle');
+        const hostDetailTitleInitial = await testSubjects.getVisibleText('hostDetailsFlyoutTitle');
+        // select the same host in the host list
+        await (await testSubjects.findAll('hostnameCellLink'))[1].click();
+        await sleep(500); // give page time to refresh and verify it did not change
+        const hostDetailTitleNew = await testSubjects.getVisibleText('hostDetailsFlyoutTitle');
+        expect(hostDetailTitleNew).to.equal(hostDetailTitleInitial);
+      });
 
-    it('details flyout remains the same when current hostname is clicked on', async () => {
-      // display flyout for the first host in the list
-      await (await testSubjects.findAll('hostnameCellLink'))[1].click();
-      await testSubjects.existOrFail('hostDetailsFlyoutTitle');
-      const hostDetailTitleInitial = await testSubjects.getVisibleText('hostDetailsFlyoutTitle');
-      // select the same host in the host list
-      await (await testSubjects.findAll('hostnameCellLink'))[1].click();
-      await sleep(500); // give page time to refresh and verify it did not change
-      const hostDetailTitleNew = await testSubjects.getVisibleText('hostDetailsFlyoutTitle');
-      expect(hostDetailTitleNew).to.equal(hostDetailTitleInitial);
+      it('navigates to ingest fleet when the Reassign Policy link is clicked', async () => {
+        await (await testSubjects.find('hostDetailsLinkToIngest')).click();
+        await testSubjects.existOrFail('fleetAgentListTable');
+      });
     });
 
-    describe('no data', () => {
+    describe('when there is no data,', () => {
       before(async () => {
         // clear out the data and reload the page
-        await esArchiver.unload('endpoint/metadata/api_feature');
+        await deleteMetadataStream(getService);
         await pageObjects.endpoint.navigateToEndpointList();
       });
       after(async () => {
         // reload the data so the other tests continue to pass
-        await esArchiver.load('endpoint/metadata/api_feature');
+        await esArchiver.load('endpoint/metadata/api_feature', { useCreate: true });
       });
-      it('displays no items found when empty', async () => {
+      it('displays No items found when empty', async () => {
         // get the endpoint list table data and verify message
         const [, [noItemsFoundMessage]] = await pageObjects.endpointPageUtils.tableData(
           'hostListTable'
@@ -166,7 +174,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
           'Windows 10',
           '',
           '0',
-          '00000000-0000-0000-0000-000000000000',
+          'Default',
           'Unknown',
           '10.101.149.262606:a000:ffc0:39:11ef:37b9:3371:578c',
           'rezzani-7.example.com',
@@ -175,7 +183,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       });
     });
     after(async () => {
-      await esArchiver.unload('endpoint/metadata/api_feature');
+      await deleteMetadataStream(getService);
     });
   });
 };
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
index 036f82a591fb..b0c161ca1d0c 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
@@ -9,7 +9,13 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 import { PolicyTestResourceInfo } from '../../services/endpoint_policy';
 
 export default function ({ getPageObjects, getService }: FtrProviderContext) {
-  const pageObjects = getPageObjects(['common', 'endpoint', 'policy', 'endpointPageUtils']);
+  const pageObjects = getPageObjects([
+    'common',
+    'endpoint',
+    'policy',
+    'endpointPageUtils',
+    'ingestManagerCreateDatasource',
+  ]);
   const testSubjects = getService('testSubjects');
   const policyTestResources = getService('policyTestResources');
 
@@ -185,5 +191,38 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         });
       });
     });
+
+    describe('when on Ingest Configurations Edit Datasource page', async () => {
+      let policyInfo: PolicyTestResourceInfo;
+      beforeEach(async () => {
+        // Create a policy and navigate to Ingest app
+        policyInfo = await policyTestResources.createPolicy();
+        await pageObjects.ingestManagerCreateDatasource.navigateToAgentConfigEditDatasource(
+          policyInfo.agentConfig.id,
+          policyInfo.datasource.id
+        );
+      });
+      afterEach(async () => {
+        if (policyInfo) {
+          await policyInfo.cleanup();
+        }
+      });
+      it('should show a link to Policy Details', async () => {
+        await testSubjects.existOrFail('editLinkToPolicyDetails');
+      });
+      it('should navigate to Policy Details when the link is clicked', async () => {
+        const linkToPolicy = await testSubjects.find('editLinkToPolicyDetails');
+        await linkToPolicy.click();
+        await pageObjects.policy.ensureIsOnDetailsPage();
+      });
+      it('should allow the user to navigate, edit and save Policy Details', async () => {
+        await (await testSubjects.find('editLinkToPolicyDetails')).click();
+        await pageObjects.policy.ensureIsOnDetailsPage();
+        await pageObjects.endpointPageUtils.clickOnEuiCheckbox('policyWindowsEvent_dns');
+        await pageObjects.policy.confirmAndSave();
+
+        await testSubjects.existOrFail('policyDetailsSuccessMessage');
+      });
+    });
   });
 }
diff --git a/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_datasource_page.ts b/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_datasource_page.ts
index f50cde6285be..e104b8701276 100644
--- a/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_datasource_page.ts
+++ b/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_datasource_page.ts
@@ -6,13 +6,14 @@
 
 import { FtrProviderContext } from '../ftr_provider_context';
 
-export function IngestManagerCreateDatasource({ getService }: FtrProviderContext) {
+export function IngestManagerCreateDatasource({ getService, getPageObjects }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const find = getService('find');
+  const pageObjects = getPageObjects(['common']);
 
   return {
     /**
-     * Validates that the page shown is the Datasource Craete Page
+     * Validates that the page shown is the Datasource Create Page
      */
     async ensureOnCreatePageOrFail() {
       await testSubjects.existOrFail('createDataSource_header');
@@ -75,5 +76,22 @@ export function IngestManagerCreateDatasource({ getService }: FtrProviderContext
     async waitForSaveSuccessNotification() {
       await testSubjects.existOrFail('datasourceCreateSuccessToast');
     },
+
+    /**
+     * Validates that the page shown is the Datasource Edit Page
+     */
+    async ensureOnEditPageOrFail() {
+      await testSubjects.existOrFail('editDataSource_header');
+    },
+
+    /**
+     * Navigates to the Ingest Agent configuration Edit Datasource page
+     */
+    async navigateToAgentConfigEditDatasource(agentConfigId: string, datasourceId: string) {
+      await pageObjects.common.navigateToApp('ingestManager', {
+        hash: `/configs/${agentConfigId}/edit-datasource/${datasourceId}`,
+      });
+      await this.ensureOnEditPageOrFail();
+    },
   };
 }
diff --git a/x-pack/test/security_solution_endpoint/services/index.ts b/x-pack/test/security_solution_endpoint/services/index.ts
index 90b4bc0b4d04..7eecae41aae4 100644
--- a/x-pack/test/security_solution_endpoint/services/index.ts
+++ b/x-pack/test/security_solution_endpoint/services/index.ts
@@ -4,12 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { services as apiIntegrationServices } from '../../api_integration/services';
 import { services as xPackFunctionalServices } from '../../functional/services';
 import { EndpointPolicyTestResourcesProvider } from './endpoint_policy';
+import { IngestManagerProvider } from '../../common/services/ingest_manager';
 
 export const services = {
   ...xPackFunctionalServices,
-  ingestManager: apiIntegrationServices.ingestManager,
   policyTestResources: EndpointPolicyTestResourcesProvider,
+  ingestManager: IngestManagerProvider,
 };

From 9d9df2b6c17979addd96562056063813ea5ee162 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cau=C3=AA=20Marcondes?=
 <55978943+cauemarcondes@users.noreply.github.com>
Date: Thu, 25 Jun 2020 16:19:38 +0100
Subject: [PATCH 07/78] [Observability] Fixing dynamic return type based on the
 appName (#69894)

* fixing generic return type

* addressing pr comments
---
 .../observability/public/data_handler.test.ts | 365 ++++++++++++++++++
 .../observability/public/data_handler.ts      |  26 +-
 x-pack/plugins/observability/public/index.ts  |   6 +-
 x-pack/plugins/observability/public/plugin.ts |   8 +-
 4 files changed, 385 insertions(+), 20 deletions(-)
 create mode 100644 x-pack/plugins/observability/public/data_handler.test.ts

diff --git a/x-pack/plugins/observability/public/data_handler.test.ts b/x-pack/plugins/observability/public/data_handler.test.ts
new file mode 100644
index 000000000000..71c2c942239f
--- /dev/null
+++ b/x-pack/plugins/observability/public/data_handler.test.ts
@@ -0,0 +1,365 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { registerDataHandler, getDataHandler } from './data_handler';
+
+const params = {
+  startTime: '0',
+  endTime: '1',
+  bucketSize: '10s',
+};
+
+describe('registerDataHandler', () => {
+  describe('APM', () => {
+    registerDataHandler({
+      appName: 'apm',
+      fetchData: async () => {
+        return {
+          title: 'apm',
+          appLink: '/apm',
+          stats: {
+            services: {
+              label: 'services',
+              type: 'number',
+              value: 1,
+            },
+            transactions: {
+              label: 'transactions',
+              type: 'number',
+              value: 1,
+            },
+          },
+          series: {
+            transactions: {
+              label: 'transactions',
+              coordinates: [{ x: 1 }],
+            },
+          },
+        };
+      },
+      hasData: async () => true,
+    });
+
+    it('registered data handler', () => {
+      const dataHandler = getDataHandler('apm');
+      expect(dataHandler?.fetchData).toBeDefined();
+      expect(dataHandler?.hasData).toBeDefined();
+    });
+
+    it('returns data when fetchData is called', async () => {
+      const dataHandler = getDataHandler('apm');
+      const response = await dataHandler?.fetchData(params);
+      expect(response).toEqual({
+        title: 'apm',
+        appLink: '/apm',
+        stats: {
+          services: {
+            label: 'services',
+            type: 'number',
+            value: 1,
+          },
+          transactions: {
+            label: 'transactions',
+            type: 'number',
+            value: 1,
+          },
+        },
+        series: {
+          transactions: {
+            label: 'transactions',
+            coordinates: [{ x: 1 }],
+          },
+        },
+      });
+    });
+
+    it('returns true when hasData is called', async () => {
+      const dataHandler = getDataHandler('apm');
+      const hasData = await dataHandler?.hasData();
+      expect(hasData).toBeTruthy();
+    });
+  });
+  describe('Logs', () => {
+    registerDataHandler({
+      appName: 'infra_logs',
+      fetchData: async () => {
+        return {
+          title: 'logs',
+          appLink: '/logs',
+          stats: {
+            foo: {
+              label: 'Foo',
+              type: 'number',
+              value: 1,
+            },
+            bar: {
+              label: 'bar',
+              type: 'number',
+              value: 1,
+            },
+          },
+          series: {
+            foo: {
+              label: 'Foo',
+              coordinates: [{ x: 1 }],
+            },
+            bar: {
+              label: 'Bar',
+              coordinates: [{ x: 1 }],
+            },
+          },
+        };
+      },
+      hasData: async () => true,
+    });
+
+    it('registered data handler', () => {
+      const dataHandler = getDataHandler('infra_logs');
+      expect(dataHandler?.fetchData).toBeDefined();
+      expect(dataHandler?.hasData).toBeDefined();
+    });
+
+    it('returns data when fetchData is called', async () => {
+      const dataHandler = getDataHandler('infra_logs');
+      const response = await dataHandler?.fetchData(params);
+      expect(response).toEqual({
+        title: 'logs',
+        appLink: '/logs',
+        stats: {
+          foo: {
+            label: 'Foo',
+            type: 'number',
+            value: 1,
+          },
+          bar: {
+            label: 'bar',
+            type: 'number',
+            value: 1,
+          },
+        },
+        series: {
+          foo: {
+            label: 'Foo',
+            coordinates: [{ x: 1 }],
+          },
+          bar: {
+            label: 'Bar',
+            coordinates: [{ x: 1 }],
+          },
+        },
+      });
+    });
+
+    it('returns true when hasData is called', async () => {
+      const dataHandler = getDataHandler('apm');
+      const hasData = await dataHandler?.hasData();
+      expect(hasData).toBeTruthy();
+    });
+  });
+  describe('Uptime', () => {
+    registerDataHandler({
+      appName: 'uptime',
+      fetchData: async () => {
+        return {
+          title: 'uptime',
+          appLink: '/uptime',
+          stats: {
+            monitors: {
+              label: 'Monitors',
+              type: 'number',
+              value: 1,
+            },
+            up: {
+              label: 'Up',
+              type: 'number',
+              value: 1,
+            },
+            down: {
+              label: 'Down',
+              type: 'number',
+              value: 1,
+            },
+          },
+          series: {
+            down: {
+              label: 'Down',
+              coordinates: [{ x: 1 }],
+            },
+            up: {
+              label: 'Up',
+              coordinates: [{ x: 1 }],
+            },
+          },
+        };
+      },
+      hasData: async () => true,
+    });
+
+    it('registered data handler', () => {
+      const dataHandler = getDataHandler('uptime');
+      expect(dataHandler?.fetchData).toBeDefined();
+      expect(dataHandler?.hasData).toBeDefined();
+    });
+
+    it('returns data when fetchData is called', async () => {
+      const dataHandler = getDataHandler('uptime');
+      const response = await dataHandler?.fetchData(params);
+      expect(response).toEqual({
+        title: 'uptime',
+        appLink: '/uptime',
+        stats: {
+          monitors: {
+            label: 'Monitors',
+            type: 'number',
+            value: 1,
+          },
+          up: {
+            label: 'Up',
+            type: 'number',
+            value: 1,
+          },
+          down: {
+            label: 'Down',
+            type: 'number',
+            value: 1,
+          },
+        },
+        series: {
+          down: {
+            label: 'Down',
+            coordinates: [{ x: 1 }],
+          },
+          up: {
+            label: 'Up',
+            coordinates: [{ x: 1 }],
+          },
+        },
+      });
+    });
+
+    it('returns true when hasData is called', async () => {
+      const dataHandler = getDataHandler('apm');
+      const hasData = await dataHandler?.hasData();
+      expect(hasData).toBeTruthy();
+    });
+  });
+  describe('Metrics', () => {
+    registerDataHandler({
+      appName: 'infra_metrics',
+      fetchData: async () => {
+        return {
+          title: 'metrics',
+          appLink: '/metrics',
+          stats: {
+            hosts: {
+              label: 'hosts',
+              type: 'number',
+              value: 1,
+            },
+            cpu: {
+              label: 'cpu',
+              type: 'number',
+              value: 1,
+            },
+            memory: {
+              label: 'memory',
+              type: 'number',
+              value: 1,
+            },
+            disk: {
+              label: 'disk',
+              type: 'number',
+              value: 1,
+            },
+            inboundTraffic: {
+              label: 'inboundTraffic',
+              type: 'number',
+              value: 1,
+            },
+            outboundTraffic: {
+              label: 'outboundTraffic',
+              type: 'number',
+              value: 1,
+            },
+          },
+          series: {
+            inboundTraffic: {
+              label: 'inbound Traffic',
+              coordinates: [{ x: 1 }],
+            },
+            outboundTraffic: {
+              label: 'outbound Traffic',
+              coordinates: [{ x: 1 }],
+            },
+          },
+        };
+      },
+      hasData: async () => true,
+    });
+
+    it('registered data handler', () => {
+      const dataHandler = getDataHandler('infra_metrics');
+      expect(dataHandler?.fetchData).toBeDefined();
+      expect(dataHandler?.hasData).toBeDefined();
+    });
+
+    it('returns data when fetchData is called', async () => {
+      const dataHandler = getDataHandler('infra_metrics');
+      const response = await dataHandler?.fetchData(params);
+      expect(response).toEqual({
+        title: 'metrics',
+        appLink: '/metrics',
+        stats: {
+          hosts: {
+            label: 'hosts',
+            type: 'number',
+            value: 1,
+          },
+          cpu: {
+            label: 'cpu',
+            type: 'number',
+            value: 1,
+          },
+          memory: {
+            label: 'memory',
+            type: 'number',
+            value: 1,
+          },
+          disk: {
+            label: 'disk',
+            type: 'number',
+            value: 1,
+          },
+          inboundTraffic: {
+            label: 'inboundTraffic',
+            type: 'number',
+            value: 1,
+          },
+          outboundTraffic: {
+            label: 'outboundTraffic',
+            type: 'number',
+            value: 1,
+          },
+        },
+        series: {
+          inboundTraffic: {
+            label: 'inbound Traffic',
+            coordinates: [{ x: 1 }],
+          },
+          outboundTraffic: {
+            label: 'outbound Traffic',
+            coordinates: [{ x: 1 }],
+          },
+        },
+      });
+    });
+
+    it('returns true when hasData is called', async () => {
+      const dataHandler = getDataHandler('apm');
+      const hasData = await dataHandler?.hasData();
+      expect(hasData).toBeTruthy();
+    });
+  });
+});
diff --git a/x-pack/plugins/observability/public/data_handler.ts b/x-pack/plugins/observability/public/data_handler.ts
index 8f80f79b2e82..288da3d78bf3 100644
--- a/x-pack/plugins/observability/public/data_handler.ts
+++ b/x-pack/plugins/observability/public/data_handler.ts
@@ -19,25 +19,27 @@ interface FetchDataParams {
 export type FetchData<T extends FetchDataResponse = FetchDataResponse> = (
   fetchDataParams: FetchDataParams
 ) => Promise<T>;
+
 export type HasData = () => Promise<boolean>;
 
-interface DataHandler {
-  fetchData: FetchData;
+interface DataHandler<T extends ObservabilityApp = ObservabilityApp> {
+  fetchData: FetchData<ObservabilityFetchDataResponse[T]>;
   hasData: HasData;
 }
 
 const dataHandlers: Partial<Record<ObservabilityApp, DataHandler>> = {};
 
-export type RegisterDataHandler<T extends ObservabilityApp = ObservabilityApp> = (params: {
-  appName: T;
-  fetchData: FetchData<ObservabilityFetchDataResponse[T]>;
-  hasData: HasData;
-}) => void;
-
-export const registerDataHandler: RegisterDataHandler = ({ appName, fetchData, hasData }) => {
+export function registerDataHandler<T extends ObservabilityApp>({
+  appName,
+  fetchData,
+  hasData,
+}: { appName: T } & DataHandler<T>) {
   dataHandlers[appName] = { fetchData, hasData };
-};
+}
 
-export function getDataHandler(appName: ObservabilityApp): DataHandler | undefined {
-  return dataHandlers[appName];
+export function getDataHandler<T extends ObservabilityApp>(appName: T) {
+  const dataHandler = dataHandlers[appName];
+  if (dataHandler) {
+    return dataHandler as DataHandler<T>;
+  }
 }
diff --git a/x-pack/plugins/observability/public/index.ts b/x-pack/plugins/observability/public/index.ts
index ade347c79728..fcb569f535d7 100644
--- a/x-pack/plugins/observability/public/index.ts
+++ b/x-pack/plugins/observability/public/index.ts
@@ -5,15 +5,15 @@
  */
 
 import { PluginInitializerContext, PluginInitializer } from 'kibana/public';
-import { Plugin, ObservabilityPluginSetup, ObservabilityPluginStart } from './plugin';
+import { Plugin, ObservabilityPluginSetup } from './plugin';
 
-export const plugin: PluginInitializer<ObservabilityPluginSetup, ObservabilityPluginStart> = (
+export const plugin: PluginInitializer<ObservabilityPluginSetup, void> = (
   context: PluginInitializerContext
 ) => {
   return new Plugin(context);
 };
 
-export { ObservabilityPluginSetup, ObservabilityPluginStart };
+export { ObservabilityPluginSetup };
 
 export * from './components/action_menu';
 
diff --git a/x-pack/plugins/observability/public/plugin.ts b/x-pack/plugins/observability/public/plugin.ts
index 16adf88d152c..c20e8c7b75d4 100644
--- a/x-pack/plugins/observability/public/plugin.ts
+++ b/x-pack/plugins/observability/public/plugin.ts
@@ -10,15 +10,13 @@ import {
   Plugin as PluginClass,
   PluginInitializerContext,
 } from '../../../../src/core/public';
-import { RegisterDataHandler, registerDataHandler } from './data_handler';
+import { registerDataHandler } from './data_handler';
 
 export interface ObservabilityPluginSetup {
-  dashboard: { register: RegisterDataHandler };
+  dashboard: { register: typeof registerDataHandler };
 }
 
-export type ObservabilityPluginStart = void;
-
-export class Plugin implements PluginClass<ObservabilityPluginSetup, ObservabilityPluginStart> {
+export class Plugin implements PluginClass<ObservabilityPluginSetup> {
   constructor(context: PluginInitializerContext) {}
 
   public setup(core: CoreSetup) {

From eb5afccfd0b5bd3bc264f5931fc8612516b101b2 Mon Sep 17 00:00:00 2001
From: Robert Austin <robert.austin@elastic.co>
Date: Thu, 25 Jun 2020 11:20:18 -0400
Subject: [PATCH 08/78] Remove unused Resolver code (#69914)

* embeddable
* embeddable factory
* a file called 'sample'
* resolver/index (it was just importing and re-exporting stuff)
---
 .../public/resolver/embeddable.tsx            |   41 -
 .../public/resolver/factory.ts                |   31 -
 .../public/resolver/index.ts                  |    8 -
 .../public/resolver/store/data/sample.ts      | 1608 -----------------
 4 files changed, 1688 deletions(-)
 delete mode 100644 x-pack/plugins/security_solution/public/resolver/embeddable.tsx
 delete mode 100644 x-pack/plugins/security_solution/public/resolver/factory.ts
 delete mode 100644 x-pack/plugins/security_solution/public/resolver/index.ts
 delete mode 100644 x-pack/plugins/security_solution/public/resolver/store/data/sample.ts

diff --git a/x-pack/plugins/security_solution/public/resolver/embeddable.tsx b/x-pack/plugins/security_solution/public/resolver/embeddable.tsx
deleted file mode 100644
index 5ec71e6b3041..000000000000
--- a/x-pack/plugins/security_solution/public/resolver/embeddable.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import ReactDOM from 'react-dom';
-import React from 'react';
-import { Provider } from 'react-redux';
-import { Resolver } from './view';
-import { storeFactory } from './store';
-import { Embeddable } from '../../../../../src/plugins/embeddable/public';
-
-export class ResolverEmbeddable extends Embeddable {
-  public readonly type = 'resolver';
-  private lastRenderTarget?: Element;
-
-  public render(node: HTMLElement) {
-    if (this.lastRenderTarget !== undefined) {
-      ReactDOM.unmountComponentAtNode(this.lastRenderTarget);
-    }
-    this.lastRenderTarget = node;
-    const { store } = storeFactory();
-    ReactDOM.render(
-      <Provider store={store}>
-        <Resolver />
-      </Provider>,
-      node
-    );
-  }
-
-  public reload(): void {
-    throw new Error('Method not implemented.');
-  }
-
-  public destroy(): void {
-    if (this.lastRenderTarget !== undefined) {
-      ReactDOM.unmountComponentAtNode(this.lastRenderTarget);
-    }
-  }
-}
diff --git a/x-pack/plugins/security_solution/public/resolver/factory.ts b/x-pack/plugins/security_solution/public/resolver/factory.ts
deleted file mode 100644
index 5168d2771e72..000000000000
--- a/x-pack/plugins/security_solution/public/resolver/factory.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { i18n } from '@kbn/i18n';
-import {
-  IContainer,
-  EmbeddableInput,
-  EmbeddableFactoryDefinition,
-} from '../../../../../src/plugins/embeddable/public';
-import { ResolverEmbeddable } from './embeddable';
-
-export class ResolverEmbeddableFactory implements EmbeddableFactoryDefinition {
-  public readonly type = 'resolver';
-
-  public async isEditable() {
-    return true;
-  }
-
-  public async create(initialInput: EmbeddableInput, parent?: IContainer) {
-    return new ResolverEmbeddable(initialInput, {}, parent);
-  }
-
-  public getDisplayName() {
-    return i18n.translate('xpack.securitySolution.endpoint.resolver.displayNameTitle', {
-      defaultMessage: 'Resolver',
-    });
-  }
-}
diff --git a/x-pack/plugins/security_solution/public/resolver/index.ts b/x-pack/plugins/security_solution/public/resolver/index.ts
deleted file mode 100644
index e4f3cc90ae30..000000000000
--- a/x-pack/plugins/security_solution/public/resolver/index.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { ResolverEmbeddableFactory } from './factory';
-export { ResolverEmbeddable } from './embeddable';
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/sample.ts b/x-pack/plugins/security_solution/public/resolver/store/data/sample.ts
deleted file mode 100644
index b0ed9f3554c9..000000000000
--- a/x-pack/plugins/security_solution/public/resolver/store/data/sample.ts
+++ /dev/null
@@ -1,1608 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { ProcessEvent } from '../../types';
-
-interface ProcessEventSampleData {
-  data: {
-    result: {
-      search_results: ProcessEvent[];
-    };
-  };
-}
-
-const rawData = {
-  data: {
-    code: 200,
-    result: {
-      alert_id: 'a9834bf5-42c1-4039-83be-08c3ad3232b3',
-      bulk_task_id: null,
-      correlation_id: '7022e509-087e-493d-b02c-d88a206cd993',
-      created_at: '2019-09-24T03:17:36Z',
-      endpoint: {
-        ad_distinguished_name:
-          'CN=ENDPOINT-W-1-07,OU=Desktops,OU=Workstations,OU=Computers_DEMO,DC=demo,DC=endgamelabs,DC=net',
-        ad_hostname: 'demo.endgamelabs.net',
-        display_operating_system: 'Windows 7 (SP1)',
-        hostname: 'ENDPOINT-W-1-07',
-        id: '39153006-0064-424b-99e9-4e21dcc00c2e',
-        ip_address: '172.31.27.17',
-        mac_address: '00:50:56:b1:b7:7b',
-        name: 'ENDPOINT-W-1-07',
-        operating_system: 'Windows 6.1 Service Pack 1',
-        status: 'monitored',
-        updated_at: '2019-09-24T01:48:47.960649+00:00',
-      },
-      event_logging_search_request_count: 3,
-      family: 'collection',
-      investigation_id: null,
-      machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-      message_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-      metadata: {
-        chunk_id: 0,
-        correlation_id: '7022e509-087e-493d-b02c-d88a206cd993',
-        final: true,
-        message_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-        origination_task_id: '2bed7d8b-72b1-4650-882c-5167a2fe1735',
-        os_type: 'windows',
-        priority: 50,
-        result: {
-          local_code: 0,
-          local_msg: 'Success',
-        },
-        semantic_version: '3.52.8',
-        task_id: '2bed7d8b-72b1-4650-882c-5167a2fe1735',
-        type: 'collection',
-      },
-      origination_task_id: '2bed7d8b-72b1-4650-882c-5167a2fe1735',
-      pagination: {
-        backwards: false,
-        eof: false,
-        page_number: 3,
-        page_offset: 31666,
-        params:
-          'eyJhbGVydF9pZCI6ICJhOTgzNGJmNS00MmMxLTQwMzktODNiZS0wOGMzYWQzMjMyYjMiLCAidGVtcGxhdGVfZmlsZSI6ICJwcm9jZXNzLWNvbnRleHQubHVhIiwgImNyaXRlcmlhIjogeyJwaWQiOiAxODA4LCAidW5pcXVlX3BpZCI6IDE4OTQzfX0=',
-        remaining_events: 0,
-      },
-      pending_event_logging_search_request: false,
-      results_count: 807,
-      search_results: [
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            _descendant_count: 6,
-            command_line: '',
-            depth: -5,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'already_running',
-            event_type_full: 'process_event',
-            integrity_level: 'system',
-            node_id: 1002,
-            opcode: 3,
-            pid: 4,
-            ppid: 0,
-            process_name: '',
-            process_path: '',
-            serial_event_id: 1002,
-            timestamp: 132137632670000000,
-            timestamp_utc: '2019-09-24 01:47:47Z',
-            unique_pid: 1002,
-            unique_ppid: 1001,
-            user_domain: 'NT AUTHORITY',
-            user_name: 'SYSTEM',
-            user_sid: 'S-1-5-18',
-          },
-          event_timestamp: 132137632670000000,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            _descendant_count: 5,
-            command_line: '\\SystemRoot\\System32\\smss.exe',
-            depth: -4,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'already_running',
-            event_type_full: 'process_event',
-            integrity_level: 'system',
-            md5: '1911a3356fa3f77ccc825ccbac038c2a',
-            node_id: 1003,
-            opcode: 3,
-            original_file_name: 'smss.exe',
-            pid: 244,
-            ppid: 4,
-            process_name: 'smss.exe',
-            process_path: 'C:\\Windows\\System32\\smss.exe',
-            serial_event_id: 1003,
-            sha1: '706473ad489e5365af1e3431c4f8fe80a9139bc2',
-            sha256: '6ed135b792c81d78b33a57f0f4770db6105c9ed3e2193629cb3ec38bfd5b7e1b',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 1002,
-            timestamp: 132137632670000000,
-            timestamp_utc: '2019-09-24 01:47:47Z',
-            unique_pid: 1003,
-            unique_ppid: 1002,
-            user_domain: 'NT AUTHORITY',
-            user_name: 'SYSTEM',
-            user_sid: 'S-1-5-18',
-          },
-          event_timestamp: 132137632670000000,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            _descendant_count: 4,
-            authentication_id: 999,
-            command_line: '\\SystemRoot\\System32\\smss.exe 00000000 00000048 ',
-            depth: -3,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'system',
-            md5: '1911a3356fa3f77ccc825ccbac038c2a',
-            node_id: 18643,
-            opcode: 1,
-            original_file_name: 'smss.exe',
-            parent_process_name: 'smss.exe',
-            parent_process_path: 'C:\\Windows\\System32\\smss.exe',
-            pid: 2364,
-            ppid: 244,
-            process_name: 'smss.exe',
-            process_path: 'C:\\Windows\\System32\\smss.exe',
-            serial_event_id: 18643,
-            sha1: '706473ad489e5365af1e3431c4f8fe80a9139bc2',
-            sha256: '6ed135b792c81d78b33a57f0f4770db6105c9ed3e2193629cb3ec38bfd5b7e1b',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 1003,
-            timestamp: 132137681960227504,
-            timestamp_utc: '2019-09-24 03:09:56Z',
-            unique_pid: 18643,
-            unique_ppid: 1003,
-            user_domain: 'NT AUTHORITY',
-            user_name: 'SYSTEM',
-            user_sid: 'S-1-5-18',
-          },
-          event_timestamp: 132137681960227504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            _descendant_count: 3,
-            authentication_id: 999,
-            command_line: 'winlogon.exe',
-            depth: -2,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'system',
-            md5: '1151b1baa6f350b1db6598e0fea7c457',
-            node_id: 18645,
-            opcode: 1,
-            original_file_name: 'WINLOGON.EXE',
-            parent_process_name: 'smss.exe',
-            parent_process_path: 'C:\\Windows\\System32\\smss.exe',
-            pid: 3108,
-            ppid: 2364,
-            process_name: 'winlogon.exe',
-            process_path: 'C:\\Windows\\System32\\winlogon.exe',
-            serial_event_id: 18645,
-            sha1: '434856b834baf163c5ea4d26434eeae775a507fb',
-            sha256: 'b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18643,
-            timestamp: 132137681961163504,
-            timestamp_utc: '2019-09-24 03:09:56Z',
-            unique_pid: 18645,
-            unique_ppid: 18643,
-            user_domain: 'NT AUTHORITY',
-            user_name: 'SYSTEM',
-            user_sid: 'S-1-5-18',
-          },
-          event_timestamp: 132137681961163504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            depth: -2,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 0,
-            md5: '1911a3356fa3f77ccc825ccbac038c2a',
-            node_id: 18646,
-            opcode: 2,
-            original_file_name: 'smss.exe',
-            parent_process_name: 'smss.exe',
-            parent_process_path: 'C:\\Windows\\System32\\smss.exe',
-            pid: 2364,
-            ppid: 244,
-            process_name: 'smss.exe',
-            process_path: 'C:\\Windows\\System32\\smss.exe',
-            serial_event_id: 18646,
-            sha1: '706473ad489e5365af1e3431c4f8fe80a9139bc2',
-            sha256: '6ed135b792c81d78b33a57f0f4770db6105c9ed3e2193629cb3ec38bfd5b7e1b',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18643,
-            timestamp: 132137681961787504,
-            timestamp_utc: '2019-09-24 03:09:56Z',
-            unique_pid: 18643,
-            unique_ppid: 1003,
-            user_domain: 'NT AUTHORITY',
-            user_name: 'SYSTEM',
-            user_sid: 'S-1-5-18',
-          },
-          event_timestamp: 132137681961787504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            _descendant_count: 1,
-            authentication_id: 4904488,
-            command_line: 'C:\\Windows\\system32\\userinit.exe',
-            depth: -1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'bafe84e637bf7388c96ef48d4d3fdd53',
-            node_id: 18833,
-            opcode: 1,
-            original_file_name: 'USERINIT.EXE',
-            parent_process_name: 'winlogon.exe',
-            parent_process_path: 'C:\\Windows\\System32\\winlogon.exe',
-            pid: 3560,
-            ppid: 3108,
-            process_name: 'userinit.exe',
-            process_path: 'C:\\Windows\\System32\\userinit.exe',
-            serial_event_id: 18833,
-            sha1: '47267f943f060e36604d56c8895a6eece063d9a1',
-            sha256: '11c194d9adce90027272c627d7fbf3ba5025ff0f7b26a8333f764e11e1382cf9',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18645,
-            timestamp: 132137681981287504,
-            timestamp_utc: '2019-09-24 03:09:58Z',
-            unique_pid: 18833,
-            unique_ppid: 18645,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137681981287504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            _descendant_count: 0,
-            authentication_id: 4904488,
-            command_line: 'C:\\Windows\\Explorer.EXE',
-            depth: 0,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'ac4c51eb24aa95b77f705ab159189e24',
-            node_id: 18943,
-            opcode: 1,
-            origin: true,
-            original_file_name: 'EXPLORER.EXE',
-            parent_process_name: 'userinit.exe',
-            parent_process_path: 'C:\\Windows\\System32\\userinit.exe',
-            pid: 1808,
-            ppid: 3560,
-            process_name: 'explorer.exe',
-            process_path: 'C:\\Windows\\explorer.exe',
-            serial_event_id: 18943,
-            sha1: '4583daf9442880204730fb2c8a060430640494b1',
-            sha256: '6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18833,
-            timestamp: 132137681985655504,
-            timestamp_utc: '2019-09-24 03:09:58Z',
-            unique_pid: 18943,
-            unique_ppid: 18833,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137681985655504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: '"C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe" -n vmusr',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: '8dc5ad50587b936f7f616738112bfd2a',
-            node_id: 19545,
-            opcode: 1,
-            original_file_name: 'vmtoolsd.exe',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 3596,
-            ppid: 1808,
-            process_name: 'vmtoolsd.exe',
-            process_path: 'C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe',
-            serial_event_id: 19545,
-            sha1: '04479ea30943ec471a6a5ca4c0dc74b5ff496e9f',
-            sha256: 'd6d9f041da6f724bf69f48bbee3bf41295a0ed4dca715b1908c5f35bc8034d53',
-            signature_signer: 'VMware, Inc.',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137681999539504,
-            timestamp_utc: '2019-09-24 03:09:59Z',
-            unique_pid: 19545,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137681999539504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            depth: 0,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 0,
-            md5: 'bafe84e637bf7388c96ef48d4d3fdd53',
-            node_id: 20261,
-            opcode: 2,
-            original_file_name: 'USERINIT.EXE',
-            parent_process_name: 'winlogon.exe',
-            parent_process_path: 'C:\\Windows\\System32\\winlogon.exe',
-            pid: 3560,
-            ppid: 3108,
-            process_name: 'userinit.exe',
-            process_path: 'C:\\Windows\\System32\\userinit.exe',
-            serial_event_id: 20261,
-            sha1: '47267f943f060e36604d56c8895a6eece063d9a1',
-            sha256: '11c194d9adce90027272c627d7fbf3ba5025ff0f7b26a8333f764e11e1382cf9',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18833,
-            timestamp: 132137682277819504,
-            timestamp_utc: '2019-09-24 03:10:27Z',
-            unique_pid: 18833,
-            unique_ppid: 18645,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137682277819504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: '"C:\\Windows\\explorer.exe" ',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'ac4c51eb24aa95b77f705ab159189e24',
-            node_id: 20303,
-            opcode: 1,
-            original_file_name: 'EXPLORER.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 3124,
-            ppid: 1808,
-            process_name: 'explorer.exe',
-            process_path: 'C:\\Windows\\explorer.exe',
-            serial_event_id: 20303,
-            sha1: '4583daf9442880204730fb2c8a060430640494b1',
-            sha256: '6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137682603979504,
-            timestamp_utc: '2019-09-24 03:11:00Z',
-            unique_pid: 20303,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137682603979504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: '310624aa-bb2b-442b-a6c9-3284148b0ae3',
-          data_buffer: {
-            depth: 2,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 1,
-            md5: 'ac4c51eb24aa95b77f705ab159189e24',
-            node_id: 20310,
-            opcode: 2,
-            original_file_name: 'EXPLORER.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 3124,
-            ppid: 1808,
-            process_name: 'explorer.exe',
-            process_path: 'C:\\Windows\\explorer.exe',
-            serial_event_id: 20310,
-            sha1: '4583daf9442880204730fb2c8a060430640494b1',
-            sha256: '6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 20303,
-            timestamp: 132137682604229504,
-            timestamp_utc: '2019-09-24 03:11:00Z',
-            unique_pid: 20303,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137682604229504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: '"C:\\Windows\\explorer.exe" ',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'ac4c51eb24aa95b77f705ab159189e24',
-            node_id: 20455,
-            opcode: 1,
-            original_file_name: 'EXPLORER.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 3084,
-            ppid: 1808,
-            process_name: 'explorer.exe',
-            process_path: 'C:\\Windows\\explorer.exe',
-            serial_event_id: 20455,
-            sha1: '4583daf9442880204730fb2c8a060430640494b1',
-            sha256: '6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137682773669504,
-            timestamp_utc: '2019-09-24 03:11:17Z',
-            unique_pid: 20455,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137682773669504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 2,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 1,
-            md5: 'ac4c51eb24aa95b77f705ab159189e24',
-            node_id: 20462,
-            opcode: 2,
-            original_file_name: 'EXPLORER.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 3084,
-            ppid: 1808,
-            process_name: 'explorer.exe',
-            process_path: 'C:\\Windows\\explorer.exe',
-            serial_event_id: 20462,
-            sha1: '4583daf9442880204730fb2c8a060430640494b1',
-            sha256: '6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 20455,
-            timestamp: 132137682774259504,
-            timestamp_utc: '2019-09-24 03:11:17Z',
-            unique_pid: 20455,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137682774259504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: '"C:\\Windows\\System32\\cmd.exe" ',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: '5746bd7e255dd6a8afa06f7c42c1ba41',
-            node_id: 21120,
-            opcode: 1,
-            original_file_name: 'Cmd.Exe',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 3280,
-            ppid: 1808,
-            process_name: 'cmd.exe',
-            process_path: 'C:\\Windows\\System32\\cmd.exe',
-            serial_event_id: 21120,
-            sha1: '0f3c4ff28f354aede202d54e9d1c5529a3bf87d8',
-            sha256: 'db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137682997939504,
-            timestamp_utc: '2019-09-24 03:11:39Z',
-            unique_pid: 21120,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137682997939504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: '"C:\\Windows\\explorer.exe" ',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'ac4c51eb24aa95b77f705ab159189e24',
-            node_id: 21166,
-            opcode: 1,
-            original_file_name: 'EXPLORER.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 3548,
-            ppid: 1808,
-            process_name: 'explorer.exe',
-            process_path: 'C:\\Windows\\explorer.exe',
-            serial_event_id: 21166,
-            sha1: '4583daf9442880204730fb2c8a060430640494b1',
-            sha256: '6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137683166079504,
-            timestamp_utc: '2019-09-24 03:11:56Z',
-            unique_pid: 21166,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137683166079504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 2,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 1,
-            md5: 'ac4c51eb24aa95b77f705ab159189e24',
-            node_id: 21173,
-            opcode: 2,
-            original_file_name: 'EXPLORER.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 3548,
-            ppid: 1808,
-            process_name: 'explorer.exe',
-            process_path: 'C:\\Windows\\explorer.exe',
-            serial_event_id: 21173,
-            sha1: '4583daf9442880204730fb2c8a060430640494b1',
-            sha256: '6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 21166,
-            timestamp: 132137683166729504,
-            timestamp_utc: '2019-09-24 03:11:56Z',
-            unique_pid: 21166,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137683166729504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: '"C:\\Python27\\python.exe" "C:\\tmp\\dns.py" ',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: '743b91619fbfee3c3e173ba5a17b1290',
-            node_id: 21480,
-            opcode: 1,
-            original_file_name: '',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 4060,
-            ppid: 1808,
-            process_name: 'python.exe',
-            process_path: 'C:\\Python27\\python.exe',
-            serial_event_id: 21480,
-            sha1: 'edabcf58d55a5e462f7a368d99616e3ac051c620',
-            sha256: '45b9384b852d850327e194ac86d84aed8916a3c13fc8f49ca54fddcbca4f7e32',
-            signature_signer: '',
-            signature_status: 'noSignature',
-            source_id: 18943,
-            timestamp: 132137683493349504,
-            timestamp_utc: '2019-09-24 03:12:29Z',
-            unique_pid: 21480,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137683493349504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 2,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 0,
-            md5: '743b91619fbfee3c3e173ba5a17b1290',
-            node_id: 21500,
-            opcode: 2,
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 4060,
-            ppid: 1808,
-            process_name: 'python.exe',
-            process_path: 'C:\\Python27\\python.exe',
-            serial_event_id: 21500,
-            sha1: 'edabcf58d55a5e462f7a368d99616e3ac051c620',
-            sha256: '45b9384b852d850327e194ac86d84aed8916a3c13fc8f49ca54fddcbca4f7e32',
-            signature_status: 'noSignature',
-            source_id: 21480,
-            timestamp: 132137683493889504,
-            timestamp_utc: '2019-09-24 03:12:29Z',
-            unique_pid: 21480,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137683493889504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: '"C:\\Python27\\python.exe" "C:\\tmp\\dns.py" ',
-            depth: 2,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: '743b91619fbfee3c3e173ba5a17b1290',
-            node_id: 21539,
-            opcode: 1,
-            original_file_name: '',
-            parent_process_name: 'cmd.exe',
-            parent_process_path: 'C:\\Windows\\System32\\cmd.exe',
-            pid: 2888,
-            ppid: 3280,
-            process_name: 'python.exe',
-            process_path: 'C:\\Python27\\python.exe',
-            serial_event_id: 21539,
-            sha1: 'edabcf58d55a5e462f7a368d99616e3ac051c620',
-            sha256: '45b9384b852d850327e194ac86d84aed8916a3c13fc8f49ca54fddcbca4f7e32',
-            signature_signer: '',
-            signature_status: 'noSignature',
-            source_id: 21120,
-            timestamp: 132137683555889504,
-            timestamp_utc: '2019-09-24 03:12:35Z',
-            unique_pid: 21539,
-            unique_ppid: 21120,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137683555889504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 3,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 0,
-            md5: '743b91619fbfee3c3e173ba5a17b1290',
-            node_id: 21540,
-            opcode: 2,
-            parent_process_name: 'cmd.exe',
-            parent_process_path: 'C:\\Windows\\System32\\cmd.exe',
-            pid: 2888,
-            ppid: 3280,
-            process_name: 'python.exe',
-            process_path: 'C:\\Python27\\python.exe',
-            serial_event_id: 21540,
-            sha1: 'edabcf58d55a5e462f7a368d99616e3ac051c620',
-            sha256: '45b9384b852d850327e194ac86d84aed8916a3c13fc8f49ca54fddcbca4f7e32',
-            signature_status: 'noSignature',
-            source_id: 21539,
-            timestamp: 132137683556159504,
-            timestamp_utc: '2019-09-24 03:12:35Z',
-            unique_pid: 21539,
-            unique_ppid: 21120,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137683556159504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            depth: 2,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'c29675ce0750f73225bf05d03080dfb2',
-            node_id: 21634,
-            opcode: 1,
-            original_file_name: '',
-            parent_process_name: 'cmd.exe',
-            parent_process_path: 'C:\\Windows\\System32\\cmd.exe',
-            pid: 3996,
-            ppid: 3280,
-            process_name: 'fakenet.exe',
-            process_path: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            serial_event_id: 21634,
-            sha1: 'b14763ef982450551bcb09f6e0ecc75d2b9684fb',
-            sha256: '948f1c024118e434b6867ea593bb180212d35f9d2a9401892903ef22841fb303',
-            signature_signer: '',
-            signature_status: 'noSignature',
-            source_id: 21120,
-            timestamp: 132137683921669504,
-            timestamp_utc: '2019-09-24 03:13:12Z',
-            unique_pid: 21634,
-            unique_ppid: 21120,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137683921669504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            depth: 3,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'c29675ce0750f73225bf05d03080dfb2',
-            node_id: 21669,
-            opcode: 1,
-            original_file_name: '',
-            parent_process_name: 'fakenet.exe',
-            parent_process_path: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            pid: 184,
-            ppid: 3996,
-            process_name: 'fakenet.exe',
-            process_path: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            serial_event_id: 21669,
-            sha1: 'b14763ef982450551bcb09f6e0ecc75d2b9684fb',
-            sha256: '948f1c024118e434b6867ea593bb180212d35f9d2a9401892903ef22841fb303',
-            signature_signer: '',
-            signature_status: 'noSignature',
-            source_id: 21634,
-            timestamp: 132137683923819504,
-            timestamp_utc: '2019-09-24 03:13:12Z',
-            unique_pid: 21669,
-            unique_ppid: 21634,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137683923819504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 4,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 1,
-            md5: 'c29675ce0750f73225bf05d03080dfb2',
-            node_id: 21679,
-            opcode: 2,
-            parent_process_name: 'fakenet.exe',
-            parent_process_path: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            pid: 184,
-            ppid: 3996,
-            process_name: 'fakenet.exe',
-            process_path: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            serial_event_id: 21679,
-            sha1: 'b14763ef982450551bcb09f6e0ecc75d2b9684fb',
-            sha256: '948f1c024118e434b6867ea593bb180212d35f9d2a9401892903ef22841fb303',
-            signature_status: 'noSignature',
-            source_id: 21669,
-            timestamp: 132137683931089504,
-            timestamp_utc: '2019-09-24 03:13:13Z',
-            unique_pid: 21669,
-            unique_ppid: 21634,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137683931089504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 3,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 1,
-            md5: 'c29675ce0750f73225bf05d03080dfb2',
-            node_id: 21694,
-            opcode: 2,
-            parent_process_name: 'cmd.exe',
-            parent_process_path: 'C:\\Windows\\System32\\cmd.exe',
-            pid: 3996,
-            ppid: 3280,
-            process_name: 'fakenet.exe',
-            process_path: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            serial_event_id: 21694,
-            sha1: 'b14763ef982450551bcb09f6e0ecc75d2b9684fb',
-            sha256: '948f1c024118e434b6867ea593bb180212d35f9d2a9401892903ef22841fb303',
-            signature_status: 'noSignature',
-            source_id: 21634,
-            timestamp: 132137683931569504,
-            timestamp_utc: '2019-09-24 03:13:13Z',
-            unique_pid: 21634,
-            unique_ppid: 21120,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137683931569504,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line:
-              '"C:\\Windows\\system32\\NOTEPAD.EXE" C:\\tmp\\fakenet1.4.3\\configs\\default.ini',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'f2c7bb8acc97f92e987a2d4087d021b1',
-            node_id: 21769,
-            opcode: 1,
-            original_file_name: 'NOTEPAD.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 2492,
-            ppid: 1808,
-            process_name: 'notepad.exe',
-            process_path: 'C:\\Windows\\System32\\notepad.exe',
-            serial_event_id: 21769,
-            sha1: '7eb0139d2175739b3ccb0d1110067820be6abd29',
-            sha256: '142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137684112851830,
-            timestamp_utc: '2019-09-24 03:13:31Z',
-            unique_pid: 21769,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137684112851830,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 2,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 0,
-            md5: 'f2c7bb8acc97f92e987a2d4087d021b1',
-            node_id: 21794,
-            opcode: 2,
-            original_file_name: 'NOTEPAD.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 2492,
-            ppid: 1808,
-            process_name: 'notepad.exe',
-            process_path: 'C:\\Windows\\System32\\notepad.exe',
-            serial_event_id: 21794,
-            sha1: '7eb0139d2175739b3ccb0d1110067820be6abd29',
-            sha256: '142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 21769,
-            timestamp: 132137684131573702,
-            timestamp_utc: '2019-09-24 03:13:33Z',
-            unique_pid: 21769,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137684131573702,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: 'fakenet.exe',
-            depth: 2,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'c29675ce0750f73225bf05d03080dfb2',
-            node_id: 21890,
-            opcode: 1,
-            original_file_name: '',
-            parent_process_name: 'cmd.exe',
-            parent_process_path: 'C:\\Windows\\System32\\cmd.exe',
-            pid: 1060,
-            ppid: 3280,
-            process_name: 'fakenet.exe',
-            process_path: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            serial_event_id: 21890,
-            sha1: 'b14763ef982450551bcb09f6e0ecc75d2b9684fb',
-            sha256: '948f1c024118e434b6867ea593bb180212d35f9d2a9401892903ef22841fb303',
-            signature_signer: '',
-            signature_status: 'noSignature',
-            source_id: 21120,
-            timestamp: 132137684579848525,
-            timestamp_utc: '2019-09-24 03:14:17Z',
-            unique_pid: 21890,
-            unique_ppid: 21120,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137684579848525,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: 'fakenet.exe',
-            depth: 3,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'c29675ce0750f73225bf05d03080dfb2',
-            node_id: 21924,
-            opcode: 1,
-            original_file_name: '',
-            parent_process_name: 'fakenet.exe',
-            parent_process_path: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            pid: 4024,
-            ppid: 1060,
-            process_name: 'fakenet.exe',
-            process_path: 'C:\\tmp\\fakenet1.4.3\\fakenet.exe',
-            serial_event_id: 21924,
-            sha1: 'b14763ef982450551bcb09f6e0ecc75d2b9684fb',
-            sha256: '948f1c024118e434b6867ea593bb180212d35f9d2a9401892903ef22841fb303',
-            signature_signer: '',
-            signature_status: 'noSignature',
-            source_id: 21890,
-            timestamp: 132137684580468587,
-            timestamp_utc: '2019-09-24 03:14:18Z',
-            unique_pid: 21924,
-            unique_ppid: 21890,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137684580468587,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: '"C:\\Windows\\System32\\cmd.exe" ',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: '5746bd7e255dd6a8afa06f7c42c1ba41',
-            node_id: 22238,
-            opcode: 1,
-            original_file_name: 'Cmd.Exe',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 3328,
-            ppid: 1808,
-            process_name: 'cmd.exe',
-            process_path: 'C:\\Windows\\System32\\cmd.exe',
-            serial_event_id: 22238,
-            sha1: '0f3c4ff28f354aede202d54e9d1c5529a3bf87d8',
-            sha256: 'db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137684944024939,
-            timestamp_utc: '2019-09-24 03:14:54Z',
-            unique_pid: 22238,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137684944024939,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            attack_references: [
-              {
-                tactics: ['Privilege Escalation', 'Execution', 'Persistence'],
-                technique_id: 'T1053',
-                technique_name: 'Scheduled Task',
-              },
-            ],
-            authentication_id: 4904488,
-            command_line: 'SCHTASKS  /CREATE /SC MINUTE /TN "Windiws" /TR "C:\\tmp\\scheduler.bat"',
-            depth: 2,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: '97e0ec3d6d99e8cc2b17ef2d3760e8fc',
-            node_id: 22376,
-            opcode: 1,
-            original_file_name: 'sctasks.exe',
-            parent_process_name: 'cmd.exe',
-            parent_process_path: 'C:\\Windows\\System32\\cmd.exe',
-            pid: 2864,
-            ppid: 3328,
-            process_name: 'schtasks.exe',
-            process_path: 'C:\\Windows\\System32\\schtasks.exe',
-            serial_event_id: 22376,
-            sha1: 'bd9dceffbcbbc82bee5f2109bd73a57477fe1f92',
-            sha256: '6dce7d58ebb0d705fcb4179349c441b45e160c94e43934c5ed8fa1964e2cd031',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 22238,
-            timestamp: 132137685249385472,
-            timestamp_utc: '2019-09-24 03:15:24Z',
-            unique_pid: 22376,
-            unique_ppid: 22238,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137685249385472,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 3,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 0,
-            md5: '97e0ec3d6d99e8cc2b17ef2d3760e8fc',
-            node_id: 22384,
-            opcode: 2,
-            original_file_name: 'sctasks.exe',
-            parent_process_name: 'cmd.exe',
-            parent_process_path: 'C:\\Windows\\System32\\cmd.exe',
-            pid: 2864,
-            ppid: 3328,
-            process_name: 'schtasks.exe',
-            process_path: 'C:\\Windows\\System32\\schtasks.exe',
-            serial_event_id: 22384,
-            sha1: 'bd9dceffbcbbc82bee5f2109bd73a57477fe1f92',
-            sha256: '6dce7d58ebb0d705fcb4179349c441b45e160c94e43934c5ed8fa1964e2cd031',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 22376,
-            timestamp: 132137685251515685,
-            timestamp_utc: '2019-09-24 03:15:25Z',
-            unique_pid: 22376,
-            unique_ppid: 22238,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137685251515685,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            authentication_id: 4904488,
-            command_line: '"C:\\Windows\\System32\\NOTEPAD.EXE" C:\\tmp\\scheduler.bat',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'f2c7bb8acc97f92e987a2d4087d021b1',
-            node_id: 22448,
-            opcode: 1,
-            original_file_name: 'NOTEPAD.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 4048,
-            ppid: 1808,
-            process_name: 'notepad.exe',
-            process_path: 'C:\\Windows\\System32\\notepad.exe',
-            serial_event_id: 22448,
-            sha1: '7eb0139d2175739b3ccb0d1110067820be6abd29',
-            sha256: '142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137685448755407,
-            timestamp_utc: '2019-09-24 03:15:44Z',
-            unique_pid: 22448,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137685448755407,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 2,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 0,
-            md5: 'f2c7bb8acc97f92e987a2d4087d021b1',
-            node_id: 22464,
-            opcode: 2,
-            original_file_name: 'NOTEPAD.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 4048,
-            ppid: 1808,
-            process_name: 'notepad.exe',
-            process_path: 'C:\\Windows\\System32\\notepad.exe',
-            serial_event_id: 22464,
-            sha1: '7eb0139d2175739b3ccb0d1110067820be6abd29',
-            sha256: '142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 22448,
-            timestamp: 132137685516752206,
-            timestamp_utc: '2019-09-24 03:15:51Z',
-            unique_pid: 22448,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137685516752206,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            attack_references: [
-              {
-                tactics: ['Execution'],
-                technique_id: 'T1085',
-                technique_name: 'Rundll32',
-              },
-            ],
-            authentication_id: 4904488,
-            command_line:
-              '"C:\\Windows\\system32\\rundll32.exe" C:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL C:\\tmp\\XLS_no_email_Upcoming Events February 2018.xls\\cb85072e6ca66a29cb0b73659a0fe5ba2456d9ba0b52e3a4c89e86549bc6e2c7.xls',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'dd81d91ff3b0763c392422865c9ac12e',
-            node_id: 22799,
-            opcode: 1,
-            original_file_name: 'RUNDLL32.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 2864,
-            ppid: 1808,
-            process_name: 'rundll32.exe',
-            process_path: 'C:\\Windows\\System32\\rundll32.exe',
-            serial_event_id: 22799,
-            sha1: '963b55acc8c566876364716d5aafa353995812a8',
-            sha256: 'f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137686572217742,
-            timestamp_utc: '2019-09-24 03:17:37Z',
-            unique_pid: 22799,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137686572217742,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 2,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 0,
-            md5: 'dd81d91ff3b0763c392422865c9ac12e',
-            node_id: 22805,
-            opcode: 2,
-            original_file_name: 'RUNDLL32.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 2864,
-            ppid: 1808,
-            process_name: 'rundll32.exe',
-            process_path: 'C:\\Windows\\System32\\rundll32.exe',
-            serial_event_id: 22805,
-            sha1: '963b55acc8c566876364716d5aafa353995812a8',
-            sha256: 'f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 22799,
-            timestamp: 132137686585839104,
-            timestamp_utc: '2019-09-24 03:17:38Z',
-            unique_pid: 22799,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137686585839104,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            attack_references: [
-              {
-                tactics: ['Execution'],
-                technique_id: 'T1085',
-                technique_name: 'Rundll32',
-              },
-            ],
-            authentication_id: 4904488,
-            command_line:
-              '"C:\\Windows\\system32\\rundll32.exe" C:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL C:\\tmp\\Upcoming Defense events February 2018.eml',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'dd81d91ff3b0763c392422865c9ac12e',
-            node_id: 22933,
-            opcode: 1,
-            original_file_name: 'RUNDLL32.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 1864,
-            ppid: 1808,
-            process_name: 'rundll32.exe',
-            process_path: 'C:\\Windows\\System32\\rundll32.exe',
-            serial_event_id: 22933,
-            sha1: '963b55acc8c566876364716d5aafa353995812a8',
-            sha256: 'f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137686702740793,
-            timestamp_utc: '2019-09-24 03:17:50Z',
-            unique_pid: 22933,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137686702740793,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 2,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 0,
-            md5: 'dd81d91ff3b0763c392422865c9ac12e',
-            node_id: 22945,
-            opcode: 2,
-            original_file_name: 'RUNDLL32.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 1864,
-            ppid: 1808,
-            process_name: 'rundll32.exe',
-            process_path: 'C:\\Windows\\System32\\rundll32.exe',
-            serial_event_id: 22945,
-            sha1: '963b55acc8c566876364716d5aafa353995812a8',
-            sha256: 'f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 22933,
-            timestamp: 132137686718432362,
-            timestamp_utc: '2019-09-24 03:17:51Z',
-            unique_pid: 22933,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137686718432362,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            attack_references: [
-              {
-                tactics: ['Execution'],
-                technique_id: 'T1085',
-                technique_name: 'Rundll32',
-              },
-            ],
-            authentication_id: 4904488,
-            command_line:
-              '"C:\\Windows\\system32\\rundll32.exe" C:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail',
-            depth: 1,
-            elevated: true,
-            elevation_type: 'default',
-            event_subtype_full: 'creation_event',
-            event_type_full: 'process_event',
-            integrity_level: 'high',
-            md5: 'dd81d91ff3b0763c392422865c9ac12e',
-            node_id: 27050,
-            opcode: 1,
-            original_file_name: 'RUNDLL32.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 568,
-            ppid: 1808,
-            process_name: 'rundll32.exe',
-            process_path: 'C:\\Windows\\System32\\rundll32.exe',
-            serial_event_id: 27050,
-            sha1: '963b55acc8c566876364716d5aafa353995812a8',
-            sha256: 'f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 18943,
-            timestamp: 132137686926723189,
-            timestamp_utc: '2019-09-24 03:18:12Z',
-            unique_pid: 27050,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137686926723189,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-        {
-          collection_id: 'f287067d-3ec7-4d5a-b6de-ea1415bc5e56',
-          data_buffer: {
-            depth: 2,
-            event_subtype_full: 'termination_event',
-            event_type_full: 'process_event',
-            exit_code: 0,
-            md5: 'dd81d91ff3b0763c392422865c9ac12e',
-            node_id: 27053,
-            opcode: 2,
-            original_file_name: 'RUNDLL32.EXE',
-            parent_process_name: 'explorer.exe',
-            parent_process_path: 'C:\\Windows\\explorer.exe',
-            pid: 568,
-            ppid: 1808,
-            process_name: 'rundll32.exe',
-            process_path: 'C:\\Windows\\System32\\rundll32.exe',
-            serial_event_id: 27053,
-            sha1: '963b55acc8c566876364716d5aafa353995812a8',
-            sha256: 'f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9',
-            signature_signer: 'Microsoft Windows',
-            signature_status: 'trusted',
-            source_id: 27050,
-            timestamp: 132137686939784495,
-            timestamp_utc: '2019-09-24 03:18:13Z',
-            unique_pid: 27050,
-            unique_ppid: 18943,
-            user_domain: 'ENDPOINT-W-1-07',
-            user_name: 'vagrant',
-            user_sid: 'S-1-5-21-3883902650-1642591343-2485142877-1001',
-          },
-          event_timestamp: 132137686939784495,
-          event_type: 4,
-          machine_id: '7f1660dc-2c12-ce99-71b8-1ef862aeec34',
-          serial_event_id: 0,
-        },
-      ],
-      status: 'success',
-      task_id: '2bed7d8b-72b1-4650-882c-5167a2fe1735',
-      total_events_searched: 7730,
-      type: 'eventLoggingSearchResponse',
-    },
-  },
-  metadata: {
-    count: 39,
-    next: null,
-    next_url: null,
-    per_page: '4000',
-    previous_url: null,
-    timestamp: '2019-12-18T19:31:27.565110',
-  },
-};
-
-export const sampleData: ProcessEventSampleData = rawData as ProcessEventSampleData;

From ff3ee41e7925cf8981ad3dbb50e720b89ac3cf62 Mon Sep 17 00:00:00 2001
From: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>
Date: Thu, 25 Jun 2020 11:30:25 -0400
Subject: [PATCH 09/78] rename old siem kibana config to securitySolution
 (#69874)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../plugins/security_solution/server/index.ts | 30 +++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/index.ts b/x-pack/plugins/security_solution/server/index.ts
index 8a77137c20c1..06b35213b471 100644
--- a/x-pack/plugins/security_solution/server/index.ts
+++ b/x-pack/plugins/security_solution/server/index.ts
@@ -4,15 +4,41 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { PluginInitializerContext } from '../../../../src/core/server';
+import { PluginInitializerContext, PluginConfigDescriptor } from '../../../../src/core/server';
 import { Plugin, PluginSetup, PluginStart } from './plugin';
 import { configSchema, ConfigType } from './config';
+import { SIGNALS_INDEX_KEY } from '../common/constants';
 
 export const plugin = (context: PluginInitializerContext) => {
   return new Plugin(context);
 };
 
-export const config = { schema: configSchema };
+export const config: PluginConfigDescriptor<ConfigType> = {
+  schema: configSchema,
+  deprecations: ({ renameFromRoot }) => [
+    renameFromRoot('xpack.siem.enabled', 'xpack.securitySolution.enabled'),
+    renameFromRoot(
+      'xpack.siem.maxRuleImportExportSize',
+      'xpack.securitySolution.maxRuleImportExportSize'
+    ),
+    renameFromRoot(
+      'xpack.siem.maxRuleImportPayloadBytes',
+      'xpack.securitySolution.maxRuleImportPayloadBytes'
+    ),
+    renameFromRoot(
+      'xpack.siem.maxTimelineImportExportSize',
+      'xpack.securitySolution.maxTimelineImportExportSize'
+    ),
+    renameFromRoot(
+      'xpack.siem.maxTimelineImportPayloadBytes',
+      'xpack.securitySolution.maxTimelineImportPayloadBytes'
+    ),
+    renameFromRoot(
+      `xpack.siem.${SIGNALS_INDEX_KEY}`,
+      `xpack.securitySolution.${SIGNALS_INDEX_KEY}`
+    ),
+  ],
+};
 
 export { ConfigType, Plugin, PluginSetup, PluginStart };
 

From a854067fb0f8dc1799a2d53134517519261918fd Mon Sep 17 00:00:00 2001
From: nnamdifrankie <56440728+nnamdifrankie@users.noreply.github.com>
Date: Thu, 25 Jun 2020 11:50:16 -0400
Subject: [PATCH 10/78] [Endpoint]EMT-451: add ability to filter endpoint
 metadata based on presence of unenrolled events (#69708)

[Endpoint]EMT-451: add ability to filter endpoint metadata based on presence of unenrolled events
---
 .../common/endpoint/constants.ts              |   1 +
 .../common/endpoint/generate_data.ts          |   5 +-
 .../common/endpoint/types.ts                  |  19 +-
 .../server/endpoint/routes/metadata/index.ts  |  24 ++-
 .../endpoint/routes/metadata/metadata.test.ts | 134 ++++++++++----
 .../routes/metadata/query_builders.test.ts    | 175 +++++++++++++++++-
 .../routes/metadata/query_builders.ts         |  66 +++++--
 .../routes/metadata/support/unenroll.test.ts  | 147 +++++++++++++++
 .../routes/metadata/support/unenroll.ts       | 114 ++++++++++++
 .../apis/endpoint/data_stream_helper.ts       |   5 +
 .../api_integration/apis/endpoint/metadata.ts |  36 +++-
 .../unenroll_feature/metadata/data.json.gz    | Bin 0 -> 598 bytes
 .../metadata_mirror/data.json.gz              | Bin 0 -> 535 bytes
 13 files changed, 670 insertions(+), 56 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.test.ts
 create mode 100644 x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
 create mode 100644 x-pack/test/functional/es_archives/endpoint/metadata/unenroll_feature/metadata/data.json.gz
 create mode 100644 x-pack/test/functional/es_archives/endpoint/metadata/unenroll_feature/metadata_mirror/data.json.gz

diff --git a/x-pack/plugins/security_solution/common/endpoint/constants.ts b/x-pack/plugins/security_solution/common/endpoint/constants.ts
index e311e358e614..984cd7d2506a 100644
--- a/x-pack/plugins/security_solution/common/endpoint/constants.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/constants.ts
@@ -7,5 +7,6 @@
 export const eventsIndexPattern = 'logs-endpoint.events.*';
 export const alertsIndexPattern = 'logs-endpoint.alerts-*';
 export const metadataIndexPattern = 'metrics-endpoint.metadata-*';
+export const metadataMirrorIndexPattern = 'metrics-endpoint.metadata_mirror-*';
 export const policyIndexPattern = 'metrics-endpoint.policy-*';
 export const telemetryIndexPattern = 'metrics-endpoint.telemetry-*';
diff --git a/x-pack/plugins/security_solution/common/endpoint/generate_data.ts b/x-pack/plugins/security_solution/common/endpoint/generate_data.ts
index ef9e8376827a..5af34b6a694e 100644
--- a/x-pack/plugins/security_solution/common/endpoint/generate_data.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/generate_data.ts
@@ -14,6 +14,7 @@ import {
   HostPolicyResponse,
   HostPolicyResponseActionStatus,
   PolicyData,
+  EndpointStatus,
 } from './types';
 import { factory as policyFactory } from './models/policy_config';
 
@@ -209,6 +210,7 @@ interface HostInfo {
   };
   host: Host;
   Endpoint: {
+    status: EndpointStatus;
     policy: {
       applied: {
         id: string;
@@ -305,7 +307,7 @@ export class EndpointDocGenerator {
    * Creates new random policy id for the host to simulate new policy application
    */
   public updatePolicyId() {
-    this.commonInfo.Endpoint.policy.applied = this.randomChoice(APPLIED_POLICIES);
+    this.commonInfo.Endpoint.policy.applied.id = this.randomChoice(APPLIED_POLICIES).id;
     this.commonInfo.Endpoint.policy.applied.status = this.randomChoice([
       HostPolicyResponseActionStatus.success,
       HostPolicyResponseActionStatus.failure,
@@ -333,6 +335,7 @@ export class EndpointDocGenerator {
         os: this.randomChoice(OS),
       },
       Endpoint: {
+        status: EndpointStatus.enrolled,
         policy: {
           applied: this.randomChoice(APPLIED_POLICIES),
         },
diff --git a/x-pack/plugins/security_solution/common/endpoint/types.ts b/x-pack/plugins/security_solution/common/endpoint/types.ts
index f8cfb8f7c3bb..4f13fd97ce44 100644
--- a/x-pack/plugins/security_solution/common/endpoint/types.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/types.ts
@@ -350,7 +350,23 @@ export interface AlertEvent {
 }
 
 /**
- * The status of the host
+ * The status of the Endpoint Agent as reported by the Agent or the
+ * Security Solution app using events from Fleet.
+ */
+export enum EndpointStatus {
+  /**
+   * Agent is enrolled with Fleet
+   */
+  enrolled = 'enrolled',
+
+  /**
+   * Agent is unenrrolled from Fleet
+   */
+  unenrolled = 'unenrolled',
+}
+
+/**
+ * The status of the host, which is mapped to the Elastic Agent status in Fleet
  */
 export enum HostStatus {
   /**
@@ -386,6 +402,7 @@ export type HostMetadata = Immutable<{
     };
   };
   Endpoint: {
+    status: EndpointStatus;
     policy: {
       applied: {
         id: string;
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/index.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/index.ts
index 4037f1a7cbc4..7c50a10846f9 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/index.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/index.ts
@@ -8,6 +8,7 @@ import { IRouter, Logger, RequestHandlerContext } from 'kibana/server';
 import { SearchResponse } from 'elasticsearch';
 import { schema } from '@kbn/config-schema';
 
+import Boom from 'boom';
 import { metadataIndexPattern } from '../../../../common/endpoint/constants';
 import { getESQueryHostMetadataByID, kibanaRequestToMetadataListESQuery } from './query_builders';
 import {
@@ -18,6 +19,7 @@ import {
 } from '../../../../common/endpoint/types';
 import { EndpointAppContext } from '../../types';
 import { AgentStatus } from '../../../../../ingest_manager/common/types/models';
+import { findAllUnenrolledHostIds, findUnenrolledHostByHostId, HostId } from './support/unenroll';
 
 interface HitSource {
   _source: HostMetadata;
@@ -68,10 +70,17 @@ export function registerEndpointRoutes(router: IRouter, endpointAppContext: Endp
     },
     async (context, req, res) => {
       try {
+        const unenrolledHostIds = await findAllUnenrolledHostIds(
+          context.core.elasticsearch.legacy.client
+        );
+
         const queryParams = await kibanaRequestToMetadataListESQuery(
           req,
           endpointAppContext,
-          metadataIndexPattern
+          metadataIndexPattern,
+          {
+            unenrolledHostIds: unenrolledHostIds.map((host: HostId) => host.host.id),
+          }
         );
         const response = (await context.core.elasticsearch.legacy.client.callAsCurrentUser(
           'search',
@@ -113,6 +122,12 @@ export function registerEndpointRoutes(router: IRouter, endpointAppContext: Endp
         return res.notFound({ body: 'Endpoint Not Found' });
       } catch (err) {
         logger.warn(JSON.stringify(err, null, 2));
+        if (err.isBoom) {
+          return res.customError({
+            statusCode: err.output.statusCode,
+            body: { message: err.message },
+          });
+        }
         return res.internalError({ body: err });
       }
     }
@@ -123,6 +138,13 @@ export async function getHostData(
   metadataRequestContext: MetadataRequestContext,
   id: string
 ): Promise<HostInfo | undefined> {
+  const unenrolledHostId = await findUnenrolledHostByHostId(
+    metadataRequestContext.requestHandlerContext.core.elasticsearch.legacy.client,
+    id
+  );
+  if (unenrolledHostId) {
+    throw Boom.badRequest('the requested endpoint is unenrolled');
+  }
   const query = getESQueryHostMetadataByID(id, metadataIndexPattern);
   const response = (await metadataRequestContext.requestHandlerContext.core.elasticsearch.legacy.client.callAsCurrentUser(
     'search',
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts
index c04975fa8b28..1ca205f669fa 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts
@@ -35,6 +35,7 @@ import Boom from 'boom';
 import { EndpointAppContextService } from '../../endpoint_app_context_services';
 import { createMockConfig } from '../../../lib/detection_engine/routes/__mocks__';
 import { EndpointDocGenerator } from '../../../../common/endpoint/generate_data';
+import { HostId } from './support/unenroll';
 
 describe('test endpoint route', () => {
   let routerMock: jest.Mocked<IRouter>;
@@ -50,6 +51,12 @@ describe('test endpoint route', () => {
     typeof createMockEndpointAppContextServiceStartContract
   >['agentService'];
   let endpointAppContextService: EndpointAppContextService;
+  const noUnenrolledEndpoint = () =>
+    Promise.resolve(({
+      hits: {
+        hits: [],
+      },
+    } as unknown) as SearchResponse<HostId>);
 
   beforeEach(() => {
     mockClusterClient = elasticsearchServiceMock.createClusterClient() as jest.Mocked<
@@ -77,7 +84,9 @@ describe('test endpoint route', () => {
   it('test find the latest of all endpoints', async () => {
     const mockRequest = httpServerMock.createKibanaRequest({});
     const response = createSearchResponse(new EndpointDocGenerator().generateHostMetadata());
-    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+    mockScopedClient.callAsCurrentUser
+      .mockImplementationOnce(noUnenrolledEndpoint)
+      .mockImplementationOnce(() => Promise.resolve(response));
     [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
       path.startsWith('/api/endpoint/metadata')
     )!;
@@ -88,7 +97,7 @@ describe('test endpoint route', () => {
       mockResponse
     );
 
-    expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+    expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(2);
     expect(routeConfig.options).toEqual({ authRequired: true });
     expect(mockResponse.ok).toBeCalled();
     const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
@@ -113,9 +122,11 @@ describe('test endpoint route', () => {
     });
 
     mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
-    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
-      Promise.resolve(createSearchResponse(new EndpointDocGenerator().generateHostMetadata()))
-    );
+    mockScopedClient.callAsCurrentUser
+      .mockImplementationOnce(noUnenrolledEndpoint)
+      .mockImplementationOnce(() =>
+        Promise.resolve(createSearchResponse(new EndpointDocGenerator().generateHostMetadata()))
+      );
     [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
       path.startsWith('/api/endpoint/metadata')
     )!;
@@ -126,8 +137,8 @@ describe('test endpoint route', () => {
       mockResponse
     );
 
-    expect(mockScopedClient.callAsCurrentUser).toBeCalled();
-    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body?.query).toEqual({
+    expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(2);
+    expect(mockScopedClient.callAsCurrentUser.mock.calls[1][1]?.body?.query).toEqual({
       match_all: {},
     });
     expect(routeConfig.options).toEqual({ authRequired: true });
@@ -156,9 +167,11 @@ describe('test endpoint route', () => {
     });
 
     mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
-    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
-      Promise.resolve(createSearchResponse(new EndpointDocGenerator().generateHostMetadata()))
-    );
+    mockScopedClient.callAsCurrentUser
+      .mockImplementationOnce(noUnenrolledEndpoint)
+      .mockImplementationOnce(() =>
+        Promise.resolve(createSearchResponse(new EndpointDocGenerator().generateHostMetadata()))
+      );
     [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
       path.startsWith('/api/endpoint/metadata')
     )!;
@@ -170,20 +183,26 @@ describe('test endpoint route', () => {
     );
 
     expect(mockScopedClient.callAsCurrentUser).toBeCalled();
-    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body?.query).toEqual({
+    expect(mockScopedClient.callAsCurrentUser.mock.calls[1][1]?.body?.query).toEqual({
       bool: {
-        must_not: {
-          bool: {
-            minimum_should_match: 1,
-            should: [
-              {
-                match: {
-                  'host.ip': '10.140.73.246',
+        must: [
+          {
+            bool: {
+              must_not: {
+                bool: {
+                  minimum_should_match: 1,
+                  should: [
+                    {
+                      match: {
+                        'host.ip': '10.140.73.246',
+                      },
+                    },
+                  ],
                 },
               },
-            ],
+            },
           },
-        },
+        ],
       },
     });
     expect(routeConfig.options).toEqual({ authRequired: true });
@@ -199,9 +218,10 @@ describe('test endpoint route', () => {
     it('should return 404 on no results', async () => {
       const mockRequest = httpServerMock.createKibanaRequest({ params: { id: 'BADID' } });
 
-      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
-        Promise.resolve(createSearchResponse())
-      );
+      mockScopedClient.callAsCurrentUser
+        .mockImplementationOnce(noUnenrolledEndpoint)
+        .mockImplementationOnce(() => Promise.resolve(createSearchResponse()));
+
       mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
       [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
         path.startsWith('/api/endpoint/metadata')
@@ -212,7 +232,7 @@ describe('test endpoint route', () => {
         mockResponse
       );
 
-      expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(2);
       expect(routeConfig.options).toEqual({ authRequired: true });
       expect(mockResponse.notFound).toBeCalled();
       const message = mockResponse.notFound.mock.calls[0][0]?.body;
@@ -224,8 +244,12 @@ describe('test endpoint route', () => {
       const mockRequest = httpServerMock.createKibanaRequest({
         params: { id: response.hits.hits[0]._id },
       });
+
       mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('online');
-      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+      mockScopedClient.callAsCurrentUser
+        .mockImplementationOnce(noUnenrolledEndpoint)
+        .mockImplementationOnce(() => Promise.resolve(response));
+
       [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
         path.startsWith('/api/endpoint/metadata')
       )!;
@@ -236,7 +260,7 @@ describe('test endpoint route', () => {
         mockResponse
       );
 
-      expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(2);
       expect(routeConfig.options).toEqual({ authRequired: true });
       expect(mockResponse.ok).toBeCalled();
       const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
@@ -254,7 +278,11 @@ describe('test endpoint route', () => {
       mockAgentService.getAgentStatusById = jest.fn().mockImplementation(() => {
         throw Boom.notFound('Agent not found');
       });
-      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+
+      mockScopedClient.callAsCurrentUser
+        .mockImplementationOnce(noUnenrolledEndpoint)
+        .mockImplementationOnce(() => Promise.resolve(response));
+
       [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
         path.startsWith('/api/endpoint/metadata')
       )!;
@@ -265,7 +293,7 @@ describe('test endpoint route', () => {
         mockResponse
       );
 
-      expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(2);
       expect(routeConfig.options).toEqual({ authRequired: true });
       expect(mockResponse.ok).toBeCalled();
       const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
@@ -280,7 +308,11 @@ describe('test endpoint route', () => {
       });
 
       mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('warning');
-      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+
+      mockScopedClient.callAsCurrentUser
+        .mockImplementationOnce(noUnenrolledEndpoint)
+        .mockImplementationOnce(() => Promise.resolve(response));
+
       [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
         path.startsWith('/api/endpoint/metadata')
       )!;
@@ -291,12 +323,50 @@ describe('test endpoint route', () => {
         mockResponse
       );
 
-      expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(2);
       expect(routeConfig.options).toEqual({ authRequired: true });
       expect(mockResponse.ok).toBeCalled();
       const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
       expect(result.host_status).toEqual(HostStatus.ERROR);
     });
+
+    it('should throw error when endpoint is unenrolled', async () => {
+      const mockRequest = httpServerMock.createKibanaRequest({
+        params: { id: 'hostId' },
+      });
+
+      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
+        Promise.resolve(({
+          hits: {
+            hits: [
+              {
+                _index: 'metrics-endpoint.metadata_mirror-default',
+                _id: 'S5M1yHIBLSMVtiLw6Wpr',
+                _score: 0.0,
+                _source: {
+                  host: {
+                    id: 'hostId',
+                  },
+                },
+              },
+            ],
+          },
+        } as unknown) as SearchResponse<HostId>)
+      );
+
+      [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+        path.startsWith('/api/endpoint/metadata')
+      )!;
+
+      await routeHandler(
+        createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+        mockRequest,
+        mockResponse
+      );
+
+      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+      expect(mockResponse.customError).toBeCalled();
+    });
   });
 });
 
@@ -319,7 +389,7 @@ function createSearchResponse(hostMetadata?: HostMetadata): SearchResponse<HostM
       hits: hostMetadata
         ? [
             {
-              _index: 'metrics-endpoint.metadata-default-1',
+              _index: 'metrics-endpoint.metadata-default',
               _id: '8FhM0HEBYyRTvb6lOQnw',
               _score: null,
               _source: hostMetadata,
@@ -334,7 +404,7 @@ function createSearchResponse(hostMetadata?: HostMetadata): SearchResponse<HostM
                     max_score: null,
                     hits: [
                       {
-                        _index: 'metrics-endpoint.metadata-default-1',
+                        _index: 'metrics-endpoint.metadata-default',
                         _id: 'W6Vo1G8BYQH1gtPUgYkC',
                         _score: null,
                         _source: hostMetadata,
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.test.ts
index f83fb5b4a5a1..a5b578f3f981 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.test.ts
@@ -58,6 +58,69 @@ describe('query builder', () => {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as Record<string, any>);
     });
+
+    it(
+      'test default query params for all endpoints metadata when no params or body is provided ' +
+        'with unenrolled host ids excluded',
+      async () => {
+        const unenrolledHostId = '1fdca33f-799f-49f4-939c-ea4383c77672';
+        const mockRequest = httpServerMock.createKibanaRequest({
+          body: {},
+        });
+        const query = await kibanaRequestToMetadataListESQuery(
+          mockRequest,
+          {
+            logFactory: loggingSystemMock.create(),
+            service: new EndpointAppContextService(),
+            config: () => Promise.resolve(createMockConfig()),
+          },
+          metadataIndexPattern,
+          {
+            unenrolledHostIds: [unenrolledHostId],
+          }
+        );
+
+        expect(query).toEqual({
+          body: {
+            query: {
+              bool: {
+                must_not: {
+                  terms: {
+                    'host.id': ['1fdca33f-799f-49f4-939c-ea4383c77672'],
+                  },
+                },
+              },
+            },
+            collapse: {
+              field: 'host.id',
+              inner_hits: {
+                name: 'most_recent',
+                size: 1,
+                sort: [{ 'event.created': 'desc' }],
+              },
+            },
+            aggs: {
+              total: {
+                cardinality: {
+                  field: 'host.id',
+                },
+              },
+            },
+            sort: [
+              {
+                'event.created': {
+                  order: 'desc',
+                },
+              },
+            ],
+          },
+          from: 0,
+          size: 10,
+          index: metadataIndexPattern,
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        } as Record<string, any>);
+      }
+    );
   });
 
   describe('test query builder with kql filter', () => {
@@ -76,22 +139,29 @@ describe('query builder', () => {
         },
         metadataIndexPattern
       );
+
       expect(query).toEqual({
         body: {
           query: {
             bool: {
-              must_not: {
-                bool: {
-                  minimum_should_match: 1,
-                  should: [
-                    {
-                      match: {
-                        'host.ip': '10.140.73.246',
+              must: [
+                {
+                  bool: {
+                    must_not: {
+                      bool: {
+                        should: [
+                          {
+                            match: {
+                              'host.ip': '10.140.73.246',
+                            },
+                          },
+                        ],
+                        minimum_should_match: 1,
                       },
                     },
-                  ],
+                  },
                 },
-              },
+              ],
             },
           },
           collapse: {
@@ -123,6 +193,93 @@ describe('query builder', () => {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as Record<string, any>);
     });
+
+    it(
+      'test default query params for all endpoints endpoint metadata excluding unerolled endpoint ' +
+        'and when body filter is provided',
+      async () => {
+        const unenrolledHostId = '1fdca33f-799f-49f4-939c-ea4383c77672';
+        const mockRequest = httpServerMock.createKibanaRequest({
+          body: {
+            filter: 'not host.ip:10.140.73.246',
+          },
+        });
+        const query = await kibanaRequestToMetadataListESQuery(
+          mockRequest,
+          {
+            logFactory: loggingSystemMock.create(),
+            service: new EndpointAppContextService(),
+            config: () => Promise.resolve(createMockConfig()),
+          },
+          metadataIndexPattern,
+          {
+            unenrolledHostIds: [unenrolledHostId],
+          }
+        );
+
+        expect(query).toEqual({
+          body: {
+            query: {
+              bool: {
+                must: [
+                  {
+                    bool: {
+                      must_not: {
+                        terms: {
+                          'host.id': [unenrolledHostId],
+                        },
+                      },
+                    },
+                  },
+                  {
+                    bool: {
+                      must_not: {
+                        bool: {
+                          should: [
+                            {
+                              match: {
+                                'host.ip': '10.140.73.246',
+                              },
+                            },
+                          ],
+                          minimum_should_match: 1,
+                        },
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            collapse: {
+              field: 'host.id',
+              inner_hits: {
+                name: 'most_recent',
+                size: 1,
+                sort: [{ 'event.created': 'desc' }],
+              },
+            },
+            aggs: {
+              total: {
+                cardinality: {
+                  field: 'host.id',
+                },
+              },
+            },
+            sort: [
+              {
+                'event.created': {
+                  order: 'desc',
+                },
+              },
+            ],
+          },
+          from: 0,
+          size: 10,
+          index: metadataIndexPattern,
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        } as Record<string, any>);
+      }
+    );
   });
 
   describe('MetadataGetQuery', () => {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.ts
index 075e4377f0b2..b6ec91675f24 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.ts
@@ -7,17 +7,22 @@ import { KibanaRequest } from 'kibana/server';
 import { esKuery } from '../../../../../../../src/plugins/data/server';
 import { EndpointAppContext } from '../../types';
 
-export const kibanaRequestToMetadataListESQuery = async (
+export interface QueryBuilderOptions {
+  unenrolledHostIds?: string[];
+}
+
+export async function kibanaRequestToMetadataListESQuery(
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   request: KibanaRequest<any, any, any>,
   endpointAppContext: EndpointAppContext,
-  index: string
+  index: string,
+  queryBuilderOptions?: QueryBuilderOptions
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
-): Promise<Record<string, any>> => {
+): Promise<Record<string, any>> {
   const pagingProperties = await getPagingProperties(request, endpointAppContext);
   return {
     body: {
-      query: buildQueryBody(request),
+      query: buildQueryBody(request, queryBuilderOptions?.unenrolledHostIds!),
       collapse: {
         field: 'host.id',
         inner_hits: {
@@ -45,7 +50,7 @@ export const kibanaRequestToMetadataListESQuery = async (
     size: pagingProperties.pageSize,
     index,
   };
-};
+}
 
 async function getPagingProperties(
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -68,14 +73,53 @@ async function getPagingProperties(
   };
 }
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function buildQueryBody(request: KibanaRequest<any, any, any>): Record<string, any> {
+function buildQueryBody(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  request: KibanaRequest<any, any, any>,
+  unerolledHostIds: string[] | undefined
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+): Record<string, any> {
+  const filterUnenrolledHosts = unerolledHostIds && unerolledHostIds.length > 0;
   if (typeof request?.body?.filter === 'string') {
-    return esKuery.toElasticsearchQuery(esKuery.fromKueryExpression(request.body.filter));
+    const kqlQuery = esKuery.toElasticsearchQuery(esKuery.fromKueryExpression(request.body.filter));
+    return {
+      bool: {
+        must: filterUnenrolledHosts
+          ? [
+              {
+                bool: {
+                  must_not: {
+                    terms: {
+                      'host.id': unerolledHostIds,
+                    },
+                  },
+                },
+              },
+              {
+                ...kqlQuery,
+              },
+            ]
+          : [
+              {
+                ...kqlQuery,
+              },
+            ],
+      },
+    };
   }
-  return {
-    match_all: {},
-  };
+  return filterUnenrolledHosts
+    ? {
+        bool: {
+          must_not: {
+            terms: {
+              'host.id': unerolledHostIds,
+            },
+          },
+        },
+      }
+    : {
+        match_all: {},
+      };
 }
 
 export function getESQueryHostMetadataByID(hostID: string, index: string) {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.test.ts
new file mode 100644
index 000000000000..2e6bb2c976fe
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.test.ts
@@ -0,0 +1,147 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IScopedClusterClient } from 'kibana/server';
+import {
+  findAllUnenrolledHostIds,
+  fetchAllUnenrolledHostIdsWithScroll,
+  HostId,
+  findUnenrolledHostByHostId,
+} from './unenroll';
+import { elasticsearchServiceMock } from '../../../../../../../../src/core/server/mocks';
+import { SearchResponse } from 'elasticsearch';
+import { metadataMirrorIndexPattern } from '../../../../../common/endpoint/constants';
+import { EndpointStatus } from '../../../../../common/endpoint/types';
+
+const noUnenrolledEndpoint = () =>
+  Promise.resolve(({
+    hits: {
+      hits: [],
+    },
+  } as unknown) as SearchResponse<HostId>);
+
+describe('test find all unenrolled HostId', () => {
+  let mockScopedClient: jest.Mocked<IScopedClusterClient>;
+
+  it('can find all hits with scroll', async () => {
+    const firstHostId = '1fdca33f-799f-49f4-939c-ea4383c77671';
+    const secondHostId = '2fdca33f-799f-49f4-939c-ea4383c77672';
+    mockScopedClient = elasticsearchServiceMock.createScopedClusterClient();
+    mockScopedClient.callAsCurrentUser
+      .mockImplementationOnce(() => Promise.resolve(createSearchResponse(secondHostId, 'scrollId')))
+      .mockImplementationOnce(noUnenrolledEndpoint);
+
+    const initialResponse = createSearchResponse(firstHostId, 'initialScrollId');
+    const hostIds = await fetchAllUnenrolledHostIdsWithScroll(
+      initialResponse,
+      mockScopedClient.callAsCurrentUser
+    );
+
+    expect(hostIds).toEqual([{ host: { id: firstHostId } }, { host: { id: secondHostId } }]);
+  });
+
+  it('can find all unerolled endpoint host ids', async () => {
+    const firstEndpointHostId = '1fdca33f-799f-49f4-939c-ea4383c77671';
+    const secondEndpointHostId = '2fdca33f-799f-49f4-939c-ea4383c77672';
+    mockScopedClient = elasticsearchServiceMock.createScopedClusterClient();
+    mockScopedClient.callAsCurrentUser
+      .mockImplementationOnce(() =>
+        Promise.resolve(createSearchResponse(firstEndpointHostId, 'initialScrollId'))
+      )
+      .mockImplementationOnce(() =>
+        Promise.resolve(createSearchResponse(secondEndpointHostId, 'scrollId'))
+      )
+      .mockImplementationOnce(noUnenrolledEndpoint);
+    const hostIds = await findAllUnenrolledHostIds(mockScopedClient);
+
+    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]).toEqual({
+      index: metadataMirrorIndexPattern,
+      scroll: '30s',
+      body: {
+        size: 1000,
+        _source: ['host.id'],
+        query: {
+          bool: {
+            filter: {
+              term: {
+                'Endpoint.status': EndpointStatus.unenrolled,
+              },
+            },
+          },
+        },
+      },
+    });
+    expect(hostIds).toEqual([
+      { host: { id: firstEndpointHostId } },
+      { host: { id: secondEndpointHostId } },
+    ]);
+  });
+});
+
+describe('test find unenrolled endpoint host id by hostId', () => {
+  let mockScopedClient: jest.Mocked<IScopedClusterClient>;
+
+  it('can find unenrolled endpoint by the host id when unenrolled', async () => {
+    const firstEndpointHostId = '1fdca33f-799f-49f4-939c-ea4383c77671';
+    mockScopedClient = elasticsearchServiceMock.createScopedClusterClient();
+    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
+      Promise.resolve(createSearchResponse(firstEndpointHostId, 'initialScrollId'))
+    );
+    const endpointHostId = await findUnenrolledHostByHostId(mockScopedClient, firstEndpointHostId);
+    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.index).toEqual(
+      metadataMirrorIndexPattern
+    );
+    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body).toEqual({
+      size: 1,
+      _source: ['host.id'],
+      query: {
+        bool: {
+          filter: [
+            {
+              term: {
+                'Endpoint.status': EndpointStatus.unenrolled,
+              },
+            },
+            {
+              term: {
+                'host.id': firstEndpointHostId,
+              },
+            },
+          ],
+        },
+      },
+    });
+    expect(endpointHostId).toEqual({ host: { id: firstEndpointHostId } });
+  });
+
+  it('find unenrolled endpoint host by the host id return undefined when no unenrolled host', async () => {
+    const firstHostId = '1fdca33f-799f-49f4-939c-ea4383c77671';
+    mockScopedClient = elasticsearchServiceMock.createScopedClusterClient();
+    mockScopedClient.callAsCurrentUser.mockImplementationOnce(noUnenrolledEndpoint);
+    const hostId = await findUnenrolledHostByHostId(mockScopedClient, firstHostId);
+    expect(hostId).toBeFalsy();
+  });
+});
+
+function createSearchResponse(hostId: string, scrollId: string): SearchResponse<HostId> {
+  return ({
+    hits: {
+      hits: [
+        {
+          _index: metadataMirrorIndexPattern,
+          _id: 'S5M1yHIBLSMVtiLw6Wpr',
+          _score: 0.0,
+          _source: {
+            host: {
+              id: hostId,
+            },
+          },
+        },
+      ],
+    },
+    _scroll_id: scrollId,
+  } as unknown) as SearchResponse<HostId>;
+}
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
new file mode 100644
index 000000000000..ef6898fad280
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
@@ -0,0 +1,114 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { APICaller, IScopedClusterClient } from 'kibana/server';
+import { SearchResponse } from 'elasticsearch';
+import { metadataMirrorIndexPattern } from '../../../../../common/endpoint/constants';
+import { EndpointStatus } from '../../../../../common/endpoint/types';
+
+const KEEPALIVE = '30s';
+const SIZE = 1000;
+
+export interface HostId {
+  host: {
+    id: string;
+  };
+}
+
+interface HitSource {
+  _source: HostId;
+}
+
+export async function findUnenrolledHostByHostId(
+  client: IScopedClusterClient,
+  hostId: string
+): Promise<HostId | undefined> {
+  const queryParams = {
+    index: metadataMirrorIndexPattern,
+    body: {
+      size: 1,
+      _source: ['host.id'],
+      query: {
+        bool: {
+          filter: [
+            {
+              term: {
+                'Endpoint.status': EndpointStatus.unenrolled,
+              },
+            },
+            {
+              term: {
+                'host.id': hostId,
+              },
+            },
+          ],
+        },
+      },
+    },
+  };
+
+  const response = (await client.callAsCurrentUser('search', queryParams)) as SearchResponse<
+    HostId
+  >;
+  const newHits = response.hits?.hits || [];
+
+  if (newHits.length > 0) {
+    const hostIds = newHits.map((hitSource: HitSource) => hitSource._source);
+    return hostIds[0];
+  } else {
+    return undefined;
+  }
+}
+
+export async function findAllUnenrolledHostIds(client: IScopedClusterClient): Promise<HostId[]> {
+  const queryParams = {
+    index: metadataMirrorIndexPattern,
+    scroll: KEEPALIVE,
+    body: {
+      size: SIZE,
+      _source: ['host.id'],
+      query: {
+        bool: {
+          filter: {
+            term: {
+              'Endpoint.status': EndpointStatus.unenrolled,
+            },
+          },
+        },
+      },
+    },
+  };
+  const response = (await client.callAsCurrentUser('search', queryParams)) as SearchResponse<
+    HostId
+  >;
+
+  return fetchAllUnenrolledHostIdsWithScroll(response, client.callAsCurrentUser);
+}
+
+export async function fetchAllUnenrolledHostIdsWithScroll(
+  response: SearchResponse<HostId>,
+  client: APICaller,
+  hits: HostId[] = []
+): Promise<HostId[]> {
+  let newHits = response.hits?.hits || [];
+  let scrollId = response._scroll_id;
+
+  while (newHits.length > 0) {
+    const hostIds: HostId[] = newHits.map((hitSource: HitSource) => hitSource._source);
+    hits.push(...hostIds);
+
+    const innerResponse = await client('scroll', {
+      body: {
+        scroll: KEEPALIVE,
+        scroll_id: scrollId,
+      },
+    });
+
+    newHits = innerResponse.hits?.hits || [];
+    scrollId = innerResponse._scroll_id;
+  }
+  return hits;
+}
diff --git a/x-pack/test/api_integration/apis/endpoint/data_stream_helper.ts b/x-pack/test/api_integration/apis/endpoint/data_stream_helper.ts
index b239ab41e41f..d2e99a80ef8a 100644
--- a/x-pack/test/api_integration/apis/endpoint/data_stream_helper.ts
+++ b/x-pack/test/api_integration/apis/endpoint/data_stream_helper.ts
@@ -10,6 +10,7 @@ import {
   eventsIndexPattern,
   alertsIndexPattern,
   policyIndexPattern,
+  metadataMirrorIndexPattern,
 } from '../../../../plugins/security_solution/common/endpoint/constants';
 
 export async function deleteDataStream(getService: (serviceName: 'es') => Client, index: string) {
@@ -29,6 +30,10 @@ export async function deleteMetadataStream(getService: (serviceName: 'es') => Cl
   await deleteDataStream(getService, metadataIndexPattern);
 }
 
+export async function deleteMetadataMirrorStream(getService: (serviceName: 'es') => Client) {
+  await deleteDataStream(getService, metadataMirrorIndexPattern);
+}
+
 export async function deleteEventsStream(getService: (serviceName: 'es') => Client) {
   await deleteDataStream(getService, eventsIndexPattern);
 }
diff --git a/x-pack/test/api_integration/apis/endpoint/metadata.ts b/x-pack/test/api_integration/apis/endpoint/metadata.ts
index 41531269ddeb..0d77486e0753 100644
--- a/x-pack/test/api_integration/apis/endpoint/metadata.ts
+++ b/x-pack/test/api_integration/apis/endpoint/metadata.ts
@@ -5,7 +5,7 @@
  */
 import expect from '@kbn/expect/expect.js';
 import { FtrProviderContext } from '../../ftr_provider_context';
-import { deleteMetadataStream } from './data_stream_helper';
+import { deleteMetadataMirrorStream, deleteMetadataStream } from './data_stream_helper';
 
 /**
  * The number of host documents in the es archive.
@@ -33,6 +33,40 @@ export default function ({ getService }: FtrProviderContext) {
       });
     });
 
+    describe('POST /api/endpoint/metadata when metadata mirror index contains unenrolled host', () => {
+      before(async () => {
+        await esArchiver.load('endpoint/metadata/unenroll_feature/metadata', { useCreate: true });
+        await esArchiver.load('endpoint/metadata/unenroll_feature/metadata_mirror', {
+          useCreate: true,
+        });
+      });
+
+      after(async () => {
+        await deleteMetadataStream(getService);
+        await deleteMetadataMirrorStream(getService);
+      });
+
+      it('metadata api should return only enrolled host', async () => {
+        const { body } = await supertest
+          .post('/api/endpoint/metadata')
+          .set('kbn-xsrf', 'xxx')
+          .send()
+          .expect(200);
+        expect(body.total).to.eql(1);
+        expect(body.hosts.length).to.eql(1);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+      });
+
+      it('metadata api should return 400 when an unenrolled host is retrieved', async () => {
+        const { body } = await supertest
+          .get('/api/endpoint/metadata/1fdca33f-799f-49f4-939c-ea4383c77671')
+          .send()
+          .expect(400);
+        expect(body.message).to.eql('the requested endpoint is unenrolled');
+      });
+    });
+
     describe('POST /api/endpoint/metadata when index is not empty', () => {
       before(
         async () => await esArchiver.load('endpoint/metadata/api_feature', { useCreate: true })
diff --git a/x-pack/test/functional/es_archives/endpoint/metadata/unenroll_feature/metadata/data.json.gz b/x-pack/test/functional/es_archives/endpoint/metadata/unenroll_feature/metadata/data.json.gz
new file mode 100644
index 0000000000000000000000000000000000000000..d7b130e4051569b283b25ab9337bcc07cd4eeb16
GIT binary patch
literal 598
zcmV-c0;&BUiwFpV`RrZ*17u-zVJ>QOZ*BnXR7sE1FciM$S5!IImbWbK35@_vkvK6D
zFo=WWWw4r!EG;vm{&$>C(`KnOED{I62P^*Gd-nI1e2?B@;WziC_E!sE71CdJz*eMf
zhdjE2J6hFQ4XHjpT(7Uf8}Mdl>D9wpzCO5j9=X!rI;TuGm6bKnxhe~rH_!n>iADgW
zjcC&b;6A1<+De{Zamb6tX1Z=fRyq_1oG=o`h@v=L_AalE_YT4wS{A95_an@qqAXLZ
z)dW7}gN_Sa*!tx!$C0_n4wZWOl+4uZxHoNmD3-8kTWNn_-=Dts=deMD&Z{C#9ba$a
z<%>H#&G;z=91%m3C;~{(05BRvAPI2*bYfJX5sR3?1CFOg_uU!Vwz{fqk$2`05=iDW
zbSmn`$}y2Sw=+8=IYUVT6pbZdA!0x%Vt^t9#Yje!hU8qJ{rtV{ENxk7(HvUp6GU9E
zLV)=VrmFz0f*5knZs)we6!qkq4(VHY?Y@ECB|J;%MtmKX<d}w0Qc!9@#JK^C8wNP#
z5@^9_Ol1^>(WuC_o8C{ua$p1rLeO;!Vva{c)7dbElt4N+5XxX2LmcCCnLZC*%7mOg
zl}KPBU^L(i&=9E0fki#-m}%3rOZL6{lZ#!wc&95j5DS7Z8Pn>^wmUkySs6QQMP<dI
zZ<EU=ZliI#Fa}<~@4da}J^r{(wOO?p>eSn{{P16=M&>`QQ{;J_BL9L;u@#~#5<-ON
k@8}fU-08Vak>_=a{De-CU)3C~{}R#p4wUF`<{SwC0D?arZ2$lO

literal 0
HcmV?d00001

diff --git a/x-pack/test/functional/es_archives/endpoint/metadata/unenroll_feature/metadata_mirror/data.json.gz b/x-pack/test/functional/es_archives/endpoint/metadata/unenroll_feature/metadata_mirror/data.json.gz
new file mode 100644
index 0000000000000000000000000000000000000000..3b4da7c47d9f22017c0b80365a9e613e90dbbf5e
GIT binary patch
literal 535
zcmV+y0_go8iwFpu`RrZ*17u-zVJ>QOZ*Bl>Q^{`IFc7`_D-4}80yi!6sR&vi>9qlh
zwkQIMOG`vsDamdc_}@!9maWA+5aOFR<ePb;x6O7N^{=gtcH2lbGP(=EUX(*X-u%HI
ztqRc>;^e=F$NTgNJ|8T-|MqCQ6Fo3$rT+#}rF&;(2f9{mW9vTlfKZ|r&y{tqaiFvj
zL)il!Q@dtx^7@!ZKJ>QIT`#KEqd4J&ku*mX<>}o>`E<U1lIGF2DXn~+VICE2TUxCa
z@TDwtUT|X@S9CYetVMNd*vI!`mSL~GAG$y=!j^;6(IkGnd>^lAla!&>wQI`KE8Z-4
zk@%&THNO{uGh#@QWq<@tfYBs_BE<>l!l*<emNA1TDld+YHcexD?K<1kA)Lk}CTkhG
z6kTuST*zA6RUML?p`rjqa|tX(41^*E6d@=_GNUvl*A^Yu@9kG*OQ%JDGBqNIc(+o(
z{0Y-t!gdLbbDn%(>;Bzzi)#Whn)%?r!5#`;mGnjYnYQFyhEY;bY9Qm>0ON)Mr(A*-
zjOJ8kS(?q7Y{UHin6?9>m>?8;w_?okY-~ad)0mQ&t^<U!IL~98<7=CKPF|{nTs~Du
zFc}yPoB>Ti-A-(}rDJ9&%TVlB|4TQAZu><$KM-4jFqz95+jck;{jAIhd*Q4&`L?)h
ZL7R=+jWO7a`*CyJ{0IMZTXL`j004KW02=@R

literal 0
HcmV?d00001


From ef496ff6fa4e8105fa856f62295216f1f9d12165 Mon Sep 17 00:00:00 2001
From: patrykkopycinski <patryk.kopycinski@elastic.co>
Date: Thu, 25 Jun 2020 18:08:17 +0200
Subject: [PATCH 11/78] [SIEM] Replace WithSource with useWithSource hook
 (#68722)

---
 .../detection_engine.test.tsx                 |  10 +-
 .../detection_engine/detection_engine.tsx     | 142 ++++----
 .../rules/details/index.test.tsx              |   8 +-
 .../detection_engine/rules/details/index.tsx  | 334 +++++++++---------
 .../public/app/home/index.tsx                 |  38 +-
 .../draggable_wrapper_hover_content.test.tsx  | 161 ++++-----
 .../draggable_wrapper_hover_content.tsx       |  60 ++--
 .../common/components/header_global/index.tsx |  96 +++--
 .../public/common/components/top_n/index.tsx  |  90 +++--
 .../common/containers/global_time/index.tsx   |   2 +
 .../common/containers/source/index.test.tsx   |  67 ++--
 .../public/common/containers/source/index.tsx | 169 ++++-----
 .../hosts/pages/details/details_tabs.test.tsx |   8 +-
 .../public/hosts/pages/details/index.tsx      | 219 ++++++------
 .../public/hosts/pages/hosts.test.tsx         |  87 ++---
 .../public/hosts/pages/hosts.tsx              | 154 ++++----
 .../__snapshots__/index.test.tsx.snap         |  19 +-
 .../network/pages/ip_details/index.test.tsx   |  41 +--
 .../public/network/pages/ip_details/index.tsx | 304 ++++++++--------
 .../public/network/pages/network.test.tsx     |  69 ++--
 .../public/network/pages/network.tsx          | 178 +++++-----
 .../public/overview/pages/overview.test.tsx   |  55 +--
 .../public/overview/pages/overview.tsx        | 171 +++++----
 .../components/flyout/button/index.tsx        |  25 +-
 .../timelines/components/timeline/index.tsx   |  66 ++--
 25 files changed, 1215 insertions(+), 1358 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.test.tsx b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.test.tsx
index 62b942d03591..d033bc25e980 100644
--- a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.test.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.test.tsx
@@ -12,9 +12,10 @@ import '../../../common/mock/match_media';
 import { setAbsoluteRangeDatePicker } from '../../../common/store/inputs/actions';
 import { DetectionEnginePageComponent } from './detection_engine';
 import { useUserInfo } from '../../components/user_info';
+import { useWithSource } from '../../../common/containers/source';
 
 jest.mock('../../components/user_info');
-jest.mock('../../../common/lib/kibana');
+jest.mock('../../../common/containers/source');
 jest.mock('../../../common/components/link_to');
 jest.mock('react-router-dom', () => {
   const originalModule = jest.requireActual('react-router-dom');
@@ -30,7 +31,12 @@ describe('DetectionEnginePageComponent', () => {
   beforeAll(() => {
     (useParams as jest.Mock).mockReturnValue({});
     (useUserInfo as jest.Mock).mockReturnValue({});
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: true,
+      indexPattern: {},
+    });
   });
+
   it('renders correctly', () => {
     const wrapper = shallow(
       <DetectionEnginePageComponent
@@ -40,6 +46,6 @@ describe('DetectionEnginePageComponent', () => {
       />
     );
 
-    expect(wrapper.find('WithSource')).toHaveLength(1);
+    expect(wrapper.find('FiltersGlobal')).toHaveLength(1);
   });
 });
diff --git a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.tsx b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.tsx
index 05a0b4441bb3..dc0b22c82af3 100644
--- a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.tsx
@@ -13,10 +13,7 @@ import { useHistory } from 'react-router-dom';
 import { SecurityPageName } from '../../../app/types';
 import { TimelineId } from '../../../../common/types/timeline';
 import { GlobalTime } from '../../../common/containers/global_time';
-import {
-  indicesExistOrDataTemporarilyUnavailable,
-  WithSource,
-} from '../../../common/containers/source';
+import { useWithSource } from '../../../common/containers/source';
 import { UpdateDateRange } from '../../../common/components/charts/common';
 import { FiltersGlobal } from '../../../common/components/filters_global';
 import { getRulesUrl } from '../../../common/components/link_to/redirect_to_detection_engine';
@@ -82,6 +79,7 @@ export const DetectionEnginePageComponent: React.FC<PropsFromRedux> = ({
   const indexToAdd = useMemo(() => (signalIndexName == null ? [] : [signalIndexName]), [
     signalIndexName,
   ]);
+  const { indicesExist, indexPattern } = useWithSource('default', indexToAdd);
 
   if (isUserAuthenticated != null && !isUserAuthenticated && !loading) {
     return (
@@ -104,77 +102,73 @@ export const DetectionEnginePageComponent: React.FC<PropsFromRedux> = ({
     <>
       {hasEncryptionKey != null && !hasEncryptionKey && <NoApiIntegrationKeyCallOut />}
       {hasIndexWrite != null && !hasIndexWrite && <NoWriteAlertsCallOut />}
-      <WithSource sourceId="default" indexToAdd={indexToAdd}>
-        {({ indicesExist, indexPattern }) => {
-          return indicesExistOrDataTemporarilyUnavailable(indicesExist) ? (
-            <StickyContainer>
-              <FiltersGlobal>
-                <SiemSearchBar id="global" indexPattern={indexPattern} />
-              </FiltersGlobal>
-              <WrapperPage>
-                <DetectionEngineHeaderPage
-                  subtitle={
-                    lastAlerts != null && (
-                      <>
-                        {i18n.LAST_ALERT}
-                        {': '}
-                        {lastAlerts}
-                      </>
-                    )
-                  }
-                  title={i18n.PAGE_TITLE}
-                >
-                  <LinkButton
-                    fill
-                    onClick={goToRules}
-                    href={formatUrl(getRulesUrl())}
-                    iconType="gear"
-                    data-test-subj="manage-alert-detection-rules"
-                  >
-                    {i18n.BUTTON_MANAGE_RULES}
-                  </LinkButton>
-                </DetectionEngineHeaderPage>
+      {indicesExist ? (
+        <StickyContainer>
+          <FiltersGlobal>
+            <SiemSearchBar id="global" indexPattern={indexPattern} />
+          </FiltersGlobal>
+          <WrapperPage>
+            <DetectionEngineHeaderPage
+              subtitle={
+                lastAlerts != null && (
+                  <>
+                    {i18n.LAST_ALERT}
+                    {': '}
+                    {lastAlerts}
+                  </>
+                )
+              }
+              title={i18n.PAGE_TITLE}
+            >
+              <LinkButton
+                fill
+                onClick={goToRules}
+                href={formatUrl(getRulesUrl())}
+                iconType="gear"
+                data-test-subj="manage-alert-detection-rules"
+              >
+                {i18n.BUTTON_MANAGE_RULES}
+              </LinkButton>
+            </DetectionEngineHeaderPage>
 
-                <GlobalTime>
-                  {({ to, from, deleteQuery, setQuery }) => (
-                    <>
-                      <>
-                        <AlertsHistogramPanel
-                          deleteQuery={deleteQuery}
-                          filters={filters}
-                          from={from}
-                          query={query}
-                          setQuery={setQuery}
-                          showTotalAlertsCount={true}
-                          signalIndexName={signalIndexName}
-                          stackByOptions={alertsHistogramOptions}
-                          to={to}
-                          updateDateRange={updateDateRangeCallback}
-                        />
-                        <EuiSpacer size="l" />
-                        <AlertsTable
-                          timelineId={TimelineId.alertsPage}
-                          loading={loading}
-                          hasIndexWrite={hasIndexWrite ?? false}
-                          canUserCRUD={(canUserCRUD ?? false) && (hasEncryptionKey ?? false)}
-                          from={from}
-                          signalsIndex={signalIndexName ?? ''}
-                          to={to}
-                        />
-                      </>
-                    </>
-                  )}
-                </GlobalTime>
-              </WrapperPage>
-            </StickyContainer>
-          ) : (
-            <WrapperPage>
-              <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
-              <DetectionEngineEmptyPage />
-            </WrapperPage>
-          );
-        }}
-      </WithSource>
+            <GlobalTime>
+              {({ to, from, deleteQuery, setQuery }) => (
+                <>
+                  <>
+                    <AlertsHistogramPanel
+                      deleteQuery={deleteQuery}
+                      filters={filters}
+                      from={from}
+                      query={query}
+                      setQuery={setQuery}
+                      showTotalAlertsCount={true}
+                      signalIndexName={signalIndexName}
+                      stackByOptions={alertsHistogramOptions}
+                      to={to}
+                      updateDateRange={updateDateRangeCallback}
+                    />
+                    <EuiSpacer size="l" />
+                    <AlertsTable
+                      timelineId={TimelineId.alertsPage}
+                      loading={loading}
+                      hasIndexWrite={hasIndexWrite ?? false}
+                      canUserCRUD={(canUserCRUD ?? false) && (hasEncryptionKey ?? false)}
+                      from={from}
+                      signalsIndex={signalIndexName ?? ''}
+                      to={to}
+                    />
+                  </>
+                </>
+              )}
+            </GlobalTime>
+          </WrapperPage>
+        </StickyContainer>
+      ) : (
+        <WrapperPage>
+          <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
+          <DetectionEngineEmptyPage />
+        </WrapperPage>
+      )}
       <SpyRoute pageName={SecurityPageName.alerts} />
     </>
   );
diff --git a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.test.tsx b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.test.tsx
index df6ea65ba52b..0acb18082379 100644
--- a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.test.tsx
@@ -12,10 +12,12 @@ import { TestProviders } from '../../../../../common/mock';
 import { RuleDetailsPageComponent } from './index';
 import { setAbsoluteRangeDatePicker } from '../../../../../common/store/inputs/actions';
 import { useUserInfo } from '../../../../components/user_info';
+import { useWithSource } from '../../../../../common/containers/source';
 import { useParams } from 'react-router-dom';
 
 jest.mock('../../../../../common/components/link_to');
 jest.mock('../../../../components/user_info');
+jest.mock('../../../../../common/containers/source');
 jest.mock('react-router-dom', () => {
   const originalModule = jest.requireActual('react-router-dom');
 
@@ -30,6 +32,10 @@ describe('RuleDetailsPageComponent', () => {
   beforeAll(() => {
     (useUserInfo as jest.Mock).mockReturnValue({});
     (useParams as jest.Mock).mockReturnValue({});
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: true,
+      indexPattern: {},
+    });
   });
 
   it('renders correctly', () => {
@@ -44,6 +50,6 @@ describe('RuleDetailsPageComponent', () => {
       }
     );
 
-    expect(wrapper.find('WithSource')).toHaveLength(1);
+    expect(wrapper.find('GlobalTime')).toHaveLength(1);
   });
 });
diff --git a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx
index 90fd4bb225ec..2ec603546983 100644
--- a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx
@@ -4,8 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-/* eslint-disable react-hooks/rules-of-hooks */
-/* eslint-disable complexity */
+/* eslint-disable react-hooks/rules-of-hooks, complexity */
 // TODO: Disabling complexity is temporary till this component is refactored as part of lists UI integration
 
 import {
@@ -36,10 +35,7 @@ import { SiemSearchBar } from '../../../../../common/components/search_bar';
 import { WrapperPage } from '../../../../../common/components/wrapper_page';
 import { useRule } from '../../../../../alerts/containers/detection_engine/rules';
 
-import {
-  indicesExistOrDataTemporarilyUnavailable,
-  WithSource,
-} from '../../../../../common/containers/source';
+import { useWithSource } from '../../../../../common/containers/source';
 import { SpyRoute } from '../../../../../common/utils/route/spy_routes';
 
 import { StepAboutRuleToggleDetails } from '../../../../components/rules/step_about_rule_details';
@@ -255,6 +251,8 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
     [history, ruleId]
   );
 
+  const { indicesExist, indexPattern } = useWithSource('default', indexToAdd);
+
   if (redirectToDetections(isSignalIndexExists, isAuthenticated, hasEncryptionKey)) {
     history.replace(getDetectionEngineUrl());
     return null;
@@ -264,187 +262,185 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
     <>
       {hasIndexWrite != null && !hasIndexWrite && <NoWriteAlertsCallOut />}
       {userHasNoPermissions(canUserCRUD) && <ReadOnlyCallOut />}
-      <WithSource sourceId="default" indexToAdd={indexToAdd}>
-        {({ indicesExist, indexPattern }) => {
-          return indicesExistOrDataTemporarilyUnavailable(indicesExist) ? (
-            <GlobalTime>
-              {({ to, from, deleteQuery, setQuery }) => (
-                <StickyContainer>
-                  <FiltersGlobal>
-                    <SiemSearchBar id="global" indexPattern={indexPattern} />
-                  </FiltersGlobal>
-
-                  <WrapperPage>
-                    <DetectionEngineHeaderPage
-                      backOptions={{
-                        href: getRulesUrl(),
-                        text: i18n.BACK_TO_RULES,
-                        pageId: SecurityPageName.alerts,
-                      }}
-                      border
-                      subtitle={subTitle}
-                      subtitle2={[
-                        ...(lastAlerts != null
-                          ? [
-                              <>
-                                {detectionI18n.LAST_ALERT}
-                                {': '}
-                                {lastAlerts}
-                              </>,
-                            ]
-                          : []),
-                        <RuleStatus ruleId={ruleId ?? null} ruleEnabled={ruleEnabled} />,
-                      ]}
-                      title={title}
-                    >
-                      <EuiFlexGroup alignItems="center">
+      {indicesExist ? (
+        <GlobalTime>
+          {({ to, from, deleteQuery, setQuery }) => (
+            <StickyContainer>
+              <FiltersGlobal>
+                <SiemSearchBar id="global" indexPattern={indexPattern} />
+              </FiltersGlobal>
+
+              <WrapperPage>
+                <DetectionEngineHeaderPage
+                  backOptions={{
+                    href: getRulesUrl(),
+                    text: i18n.BACK_TO_RULES,
+                    pageId: SecurityPageName.alerts,
+                  }}
+                  border
+                  subtitle={subTitle}
+                  subtitle2={[
+                    ...(lastAlerts != null
+                      ? [
+                          <>
+                            {detectionI18n.LAST_ALERT}
+                            {': '}
+                            {lastAlerts}
+                          </>,
+                        ]
+                      : []),
+                    <RuleStatus ruleId={ruleId ?? null} ruleEnabled={ruleEnabled} />,
+                  ]}
+                  title={title}
+                >
+                  <EuiFlexGroup alignItems="center">
+                    <EuiFlexItem grow={false}>
+                      <EuiToolTip
+                        position="top"
+                        content={
+                          rule?.type === 'machine_learning' && !hasMlPermissions
+                            ? detectionI18n.ML_RULES_DISABLED_MESSAGE
+                            : undefined
+                        }
+                      >
+                        <RuleSwitch
+                          id={rule?.id ?? '-1'}
+                          isDisabled={
+                            userHasNoPermissions(canUserCRUD) ||
+                            (!hasMlPermissions && !rule?.enabled)
+                          }
+                          enabled={rule?.enabled ?? false}
+                          optionLabel={i18n.ACTIVATE_RULE}
+                          onChange={handleOnChangeEnabledRule}
+                        />
+                      </EuiToolTip>
+                    </EuiFlexItem>
+
+                    <EuiFlexItem grow={false}>
+                      <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false}>
                         <EuiFlexItem grow={false}>
-                          <EuiToolTip
-                            position="top"
-                            content={
-                              rule?.type === 'machine_learning' && !hasMlPermissions
-                                ? detectionI18n.ML_RULES_DISABLED_MESSAGE
-                                : undefined
-                            }
+                          <LinkButton
+                            onClick={goToEditRule}
+                            iconType="controlsHorizontal"
+                            isDisabled={userHasNoPermissions(canUserCRUD) ?? true}
+                            href={formatUrl(getEditRuleUrl(ruleId ?? ''))}
                           >
-                            <RuleSwitch
-                              id={rule?.id ?? '-1'}
-                              isDisabled={
-                                userHasNoPermissions(canUserCRUD) ||
-                                (!hasMlPermissions && !rule?.enabled)
-                              }
-                              enabled={rule?.enabled ?? false}
-                              optionLabel={i18n.ACTIVATE_RULE}
-                              onChange={handleOnChangeEnabledRule}
-                            />
-                          </EuiToolTip>
+                            {ruleI18n.EDIT_RULE_SETTINGS}
+                          </LinkButton>
                         </EuiFlexItem>
-
                         <EuiFlexItem grow={false}>
-                          <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false}>
-                            <EuiFlexItem grow={false}>
-                              <LinkButton
-                                onClick={goToEditRule}
-                                iconType="controlsHorizontal"
-                                isDisabled={userHasNoPermissions(canUserCRUD) ?? true}
-                                href={formatUrl(getEditRuleUrl(ruleId ?? ''))}
-                              >
-                                {ruleI18n.EDIT_RULE_SETTINGS}
-                              </LinkButton>
-                            </EuiFlexItem>
-                            <EuiFlexItem grow={false}>
-                              <RuleActionsOverflow
-                                rule={rule}
-                                userHasNoPermissions={userHasNoPermissions(canUserCRUD)}
-                              />
-                            </EuiFlexItem>
-                          </EuiFlexGroup>
+                          <RuleActionsOverflow
+                            rule={rule}
+                            userHasNoPermissions={userHasNoPermissions(canUserCRUD)}
+                          />
                         </EuiFlexItem>
                       </EuiFlexGroup>
-                    </DetectionEngineHeaderPage>
-                    {ruleError}
-                    <EuiSpacer />
-                    <EuiFlexGroup>
-                      <EuiFlexItem data-test-subj="aboutRule" component="section" grow={1}>
-                        <StepAboutRuleToggleDetails
-                          loading={isLoading}
-                          stepData={aboutRuleData}
-                          stepDataDetails={modifiedAboutRuleDetailsData}
-                        />
-                      </EuiFlexItem>
+                    </EuiFlexItem>
+                  </EuiFlexGroup>
+                </DetectionEngineHeaderPage>
+                {ruleError}
+                <EuiSpacer />
+                <EuiFlexGroup>
+                  <EuiFlexItem data-test-subj="aboutRule" component="section" grow={1}>
+                    <StepAboutRuleToggleDetails
+                      loading={isLoading}
+                      stepData={aboutRuleData}
+                      stepDataDetails={modifiedAboutRuleDetailsData}
+                    />
+                  </EuiFlexItem>
 
-                      <EuiFlexItem grow={1}>
-                        <EuiFlexGroup direction="column">
-                          <EuiFlexItem component="section" grow={1}>
-                            <StepPanel loading={isLoading} title={ruleI18n.DEFINITION}>
-                              {defineRuleData != null && (
-                                <StepDefineRule
-                                  descriptionColumns="singleSplit"
-                                  isReadOnlyView={true}
-                                  isLoading={false}
-                                  defaultValues={defineRuleData}
-                                />
-                              )}
-                            </StepPanel>
-                          </EuiFlexItem>
-                          <EuiSpacer />
-                          <EuiFlexItem data-test-subj="schedule" component="section" grow={1}>
-                            <StepPanel loading={isLoading} title={ruleI18n.SCHEDULE}>
-                              {scheduleRuleData != null && (
-                                <StepScheduleRule
-                                  descriptionColumns="singleSplit"
-                                  isReadOnlyView={true}
-                                  isLoading={false}
-                                  defaultValues={scheduleRuleData}
-                                />
-                              )}
-                            </StepPanel>
-                          </EuiFlexItem>
-                        </EuiFlexGroup>
+                  <EuiFlexItem grow={1}>
+                    <EuiFlexGroup direction="column">
+                      <EuiFlexItem component="section" grow={1}>
+                        <StepPanel loading={isLoading} title={ruleI18n.DEFINITION}>
+                          {defineRuleData != null && (
+                            <StepDefineRule
+                              descriptionColumns="singleSplit"
+                              isReadOnlyView={true}
+                              isLoading={false}
+                              defaultValues={defineRuleData}
+                            />
+                          )}
+                        </StepPanel>
+                      </EuiFlexItem>
+                      <EuiSpacer />
+                      <EuiFlexItem data-test-subj="schedule" component="section" grow={1}>
+                        <StepPanel loading={isLoading} title={ruleI18n.SCHEDULE}>
+                          {scheduleRuleData != null && (
+                            <StepScheduleRule
+                              descriptionColumns="singleSplit"
+                              isReadOnlyView={true}
+                              isLoading={false}
+                              defaultValues={scheduleRuleData}
+                            />
+                          )}
+                        </StepPanel>
                       </EuiFlexItem>
                     </EuiFlexGroup>
+                  </EuiFlexItem>
+                </EuiFlexGroup>
+                <EuiSpacer />
+                {tabs}
+                <EuiSpacer />
+                {ruleDetailTab === RuleDetailTabs.alerts && (
+                  <>
+                    <AlertsHistogramPanel
+                      deleteQuery={deleteQuery}
+                      filters={alertMergedFilters}
+                      query={query}
+                      from={from}
+                      signalIndexName={signalIndexName}
+                      setQuery={setQuery}
+                      stackByOptions={alertsHistogramOptions}
+                      to={to}
+                      updateDateRange={updateDateRangeCallback}
+                    />
                     <EuiSpacer />
-                    {tabs}
-                    <EuiSpacer />
-                    {ruleDetailTab === RuleDetailTabs.alerts && (
-                      <>
-                        <AlertsHistogramPanel
-                          deleteQuery={deleteQuery}
-                          filters={alertMergedFilters}
-                          query={query}
-                          from={from}
-                          signalIndexName={signalIndexName}
-                          setQuery={setQuery}
-                          stackByOptions={alertsHistogramOptions}
-                          to={to}
-                          updateDateRange={updateDateRangeCallback}
-                        />
-                        <EuiSpacer />
-                        {ruleId != null && (
-                          <AlertsTable
-                            timelineId={TimelineId.alertsRulesDetailsPage}
-                            canUserCRUD={canUserCRUD ?? false}
-                            defaultFilters={alertDefaultFilters}
-                            hasIndexWrite={hasIndexWrite ?? false}
-                            from={from}
-                            loading={loading}
-                            signalsIndex={signalIndexName ?? ''}
-                            to={to}
-                          />
-                        )}
-                      </>
-                    )}
-                    {ruleDetailTab === RuleDetailTabs.exceptions && (
-                      <ExceptionsViewer
-                        ruleId={ruleId ?? ''}
-                        availableListTypes={[
-                          ExceptionListType.DETECTION_ENGINE,
-                          ExceptionListType.ENDPOINT,
-                        ]}
-                        commentsAccordionId={'ruleDetailsTabExceptions'}
-                        exceptionListsMeta={[]}
+                    {ruleId != null && (
+                      <AlertsTable
+                        timelineId={TimelineId.alertsRulesDetailsPage}
+                        canUserCRUD={canUserCRUD ?? false}
+                        defaultFilters={alertDefaultFilters}
+                        hasIndexWrite={hasIndexWrite ?? false}
+                        from={from}
+                        loading={loading}
+                        signalsIndex={signalIndexName ?? ''}
+                        to={to}
                       />
                     )}
-                    {ruleDetailTab === RuleDetailTabs.failures && <FailureHistory id={rule?.id} />}
-                  </WrapperPage>
-                </StickyContainer>
-              )}
-            </GlobalTime>
-          ) : (
-            <WrapperPage>
-              <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
+                  </>
+                )}
+                {ruleDetailTab === RuleDetailTabs.exceptions && (
+                  <ExceptionsViewer
+                    ruleId={ruleId ?? ''}
+                    availableListTypes={[
+                      ExceptionListType.DETECTION_ENGINE,
+                      ExceptionListType.ENDPOINT,
+                    ]}
+                    commentsAccordionId={'ruleDetailsTabExceptions'}
+                    exceptionListsMeta={[]}
+                  />
+                )}
+                {ruleDetailTab === RuleDetailTabs.failures && <FailureHistory id={rule?.id} />}
+              </WrapperPage>
+            </StickyContainer>
+          )}
+        </GlobalTime>
+      ) : (
+        <WrapperPage>
+          <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
 
-              <DetectionEngineEmptyPage />
-            </WrapperPage>
-          );
-        }}
-      </WithSource>
+          <DetectionEngineEmptyPage />
+        </WrapperPage>
+      )}
 
       <SpyRoute pageName={SecurityPageName.alerts} state={{ ruleName: rule?.name }} />
     </>
   );
 };
 
+RuleDetailsPageComponent.displayName = 'RuleDetailsPageComponent';
+
 const makeMapStateToProps = () => {
   const getGlobalInputs = inputsSelectors.globalSelector();
   return (state: State) => {
@@ -467,3 +463,5 @@ const connector = connect(makeMapStateToProps, mapDispatchToProps);
 type PropsFromRedux = ConnectedProps<typeof connector>;
 
 export const RuleDetailsPage = connector(memo(RuleDetailsPageComponent));
+
+RuleDetailsPage.displayName = 'RuleDetailsPage';
diff --git a/x-pack/plugins/security_solution/public/app/home/index.tsx b/x-pack/plugins/security_solution/public/app/home/index.tsx
index d8bdbd6e7ef5..03e48282cb75 100644
--- a/x-pack/plugins/security_solution/public/app/home/index.tsx
+++ b/x-pack/plugins/security_solution/public/app/home/index.tsx
@@ -14,10 +14,7 @@ import { HeaderGlobal } from '../../common/components/header_global';
 import { HelpMenu } from '../../common/components/help_menu';
 import { AutoSaveWarningMsg } from '../../timelines/components/timeline/auto_save_warning';
 import { UseUrlState } from '../../common/components/url_state';
-import {
-  WithSource,
-  indicesExistOrDataTemporarilyUnavailable,
-} from '../../common/containers/source';
+import { useWithSource } from '../../common/containers/source';
 import { useShowTimeline } from '../../common/utils/timeline/use_show_timeline';
 import { navTabs } from './home_navigations';
 
@@ -60,31 +57,28 @@ export const HomePage: React.FC<HomePageProps> = ({ children }) => {
   );
 
   const [showTimeline] = useShowTimeline();
+  const { browserFields, indexPattern, indicesExist } = useWithSource();
 
   return (
     <WrappedByAutoSizer data-test-subj="wrapped-by-auto-sizer" ref={measureRef}>
       <HeaderGlobal />
 
       <Main data-test-subj="pageContainer">
-        <WithSource sourceId="default">
-          {({ browserFields, indexPattern, indicesExist }) => (
-            <DragDropContextWrapper browserFields={browserFields}>
-              <UseUrlState indexPattern={indexPattern} navTabs={navTabs} />
-              {indicesExistOrDataTemporarilyUnavailable(indicesExist) && showTimeline && (
-                <>
-                  <AutoSaveWarningMsg />
-                  <Flyout
-                    flyoutHeight={flyoutHeight}
-                    timelineId="timeline-1"
-                    usersViewing={usersViewing}
-                  />
-                </>
-              )}
-
-              {children}
-            </DragDropContextWrapper>
+        <DragDropContextWrapper browserFields={browserFields}>
+          <UseUrlState indexPattern={indexPattern} navTabs={navTabs} />
+          {indicesExist && showTimeline && (
+            <>
+              <AutoSaveWarningMsg />
+              <Flyout
+                flyoutHeight={flyoutHeight}
+                timelineId="timeline-1"
+                usersViewing={usersViewing}
+              />
+            </>
           )}
-        </WithSource>
+
+          {children}
+        </DragDropContextWrapper>
       </Main>
 
       <HelpMenu />
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
index e60d876617dc..16207fcec3b2 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
@@ -6,10 +6,9 @@
 
 import { mount, ReactWrapper } from 'enzyme';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 
-import { mocksSource } from '../../containers/source/mock';
-import { wait } from '../../lib/helpers';
+import { useWithSource } from '../../containers/source';
+import { mockBrowserFields } from '../../containers/source/mock';
 import { useKibana } from '../../lib/kibana';
 import { TestProviders } from '../../mock';
 import { createKibanaCoreStartMock } from '../../mock/kibana_core';
@@ -25,6 +24,14 @@ import {
 jest.mock('../link_to');
 
 jest.mock('../../lib/kibana');
+jest.mock('../../containers/source', () => {
+  const original = jest.requireActual('../../containers/source');
+
+  return {
+    ...original,
+    useWithSource: jest.fn(),
+  };
+});
 
 jest.mock('uuid', () => {
   return {
@@ -52,6 +59,9 @@ describe('DraggableWrapperHoverContent', () => {
   beforeAll(() => {
     // our mock implementation of the useAddToTimeline hook returns a mock startDragToTimeline function:
     (useAddToTimeline as jest.Mock).mockReturnValue(jest.fn());
+    (useWithSource as jest.Mock).mockReturnValue({
+      browserFields: mockBrowserFields,
+    });
   });
 
   // Suppress warnings about "react-beautiful-dnd"
@@ -323,17 +333,15 @@ describe('DraggableWrapperHoverContent', () => {
           test(`it ${assertion} the 'Add to timeline investigation' button when showTopN is ${showTopN}, value is ${maybeValue}, and a draggableId is ${maybeDraggableId}`, () => {
             const wrapper = mount(
               <TestProviders>
-                <MockedProvider mocks={mocksSource} addTypename={false}>
-                  <DraggableWrapperHoverContent
-                    {...{
-                      ...defaultProps,
-                      draggableId: maybeDraggableId,
-                      field: aggregatableStringField,
-                      showTopN,
-                      value: maybeValue,
-                    }}
-                  />
-                </MockedProvider>
+                <DraggableWrapperHoverContent
+                  {...{
+                    ...defaultProps,
+                    draggableId: maybeDraggableId,
+                    field: aggregatableStringField,
+                    showTopN,
+                    value: maybeValue,
+                  }}
+                />
               </TestProviders>
             );
 
@@ -348,15 +356,13 @@ describe('DraggableWrapperHoverContent', () => {
     test('when clicked, it invokes the `startDragToTimeline` function returned by the `useAddToTimeline` hook', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocksSource} addTypename={false}>
-            <DraggableWrapperHoverContent
-              {...{
-                ...defaultProps,
-                draggableId,
-                field: aggregatableStringField,
-              }}
-            />
-          </MockedProvider>
+          <DraggableWrapperHoverContent
+            {...{
+              ...defaultProps,
+              draggableId,
+              field: aggregatableStringField,
+            }}
+          />
         </TestProviders>
       );
 
@@ -380,18 +386,15 @@ describe('DraggableWrapperHoverContent', () => {
       const aggregatableStringField = 'cloud.account.id';
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocksSource} addTypename={false}>
-            <DraggableWrapperHoverContent
-              {...{
-                ...defaultProps,
-                field: aggregatableStringField,
-              }}
-            />
-          </MockedProvider>
+          <DraggableWrapperHoverContent
+            {...{
+              ...defaultProps,
+              field: aggregatableStringField,
+            }}
+          />
         </TestProviders>
       );
 
-      await wait(); // https://github.com/apollographql/react-apollo/issues/1711
       wrapper.update();
 
       expect(wrapper.find('[data-test-subj="show-top-field"]').first().exists()).toBe(true);
@@ -401,18 +404,15 @@ describe('DraggableWrapperHoverContent', () => {
       const whitelistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocksSource} addTypename={false}>
-            <DraggableWrapperHoverContent
-              {...{
-                ...defaultProps,
-                field: whitelistedField,
-              }}
-            />
-          </MockedProvider>
+          <DraggableWrapperHoverContent
+            {...{
+              ...defaultProps,
+              field: whitelistedField,
+            }}
+          />
         </TestProviders>
       );
 
-      await wait();
       wrapper.update();
 
       expect(wrapper.find('[data-test-subj="show-top-field"]').first().exists()).toBe(true);
@@ -422,18 +422,15 @@ describe('DraggableWrapperHoverContent', () => {
       const notKnownToBrowserFields = 'unknown.field';
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocksSource} addTypename={false}>
-            <DraggableWrapperHoverContent
-              {...{
-                ...defaultProps,
-                field: notKnownToBrowserFields,
-              }}
-            />
-          </MockedProvider>
+          <DraggableWrapperHoverContent
+            {...{
+              ...defaultProps,
+              field: notKnownToBrowserFields,
+            }}
+          />
         </TestProviders>
       );
 
-      await wait();
       wrapper.update();
 
       expect(wrapper.find('[data-test-subj="show-top-field"]').first().exists()).toBe(false);
@@ -443,18 +440,15 @@ describe('DraggableWrapperHoverContent', () => {
       const whitelistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocksSource} addTypename={false}>
-            <DraggableWrapperHoverContent
-              {...{
-                ...defaultProps,
-                field: whitelistedField,
-              }}
-            />
-          </MockedProvider>
+          <DraggableWrapperHoverContent
+            {...{
+              ...defaultProps,
+              field: whitelistedField,
+            }}
+          />
         </TestProviders>
       );
 
-      await wait();
       wrapper.update();
 
       wrapper.find('[data-test-subj="show-top-field"]').first().simulate('click');
@@ -467,18 +461,15 @@ describe('DraggableWrapperHoverContent', () => {
       const whitelistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocksSource} addTypename={false}>
-            <DraggableWrapperHoverContent
-              {...{
-                ...defaultProps,
-                field: whitelistedField,
-              }}
-            />
-          </MockedProvider>
+          <DraggableWrapperHoverContent
+            {...{
+              ...defaultProps,
+              field: whitelistedField,
+            }}
+          />
         </TestProviders>
       );
 
-      await wait();
       wrapper.update();
 
       expect(wrapper.find('[data-test-subj="eventsByDatasetOverviewPanel"]').first().exists()).toBe(
@@ -490,19 +481,16 @@ describe('DraggableWrapperHoverContent', () => {
       const whitelistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocksSource} addTypename={false}>
-            <DraggableWrapperHoverContent
-              {...{
-                ...defaultProps,
-                field: whitelistedField,
-                showTopN: true,
-              }}
-            />
-          </MockedProvider>
+          <DraggableWrapperHoverContent
+            {...{
+              ...defaultProps,
+              field: whitelistedField,
+              showTopN: true,
+            }}
+          />
         </TestProviders>
       );
 
-      await wait();
       wrapper.update();
 
       expect(wrapper.find('[data-test-subj="show-top-field"]').first().exists()).toBe(false);
@@ -512,19 +500,16 @@ describe('DraggableWrapperHoverContent', () => {
       const whitelistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocksSource} addTypename={false}>
-            <DraggableWrapperHoverContent
-              {...{
-                ...defaultProps,
-                field: whitelistedField,
-                showTopN: true,
-              }}
-            />
-          </MockedProvider>
+          <DraggableWrapperHoverContent
+            {...{
+              ...defaultProps,
+              field: whitelistedField,
+              showTopN: true,
+            }}
+          />
         </TestProviders>
       );
 
-      await wait();
       wrapper.update();
 
       expect(
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.tsx
index f916f42fe41c..e805750cf247 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.tsx
@@ -8,7 +8,7 @@ import { EuiButtonIcon, EuiToolTip } from '@elastic/eui';
 import React, { useCallback, useMemo } from 'react';
 import { DraggableId } from 'react-beautiful-dnd';
 
-import { getAllFieldsByName, WithSource } from '../../containers/source';
+import { getAllFieldsByName, useWithSource } from '../../containers/source';
 import { useAddToTimeline } from '../../hooks/use_add_to_timeline';
 import { WithCopyToClipboard } from '../../lib/clipboard/with_copy_to_clipboard';
 import { useKibana } from '../../lib/kibana';
@@ -79,6 +79,8 @@ const DraggableWrapperHoverContentComponent: React.FC<Props> = ({
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [field, value, filterManager, onFilterAdded]);
 
+  const { browserFields } = useWithSource();
+
   return (
     <>
       {!showTopN && value != null && (
@@ -117,40 +119,36 @@ const DraggableWrapperHoverContentComponent: React.FC<Props> = ({
         </EuiToolTip>
       )}
 
-      <WithSource sourceId="default">
-        {({ browserFields }) => (
+      <>
+        {allowTopN({
+          browserField: getAllFieldsByName(browserFields)[field],
+          fieldName: field,
+        }) && (
           <>
-            {allowTopN({
-              browserField: getAllFieldsByName(browserFields)[field],
-              fieldName: field,
-            }) && (
-              <>
-                {!showTopN && (
-                  <EuiToolTip content={i18n.SHOW_TOP(field)}>
-                    <EuiButtonIcon
-                      aria-label={i18n.SHOW_TOP(field)}
-                      color="text"
-                      data-test-subj="show-top-field"
-                      iconType="visBarVertical"
-                      onClick={toggleTopN}
-                    />
-                  </EuiToolTip>
-                )}
-
-                {showTopN && (
-                  <StatefulTopN
-                    browserFields={browserFields}
-                    field={field}
-                    onFilterAdded={onFilterAdded}
-                    toggleTopN={toggleTopN}
-                    value={value}
-                  />
-                )}
-              </>
+            {!showTopN && (
+              <EuiToolTip content={i18n.SHOW_TOP(field)}>
+                <EuiButtonIcon
+                  aria-label={i18n.SHOW_TOP(field)}
+                  color="text"
+                  data-test-subj="show-top-field"
+                  iconType="visBarVertical"
+                  onClick={toggleTopN}
+                />
+              </EuiToolTip>
+            )}
+
+            {showTopN && (
+              <StatefulTopN
+                browserFields={browserFields}
+                field={field}
+                onFilterAdded={onFilterAdded}
+                toggleTopN={toggleTopN}
+                value={value}
+              />
             )}
           </>
         )}
-      </WithSource>
+      </>
 
       {!showTopN && (
         <EuiToolTip content={i18n.COPY_TO_CLIPBOARD}>
diff --git a/x-pack/plugins/security_solution/public/common/components/header_global/index.tsx b/x-pack/plugins/security_solution/public/common/components/header_global/index.tsx
index de19c1903586..17fdf2163b58 100644
--- a/x-pack/plugins/security_solution/public/common/components/header_global/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/header_global/index.tsx
@@ -16,7 +16,7 @@ import { getAppOverviewUrl } from '../link_to';
 import { MlPopover } from '../ml_popover/ml_popover';
 import { SiemNavigation } from '../navigation';
 import * as i18n from './translations';
-import { indicesExistOrDataTemporarilyUnavailable, WithSource } from '../../containers/source';
+import { useWithSource } from '../../containers/source';
 import { useGetUrlSearch } from '../navigation/use_get_url_search';
 import { useKibana } from '../../lib/kibana';
 import { APP_ID, ADD_DATA_PATH, APP_ALERTS_PATH } from '../../../../common/constants';
@@ -41,6 +41,7 @@ interface HeaderGlobalProps {
   hideDetectionEngine?: boolean;
 }
 export const HeaderGlobal = React.memo<HeaderGlobalProps>(({ hideDetectionEngine = false }) => {
+  const { indicesExist } = useWithSource();
   const search = useGetUrlSearch(navTabs.overview);
   const { navigateToApp } = useKibana().services.application;
   const goToOverview = useCallback(
@@ -54,60 +55,55 @@ export const HeaderGlobal = React.memo<HeaderGlobalProps>(({ hideDetectionEngine
   return (
     <Wrapper className="siemHeaderGlobal">
       <EuiFlexGroup alignItems="center" justifyContent="spaceBetween" wrap>
-        <WithSource sourceId="default">
-          {({ indicesExist }) => (
-            <>
-              <FlexItem>
-                <EuiFlexGroup alignItems="center" responsive={false}>
-                  <FlexItem grow={false}>
-                    <LinkAnchor onClick={goToOverview} href={getAppOverviewUrl(search)}>
-                      <EuiIcon aria-label={i18n.SIEM} type="securityAnalyticsApp" size="l" />
-                    </LinkAnchor>
-                  </FlexItem>
+        <>
+          <FlexItem>
+            <EuiFlexGroup alignItems="center" responsive={false}>
+              <FlexItem grow={false}>
+                <LinkAnchor onClick={goToOverview} href={getAppOverviewUrl(search)}>
+                  <EuiIcon aria-label={i18n.SIEM} type="securityAnalyticsApp" size="l" />
+                </LinkAnchor>
+              </FlexItem>
 
-                  <FlexItem component="nav">
-                    {indicesExistOrDataTemporarilyUnavailable(indicesExist) ? (
-                      <SiemNavigation
-                        display="condensed"
-                        navTabs={
-                          hideDetectionEngine
-                            ? pickBy((_, key) => key !== SecurityPageName.alerts, navTabs)
-                            : navTabs
-                        }
-                      />
-                    ) : (
-                      <SiemNavigation
-                        display="condensed"
-                        navTabs={pickBy((_, key) => key === SecurityPageName.overview, navTabs)}
-                      />
-                    )}
-                  </FlexItem>
-                </EuiFlexGroup>
+              <FlexItem component="nav">
+                {indicesExist ? (
+                  <SiemNavigation
+                    display="condensed"
+                    navTabs={
+                      hideDetectionEngine
+                        ? pickBy((_, key) => key !== SecurityPageName.alerts, navTabs)
+                        : navTabs
+                    }
+                  />
+                ) : (
+                  <SiemNavigation
+                    display="condensed"
+                    navTabs={pickBy((_, key) => key === SecurityPageName.overview, navTabs)}
+                  />
+                )}
               </FlexItem>
+            </EuiFlexGroup>
+          </FlexItem>
 
-              <FlexItem grow={false}>
-                <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false} wrap>
-                  {indicesExistOrDataTemporarilyUnavailable(indicesExist) &&
-                    window.location.pathname.includes(APP_ALERTS_PATH) && (
-                      <FlexItem grow={false}>
-                        <MlPopover />
-                      </FlexItem>
-                    )}
+          <FlexItem grow={false}>
+            <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false} wrap>
+              {indicesExist && window.location.pathname.includes(APP_ALERTS_PATH) && (
+                <FlexItem grow={false}>
+                  <MlPopover />
+                </FlexItem>
+              )}
 
-                  <FlexItem grow={false}>
-                    <EuiButtonEmpty
-                      data-test-subj="add-data"
-                      href={ADD_DATA_PATH}
-                      iconType="plusInCircle"
-                    >
-                      {i18n.BUTTON_ADD_DATA}
-                    </EuiButtonEmpty>
-                  </FlexItem>
-                </EuiFlexGroup>
+              <FlexItem grow={false}>
+                <EuiButtonEmpty
+                  data-test-subj="add-data"
+                  href={ADD_DATA_PATH}
+                  iconType="plusInCircle"
+                >
+                  {i18n.BUTTON_ADD_DATA}
+                </EuiButtonEmpty>
               </FlexItem>
-            </>
-          )}
-        </WithSource>
+            </EuiFlexGroup>
+          </FlexItem>
+        </>
       </EuiFlexGroup>
     </Wrapper>
   );
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx
index c28f5ab8aa44..09da027569c6 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx
@@ -8,7 +8,7 @@ import React, { useMemo } from 'react';
 import { connect, ConnectedProps } from 'react-redux';
 
 import { GlobalTime } from '../../containers/global_time';
-import { BrowserFields, WithSource } from '../../containers/source';
+import { BrowserFields, useWithSource } from '../../containers/source';
 import { useKibana } from '../../lib/kibana';
 import { esQuery, Filter, Query } from '../../../../../../../src/plugins/data/public';
 import { inputsModel, inputsSelectors, State } from '../../store';
@@ -99,7 +99,7 @@ const StatefulTopNComponent: React.FC<Props> = ({
   //  * `id` (`timelineId`) may only be populated when we are rendered in the
   //    context of the active timeline.
   //  * `indexToAdd`, which enables the alerts index to be appended to
-  //    the `indexPattern` returned by `WithSource`, may only be populated when
+  //    the `indexPattern` returned by `useWithSource`, may only be populated when
   //    this component is rendered in the context of the active timeline. This
   //    behavior enables the 'All events' view by appending the alerts index
   //    to the index pattern.
@@ -117,54 +117,50 @@ const StatefulTopNComponent: React.FC<Props> = ({
     timelineId === ACTIVE_TIMELINE_REDUX_ID ? activeTimelineEventType : undefined
   );
 
+  const { indexPattern } = useWithSource('default', indexToAdd);
+
   return (
     <GlobalTime>
       {({ from, deleteQuery, setQuery, to }) => (
-        <WithSource sourceId="default" indexToAdd={indexToAdd}>
-          {({ indexPattern }) => (
-            <TopN
-              combinedQueries={
-                timelineId === ACTIVE_TIMELINE_REDUX_ID
-                  ? combineQueries({
-                      browserFields,
-                      config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
-                      dataProviders,
-                      end: activeTimelineTo,
-                      filters: activeTimelineFilters,
-                      indexPattern,
-                      kqlMode,
-                      kqlQuery: {
-                        language: 'kuery',
-                        query: activeTimelineKqlQueryExpression ?? '',
-                      },
-                      start: activeTimelineFrom,
-                    })?.filterQuery
-                  : undefined
-              }
-              data-test-subj="top-n"
-              defaultView={
-                documentType?.toLocaleLowerCase() === 'alerts' ? 'alert' : options[0].value
-              }
-              deleteQuery={timelineId === ACTIVE_TIMELINE_REDUX_ID ? undefined : deleteQuery}
-              field={field}
-              filters={timelineId === ACTIVE_TIMELINE_REDUX_ID ? EMPTY_FILTERS : globalFilters}
-              from={timelineId === ACTIVE_TIMELINE_REDUX_ID ? activeTimelineFrom : from}
-              indexPattern={indexPattern}
-              indexToAdd={indexToAdd}
-              options={options}
-              query={timelineId === ACTIVE_TIMELINE_REDUX_ID ? EMPTY_QUERY : globalQuery}
-              setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
-              setAbsoluteRangeDatePickerTarget={
-                timelineId === ACTIVE_TIMELINE_REDUX_ID ? 'timeline' : 'global'
-              }
-              setQuery={setQuery}
-              to={timelineId === ACTIVE_TIMELINE_REDUX_ID ? activeTimelineTo : to}
-              toggleTopN={toggleTopN}
-              onFilterAdded={onFilterAdded}
-              value={value}
-            />
-          )}
-        </WithSource>
+        <TopN
+          combinedQueries={
+            timelineId === ACTIVE_TIMELINE_REDUX_ID
+              ? combineQueries({
+                  browserFields,
+                  config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
+                  dataProviders,
+                  end: activeTimelineTo,
+                  filters: activeTimelineFilters,
+                  indexPattern,
+                  kqlMode,
+                  kqlQuery: {
+                    language: 'kuery',
+                    query: activeTimelineKqlQueryExpression ?? '',
+                  },
+                  start: activeTimelineFrom,
+                })?.filterQuery
+              : undefined
+          }
+          data-test-subj="top-n"
+          defaultView={documentType?.toLocaleLowerCase() === 'alerts' ? 'alert' : options[0].value}
+          deleteQuery={timelineId === ACTIVE_TIMELINE_REDUX_ID ? undefined : deleteQuery}
+          field={field}
+          filters={timelineId === ACTIVE_TIMELINE_REDUX_ID ? EMPTY_FILTERS : globalFilters}
+          from={timelineId === ACTIVE_TIMELINE_REDUX_ID ? activeTimelineFrom : from}
+          indexPattern={indexPattern}
+          indexToAdd={indexToAdd}
+          options={options}
+          query={timelineId === ACTIVE_TIMELINE_REDUX_ID ? EMPTY_QUERY : globalQuery}
+          setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
+          setAbsoluteRangeDatePickerTarget={
+            timelineId === ACTIVE_TIMELINE_REDUX_ID ? 'timeline' : 'global'
+          }
+          setQuery={setQuery}
+          to={timelineId === ACTIVE_TIMELINE_REDUX_ID ? activeTimelineTo : to}
+          toggleTopN={toggleTopN}
+          onFilterAdded={onFilterAdded}
+          value={value}
+        />
       )}
     </GlobalTime>
   );
diff --git a/x-pack/plugins/security_solution/public/common/containers/global_time/index.tsx b/x-pack/plugins/security_solution/public/common/containers/global_time/index.tsx
index 9b9b5c5d815b..9c9778c7074e 100644
--- a/x-pack/plugins/security_solution/public/common/containers/global_time/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/global_time/index.tsx
@@ -94,3 +94,5 @@ export const connector = connect(mapStateToProps, mapDispatchToProps);
 type PropsFromRedux = ConnectedProps<typeof connector>;
 
 export const GlobalTime = connector(React.memo(GlobalTimeComponent));
+
+GlobalTime.displayName = 'GlobalTime';
diff --git a/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx b/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
index d1a183a402e3..c30c3668638a 100644
--- a/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
@@ -4,55 +4,48 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { isEqual } from 'lodash/fp';
-import { mount } from 'enzyme';
-import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
+import { act, renderHook } from '@testing-library/react-hooks';
 
-import { wait } from '../../lib/helpers';
-
-import { WithSource, indicesExistOrDataTemporarilyUnavailable } from '.';
+import { useWithSource, indicesExistOrDataTemporarilyUnavailable } from '.';
 import { mockBrowserFields, mockIndexFields, mocksSource } from './mock';
 
 jest.mock('../../lib/kibana');
+jest.mock('../../utils/apollo_context', () => ({
+  useApolloClient: jest.fn().mockReturnValue({
+    query: jest.fn().mockImplementation(() => Promise.resolve(mocksSource[0].result)),
+  }),
+}));
 
 describe('Index Fields & Browser Fields', () => {
-  test('Index Fields', async () => {
-    mount(
-      <MockedProvider mocks={mocksSource} addTypename={false}>
-        <WithSource sourceId="default">
-          {({ indexPattern }) => {
-            if (!isEqual(indexPattern.fields, [])) {
-              expect(indexPattern.fields).toEqual(mockIndexFields);
-            }
+  test('returns memoized value', async () => {
+    const { result, waitForNextUpdate, rerender } = renderHook(() => useWithSource());
+    await waitForNextUpdate();
 
-            return null;
-          }}
-        </WithSource>
-      </MockedProvider>
-    );
+    const result1 = result.current;
+    act(() => rerender());
+    const result2 = result.current;
 
-    // Why => https://github.com/apollographql/react-apollo/issues/1711
-    await wait();
+    return expect(result1).toBe(result2);
   });
 
-  test('Browser Fields', async () => {
-    mount(
-      <MockedProvider mocks={mocksSource} addTypename={false}>
-        <WithSource sourceId="default">
-          {({ browserFields }) => {
-            if (!isEqual(browserFields, {})) {
-              expect(browserFields).toEqual(mockBrowserFields);
-            }
+  test('Index Fields', async () => {
+    const { result, waitForNextUpdate } = renderHook(() => useWithSource());
 
-            return null;
-          }}
-        </WithSource>
-      </MockedProvider>
-    );
+    await waitForNextUpdate();
 
-    // Why => https://github.com/apollographql/react-apollo/issues/1711
-    await wait();
+    return expect(result).toEqual({
+      current: {
+        indicesExist: true,
+        browserFields: mockBrowserFields,
+        indexPattern: {
+          fields: mockIndexFields,
+          title: 'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,packetbeat-*,winlogbeat-*',
+        },
+        loading: false,
+        errorMessage: null,
+      },
+      error: undefined,
+    });
   });
 
   describe('indicesExistOrDataTemporarilyUnavailable', () => {
diff --git a/x-pack/plugins/security_solution/public/common/containers/source/index.tsx b/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
index ad480ad2c496..34ac5f8f5d94 100644
--- a/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
@@ -6,8 +6,7 @@
 
 import { isUndefined } from 'lodash';
 import { get, keyBy, pick, set, isEmpty } from 'lodash/fp';
-import { Query } from 'react-apollo';
-import React, { useEffect, useMemo, useState } from 'react';
+import { useEffect, useMemo, useState } from 'react';
 import memoizeOne from 'memoize-one';
 import { IIndexPattern } from 'src/plugins/data/public';
 
@@ -50,18 +49,6 @@ export const getAllFieldsByName = (
 ): { [fieldName: string]: Partial<BrowserField> } =>
   keyBy('name', getAllBrowserFields(browserFields));
 
-interface WithSourceArgs {
-  indicesExist: boolean;
-  browserFields: BrowserFields;
-  indexPattern: IIndexPattern;
-}
-
-interface WithSourceProps {
-  children: (args: WithSourceArgs) => React.ReactNode;
-  indexToAdd?: string[] | null;
-  sourceId: string;
-}
-
 export const getIndexFields = memoizeOne(
   (title: string, fields: IndexField[]): IIndexPattern =>
     fields && fields.length > 0
@@ -71,7 +58,8 @@ export const getIndexFields = memoizeOne(
           ),
           title,
         }
-      : { fields: [], title }
+      : { fields: [], title },
+  (newArgs, lastArgs) => newArgs[0] === lastArgs[0] && newArgs[1].length === lastArgs[1].length
 );
 
 export const getBrowserFields = memoizeOne(
@@ -82,10 +70,26 @@ export const getBrowserFields = memoizeOne(
             set([field.category, 'fields', field.name], field, accumulator),
           {}
         )
-      : {}
+      : {},
+  // Update the value only if _title has changed
+  (newArgs, lastArgs) => newArgs[0] === lastArgs[0]
 );
 
-export const WithSource = React.memo<WithSourceProps>(({ children, indexToAdd, sourceId }) => {
+export const indicesExistOrDataTemporarilyUnavailable = (
+  indicesExist: boolean | null | undefined
+) => indicesExist || isUndefined(indicesExist);
+
+const EMPTY_BROWSER_FIELDS = {};
+
+interface UseWithSourceState {
+  browserFields: BrowserFields;
+  errorMessage: string | null;
+  indexPattern: IIndexPattern;
+  indicesExist: boolean | undefined | null;
+  loading: boolean;
+}
+
+export const useWithSource = (sourceId = 'default', indexToAdd?: string[] | null) => {
   const [configIndex] = useUiSetting$<string[]>(DEFAULT_INDEX_KEY);
   const defaultIndex = useMemo<string[]>(() => {
     if (indexToAdd != null && !isEmpty(indexToAdd)) {
@@ -94,87 +98,84 @@ export const WithSource = React.memo<WithSourceProps>(({ children, indexToAdd, s
     return configIndex;
   }, [configIndex, indexToAdd]);
 
-  return (
-    <Query<SourceQuery.Query, SourceQuery.Variables>
-      query={sourceQuery}
-      fetchPolicy="cache-first"
-      notifyOnNetworkStatusChange
-      variables={{
-        sourceId,
-        defaultIndex,
-      }}
-    >
-      {({ data }) =>
-        children({
-          indicesExist: get('source.status.indicesExist', data),
-          browserFields: getBrowserFields(
-            defaultIndex.join(),
-            get('source.status.indexFields', data)
-          ),
-          indexPattern: getIndexFields(defaultIndex.join(), get('source.status.indexFields', data)),
-        })
-      }
-    </Query>
-  );
-});
+  const [state, setState] = useState<UseWithSourceState>({
+    browserFields: EMPTY_BROWSER_FIELDS,
+    errorMessage: null,
+    indexPattern: getIndexFields(defaultIndex.join(), []),
+    indicesExist: undefined,
+    loading: false,
+  });
 
-WithSource.displayName = 'WithSource';
+  const apolloClient = useApolloClient();
 
-export const indicesExistOrDataTemporarilyUnavailable = (indicesExist: boolean | undefined) =>
-  indicesExist || isUndefined(indicesExist);
+  useEffect(() => {
+    let isSubscribed = true;
+    const abortCtrl = new AbortController();
 
-export const useWithSource = (sourceId: string, indices: string[]) => {
-  const [loading, updateLoading] = useState(false);
-  const [indicesExist, setIndicesExist] = useState<boolean | undefined | null>(undefined);
-  const [browserFields, setBrowserFields] = useState<BrowserFields | null>(null);
-  const [indexPattern, setIndexPattern] = useState<IIndexPattern | null>(null);
-  const [errorMessage, updateErrorMessage] = useState<string | null>(null);
+    async function fetchSource() {
+      if (!apolloClient) return;
 
-  const apolloClient = useApolloClient();
-  async function fetchSource(signal: AbortSignal) {
-    updateLoading(true);
-    if (apolloClient) {
-      apolloClient
-        .query<SourceQuery.Query, SourceQuery.Variables>({
+      setState((prevState) => ({ ...prevState, loading: true }));
+
+      try {
+        const result = await apolloClient.query<SourceQuery.Query, SourceQuery.Variables>({
           query: sourceQuery,
           fetchPolicy: 'cache-first',
           variables: {
             sourceId,
-            defaultIndex: indices,
+            defaultIndex,
           },
           context: {
             fetchOptions: {
-              signal,
+              signal: abortCtrl.signal,
             },
           },
-        })
-        .then(
-          (result) => {
-            updateLoading(false);
-            updateErrorMessage(null);
-            setIndicesExist(get('data.source.status.indicesExist', result));
-            setBrowserFields(
-              getBrowserFields(indices.join(), get('data.source.status.indexFields', result))
-            );
-            setIndexPattern(
-              getIndexFields(indices.join(), get('data.source.status.indexFields', result))
-            );
-          },
-          (error) => {
-            updateLoading(false);
-            updateErrorMessage(error.message);
-          }
-        );
+        });
+        if (!isSubscribed) {
+          return setState((prevState) => ({
+            ...prevState,
+            loading: false,
+          }));
+        }
+
+        setState({
+          loading: false,
+          indicesExist: indicesExistOrDataTemporarilyUnavailable(
+            get('data.source.status.indicesExist', result)
+          ),
+          browserFields: getBrowserFields(
+            defaultIndex.join(),
+            get('data.source.status.indexFields', result)
+          ),
+          indexPattern: getIndexFields(
+            defaultIndex.join(),
+            get('data.source.status.indexFields', result)
+          ),
+          errorMessage: null,
+        });
+      } catch (error) {
+        if (!isSubscribed) {
+          return setState((prevState) => ({
+            ...prevState,
+            loading: false,
+          }));
+        }
+
+        setState((prevState) => ({
+          ...prevState,
+          loading: false,
+          errorMessage: error.message,
+        }));
+      }
     }
-  }
 
-  useEffect(() => {
-    const abortCtrl = new AbortController();
-    const signal = abortCtrl.signal;
-    fetchSource(signal);
-    return () => abortCtrl.abort();
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [apolloClient, sourceId, indices]);
+    fetchSource();
+
+    return () => {
+      isSubscribed = false;
+      return abortCtrl.abort();
+    };
+  }, [apolloClient, sourceId, defaultIndex]);
 
-  return { indicesExist, browserFields, indexPattern, loading, errorMessage };
+  return state;
 };
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/details/details_tabs.test.tsx b/x-pack/plugins/security_solution/public/hosts/pages/details/details_tabs.test.tsx
index 936789625a4d..e520facf285c 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/details/details_tabs.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/details/details_tabs.test.tsx
@@ -5,7 +5,6 @@
  */
 
 import React from 'react';
-import { IIndexPattern } from 'src/plugins/data/public';
 import { MemoryRouter } from 'react-router-dom';
 import useResizeObserver from 'use-resize-observer/polyfilled';
 
@@ -19,12 +18,7 @@ import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { getHostDetailsPageFilters } from './helpers';
 
 jest.mock('../../../common/containers/source', () => ({
-  indicesExistOrDataTemporarilyUnavailable: () => true,
-  WithSource: ({
-    children,
-  }: {
-    children: (args: { indicesExist: boolean; indexPattern: IIndexPattern }) => React.ReactNode;
-  }) => children({ indicesExist: true, indexPattern: mockIndexPattern }),
+  useWithSource: jest.fn().mockReturnValue({ indicesExist: true, indexPattern: mockIndexPattern }),
 }));
 
 // Test will fail because we will to need to mock some core services to make the test work
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx b/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
index e3f00a377d27..1c66a9edc194 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
@@ -27,10 +27,7 @@ import { SiemSearchBar } from '../../../common/components/search_bar';
 import { WrapperPage } from '../../../common/components/wrapper_page';
 import { HostOverviewByNameQuery } from '../../containers/hosts/overview';
 import { KpiHostDetailsQuery } from '../../containers/kpi_host_details';
-import {
-  indicesExistOrDataTemporarilyUnavailable,
-  WithSource,
-} from '../../../common/containers/source';
+import { useWithSource } from '../../../common/containers/source';
 import { LastEventIndexKey } from '../../../graphql/types';
 import { useKibana } from '../../../common/lib/kibana';
 import { convertToBuildEsQuery } from '../../../common/lib/keury';
@@ -83,132 +80,126 @@ const HostDetailsComponent = React.memo<HostDetailsProps & PropsFromRedux>(
       },
       [setAbsoluteRangeDatePicker]
     );
+    const { indicesExist, indexPattern } = useWithSource();
+    const filterQuery = convertToBuildEsQuery({
+      config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
+      indexPattern,
+      queries: [query],
+      filters: getFilters(),
+    });
 
     return (
       <>
-        <WithSource sourceId="default">
-          {({ indicesExist, indexPattern }) => {
-            const filterQuery = convertToBuildEsQuery({
-              config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
-              indexPattern,
-              queries: [query],
-              filters: getFilters(),
-            });
-            return indicesExistOrDataTemporarilyUnavailable(indicesExist) ? (
-              <StickyContainer>
-                <FiltersGlobal>
-                  <SiemSearchBar indexPattern={indexPattern} id="global" />
-                </FiltersGlobal>
-
-                <WrapperPage>
-                  <HeaderPage
-                    border
-                    subtitle={
-                      <LastEventTime
-                        indexKey={LastEventIndexKey.hostDetails}
-                        hostName={detailName}
-                      />
-                    }
-                    title={detailName}
-                  />
-
-                  <HostOverviewByNameQuery
-                    sourceId="default"
-                    hostName={detailName}
-                    skip={isInitializing}
+        {indicesExist ? (
+          <StickyContainer>
+            <FiltersGlobal>
+              <SiemSearchBar indexPattern={indexPattern} id="global" />
+            </FiltersGlobal>
+
+            <WrapperPage>
+              <HeaderPage
+                border
+                subtitle={
+                  <LastEventTime indexKey={LastEventIndexKey.hostDetails} hostName={detailName} />
+                }
+                title={detailName}
+              />
+
+              <HostOverviewByNameQuery
+                sourceId="default"
+                hostName={detailName}
+                skip={isInitializing}
+                startDate={from}
+                endDate={to}
+              >
+                {({ hostOverview, loading, id, inspect, refetch }) => (
+                  <AnomalyTableProvider
+                    criteriaFields={hostToCriteria(hostOverview)}
                     startDate={from}
                     endDate={to}
-                  >
-                    {({ hostOverview, loading, id, inspect, refetch }) => (
-                      <AnomalyTableProvider
-                        criteriaFields={hostToCriteria(hostOverview)}
-                        startDate={from}
-                        endDate={to}
-                        skip={isInitializing}
-                      >
-                        {({ isLoadingAnomaliesData, anomaliesData }) => (
-                          <HostOverviewManage
-                            id={id}
-                            inspect={inspect}
-                            refetch={refetch}
-                            setQuery={setQuery}
-                            data={hostOverview}
-                            anomaliesData={anomaliesData}
-                            isLoadingAnomaliesData={isLoadingAnomaliesData}
-                            loading={loading}
-                            startDate={from}
-                            endDate={to}
-                            narrowDateRange={(score, interval) => {
-                              const fromTo = scoreIntervalToDateTime(score, interval);
-                              setAbsoluteRangeDatePicker({
-                                id: 'global',
-                                from: fromTo.from,
-                                to: fromTo.to,
-                              });
-                            }}
-                          />
-                        )}
-                      </AnomalyTableProvider>
-                    )}
-                  </HostOverviewByNameQuery>
-
-                  <EuiHorizontalRule />
-
-                  <KpiHostDetailsQuery
-                    sourceId="default"
-                    filterQuery={filterQuery}
                     skip={isInitializing}
-                    startDate={from}
-                    endDate={to}
                   >
-                    {({ kpiHostDetails, id, inspect, loading, refetch }) => (
-                      <KpiHostDetailsManage
-                        data={kpiHostDetails}
-                        from={from}
+                    {({ isLoadingAnomaliesData, anomaliesData }) => (
+                      <HostOverviewManage
                         id={id}
                         inspect={inspect}
-                        loading={loading}
                         refetch={refetch}
                         setQuery={setQuery}
-                        to={to}
-                        narrowDateRange={narrowDateRange}
+                        data={hostOverview}
+                        anomaliesData={anomaliesData}
+                        isLoadingAnomaliesData={isLoadingAnomaliesData}
+                        loading={loading}
+                        startDate={from}
+                        endDate={to}
+                        narrowDateRange={(score, interval) => {
+                          const fromTo = scoreIntervalToDateTime(score, interval);
+                          setAbsoluteRangeDatePicker({
+                            id: 'global',
+                            from: fromTo.from,
+                            to: fromTo.to,
+                          });
+                        }}
                       />
                     )}
-                  </KpiHostDetailsQuery>
-
-                  <EuiSpacer />
-
-                  <SiemNavigation
-                    navTabs={navTabsHostDetails(detailName, hasMlUserPermissions(capabilities))}
-                  />
-
-                  <EuiSpacer />
-
-                  <HostDetailsTabs
-                    isInitializing={isInitializing}
-                    deleteQuery={deleteQuery}
-                    pageFilters={hostDetailsPageFilters}
-                    to={to}
+                  </AnomalyTableProvider>
+                )}
+              </HostOverviewByNameQuery>
+
+              <EuiHorizontalRule />
+
+              <KpiHostDetailsQuery
+                sourceId="default"
+                filterQuery={filterQuery}
+                skip={isInitializing}
+                startDate={from}
+                endDate={to}
+              >
+                {({ kpiHostDetails, id, inspect, loading, refetch }) => (
+                  <KpiHostDetailsManage
+                    data={kpiHostDetails}
                     from={from}
-                    detailName={detailName}
-                    type={type}
+                    id={id}
+                    inspect={inspect}
+                    loading={loading}
+                    refetch={refetch}
                     setQuery={setQuery}
-                    filterQuery={filterQuery}
-                    hostDetailsPagePath={hostDetailsPagePath}
-                    indexPattern={indexPattern}
-                    setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
+                    to={to}
+                    narrowDateRange={narrowDateRange}
                   />
-                </WrapperPage>
-              </StickyContainer>
-            ) : (
-              <WrapperPage>
-                <HeaderPage border title={detailName} />
-
-                <HostsEmptyPage />
-              </WrapperPage>
-            );
-          }}
-        </WithSource>
+                )}
+              </KpiHostDetailsQuery>
+
+              <EuiSpacer />
+
+              <SiemNavigation
+                navTabs={navTabsHostDetails(detailName, hasMlUserPermissions(capabilities))}
+              />
+
+              <EuiSpacer />
+
+              <HostDetailsTabs
+                isInitializing={isInitializing}
+                deleteQuery={deleteQuery}
+                pageFilters={hostDetailsPageFilters}
+                to={to}
+                from={from}
+                detailName={detailName}
+                type={type}
+                setQuery={setQuery}
+                filterQuery={filterQuery}
+                hostDetailsPagePath={hostDetailsPagePath}
+                indexPattern={indexPattern}
+                setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
+              />
+            </WrapperPage>
+          </StickyContainer>
+        ) : (
+          <WrapperPage>
+            <HeaderPage border title={detailName} />
+
+            <HostsEmptyPage />
+          </WrapperPage>
+        )}
 
         <SpyRoute pageName={SecurityPageName.hosts} />
       </>
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
index 85db3b4e159f..ea0b32137eb3 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
@@ -5,15 +5,12 @@
  */
 
 import { mount } from 'enzyme';
-import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 import { Router } from 'react-router-dom';
-import { MockedProvider } from 'react-apollo/test-utils';
 
 import { Filter } from '../../../../../../src/plugins/data/common/es_query';
 import '../../common/mock/match_media';
-import { mocksSource } from '../../common/containers/source/mock';
-import { wait } from '../../common/lib/helpers';
+import { useWithSource } from '../../common/containers/source';
 import {
   apolloClientObservable,
   TestProviders,
@@ -28,6 +25,8 @@ import { HostsComponentProps } from './types';
 import { Hosts } from './hosts';
 import { HostsTabs } from './hosts_tabs';
 
+jest.mock('../../common/containers/source');
+
 // Test will fail because we will to need to mock some core services to make the test work
 // For now let's forget about SiemSearchBar and QueryBar
 jest.mock('../../common/components/search_bar', () => ({
@@ -37,19 +36,6 @@ jest.mock('../../common/components/query_bar', () => ({
   QueryBar: () => null,
 }));
 
-let localSource: Array<{
-  request: {};
-  result: {
-    data: {
-      source: {
-        status: {
-          indicesExist: boolean;
-        };
-      };
-    };
-  };
-}>;
-
 type Action = 'PUSH' | 'POP' | 'REPLACE';
 const pop: Action = 'POP';
 const location = {
@@ -84,57 +70,49 @@ describe('Hosts - rendering', () => {
     hostsPagePath: '',
   };
 
-  beforeEach(() => {
-    localSource = cloneDeep(mocksSource);
-  });
-
   test('it renders the Setup Instructions text when no index is available', async () => {
-    localSource[0].result.data.source.status.indicesExist = false;
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: false,
+    });
+
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={localSource} addTypename={false}>
-          <Router history={mockHistory}>
-            <Hosts {...hostProps} />
-          </Router>
-        </MockedProvider>
+        <Router history={mockHistory}>
+          <Hosts {...hostProps} />
+        </Router>
       </TestProviders>
     );
-    // Why => https://github.com/apollographql/react-apollo/issues/1711
-    await new Promise((resolve) => setTimeout(resolve));
-    wrapper.update();
     expect(wrapper.find('[data-test-subj="empty-page"]').exists()).toBe(true);
   });
 
   test('it DOES NOT render the Setup Instructions text when an index is available', async () => {
-    localSource[0].result.data.source.status.indicesExist = true;
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: true,
+      indexPattern: {},
+    });
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={localSource} addTypename={false}>
-          <Router history={mockHistory}>
-            <Hosts {...hostProps} />
-          </Router>
-        </MockedProvider>
+        <Router history={mockHistory}>
+          <Hosts {...hostProps} />
+        </Router>
       </TestProviders>
     );
-    // Why => https://github.com/apollographql/react-apollo/issues/1711
-    await new Promise((resolve) => setTimeout(resolve));
-    wrapper.update();
     expect(wrapper.find('[data-test-subj="empty-page"]').exists()).toBe(false);
   });
 
   test('it should render tab navigation', async () => {
-    localSource[0].result.data.source.status.indicesExist = true;
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: true,
+      indexPattern: {},
+    });
+
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={localSource} addTypename={false}>
-          <Router history={mockHistory}>
-            <Hosts {...hostProps} />
-          </Router>
-        </MockedProvider>
+        <Router history={mockHistory}>
+          <Hosts {...hostProps} />
+        </Router>
       </TestProviders>
     );
-    await wait();
-    wrapper.update();
     expect(wrapper.find(SiemNavigation).exists()).toBe(true);
   });
 
@@ -170,22 +148,21 @@ describe('Hosts - rendering', () => {
         },
       },
     ];
-    localSource[0].result.data.source.status.indicesExist = true;
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: true,
+      indexPattern: { fields: [], title: 'title' },
+    });
     const myState: State = mockGlobalState;
     const { storage } = createSecuritySolutionStorageMock();
     const myStore = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
     const wrapper = mount(
       <TestProviders store={myStore}>
-        <MockedProvider mocks={localSource} addTypename={false}>
-          <Router history={mockHistory}>
-            <Hosts {...hostProps} />
-          </Router>
-        </MockedProvider>
+        <Router history={mockHistory}>
+          <Hosts {...hostProps} />
+        </Router>
       </TestProviders>
     );
-    await wait();
     wrapper.update();
-
     myStore.dispatch(inputsActions.setSearchBarFilter({ id: 'global', filters: newFilters }));
     wrapper.update();
     expect(wrapper.find(HostsTabs).props().filterQuery).toEqual(
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
index f6429544f855..f5cc651a3044 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
@@ -22,10 +22,7 @@ import { manageQuery } from '../../common/components/page/manage_query';
 import { SiemSearchBar } from '../../common/components/search_bar';
 import { WrapperPage } from '../../common/components/wrapper_page';
 import { KpiHostsQuery } from '../containers/kpi_hosts';
-import {
-  indicesExistOrDataTemporarilyUnavailable,
-  WithSource,
-} from '../../common/containers/source';
+import { useWithSource } from '../../common/containers/source';
 import { LastEventIndexKey } from '../../graphql/types';
 import { useKibana } from '../../common/lib/kibana';
 import { convertToBuildEsQuery } from '../../common/lib/keury';
@@ -77,87 +74,84 @@ export const HostsComponent = React.memo<HostsComponentProps & PropsFromRedux>(
       },
       [setAbsoluteRangeDatePicker]
     );
+    const { indicesExist, indexPattern } = useWithSource();
+    const filterQuery = convertToBuildEsQuery({
+      config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
+      indexPattern,
+      queries: [query],
+      filters,
+    });
+    const tabsFilterQuery = convertToBuildEsQuery({
+      config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
+      indexPattern,
+      queries: [query],
+      filters: tabsFilters,
+    });
 
     return (
       <>
-        <WithSource sourceId="default">
-          {({ indicesExist, indexPattern }) => {
-            const filterQuery = convertToBuildEsQuery({
-              config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
-              indexPattern,
-              queries: [query],
-              filters,
-            });
-            const tabsFilterQuery = convertToBuildEsQuery({
-              config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
-              indexPattern,
-              queries: [query],
-              filters: tabsFilters,
-            });
-            return indicesExistOrDataTemporarilyUnavailable(indicesExist) ? (
-              <StickyContainer>
-                <FiltersGlobal>
-                  <SiemSearchBar indexPattern={indexPattern} id="global" />
-                </FiltersGlobal>
-
-                <WrapperPage>
-                  <HeaderPage
-                    border
-                    subtitle={<LastEventTime indexKey={LastEventIndexKey.hosts} />}
-                    title={i18n.PAGE_TITLE}
-                  />
-
-                  <KpiHostsQuery
-                    endDate={to}
-                    filterQuery={filterQuery}
-                    skip={isInitializing}
-                    sourceId="default"
-                    startDate={from}
-                  >
-                    {({ kpiHosts, loading, id, inspect, refetch }) => (
-                      <KpiHostsComponentManage
-                        data={kpiHosts}
-                        from={from}
-                        id={id}
-                        inspect={inspect}
-                        loading={loading}
-                        refetch={refetch}
-                        setQuery={setQuery}
-                        to={to}
-                        narrowDateRange={narrowDateRange}
-                      />
-                    )}
-                  </KpiHostsQuery>
-
-                  <EuiSpacer />
-
-                  <SiemNavigation navTabs={navTabsHosts(hasMlUserPermissions(capabilities))} />
-
-                  <EuiSpacer />
-
-                  <HostsTabs
-                    deleteQuery={deleteQuery}
-                    to={to}
-                    filterQuery={tabsFilterQuery}
-                    isInitializing={isInitializing}
-                    setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
-                    setQuery={setQuery}
+        {indicesExist ? (
+          <StickyContainer>
+            <FiltersGlobal>
+              <SiemSearchBar indexPattern={indexPattern} id="global" />
+            </FiltersGlobal>
+
+            <WrapperPage>
+              <HeaderPage
+                border
+                subtitle={<LastEventTime indexKey={LastEventIndexKey.hosts} />}
+                title={i18n.PAGE_TITLE}
+              />
+
+              <KpiHostsQuery
+                endDate={to}
+                filterQuery={filterQuery}
+                skip={isInitializing}
+                sourceId="default"
+                startDate={from}
+              >
+                {({ kpiHosts, loading, id, inspect, refetch }) => (
+                  <KpiHostsComponentManage
+                    data={kpiHosts}
                     from={from}
-                    type={hostsModel.HostsType.page}
-                    indexPattern={indexPattern}
-                    hostsPagePath={hostsPagePath}
+                    id={id}
+                    inspect={inspect}
+                    loading={loading}
+                    refetch={refetch}
+                    setQuery={setQuery}
+                    to={to}
+                    narrowDateRange={narrowDateRange}
                   />
-                </WrapperPage>
-              </StickyContainer>
-            ) : (
-              <WrapperPage>
-                <HeaderPage border title={i18n.PAGE_TITLE} />
-
-                <HostsEmptyPage />
-              </WrapperPage>
-            );
-          }}
-        </WithSource>
+                )}
+              </KpiHostsQuery>
+
+              <EuiSpacer />
+
+              <SiemNavigation navTabs={navTabsHosts(hasMlUserPermissions(capabilities))} />
+
+              <EuiSpacer />
+
+              <HostsTabs
+                deleteQuery={deleteQuery}
+                to={to}
+                filterQuery={tabsFilterQuery}
+                isInitializing={isInitializing}
+                setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
+                setQuery={setQuery}
+                from={from}
+                type={hostsModel.HostsType.page}
+                indexPattern={indexPattern}
+                hostsPagePath={hostsPagePath}
+              />
+            </WrapperPage>
+          </StickyContainer>
+        ) : (
+          <WrapperPage>
+            <HeaderPage border title={i18n.PAGE_TITLE} />
+
+            <HostsEmptyPage />
+          </WrapperPage>
+        )}
 
         <SpyRoute pageName={SecurityPageName.hosts} />
       </>
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/network/pages/ip_details/__snapshots__/index.test.tsx.snap
index 6e76ff00a814..d7af8d6910f4 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/__snapshots__/index.test.tsx.snap
@@ -1,15 +1,18 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`Ip Details it matches the snapshot 1`] = `
-<Fragment>
-  <WithSource
-    data-test-subj="ip-details-page"
-    sourceId="default"
-  >
-    <Component />
-  </WithSource>
+<div
+  data-test-subj="ip-details-page"
+>
+  <Memo(WrapperPageComponent)>
+    <Memo(HeaderPageComponent)
+      border={true}
+      title="123.456.78.90"
+    />
+    <NetworkEmptyPage />
+  </Memo(WrapperPageComponent)>
   <withRouter(undefined)
     pageName="network"
   />
-</Fragment>
+</div>
 `;
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx b/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx
index bbb964ae17b9..a87eb3d05744 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx
@@ -5,15 +5,13 @@
  */
 
 import { shallow } from 'enzyme';
-import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 import { Router } from 'react-router-dom';
-import { MockedProvider } from 'react-apollo/test-utils';
 import { ActionCreator } from 'typescript-fsa';
 
 import '../../../common/mock/match_media';
 
-import { mocksSource } from '../../../common/containers/source/mock';
+import { useWithSource } from '../../../common/containers/source';
 import { FlowTarget } from '../../../graphql/types';
 import {
   apolloClientObservable,
@@ -32,6 +30,9 @@ const pop: Action = 'POP';
 
 type GlobalWithFetch = NodeJS.Global & { fetch: jest.Mock };
 
+jest.mock('../../../common/lib/kibana');
+jest.mock('../../../common/containers/source');
+
 // Test will fail because we will to need to mock some core services to make the test work
 // For now let's forget about SiemSearchBar and QueryBar
 jest.mock('../../../common/components/search_bar', () => ({
@@ -41,19 +42,6 @@ jest.mock('../../../common/components/query_bar', () => ({
   QueryBar: () => null,
 }));
 
-let localSource: Array<{
-  request: {};
-  result: {
-    data: {
-      source: {
-        status: {
-          indicesExist: boolean;
-        };
-      };
-    };
-  };
-}>;
-
 const getMockHistory = (ip: string) => ({
   length: 2,
   location: {
@@ -104,6 +92,10 @@ describe('Ip Details', () => {
   const mount = useMountAppended();
 
   beforeAll(() => {
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: false,
+      indexPattern: {},
+    });
     (global as GlobalWithFetch).fetch = jest.fn().mockImplementationOnce(() =>
       Promise.resolve({
         ok: true,
@@ -124,7 +116,6 @@ describe('Ip Details', () => {
 
   beforeEach(() => {
     store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
-    localSource = cloneDeep(mocksSource);
   });
 
   test('it renders', () => {
@@ -138,20 +129,18 @@ describe('Ip Details', () => {
   });
 
   test('it renders ipv6 headline', async () => {
-    localSource[0].result.data.source.status.indicesExist = true;
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: true,
+      indexPattern: {},
+    });
     const ip = 'fe80--24ce-f7ff-fede-a571';
     const wrapper = mount(
       <TestProviders store={store}>
-        <MockedProvider mocks={localSource} addTypename={false}>
-          <Router history={getMockHistory(ip)}>
-            <IPDetails {...getMockProps(ip)} />
-          </Router>
-        </MockedProvider>
+        <Router history={getMockHistory(ip)}>
+          <IPDetails {...getMockProps(ip)} />
+        </Router>
       </TestProviders>
     );
-    // Why => https://github.com/apollographql/react-apollo/issues/1711
-    await new Promise((resolve) => setTimeout(resolve));
-    wrapper.update();
     expect(
       wrapper
         .find('[data-test-subj="ip-details-headline"] [data-test-subj="header-page-title"]')
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/index.tsx b/x-pack/plugins/security_solution/public/network/pages/ip_details/index.tsx
index face3f890479..162b3a7c158d 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/index.tsx
@@ -22,10 +22,7 @@ import { IpOverview } from '../../components/ip_overview';
 import { SiemSearchBar } from '../../../common/components/search_bar';
 import { WrapperPage } from '../../../common/components/wrapper_page';
 import { IpOverviewQuery } from '../../containers/ip_overview';
-import {
-  indicesExistOrDataTemporarilyUnavailable,
-  WithSource,
-} from '../../../common/containers/source';
+import { useWithSource } from '../../../common/containers/source';
 import { FlowTargetSourceDest, LastEventIndexKey } from '../../../graphql/types';
 import { useKibana } from '../../../common/lib/kibana';
 import { decodeIpv6 } from '../../../common/lib/helpers';
@@ -74,208 +71,207 @@ export const IPDetailsComponent: React.FC<IPDetailsComponentProps & PropsFromRed
     },
     [setAbsoluteRangeDatePicker]
   );
-  const kibana = useKibana();
+  const {
+    services: { uiSettings },
+  } = useKibana();
 
   useEffect(() => {
     setIpDetailsTablesActivePageToZero();
   }, [detailName, setIpDetailsTablesActivePageToZero]);
 
-  return (
-    <>
-      <WithSource sourceId="default" data-test-subj="ip-details-page">
-        {({ indicesExist, indexPattern }) => {
-          const ip = decodeIpv6(detailName);
-          const filterQuery = convertToBuildEsQuery({
-            config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
-            indexPattern,
-            queries: [query],
-            filters,
-          });
+  const { indicesExist, indexPattern } = useWithSource();
+  const ip = decodeIpv6(detailName);
+  const filterQuery = convertToBuildEsQuery({
+    config: esQuery.getEsQueryConfig(uiSettings),
+    indexPattern,
+    queries: [query],
+    filters,
+  });
 
-          return indicesExistOrDataTemporarilyUnavailable(indicesExist) ? (
-            <StickyContainer>
-              <FiltersGlobal>
-                <SiemSearchBar indexPattern={indexPattern} id="global" />
-              </FiltersGlobal>
+  return (
+    <div data-test-subj="ip-details-page">
+      {indicesExist ? (
+        <StickyContainer>
+          <FiltersGlobal>
+            <SiemSearchBar indexPattern={indexPattern} id="global" />
+          </FiltersGlobal>
 
-              <WrapperPage>
-                <HeaderPage
-                  border
-                  data-test-subj="ip-details-headline"
-                  draggableArguments={{ field: `${flowTarget}.ip`, value: ip }}
-                  subtitle={<LastEventTime indexKey={LastEventIndexKey.ipDetails} ip={ip} />}
-                  title={ip}
-                >
-                  <FlowTargetSelectConnected flowTarget={flowTarget} />
-                </HeaderPage>
+          <WrapperPage>
+            <HeaderPage
+              border
+              data-test-subj="ip-details-headline"
+              draggableArguments={{ field: `${flowTarget}.ip`, value: ip }}
+              subtitle={<LastEventTime indexKey={LastEventIndexKey.ipDetails} ip={ip} />}
+              title={ip}
+            >
+              <FlowTargetSelectConnected flowTarget={flowTarget} />
+            </HeaderPage>
 
-                <IpOverviewQuery
+            <IpOverviewQuery
+              skip={isInitializing}
+              sourceId="default"
+              filterQuery={filterQuery}
+              type={type}
+              ip={ip}
+            >
+              {({ id, inspect, ipOverviewData, loading, refetch }) => (
+                <AnomalyTableProvider
+                  criteriaFields={networkToCriteria(detailName, flowTarget)}
+                  startDate={from}
+                  endDate={to}
                   skip={isInitializing}
-                  sourceId="default"
-                  filterQuery={filterQuery}
-                  type={type}
-                  ip={ip}
                 >
-                  {({ id, inspect, ipOverviewData, loading, refetch }) => (
-                    <AnomalyTableProvider
-                      criteriaFields={networkToCriteria(detailName, flowTarget)}
-                      startDate={from}
-                      endDate={to}
-                      skip={isInitializing}
-                    >
-                      {({ isLoadingAnomaliesData, anomaliesData }) => (
-                        <IpOverviewManage
-                          id={id}
-                          inspect={inspect}
-                          ip={ip}
-                          data={ipOverviewData}
-                          anomaliesData={anomaliesData}
-                          loading={loading}
-                          isLoadingAnomaliesData={isLoadingAnomaliesData}
-                          type={type}
-                          flowTarget={flowTarget}
-                          refetch={refetch}
-                          setQuery={setQuery}
-                          startDate={from}
-                          endDate={to}
-                          narrowDateRange={narrowDateRange}
-                        />
-                      )}
-                    </AnomalyTableProvider>
-                  )}
-                </IpOverviewQuery>
-
-                <EuiHorizontalRule />
-
-                <ConditionalFlexGroup direction="column">
-                  <EuiFlexItem>
-                    <NetworkTopNFlowQueryTable
-                      endDate={to}
-                      filterQuery={filterQuery}
-                      flowTarget={FlowTargetSourceDest.source}
+                  {({ isLoadingAnomaliesData, anomaliesData }) => (
+                    <IpOverviewManage
+                      id={id}
+                      inspect={inspect}
                       ip={ip}
-                      skip={isInitializing}
-                      startDate={from}
+                      data={ipOverviewData}
+                      anomaliesData={anomaliesData}
+                      loading={loading}
+                      isLoadingAnomaliesData={isLoadingAnomaliesData}
                       type={type}
+                      flowTarget={flowTarget}
+                      refetch={refetch}
                       setQuery={setQuery}
-                      indexPattern={indexPattern}
-                    />
-                  </EuiFlexItem>
-
-                  <EuiFlexItem>
-                    <NetworkTopNFlowQueryTable
-                      endDate={to}
-                      flowTarget={FlowTargetSourceDest.destination}
-                      filterQuery={filterQuery}
-                      ip={ip}
-                      skip={isInitializing}
                       startDate={from}
-                      type={type}
-                      setQuery={setQuery}
-                      indexPattern={indexPattern}
-                    />
-                  </EuiFlexItem>
-                </ConditionalFlexGroup>
-
-                <EuiSpacer />
-
-                <ConditionalFlexGroup direction="column">
-                  <EuiFlexItem>
-                    <NetworkTopCountriesQueryTable
                       endDate={to}
-                      filterQuery={filterQuery}
-                      flowTarget={FlowTargetSourceDest.source}
-                      ip={ip}
-                      skip={isInitializing}
-                      startDate={from}
-                      type={type}
-                      setQuery={setQuery}
-                      indexPattern={indexPattern}
+                      narrowDateRange={narrowDateRange}
                     />
-                  </EuiFlexItem>
-
-                  <EuiFlexItem>
-                    <NetworkTopCountriesQueryTable
-                      endDate={to}
-                      flowTarget={FlowTargetSourceDest.destination}
-                      filterQuery={filterQuery}
-                      ip={ip}
-                      skip={isInitializing}
-                      startDate={from}
-                      type={type}
-                      setQuery={setQuery}
-                      indexPattern={indexPattern}
-                    />
-                  </EuiFlexItem>
-                </ConditionalFlexGroup>
+                  )}
+                </AnomalyTableProvider>
+              )}
+            </IpOverviewQuery>
 
-                <EuiSpacer />
+            <EuiHorizontalRule />
 
-                <UsersQueryTable
+            <ConditionalFlexGroup direction="column">
+              <EuiFlexItem>
+                <NetworkTopNFlowQueryTable
                   endDate={to}
                   filterQuery={filterQuery}
-                  flowTarget={flowTarget}
+                  flowTarget={FlowTargetSourceDest.source}
                   ip={ip}
                   skip={isInitializing}
                   startDate={from}
                   type={type}
                   setQuery={setQuery}
+                  indexPattern={indexPattern}
                 />
+              </EuiFlexItem>
 
-                <EuiSpacer />
-
-                <NetworkHttpQueryTable
+              <EuiFlexItem>
+                <NetworkTopNFlowQueryTable
                   endDate={to}
+                  flowTarget={FlowTargetSourceDest.destination}
                   filterQuery={filterQuery}
                   ip={ip}
                   skip={isInitializing}
                   startDate={from}
                   type={type}
                   setQuery={setQuery}
+                  indexPattern={indexPattern}
                 />
+              </EuiFlexItem>
+            </ConditionalFlexGroup>
 
-                <EuiSpacer />
+            <EuiSpacer />
 
-                <TlsQueryTable
+            <ConditionalFlexGroup direction="column">
+              <EuiFlexItem>
+                <NetworkTopCountriesQueryTable
                   endDate={to}
                   filterQuery={filterQuery}
-                  flowTarget={(flowTarget as unknown) as FlowTargetSourceDest}
+                  flowTarget={FlowTargetSourceDest.source}
                   ip={ip}
-                  setQuery={setQuery}
                   skip={isInitializing}
                   startDate={from}
                   type={type}
+                  setQuery={setQuery}
+                  indexPattern={indexPattern}
                 />
+              </EuiFlexItem>
 
-                <EuiSpacer />
-
-                <AnomaliesQueryTabBody
-                  filterQuery={filterQuery}
-                  setQuery={setQuery}
-                  startDate={from}
+              <EuiFlexItem>
+                <NetworkTopCountriesQueryTable
                   endDate={to}
-                  skip={isInitializing}
+                  flowTarget={FlowTargetSourceDest.destination}
+                  filterQuery={filterQuery}
                   ip={ip}
+                  skip={isInitializing}
+                  startDate={from}
                   type={type}
-                  flowTarget={flowTarget}
-                  narrowDateRange={narrowDateRange}
-                  hideHistogramIfEmpty={true}
-                  AnomaliesTableComponent={AnomaliesNetworkTable}
+                  setQuery={setQuery}
+                  indexPattern={indexPattern}
                 />
-              </WrapperPage>
-            </StickyContainer>
-          ) : (
-            <WrapperPage>
-              <HeaderPage border title={ip} />
+              </EuiFlexItem>
+            </ConditionalFlexGroup>
+
+            <EuiSpacer />
+
+            <UsersQueryTable
+              endDate={to}
+              filterQuery={filterQuery}
+              flowTarget={flowTarget}
+              ip={ip}
+              skip={isInitializing}
+              startDate={from}
+              type={type}
+              setQuery={setQuery}
+            />
+
+            <EuiSpacer />
+
+            <NetworkHttpQueryTable
+              endDate={to}
+              filterQuery={filterQuery}
+              ip={ip}
+              skip={isInitializing}
+              startDate={from}
+              type={type}
+              setQuery={setQuery}
+            />
+
+            <EuiSpacer />
+
+            <TlsQueryTable
+              endDate={to}
+              filterQuery={filterQuery}
+              flowTarget={(flowTarget as unknown) as FlowTargetSourceDest}
+              ip={ip}
+              setQuery={setQuery}
+              skip={isInitializing}
+              startDate={from}
+              type={type}
+            />
+
+            <EuiSpacer />
+
+            <AnomaliesQueryTabBody
+              filterQuery={filterQuery}
+              setQuery={setQuery}
+              startDate={from}
+              endDate={to}
+              skip={isInitializing}
+              ip={ip}
+              type={type}
+              flowTarget={flowTarget}
+              narrowDateRange={narrowDateRange}
+              hideHistogramIfEmpty={true}
+              AnomaliesTableComponent={AnomaliesNetworkTable}
+            />
+          </WrapperPage>
+        </StickyContainer>
+      ) : (
+        <WrapperPage>
+          <HeaderPage border title={ip} />
 
-              <NetworkEmptyPage />
-            </WrapperPage>
-          );
-        }}
-      </WithSource>
+          <NetworkEmptyPage />
+        </WrapperPage>
+      )}
 
       <SpyRoute pageName={SecurityPageName.network} />
-    </>
+    </div>
   );
 };
 IPDetailsComponent.displayName = 'IPDetailsComponent';
diff --git a/x-pack/plugins/security_solution/public/network/pages/network.test.tsx b/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
index e1078dee3eb0..7cdfdbf0af69 100644
--- a/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
@@ -5,14 +5,12 @@
  */
 
 import { mount } from 'enzyme';
-import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 import { Router } from 'react-router-dom';
-import { MockedProvider } from 'react-apollo/test-utils';
 
 import '../../common/mock/match_media';
 import { Filter } from '../../../../../../src/plugins/data/common/es_query';
-import { mocksSource } from '../../common/containers/source/mock';
+import { useWithSource } from '../../common/containers/source';
 import {
   TestProviders,
   mockGlobalState,
@@ -26,6 +24,8 @@ import { inputsActions } from '../../common/store/inputs';
 import { Network } from './network';
 import { NetworkRoutes } from './navigation';
 
+jest.mock('../../common/containers/source');
+
 // Test will fail because we will to need to mock some core services to make the test work
 // For now let's forget about SiemSearchBar and QueryBar
 jest.mock('../../common/components/search_bar', () => ({
@@ -35,19 +35,6 @@ jest.mock('../../common/components/query_bar', () => ({
   QueryBar: () => null,
 }));
 
-let localSource: Array<{
-  request: {};
-  result: {
-    data: {
-      source: {
-        status: {
-          indicesExist: boolean;
-        };
-      };
-    };
-  };
-}>;
-
 type Action = 'PUSH' | 'POP' | 'REPLACE';
 const pop: Action = 'POP';
 const location = {
@@ -84,41 +71,33 @@ const getMockProps = () => ({
 });
 
 describe('rendering - rendering', () => {
-  beforeEach(() => {
-    localSource = cloneDeep(mocksSource);
-  });
-
   test('it renders the Setup Instructions text when no index is available', async () => {
-    localSource[0].result.data.source.status.indicesExist = false;
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: false,
+    });
+
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={localSource} addTypename={false}>
-          <Router history={mockHistory}>
-            <Network {...getMockProps()} />
-          </Router>
-        </MockedProvider>
+        <Router history={mockHistory}>
+          <Network {...getMockProps()} />
+        </Router>
       </TestProviders>
     );
-    // Why => https://github.com/apollographql/react-apollo/issues/1711
-    await new Promise((resolve) => setTimeout(resolve));
-    wrapper.update();
     expect(wrapper.find('[data-test-subj="empty-page"]').exists()).toBe(true);
   });
 
   test('it DOES NOT render the Setup Instructions text when an index is available', async () => {
-    localSource[0].result.data.source.status.indicesExist = true;
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: true,
+      indexPattern: {},
+    });
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={localSource} addTypename={false}>
-          <Router history={mockHistory}>
-            <Network {...getMockProps()} />
-          </Router>
-        </MockedProvider>
+        <Router history={mockHistory}>
+          <Network {...getMockProps()} />
+        </Router>
       </TestProviders>
     );
-    // Why => https://github.com/apollographql/react-apollo/issues/1711
-    await new Promise((resolve) => setTimeout(resolve));
-    wrapper.update();
     expect(wrapper.find('[data-test-subj="empty-page"]').exists()).toBe(false);
   });
 
@@ -154,20 +133,20 @@ describe('rendering - rendering', () => {
         },
       },
     ];
-    localSource[0].result.data.source.status.indicesExist = true;
+    (useWithSource as jest.Mock).mockReturnValue({
+      indicesExist: true,
+      indexPattern: { fields: [], title: 'title' },
+    });
     const myState: State = mockGlobalState;
     const { storage } = createSecuritySolutionStorageMock();
     const myStore = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
     const wrapper = mount(
       <TestProviders store={myStore}>
-        <MockedProvider mocks={localSource} addTypename={false}>
-          <Router history={mockHistory}>
-            <Network {...getMockProps()} />
-          </Router>
-        </MockedProvider>
+        <Router history={mockHistory}>
+          <Network {...getMockProps()} />
+        </Router>
       </TestProviders>
     );
-    await new Promise((resolve) => setTimeout(resolve));
     wrapper.update();
 
     myStore.dispatch(inputsActions.setSearchBarFilter({ id: 'global', filters: newFilters }));
diff --git a/x-pack/plugins/security_solution/public/network/pages/network.tsx b/x-pack/plugins/security_solution/public/network/pages/network.tsx
index 845a6bbd95dd..4275c1641f51 100644
--- a/x-pack/plugins/security_solution/public/network/pages/network.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/network.tsx
@@ -23,10 +23,7 @@ import { KpiNetworkComponent } from '..//components/kpi_network';
 import { SiemSearchBar } from '../../common/components/search_bar';
 import { WrapperPage } from '../../common/components/wrapper_page';
 import { KpiNetworkQuery } from '../../network/containers/kpi_network';
-import {
-  indicesExistOrDataTemporarilyUnavailable,
-  WithSource,
-} from '../../common/containers/source';
+import { useWithSource } from '../../common/containers/source';
 import { LastEventIndexKey } from '../../graphql/types';
 import { useKibana } from '../../common/lib/kibana';
 import { convertToBuildEsQuery } from '../../common/lib/keury';
@@ -78,103 +75,100 @@ const NetworkComponent = React.memo<NetworkComponentProps & PropsFromRedux>(
       [setAbsoluteRangeDatePicker]
     );
 
+    const { indicesExist, indexPattern } = useWithSource(sourceId);
+    const filterQuery = convertToBuildEsQuery({
+      config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
+      indexPattern,
+      queries: [query],
+      filters,
+    });
+    const tabsFilterQuery = convertToBuildEsQuery({
+      config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
+      indexPattern,
+      queries: [query],
+      filters: tabsFilters,
+    });
+
     return (
       <>
-        <WithSource sourceId={sourceId}>
-          {({ indicesExist, indexPattern }) => {
-            const filterQuery = convertToBuildEsQuery({
-              config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
-              indexPattern,
-              queries: [query],
-              filters,
-            });
-            const tabsFilterQuery = convertToBuildEsQuery({
-              config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
-              indexPattern,
-              queries: [query],
-              filters: tabsFilters,
-            });
-
-            return indicesExistOrDataTemporarilyUnavailable(indicesExist) ? (
-              <StickyContainer>
-                <FiltersGlobal>
-                  <SiemSearchBar indexPattern={indexPattern} id="global" />
-                </FiltersGlobal>
-
-                <WrapperPage>
-                  <HeaderPage
-                    border
-                    subtitle={<LastEventTime indexKey={LastEventIndexKey.network} />}
-                    title={i18n.PAGE_TITLE}
-                  />
-
-                  <EmbeddedMap
-                    query={query}
-                    filters={filters}
-                    startDate={from}
-                    endDate={to}
+        {indicesExist ? (
+          <StickyContainer>
+            <FiltersGlobal>
+              <SiemSearchBar indexPattern={indexPattern} id="global" />
+            </FiltersGlobal>
+
+            <WrapperPage>
+              <HeaderPage
+                border
+                subtitle={<LastEventTime indexKey={LastEventIndexKey.network} />}
+                title={i18n.PAGE_TITLE}
+              />
+
+              <EmbeddedMap
+                query={query}
+                filters={filters}
+                startDate={from}
+                endDate={to}
+                setQuery={setQuery}
+              />
+
+              <EuiSpacer />
+
+              <KpiNetworkQuery
+                endDate={to}
+                filterQuery={filterQuery}
+                skip={isInitializing}
+                sourceId={sourceId}
+                startDate={from}
+              >
+                {({ kpiNetwork, loading, id, inspect, refetch }) => (
+                  <KpiNetworkComponentManage
+                    id={id}
+                    inspect={inspect}
                     setQuery={setQuery}
+                    refetch={refetch}
+                    data={kpiNetwork}
+                    loading={loading}
+                    from={from}
+                    to={to}
+                    narrowDateRange={narrowDateRange}
                   />
+                )}
+              </KpiNetworkQuery>
 
+              {capabilitiesFetched && !isInitializing ? (
+                <>
                   <EuiSpacer />
 
-                  <KpiNetworkQuery
-                    endDate={to}
-                    filterQuery={filterQuery}
-                    skip={isInitializing}
-                    sourceId={sourceId}
-                    startDate={from}
-                  >
-                    {({ kpiNetwork, loading, id, inspect, refetch }) => (
-                      <KpiNetworkComponentManage
-                        id={id}
-                        inspect={inspect}
-                        setQuery={setQuery}
-                        refetch={refetch}
-                        data={kpiNetwork}
-                        loading={loading}
-                        from={from}
-                        to={to}
-                        narrowDateRange={narrowDateRange}
-                      />
-                    )}
-                  </KpiNetworkQuery>
-
-                  {capabilitiesFetched && !isInitializing ? (
-                    <>
-                      <EuiSpacer />
-
-                      <SiemNavigation navTabs={navTabsNetwork(hasMlUserPermissions)} />
-
-                      <EuiSpacer />
-
-                      <NetworkRoutes
-                        filterQuery={tabsFilterQuery}
-                        from={from}
-                        isInitializing={isInitializing}
-                        indexPattern={indexPattern}
-                        setQuery={setQuery}
-                        setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
-                        type={networkModel.NetworkType.page}
-                        to={to}
-                        networkPagePath={networkPagePath}
-                      />
-                    </>
-                  ) : (
-                    <NetworkRoutesLoading />
-                  )}
+                  <SiemNavigation navTabs={navTabsNetwork(hasMlUserPermissions)} />
 
                   <EuiSpacer />
-                </WrapperPage>
-              </StickyContainer>
-            ) : (
-              <WrapperPage>
-                <HeaderPage border title={i18n.PAGE_TITLE} />
-                <NetworkEmptyPage />
-              </WrapperPage>
-            );
-          }}
-        </WithSource>
+
+                  <NetworkRoutes
+                    filterQuery={tabsFilterQuery}
+                    from={from}
+                    isInitializing={isInitializing}
+                    indexPattern={indexPattern}
+                    setQuery={setQuery}
+                    setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
+                    type={networkModel.NetworkType.page}
+                    to={to}
+                    networkPagePath={networkPagePath}
+                  />
+                </>
+              ) : (
+                <NetworkRoutesLoading />
+              )}
+
+              <EuiSpacer />
+            </WrapperPage>
+          </StickyContainer>
+        ) : (
+          <WrapperPage>
+            <HeaderPage border title={i18n.PAGE_TITLE} />
+            <NetworkEmptyPage />
+          </WrapperPage>
+        )}
 
         <SpyRoute pageName={SecurityPageName.network} />
       </>
diff --git a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
index a2010f1f64b7..d6e8fb984ac0 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
@@ -5,17 +5,16 @@
  */
 
 import { mount } from 'enzyme';
-import { cloneDeep } from 'lodash/fp';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 import { MemoryRouter } from 'react-router-dom';
 
 import '../../common/mock/match_media';
 import { TestProviders } from '../../common/mock';
-import { mocksSource } from '../../common/containers/source/mock';
+import { useWithSource } from '../../common/containers/source';
 import { Overview } from './index';
 
 jest.mock('../../common/lib/kibana');
+jest.mock('../../common/containers/source');
 
 // Test will fail because we will to need to mock some core services to make the test work
 // For now let's forget about SiemSearchBar and QueryBar
@@ -26,56 +25,36 @@ jest.mock('../../common/components/query_bar', () => ({
   QueryBar: () => null,
 }));
 
-let localSource: Array<{
-  request: {};
-  result: {
-    data: {
-      source: {
-        status: {
-          indicesExist: boolean;
-        };
-      };
-    };
-  };
-}>;
-
 describe('Overview', () => {
   describe('rendering', () => {
-    beforeEach(() => {
-      localSource = cloneDeep(mocksSource);
-    });
-
     test('it renders the Setup Instructions text when no index is available', async () => {
-      localSource[0].result.data.source.status.indicesExist = false;
+      (useWithSource as jest.Mock).mockReturnValue({
+        indicesExist: false,
+      });
+
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={localSource} addTypename={false}>
-            <MemoryRouter>
-              <Overview />
-            </MemoryRouter>
-          </MockedProvider>
+          <MemoryRouter>
+            <Overview />
+          </MemoryRouter>
         </TestProviders>
       );
-      // Why => https://github.com/apollographql/react-apollo/issues/1711
-      await new Promise((resolve) => setTimeout(resolve));
-      wrapper.update();
+
       expect(wrapper.find('[data-test-subj="empty-page"]').exists()).toBe(true);
     });
 
     test('it DOES NOT render the Getting started text when an index is available', async () => {
-      localSource[0].result.data.source.status.indicesExist = true;
+      (useWithSource as jest.Mock).mockReturnValue({
+        indicesExist: true,
+        indexPattern: {},
+      });
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={localSource} addTypename={false}>
-            <MemoryRouter>
-              <Overview />
-            </MemoryRouter>
-          </MockedProvider>
+          <MemoryRouter>
+            <Overview />
+          </MemoryRouter>
         </TestProviders>
       );
-      // Why => https://github.com/apollographql/react-apollo/issues/1711
-      await new Promise((resolve) => setTimeout(resolve));
-      wrapper.update();
       expect(wrapper.find('[data-test-subj="empty-page"]').exists()).toBe(false);
     });
   });
diff --git a/x-pack/plugins/security_solution/public/overview/pages/overview.tsx b/x-pack/plugins/security_solution/public/overview/pages/overview.tsx
index 543dafd50c8e..53cb32a16a9d 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/overview.tsx
+++ b/x-pack/plugins/security_solution/public/overview/pages/overview.tsx
@@ -16,10 +16,7 @@ import { FiltersGlobal } from '../../common/components/filters_global';
 import { SiemSearchBar } from '../../common/components/search_bar';
 import { WrapperPage } from '../../common/components/wrapper_page';
 import { GlobalTime } from '../../common/containers/global_time';
-import {
-  WithSource,
-  indicesExistOrDataTemporarilyUnavailable,
-} from '../../common/containers/source';
+import { useWithSource } from '../../common/containers/source';
 import { EventsByDataset } from '../components/events_by_dataset';
 import { EventCounts } from '../components/event_counts';
 import { OverviewEmpty } from '../components/overview_empty';
@@ -41,89 +38,89 @@ const OverviewComponent: React.FC<PropsFromRedux> = ({
   filters = NO_FILTERS,
   query = DEFAULT_QUERY,
   setAbsoluteRangeDatePicker,
-}) => (
-  <>
-    <WithSource sourceId="default">
-      {({ indicesExist, indexPattern }) =>
-        indicesExistOrDataTemporarilyUnavailable(indicesExist) ? (
-          <StickyContainer>
-            <FiltersGlobal>
-              <SiemSearchBar id="global" indexPattern={indexPattern} />
-            </FiltersGlobal>
-
-            <WrapperPage>
-              <EuiFlexGroup gutterSize="none" justifyContent="spaceBetween">
-                <SidebarFlexItem grow={false}>
-                  <StatefulSidebar />
-                </SidebarFlexItem>
-
-                <EuiFlexItem grow={true}>
-                  <GlobalTime>
-                    {({ from, deleteQuery, setQuery, to }) => (
-                      <EuiFlexGroup direction="column" gutterSize="none">
-                        <EuiFlexItem grow={false}>
-                          <SignalsByCategory
-                            filters={filters}
-                            from={from}
-                            indexPattern={indexPattern}
-                            query={query}
-                            setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
-                            setQuery={setQuery}
-                            to={to}
-                          />
-                          <EuiSpacer size="l" />
-                        </EuiFlexItem>
-
-                        <EuiFlexItem grow={false}>
-                          <AlertsByCategory
-                            deleteQuery={deleteQuery}
-                            filters={filters}
-                            from={from}
-                            indexPattern={indexPattern}
-                            query={query}
-                            setQuery={setQuery}
-                            to={to}
-                          />
-                        </EuiFlexItem>
-
-                        <EuiFlexItem grow={false}>
-                          <EventsByDataset
-                            deleteQuery={deleteQuery}
-                            filters={filters}
-                            from={from}
-                            indexPattern={indexPattern}
-                            query={query}
-                            setQuery={setQuery}
-                            to={to}
-                          />
-                        </EuiFlexItem>
-
-                        <EuiFlexItem grow={false}>
-                          <EventCounts
-                            filters={filters}
-                            from={from}
-                            indexPattern={indexPattern}
-                            query={query}
-                            setQuery={setQuery}
-                            to={to}
-                          />
-                        </EuiFlexItem>
-                      </EuiFlexGroup>
-                    )}
-                  </GlobalTime>
-                </EuiFlexItem>
-              </EuiFlexGroup>
-            </WrapperPage>
-          </StickyContainer>
-        ) : (
-          <OverviewEmpty />
-        )
-      }
-    </WithSource>
-
-    <SpyRoute pageName={SecurityPageName.overview} />
-  </>
-);
+}) => {
+  const { indicesExist, indexPattern } = useWithSource();
+
+  return (
+    <>
+      {indicesExist ? (
+        <StickyContainer>
+          <FiltersGlobal>
+            <SiemSearchBar id="global" indexPattern={indexPattern} />
+          </FiltersGlobal>
+
+          <WrapperPage>
+            <EuiFlexGroup gutterSize="none" justifyContent="spaceBetween">
+              <SidebarFlexItem grow={false}>
+                <StatefulSidebar />
+              </SidebarFlexItem>
+
+              <EuiFlexItem grow={true}>
+                <GlobalTime>
+                  {({ from, deleteQuery, setQuery, to }) => (
+                    <EuiFlexGroup direction="column" gutterSize="none">
+                      <EuiFlexItem grow={false}>
+                        <SignalsByCategory
+                          filters={filters}
+                          from={from}
+                          indexPattern={indexPattern}
+                          query={query}
+                          setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
+                          setQuery={setQuery}
+                          to={to}
+                        />
+                        <EuiSpacer size="l" />
+                      </EuiFlexItem>
+
+                      <EuiFlexItem grow={false}>
+                        <AlertsByCategory
+                          deleteQuery={deleteQuery}
+                          filters={filters}
+                          from={from}
+                          indexPattern={indexPattern}
+                          query={query}
+                          setQuery={setQuery}
+                          to={to}
+                        />
+                      </EuiFlexItem>
+
+                      <EuiFlexItem grow={false}>
+                        <EventsByDataset
+                          deleteQuery={deleteQuery}
+                          filters={filters}
+                          from={from}
+                          indexPattern={indexPattern}
+                          query={query}
+                          setQuery={setQuery}
+                          to={to}
+                        />
+                      </EuiFlexItem>
+
+                      <EuiFlexItem grow={false}>
+                        <EventCounts
+                          filters={filters}
+                          from={from}
+                          indexPattern={indexPattern}
+                          query={query}
+                          setQuery={setQuery}
+                          to={to}
+                        />
+                      </EuiFlexItem>
+                    </EuiFlexGroup>
+                  )}
+                </GlobalTime>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </WrapperPage>
+        </StickyContainer>
+      ) : (
+        <OverviewEmpty />
+      )}
+
+      <SpyRoute pageName={SecurityPageName.overview} />
+    </>
+  );
+};
 
 const makeMapStateToProps = () => {
   const getGlobalFiltersQuerySelector = inputsSelectors.globalFiltersQuerySelector();
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/button/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/button/index.tsx
index ae05d99b58ee..a1392ad8b827 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/button/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/button/index.tsx
@@ -10,7 +10,7 @@ import { rgba } from 'polished';
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
-import { WithSource } from '../../../../common/containers/source';
+import { useWithSource } from '../../../../common/containers/source';
 import { IS_DRAGGING_CLASS_NAME } from '../../../../common/components/drag_and_drop/helpers';
 import { DataProvider } from '../../timeline/data_providers/data_provider';
 import { flattenIntoAndGroups } from '../../timeline/data_providers/helpers';
@@ -84,6 +84,7 @@ interface FlyoutButtonProps {
 export const FlyoutButton = React.memo<FlyoutButtonProps>(
   ({ onOpen, show, dataProviders, timelineId }) => {
     const badgeCount = useMemo(() => getBadgeCount(dataProviders), [dataProviders]);
+    const { browserFields } = useWithSource();
 
     if (!show) {
       return null;
@@ -121,19 +122,15 @@ export const FlyoutButton = React.memo<FlyoutButtonProps>(
           </EuiNotificationBadge>
         </BadgeButtonContainer>
         <DataProvidersPanel paddingSize="none">
-          <WithSource sourceId="default">
-            {({ browserFields }) => (
-              <DataProviders
-                browserFields={browserFields}
-                id={timelineId}
-                dataProviders={dataProviders}
-                onDataProviderEdited={noop}
-                onDataProviderRemoved={noop}
-                onToggleDataProviderEnabled={noop}
-                onToggleDataProviderExcluded={noop}
-              />
-            )}
-          </WithSource>
+          <DataProviders
+            browserFields={browserFields}
+            id={timelineId}
+            dataProviders={dataProviders}
+            onDataProviderEdited={noop}
+            onDataProviderRemoved={noop}
+            onToggleDataProviderEnabled={noop}
+            onToggleDataProviderExcluded={noop}
+          />
         </DataProvidersPanel>
       </Container>
     );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
index 51cfe8ae33b0..df76eb350ace 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
@@ -9,7 +9,7 @@ import { connect, ConnectedProps } from 'react-redux';
 import deepEqual from 'fast-deep-equal';
 
 import { NO_ALERT_INDEX } from '../../../../common/constants';
-import { WithSource } from '../../../common/containers/source';
+import { useWithSource } from '../../../common/containers/source';
 import { useSignalIndex } from '../../../alerts/containers/detection_engine/alerts/use_signal_index';
 import { inputsModel, inputsSelectors, State } from '../../../common/store';
 import { timelineActions, timelineSelectors } from '../../store/timeline';
@@ -158,40 +158,38 @@ const StatefulTimelineComponent = React.memo<Props>(
       // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []);
 
+    const { indexPattern, browserFields } = useWithSource('default', indexToAdd);
+
     return (
-      <WithSource sourceId="default" indexToAdd={indexToAdd}>
-        {({ indexPattern, browserFields }) => (
-          <Timeline
-            browserFields={browserFields}
-            columns={columns}
-            dataProviders={dataProviders!}
-            end={end}
-            eventType={eventType}
-            filters={filters}
-            id={id}
-            indexPattern={indexPattern}
-            indexToAdd={indexToAdd}
-            isLive={isLive}
-            itemsPerPage={itemsPerPage!}
-            itemsPerPageOptions={itemsPerPageOptions!}
-            kqlMode={kqlMode}
-            kqlQueryExpression={kqlQueryExpression}
-            loadingIndexName={loading}
-            onChangeItemsPerPage={onChangeItemsPerPage}
-            onClose={onClose}
-            onDataProviderEdited={onDataProviderEditedLocal}
-            onDataProviderRemoved={onDataProviderRemoved}
-            onToggleDataProviderEnabled={onToggleDataProviderEnabled}
-            onToggleDataProviderExcluded={onToggleDataProviderExcluded}
-            show={show!}
-            showCallOutUnauthorizedMsg={showCallOutUnauthorizedMsg}
-            sort={sort!}
-            start={start}
-            toggleColumn={toggleColumn}
-            usersViewing={usersViewing}
-          />
-        )}
-      </WithSource>
+      <Timeline
+        browserFields={browserFields}
+        columns={columns}
+        dataProviders={dataProviders!}
+        end={end}
+        eventType={eventType}
+        filters={filters}
+        id={id}
+        indexPattern={indexPattern}
+        indexToAdd={indexToAdd}
+        isLive={isLive}
+        itemsPerPage={itemsPerPage!}
+        itemsPerPageOptions={itemsPerPageOptions!}
+        kqlMode={kqlMode}
+        kqlQueryExpression={kqlQueryExpression}
+        loadingIndexName={loading}
+        onChangeItemsPerPage={onChangeItemsPerPage}
+        onClose={onClose}
+        onDataProviderEdited={onDataProviderEditedLocal}
+        onDataProviderRemoved={onDataProviderRemoved}
+        onToggleDataProviderEnabled={onToggleDataProviderEnabled}
+        onToggleDataProviderExcluded={onToggleDataProviderExcluded}
+        show={show!}
+        showCallOutUnauthorizedMsg={showCallOutUnauthorizedMsg}
+        sort={sort!}
+        start={start}
+        toggleColumn={toggleColumn}
+        usersViewing={usersViewing}
+      />
     );
   },
   (prevProps, nextProps) => {

From 68cf8571935a1de1011bd205ea2f86bfe5237015 Mon Sep 17 00:00:00 2001
From: Gidi Meir Morris <github@gidi.io>
Date: Thu, 25 Jun 2020 17:23:31 +0100
Subject: [PATCH 12/78] [Encrypted Saved Objects] Adds support for migrations
 in ESO (#69513)

Introduces migrations into Encrypted Saved Objects.

The two main changes here are:
1. The addition of a createMigration api on the EncryptedSavedObjectsPluginSetup.
2. A change in SavedObjects migration to ensure they don't block the event loop.
---
 src/core/server/mocks.ts                      |    1 +
 .../migrations/core/index_migrator.ts         |    2 +-
 .../migrations/core/migrate_raw_docs.test.ts  |    4 +-
 .../migrations/core/migrate_raw_docs.ts       |   57 +-
 x-pack/package.json                           |    2 +-
 .../plugins/encrypted_saved_objects/README.md |  132 +
 .../server/create_migration.test.ts           |  296 ++
 .../server/create_migration.ts                |   91 +
 .../encrypted_saved_objects_service.mocks.ts  |   84 +
 .../encrypted_saved_objects_service.test.ts   |  586 +++-
 .../crypto/encrypted_saved_objects_service.ts |  149 +-
 .../server/crypto/index.mock.ts               |   69 +-
 .../server/crypto/index.ts                    |    1 +
 .../encrypted_saved_objects/server/mocks.ts   |    1 +
 .../server/plugin.test.ts                     |    1 +
 .../encrypted_saved_objects/server/plugin.ts  |   35 +-
 ...ypted_saved_objects_client_wrapper.test.ts |    2 +-
 .../server/saved_objects/index.test.ts        |    2 +-
 .../config.ts                                 |    8 +-
 .../api_consumer_plugin/server/index.ts       |   96 +-
 .../encrypted_saved_objects/data.json         |  370 +++
 .../encrypted_saved_objects/mappings.json     | 2413 +++++++++++++++++
 .../tests/encrypted_saved_objects_api.ts      |   28 +
 yarn.lock                                     |    5 +
 24 files changed, 4281 insertions(+), 154 deletions(-)
 create mode 100644 x-pack/plugins/encrypted_saved_objects/server/create_migration.test.ts
 create mode 100644 x-pack/plugins/encrypted_saved_objects/server/create_migration.ts
 create mode 100644 x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.mocks.ts
 create mode 100644 x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/data.json
 create mode 100644 x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/mappings.json

diff --git a/src/core/server/mocks.ts b/src/core/server/mocks.ts
index 0770e8843e2f..2ac5bd98f7ed 100644
--- a/src/core/server/mocks.ts
+++ b/src/core/server/mocks.ts
@@ -46,6 +46,7 @@ export { httpServiceMock } from './http/http_service.mock';
 export { loggingSystemMock } from './logging/logging_system.mock';
 export { savedObjectsRepositoryMock } from './saved_objects/service/lib/repository.mock';
 export { savedObjectsServiceMock } from './saved_objects/saved_objects_service.mock';
+export { migrationMocks } from './saved_objects/migrations/mocks';
 export { typeRegistryMock as savedObjectsTypeRegistryMock } from './saved_objects/saved_objects_type_registry.mock';
 export { uiSettingsServiceMock } from './ui_settings/ui_settings_service.mock';
 export { metricsServiceMock } from './metrics/metrics_service.mock';
diff --git a/src/core/server/saved_objects/migrations/core/index_migrator.ts b/src/core/server/saved_objects/migrations/core/index_migrator.ts
index b2ffe2ad04a8..e588eb787732 100644
--- a/src/core/server/saved_objects/migrations/core/index_migrator.ts
+++ b/src/core/server/saved_objects/migrations/core/index_migrator.ts
@@ -195,7 +195,7 @@ async function migrateSourceToDest(context: Context) {
     await Index.write(
       callCluster,
       dest.indexName,
-      migrateRawDocs(serializer, documentMigrator.migrate, docs, log)
+      await migrateRawDocs(serializer, documentMigrator.migrate, docs, log)
     );
   }
 }
diff --git a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts
index e55b72be2436..6e4dd9615d42 100644
--- a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts
+++ b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts
@@ -26,7 +26,7 @@ import { createSavedObjectsMigrationLoggerMock } from '../../migrations/mocks';
 describe('migrateRawDocs', () => {
   test('converts raw docs to saved objects', async () => {
     const transform = jest.fn<any, any>((doc: any) => _.set(doc, 'attributes.name', 'HOI!'));
-    const result = migrateRawDocs(
+    const result = await migrateRawDocs(
       new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
       transform,
       [
@@ -55,7 +55,7 @@ describe('migrateRawDocs', () => {
     const transform = jest.fn<any, any>((doc: any) =>
       _.set(_.cloneDeep(doc), 'attributes.name', 'TADA')
     );
-    const result = migrateRawDocs(
+    const result = await migrateRawDocs(
       new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
       transform,
       [
diff --git a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts
index a2b72ea76c1a..2bdf59d25dc7 100644
--- a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts
+++ b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts
@@ -21,7 +21,11 @@
  * This file provides logic for migrating raw documents.
  */
 
-import { SavedObjectsRawDoc, SavedObjectsSerializer } from '../../serialization';
+import {
+  SavedObjectsRawDoc,
+  SavedObjectsSerializer,
+  SavedObjectUnsanitizedDoc,
+} from '../../serialization';
 import { TransformFn } from './document_migrator';
 import { SavedObjectsMigrationLogger } from '.';
 
@@ -33,26 +37,51 @@ import { SavedObjectsMigrationLogger } from '.';
  * @param {SavedObjectsRawDoc[]} rawDocs
  * @returns {SavedObjectsRawDoc[]}
  */
-export function migrateRawDocs(
+export async function migrateRawDocs(
   serializer: SavedObjectsSerializer,
   migrateDoc: TransformFn,
   rawDocs: SavedObjectsRawDoc[],
   log: SavedObjectsMigrationLogger
-): SavedObjectsRawDoc[] {
-  return rawDocs.map((raw) => {
+): Promise<SavedObjectsRawDoc[]> {
+  const migrateDocWithoutBlocking = transformNonBlocking(migrateDoc);
+  const processedDocs = [];
+  for (const raw of rawDocs) {
     if (serializer.isRawSavedObject(raw)) {
       const savedObject = serializer.rawToSavedObject(raw);
       savedObject.migrationVersion = savedObject.migrationVersion || {};
-      return serializer.savedObjectToRaw({
-        references: [],
-        ...migrateDoc(savedObject),
-      });
+      processedDocs.push(
+        serializer.savedObjectToRaw({
+          references: [],
+          ...(await migrateDocWithoutBlocking(savedObject)),
+        })
+      );
+    } else {
+      log.error(
+        `Error: Unable to migrate the corrupt Saved Object document ${raw._id}. To prevent Kibana from performing a migration on every restart, please delete or fix this document by ensuring that the namespace and type in the document's id matches the values in the namespace and type fields.`,
+        { rawDocument: raw }
+      );
+      processedDocs.push(raw);
     }
+  }
+  return processedDocs;
+}
 
-    log.error(
-      `Error: Unable to migrate the corrupt Saved Object document ${raw._id}. To prevent Kibana from performing a migration on every restart, please delete or fix this document by ensuring that the namespace and type in the document's id matches the values in the namespace and type fields.`,
-      { rawDocument: raw }
-    );
-    return raw;
-  });
+/**
+ * Migration transform functions are potentially CPU heavy e.g. doing decryption/encryption
+ * or (de)/serializing large JSON payloads.
+ * Executing all transforms for a batch in a synchronous loop can block the event-loop for a long time.
+ * To prevent this we use setImmediate to ensure that the event-loop can process other parallel
+ * work in between each transform.
+ */
+function transformNonBlocking(
+  transform: TransformFn
+): (doc: SavedObjectUnsanitizedDoc) => Promise<SavedObjectUnsanitizedDoc> {
+  // promises aren't enough to unblock the event loop
+  return (doc: SavedObjectUnsanitizedDoc) =>
+    new Promise((resolve) => {
+      // set immediate is though
+      setImmediate(() => {
+        resolve(transform(doc));
+      });
+    });
 }
diff --git a/x-pack/package.json b/x-pack/package.json
index ad8c12d41000..ac5b77c4f78d 100644
--- a/x-pack/package.json
+++ b/x-pack/package.json
@@ -198,7 +198,7 @@
     "@elastic/eui": "24.1.0",
     "@elastic/filesaver": "1.1.2",
     "@elastic/maki": "6.3.0",
-    "@elastic/node-crypto": "1.1.1",
+    "@elastic/node-crypto": "1.2.1",
     "@elastic/numeral": "^2.5.0",
     "@kbn/babel-preset": "1.0.0",
     "@kbn/config-schema": "1.0.0",
diff --git a/x-pack/plugins/encrypted_saved_objects/README.md b/x-pack/plugins/encrypted_saved_objects/README.md
index 2f0af9e86679..0a5e79a96f02 100644
--- a/x-pack/plugins/encrypted_saved_objects/README.md
+++ b/x-pack/plugins/encrypted_saved_objects/README.md
@@ -99,6 +99,138 @@ const savedObjectWithDecryptedContent =  await esoClient.getDecryptedAsInternalU
 one would pass to `SavedObjectsClient.get`. These argument allows to specify `namespace` property that, for example, is
 required if Saved Object was created within a non-default space.
 
+### Defining migrations
+EncryptedSavedObjects rely on standard SavedObject migrations, but due to the additional complexity introduced by the need to decrypt and reencrypt the migrated document, there are some caveats to how we support this.
+The good news is, most of this complexity is abstracted away by the plugin and all you need to do is leverage our api.
+
+The `EncryptedSavedObjects` Plugin _SetupContract_ exposes an `createMigration` api which facilitates defining a migration for your EncryptedSavedObject type.
+
+The `createMigration` function takes four arguments:
+
+|Argument|Description|Type|
+|---|---|---|
+|isMigrationNeededPredicate|A predicate which is called for each document, prior to being decrypted, which confirms whether a document requires migration or not. This predicate is important as the decryption step is costly and we would rather not decrypt and re-encrypt a document if we can avoid it.|function| 
+|migration|A migration function which will migrate each decrypted document from the old shape to the new one.|function| 
+|inputType|Optional. An `EncryptedSavedObjectTypeRegistration` which describes the ESOType of the input (the document prior to migration). If this type isn't provided, we'll assume the input doc follows the registered type. |object| 
+|migratedType| Optional. An `EncryptedSavedObjectTypeRegistration` which describes the ESOType of the output (the document after migration). If this type isn't provided, we'll assume the migrated doc follows the registered type.|object| 
+
+### Example: Migrating a Value
+
+```typescript
+encryptedSavedObjects.registerType({
+  type: 'alert',
+  attributesToEncrypt: new Set(['apiKey']),
+  attributesToExcludeFromAAD: new Set(['mutedInstanceIds', 'updatedBy']),
+});
+
+const migration790 = encryptedSavedObjects.createMigration<RawAlert, RawAlert>(
+  function shouldBeMigrated(doc): doc is SavedObjectUnsanitizedDoc<RawAlert> {
+    return doc.consumer === 'alerting' || doc.consumer === undefined;
+  },
+  (doc: SavedObjectUnsanitizedDoc<RawAlert>): SavedObjectUnsanitizedDoc<RawAlert> => {
+    const {
+      attributes: { consumer },
+    } = doc;
+    return {
+      ...doc,
+      attributes: {
+        ...doc.attributes,
+        consumer: consumer === 'alerting' || !consumer ? 'alerts' : consumer,
+      },
+    };
+  }
+);
+```
+
+In the above example you can see thwe following:
+1. In `shouldBeMigrated` we limit the migrated alerts to those whose `consumer` field equals `alerting` or is undefined.
+2. In the migration function we then migrate the value of `consumer` to the value we want (`alerts` or `unknown`, depending on the current value). In this function we can assume that only documents with a `consumer` of `alerting` or `undefined` will be passed in, but it's still safest not to, and so we use the current `consumer` as the default when needed.
+3. Note that we haven't passed in any type definitions. This is because we can rely on the registered type, as the migration is changing a value and not the shape of the object.
+
+As we said above, an EncryptedSavedObject migration is a normal SavedObjects migration, and so we can plug it into the underlying SavedObject just like any other kind of migration:
+
+```typescript
+savedObjects.registerType({
+    name: 'alert',
+    hidden: true,
+    namespaceType: 'single',
+    migrations: {
+        // apply this migration in 7.9.0
+       '7.9.0': migration790,
+    },
+    mappings: { 
+        //...
+    },
+});
+```
+
+### Example: Migating a Type
+If your migration needs to change the type by, for example, removing an encrypted field, you will have to specify the legacy type for the input.
+
+```typescript
+encryptedSavedObjects.registerType({
+  type: 'alert',
+  attributesToEncrypt: new Set(['apiKey']),
+  attributesToExcludeFromAAD: new Set(['mutedInstanceIds', 'updatedBy']),
+});
+
+const migration790 = encryptedSavedObjects.createMigration<RawAlert, RawAlert>(
+  function shouldBeMigrated(doc): doc is SavedObjectUnsanitizedDoc<RawAlert> {
+    return doc.consumer === 'alerting' || doc.consumer === undefined;
+  },
+  (doc: SavedObjectUnsanitizedDoc<RawAlert>): SavedObjectUnsanitizedDoc<RawAlert> => {
+    const {
+      attributes: { legacyEncryptedField, ...attributes },
+    } = doc;
+    return {
+      ...doc,
+      attributes: {
+        ...attributes
+      },
+    };
+  },
+  {
+    type: 'alert',
+    attributesToEncrypt: new Set(['apiKey', 'legacyEncryptedField']),
+    attributesToExcludeFromAAD: new Set(['mutedInstanceIds', 'updatedBy']),
+  }
+);
+```
+
+As you can see in this example we provide a legacy type which describes the _input_ which needs to be decrypted.
+The migration function will default to using the registered type to encrypt the migrated document after the migration is applied.
+
+If you need to migrate between two legacy types, you can specify both types at once:
+
+```typescript
+encryptedSavedObjects.registerType({
+  type: 'alert',
+  attributesToEncrypt: new Set(['apiKey']),
+  attributesToExcludeFromAAD: new Set(['mutedInstanceIds', 'updatedBy']),
+});
+
+const migration780 = encryptedSavedObjects.createMigration<RawAlert, RawAlert>(
+  function shouldBeMigrated(doc): doc is SavedObjectUnsanitizedDoc<RawAlert> {
+    // ...
+  },
+  (doc: SavedObjectUnsanitizedDoc<RawAlert>): SavedObjectUnsanitizedDoc<RawAlert> => {
+    // ...
+  },
+  // legacy input type
+  {
+    type: 'alert',
+    attributesToEncrypt: new Set(['apiKey', 'legacyEncryptedField']),
+    attributesToExcludeFromAAD: new Set(['mutedInstanceIds', 'updatedBy']),
+  },
+  // legacy migration type
+  {
+    type: 'alert',
+    attributesToEncrypt: new Set(['apiKey', 'legacyEncryptedField']),
+    attributesToExcludeFromAAD: new Set(['mutedInstanceIds', 'updatedBy', 'legacyEncryptedField']),
+  }
+);
+```
+
 ## Testing
 
 ### Unit tests
diff --git a/x-pack/plugins/encrypted_saved_objects/server/create_migration.test.ts b/x-pack/plugins/encrypted_saved_objects/server/create_migration.test.ts
new file mode 100644
index 000000000000..620e00167759
--- /dev/null
+++ b/x-pack/plugins/encrypted_saved_objects/server/create_migration.test.ts
@@ -0,0 +1,296 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SavedObjectUnsanitizedDoc } from 'kibana/server';
+import { migrationMocks } from 'src/core/server/mocks';
+import { encryptedSavedObjectsServiceMock } from './crypto/index.mock';
+import { getCreateMigration } from './create_migration';
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+describe('createMigration()', () => {
+  const { log } = migrationMocks.createContext();
+  const inputType = { type: 'known-type-1', attributesToEncrypt: new Set(['firstAttr']) };
+  const migrationType = {
+    type: 'known-type-1',
+    attributesToEncrypt: new Set(['firstAttr', 'secondAttr']),
+  };
+
+  interface InputType {
+    firstAttr: string;
+    nonEncryptedAttr?: string;
+  }
+  interface MigrationType {
+    firstAttr: string;
+    encryptedAttr?: string;
+  }
+
+  const encryptionSavedObjectService = encryptedSavedObjectsServiceMock.create();
+
+  it('throws if the types arent compatible', async () => {
+    const migrationCreator = getCreateMigration(encryptionSavedObjectService, () =>
+      encryptedSavedObjectsServiceMock.create()
+    );
+    expect(() =>
+      migrationCreator(
+        function (doc): doc is SavedObjectUnsanitizedDoc {
+          return true;
+        },
+        (doc) => doc,
+        {
+          type: 'known-type-1',
+          attributesToEncrypt: new Set(),
+        },
+        {
+          type: 'known-type-2',
+          attributesToEncrypt: new Set(),
+        }
+      )
+    ).toThrowErrorMatchingInlineSnapshot(
+      `"An Invalid Encrypted Saved Objects migration is trying to migrate across types (\\"known-type-1\\" => \\"known-type-2\\"), which isn't permitted"`
+    );
+  });
+
+  describe('migration of an existing type', () => {
+    it('uses the type in the current service for both input and migration types when none are specified', async () => {
+      const instantiateServiceWithLegacyType = jest.fn(() =>
+        encryptedSavedObjectsServiceMock.create()
+      );
+
+      const migrationCreator = getCreateMigration(
+        encryptionSavedObjectService,
+        instantiateServiceWithLegacyType
+      );
+      const noopMigration = migrationCreator<InputType, MigrationType>(
+        function (doc): doc is SavedObjectUnsanitizedDoc<InputType> {
+          return true;
+        },
+        (doc) => doc
+      );
+
+      const attributes = {
+        firstAttr: 'first_attr',
+      };
+
+      encryptionSavedObjectService.decryptAttributesSync.mockReturnValueOnce(attributes);
+      encryptionSavedObjectService.encryptAttributesSync.mockReturnValueOnce(attributes);
+
+      noopMigration(
+        {
+          id: '123',
+          type: 'known-type-1',
+          namespace: 'namespace',
+          attributes,
+        },
+        { log }
+      );
+
+      expect(encryptionSavedObjectService.decryptAttributesSync).toHaveBeenCalledWith(
+        {
+          id: '123',
+          type: 'known-type-1',
+          namespace: 'namespace',
+        },
+        attributes
+      );
+
+      expect(encryptionSavedObjectService.encryptAttributesSync).toHaveBeenCalledWith(
+        {
+          id: '123',
+          type: 'known-type-1',
+          namespace: 'namespace',
+        },
+        attributes
+      );
+    });
+  });
+
+  describe('migration of a single legacy type', () => {
+    it('uses the input type as the mirgation type when omitted', async () => {
+      const serviceWithLegacyType = encryptedSavedObjectsServiceMock.create();
+      const instantiateServiceWithLegacyType = jest.fn(() => serviceWithLegacyType);
+
+      const migrationCreator = getCreateMigration(
+        encryptionSavedObjectService,
+        instantiateServiceWithLegacyType
+      );
+      const noopMigration = migrationCreator<InputType, MigrationType>(
+        function (doc): doc is SavedObjectUnsanitizedDoc<InputType> {
+          return true;
+        },
+        (doc) => doc,
+        inputType
+      );
+
+      const attributes = {
+        firstAttr: 'first_attr',
+      };
+
+      serviceWithLegacyType.decryptAttributesSync.mockReturnValueOnce(attributes);
+      encryptionSavedObjectService.encryptAttributesSync.mockReturnValueOnce(attributes);
+
+      noopMigration(
+        {
+          id: '123',
+          type: 'known-type-1',
+          namespace: 'namespace',
+          attributes,
+        },
+        { log }
+      );
+
+      expect(serviceWithLegacyType.decryptAttributesSync).toHaveBeenCalledWith(
+        {
+          id: '123',
+          type: 'known-type-1',
+          namespace: 'namespace',
+        },
+        attributes
+      );
+
+      expect(encryptionSavedObjectService.encryptAttributesSync).toHaveBeenCalledWith(
+        {
+          id: '123',
+          type: 'known-type-1',
+          namespace: 'namespace',
+        },
+        attributes
+      );
+    });
+  });
+
+  describe('migration across two legacy types', () => {
+    const serviceWithInputLegacyType = encryptedSavedObjectsServiceMock.create();
+    const serviceWithMigrationLegacyType = encryptedSavedObjectsServiceMock.create();
+    const instantiateServiceWithLegacyType = jest.fn();
+
+    function createMigration() {
+      instantiateServiceWithLegacyType
+        .mockImplementationOnce(() => serviceWithInputLegacyType)
+        .mockImplementationOnce(() => serviceWithMigrationLegacyType);
+
+      const migrationCreator = getCreateMigration(
+        encryptionSavedObjectService,
+        instantiateServiceWithLegacyType
+      );
+      return migrationCreator<InputType, MigrationType>(
+        function (doc): doc is SavedObjectUnsanitizedDoc<InputType> {
+          // migrate doc that have the second field
+          return (
+            typeof (doc as SavedObjectUnsanitizedDoc<InputType>).attributes.nonEncryptedAttr ===
+            'string'
+          );
+        },
+        ({ attributes: { firstAttr, nonEncryptedAttr }, ...doc }) => ({
+          attributes: {
+            // modify an encrypted field
+            firstAttr: `~~${firstAttr}~~`,
+            // encrypt a non encrypted field if it's there
+            ...(nonEncryptedAttr ? { encryptedAttr: `${nonEncryptedAttr}` } : {}),
+          },
+          ...doc,
+        }),
+        inputType,
+        migrationType
+      );
+    }
+
+    it('doesnt decrypt saved objects that dont need to be migrated', async () => {
+      const migration = createMigration();
+      expect(instantiateServiceWithLegacyType).toHaveBeenCalledWith(inputType);
+      expect(instantiateServiceWithLegacyType).toHaveBeenCalledWith(migrationType);
+
+      expect(
+        migration(
+          {
+            id: '123',
+            type: 'known-type-1',
+            namespace: 'namespace',
+            attributes: {
+              firstAttr: '#####',
+            },
+          },
+          { log }
+        )
+      ).toMatchObject({
+        id: '123',
+        type: 'known-type-1',
+        namespace: 'namespace',
+        attributes: {
+          firstAttr: '#####',
+        },
+      });
+
+      expect(serviceWithInputLegacyType.decryptAttributesSync).not.toHaveBeenCalled();
+      expect(serviceWithMigrationLegacyType.encryptAttributesSync).not.toHaveBeenCalled();
+    });
+
+    it('decrypt, migrates and reencrypts saved objects that need to be migrated', async () => {
+      const migration = createMigration();
+      expect(instantiateServiceWithLegacyType).toHaveBeenCalledWith(inputType);
+      expect(instantiateServiceWithLegacyType).toHaveBeenCalledWith(migrationType);
+
+      serviceWithInputLegacyType.decryptAttributesSync.mockReturnValueOnce({
+        firstAttr: 'first_attr',
+        nonEncryptedAttr: 'non encrypted',
+      });
+
+      serviceWithMigrationLegacyType.encryptAttributesSync.mockReturnValueOnce({
+        firstAttr: `#####`,
+        encryptedAttr: `#####`,
+      });
+
+      expect(
+        migration(
+          {
+            id: '123',
+            type: 'known-type-1',
+            namespace: 'namespace',
+            attributes: {
+              firstAttr: '#####',
+              nonEncryptedAttr: 'non encrypted',
+            },
+          },
+          { log }
+        )
+      ).toMatchObject({
+        id: '123',
+        type: 'known-type-1',
+        namespace: 'namespace',
+        attributes: {
+          firstAttr: '#####',
+          encryptedAttr: `#####`,
+        },
+      });
+
+      expect(serviceWithInputLegacyType.decryptAttributesSync).toHaveBeenCalledWith(
+        {
+          id: '123',
+          type: 'known-type-1',
+          namespace: 'namespace',
+        },
+        {
+          firstAttr: '#####',
+          nonEncryptedAttr: 'non encrypted',
+        }
+      );
+
+      expect(serviceWithMigrationLegacyType.encryptAttributesSync).toHaveBeenCalledWith(
+        {
+          id: '123',
+          type: 'known-type-1',
+          namespace: 'namespace',
+        },
+        {
+          firstAttr: `~~first_attr~~`,
+          encryptedAttr: 'non encrypted',
+        }
+      );
+    });
+  });
+});
diff --git a/x-pack/plugins/encrypted_saved_objects/server/create_migration.ts b/x-pack/plugins/encrypted_saved_objects/server/create_migration.ts
new file mode 100644
index 000000000000..8e9dc1c13896
--- /dev/null
+++ b/x-pack/plugins/encrypted_saved_objects/server/create_migration.ts
@@ -0,0 +1,91 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  SavedObjectUnsanitizedDoc,
+  SavedObjectMigrationFn,
+  SavedObjectMigrationContext,
+} from 'src/core/server';
+import { EncryptedSavedObjectTypeRegistration, EncryptedSavedObjectsService } from './crypto';
+
+type SavedObjectOptionalMigrationFn<InputAttributes, MigratedAttributes> = (
+  doc: SavedObjectUnsanitizedDoc<InputAttributes> | SavedObjectUnsanitizedDoc<MigratedAttributes>,
+  context: SavedObjectMigrationContext
+) => SavedObjectUnsanitizedDoc<MigratedAttributes>;
+
+type IsMigrationNeededPredicate<InputAttributes, MigratedAttributes> = (
+  encryptedDoc:
+    | SavedObjectUnsanitizedDoc<InputAttributes>
+    | SavedObjectUnsanitizedDoc<MigratedAttributes>
+) => encryptedDoc is SavedObjectUnsanitizedDoc<InputAttributes>;
+
+export type CreateEncryptedSavedObjectsMigrationFn = <
+  InputAttributes = unknown,
+  MigratedAttributes = InputAttributes
+>(
+  isMigrationNeededPredicate: IsMigrationNeededPredicate<InputAttributes, MigratedAttributes>,
+  migration: SavedObjectMigrationFn<InputAttributes, MigratedAttributes>,
+  inputType?: EncryptedSavedObjectTypeRegistration,
+  migratedType?: EncryptedSavedObjectTypeRegistration
+) => SavedObjectOptionalMigrationFn<InputAttributes, MigratedAttributes>;
+
+export const getCreateMigration = (
+  encryptedSavedObjectsService: Readonly<EncryptedSavedObjectsService>,
+  instantiateServiceWithLegacyType: (
+    typeRegistration: EncryptedSavedObjectTypeRegistration
+  ) => EncryptedSavedObjectsService
+): CreateEncryptedSavedObjectsMigrationFn => (
+  isMigrationNeededPredicate,
+  migration,
+  inputType,
+  migratedType
+) => {
+  if (inputType && migratedType && inputType.type !== migratedType.type) {
+    throw new Error(
+      `An Invalid Encrypted Saved Objects migration is trying to migrate across types ("${inputType.type}" => "${migratedType.type}"), which isn't permitted`
+    );
+  }
+
+  const inputService = inputType
+    ? instantiateServiceWithLegacyType(inputType)
+    : encryptedSavedObjectsService;
+
+  const migratedService = migratedType
+    ? instantiateServiceWithLegacyType(migratedType)
+    : encryptedSavedObjectsService;
+
+  return (encryptedDoc, context) => {
+    if (!isMigrationNeededPredicate(encryptedDoc)) {
+      return encryptedDoc;
+    }
+
+    const descriptor = {
+      id: encryptedDoc.id!,
+      type: encryptedDoc.type,
+      namespace: encryptedDoc.namespace,
+    };
+
+    // decrypt the attributes using the input type definition
+    // then migrate the document
+    // then encrypt the attributes using the migration type definition
+    return mapAttributes(
+      migration(
+        mapAttributes(encryptedDoc, (inputAttributes) =>
+          inputService.decryptAttributesSync<any>(descriptor, inputAttributes)
+        ),
+        context
+      ),
+      (migratedAttributes) =>
+        migratedService.encryptAttributesSync<any>(descriptor, migratedAttributes)
+    );
+  };
+};
+
+function mapAttributes<T>(obj: SavedObjectUnsanitizedDoc<T>, mapper: (attributes: T) => T) {
+  return Object.assign(obj, {
+    attributes: mapper(obj.attributes),
+  });
+}
diff --git a/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.mocks.ts b/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.mocks.ts
new file mode 100644
index 000000000000..c692d8698771
--- /dev/null
+++ b/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.mocks.ts
@@ -0,0 +1,84 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  EncryptedSavedObjectsService,
+  EncryptedSavedObjectTypeRegistration,
+  SavedObjectDescriptor,
+} from './encrypted_saved_objects_service';
+
+function createEncryptedSavedObjectsServiceMock() {
+  return ({
+    isRegistered: jest.fn(),
+    stripOrDecryptAttributes: jest.fn(),
+    encryptAttributes: jest.fn(),
+    decryptAttributes: jest.fn(),
+    encryptAttributesSync: jest.fn(),
+    decryptAttributesSync: jest.fn(),
+  } as unknown) as jest.Mocked<EncryptedSavedObjectsService>;
+}
+
+export const encryptedSavedObjectsServiceMock = {
+  create: createEncryptedSavedObjectsServiceMock,
+  createWithTypes(registrations: EncryptedSavedObjectTypeRegistration[] = []) {
+    const mock = createEncryptedSavedObjectsServiceMock();
+
+    function processAttributes<T extends Record<string, any>>(
+      descriptor: Pick<SavedObjectDescriptor, 'type'>,
+      attrs: T,
+      action: (attrs: T, attrName: string, shouldExpose: boolean) => void
+    ) {
+      const registration = registrations.find((r) => r.type === descriptor.type);
+      if (!registration) {
+        return attrs;
+      }
+
+      const clonedAttrs = { ...attrs };
+      for (const attr of registration.attributesToEncrypt) {
+        const [attrName, shouldExpose] =
+          typeof attr === 'string'
+            ? [attr, false]
+            : [attr.key, attr.dangerouslyExposeValue === true];
+        if (attrName in clonedAttrs) {
+          action(clonedAttrs, attrName, shouldExpose);
+        }
+      }
+      return clonedAttrs;
+    }
+
+    mock.isRegistered.mockImplementation(
+      (type) => registrations.findIndex((r) => r.type === type) >= 0
+    );
+    mock.encryptAttributes.mockImplementation(async (descriptor, attrs) =>
+      processAttributes(
+        descriptor,
+        attrs,
+        (clonedAttrs, attrName) => (clonedAttrs[attrName] = `*${clonedAttrs[attrName]}*`)
+      )
+    );
+    mock.decryptAttributes.mockImplementation(async (descriptor, attrs) =>
+      processAttributes(
+        descriptor,
+        attrs,
+        (clonedAttrs, attrName) =>
+          (clonedAttrs[attrName] = (clonedAttrs[attrName] as string).slice(1, -1))
+      )
+    );
+    mock.stripOrDecryptAttributes.mockImplementation((descriptor, attrs) =>
+      Promise.resolve({
+        attributes: processAttributes(descriptor, attrs, (clonedAttrs, attrName, shouldExpose) => {
+          if (shouldExpose) {
+            clonedAttrs[attrName] = (clonedAttrs[attrName] as string).slice(1, -1);
+          } else {
+            delete clonedAttrs[attrName];
+          }
+        }),
+      })
+    );
+
+    return mock;
+  },
+};
diff --git a/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.test.ts b/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.test.ts
index db7c96f83dff..42d2e2ffd151 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.test.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.test.ts
@@ -4,10 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { mockAuthenticatedUser } from '../../../security/common/model/authenticated_user.mock';
-
-jest.mock('@elastic/node-crypto', () => jest.fn());
+import nodeCrypto, { Crypto } from '@elastic/node-crypto';
 
+import { mockAuthenticatedUser } from '../../../security/common/model/authenticated_user.mock';
 import { EncryptedSavedObjectsAuditLogger } from '../audit';
 import { EncryptedSavedObjectsService } from './encrypted_saved_objects_service';
 import { EncryptionError } from './encryption_error';
@@ -15,19 +14,37 @@ import { EncryptionError } from './encryption_error';
 import { loggingSystemMock } from 'src/core/server/mocks';
 import { encryptedSavedObjectsAuditLoggerMock } from '../audit/index.mock';
 
+const crypto = nodeCrypto({ encryptionKey: 'encryption-key-abc' });
+
+const mockNodeCrypto: jest.Mocked<Crypto> = {
+  encrypt: jest.fn(),
+  decrypt: jest.fn(),
+  encryptSync: jest.fn(),
+  decryptSync: jest.fn(),
+};
+
 let service: EncryptedSavedObjectsService;
 let mockAuditLogger: jest.Mocked<EncryptedSavedObjectsAuditLogger>;
-beforeEach(() => {
-  mockAuditLogger = encryptedSavedObjectsAuditLoggerMock.create();
 
+beforeEach(() => {
   // Call actual `@elastic/node-crypto` by default, but allow to override implementation in tests.
-  jest.requireMock('@elastic/node-crypto').mockImplementation((...args: any[]) => {
-    const { default: nodeCrypto } = jest.requireActual('@elastic/node-crypto');
-    return nodeCrypto(...args);
-  });
+  mockNodeCrypto.encrypt.mockImplementation(async (input: any, aad?: string) =>
+    crypto.encrypt(input, aad)
+  );
+  mockNodeCrypto.decrypt.mockImplementation(
+    async (encryptedOutput: string | Buffer, aad?: string) => crypto.decrypt(encryptedOutput, aad)
+  );
+  mockNodeCrypto.encryptSync.mockImplementation((input: any, aad?: string) =>
+    crypto.encryptSync(input, aad)
+  );
+  mockNodeCrypto.decryptSync.mockImplementation((encryptedOutput: string | Buffer, aad?: string) =>
+    crypto.decryptSync(encryptedOutput, aad)
+  );
+
+  mockAuditLogger = encryptedSavedObjectsAuditLoggerMock.create();
 
   service = new EncryptedSavedObjectsService(
-    'encryption-key-abc',
+    mockNodeCrypto,
     loggingSystemMock.create().get(),
     mockAuditLogger
   );
@@ -35,12 +52,6 @@ beforeEach(() => {
 
 afterEach(() => jest.resetAllMocks());
 
-it('correctly initializes crypto', () => {
-  const mockNodeCrypto = jest.requireMock('@elastic/node-crypto');
-  expect(mockNodeCrypto).toHaveBeenCalledTimes(1);
-  expect(mockNodeCrypto).toHaveBeenCalledWith({ encryptionKey: 'encryption-key-abc' });
-});
-
 describe('#registerType', () => {
   it('throws if `attributesToEncrypt` is empty', () => {
     expect(() =>
@@ -213,15 +224,13 @@ describe('#stripOrDecryptAttributes', () => {
 });
 
 describe('#encryptAttributes', () => {
-  let mockEncrypt: jest.Mock;
   beforeEach(() => {
-    mockEncrypt = jest
-      .fn()
-      .mockImplementation(async (valueToEncrypt, aad) => `|${valueToEncrypt}|${aad}|`);
-    jest.requireMock('@elastic/node-crypto').mockReturnValue({ encrypt: mockEncrypt });
+    mockNodeCrypto.encrypt.mockImplementation(
+      async (valueToEncrypt, aad) => `|${valueToEncrypt}|${aad}|`
+    );
 
     service = new EncryptedSavedObjectsService(
-      'encryption-key-abc',
+      mockNodeCrypto,
       loggingSystemMock.create().get(),
       mockAuditLogger
     );
@@ -399,7 +408,7 @@ describe('#encryptAttributes', () => {
       attributesToEncrypt: new Set(['attrOne', 'attrThree']),
     });
 
-    mockEncrypt
+    mockNodeCrypto.encrypt
       .mockResolvedValueOnce('Successfully encrypted attrOne')
       .mockRejectedValueOnce(new Error('Something went wrong with attrThree...'));
 
@@ -915,7 +924,7 @@ describe('#decryptAttributes', () => {
 
     it('fails if encrypted with another encryption key', async () => {
       service = new EncryptedSavedObjectsService(
-        'encryption-key-abc*',
+        nodeCrypto({ encryptionKey: 'encryption-key-abc*' }),
         loggingSystemMock.create().get(),
         mockAuditLogger
       );
@@ -941,3 +950,532 @@ describe('#decryptAttributes', () => {
     });
   });
 });
+
+describe('#encryptAttributesSync', () => {
+  beforeEach(() => {
+    mockNodeCrypto.encryptSync.mockImplementation(
+      (valueToEncrypt, aad) => `|${valueToEncrypt}|${aad}|`
+    );
+
+    service = new EncryptedSavedObjectsService(
+      mockNodeCrypto,
+      loggingSystemMock.create().get(),
+      mockAuditLogger
+    );
+  });
+
+  it('does not encrypt attributes that are not supposed to be encrypted', () => {
+    const attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three' };
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrFour']),
+    });
+    expect(
+      service.encryptAttributesSync({ type: 'known-type-1', id: 'object-id' }, attributes)
+    ).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: 'three',
+    });
+  });
+
+  it('encrypts only attributes that are supposed to be encrypted', () => {
+    const attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three', attrFour: null };
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrOne', 'attrThree', 'attrFour']),
+    });
+
+    expect(
+      service.encryptAttributesSync({ type: 'known-type-1', id: 'object-id' }, attributes)
+    ).toEqual({
+      attrOne: '|one|["known-type-1","object-id",{"attrTwo":"two"}]|',
+      attrTwo: 'two',
+      attrThree: '|three|["known-type-1","object-id",{"attrTwo":"two"}]|',
+      attrFour: null,
+    });
+  });
+
+  it('encrypts only attributes that are supposed to be encrypted even if not all provided', () => {
+    const attributes = { attrTwo: 'two', attrThree: 'three' };
+
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrOne', 'attrThree']),
+    });
+
+    expect(
+      service.encryptAttributesSync({ type: 'known-type-1', id: 'object-id' }, attributes)
+    ).toEqual({
+      attrTwo: 'two',
+      attrThree: '|three|["known-type-1","object-id",{"attrTwo":"two"}]|',
+    });
+  });
+
+  it('includes `namespace` into AAD if provided', () => {
+    const attributes = { attrTwo: 'two', attrThree: 'three' };
+
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrOne', 'attrThree']),
+    });
+
+    expect(
+      service.encryptAttributesSync(
+        { type: 'known-type-1', id: 'object-id', namespace: 'object-ns' },
+        attributes
+      )
+    ).toEqual({
+      attrTwo: 'two',
+      attrThree: '|three|["object-ns","known-type-1","object-id",{"attrTwo":"two"}]|',
+    });
+  });
+
+  it('does not include specified attributes to AAD', () => {
+    const knownType1attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three' };
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrThree']),
+    });
+
+    const knownType2attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three' };
+    service.registerType({
+      type: 'known-type-2',
+      attributesToEncrypt: new Set(['attrThree']),
+      attributesToExcludeFromAAD: new Set(['attrTwo']),
+    });
+
+    expect(
+      service.encryptAttributesSync(
+        { type: 'known-type-1', id: 'object-id-1' },
+        knownType1attributes
+      )
+    ).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: '|three|["known-type-1","object-id-1",{"attrOne":"one","attrTwo":"two"}]|',
+    });
+    expect(
+      service.encryptAttributesSync(
+        { type: 'known-type-2', id: 'object-id-2' },
+        knownType2attributes
+      )
+    ).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: '|three|["known-type-2","object-id-2",{"attrOne":"one"}]|',
+    });
+  });
+
+  it('encrypts even if no attributes are included into AAD', () => {
+    const attributes = { attrOne: 'one', attrThree: 'three' };
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrOne', 'attrThree']),
+    });
+
+    expect(
+      service.encryptAttributesSync({ type: 'known-type-1', id: 'object-id-1' }, attributes)
+    ).toEqual({
+      attrOne: '|one|["known-type-1","object-id-1",{}]|',
+      attrThree: '|three|["known-type-1","object-id-1",{}]|',
+    });
+  });
+
+  it('fails if encryption of any attribute fails', () => {
+    const attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three' };
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrOne', 'attrThree']),
+    });
+
+    mockNodeCrypto.encryptSync
+      .mockImplementationOnce(() => 'Successfully encrypted attrOne')
+      .mockImplementationOnce(() => {
+        throw new Error('Something went wrong with attrThree...');
+      });
+
+    expect(() =>
+      service.encryptAttributesSync({ type: 'known-type-1', id: 'object-id' }, attributes)
+    ).toThrowError(EncryptionError);
+
+    expect(attributes).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: 'three',
+    });
+  });
+});
+
+describe('#decryptAttributesSync', () => {
+  it('does not decrypt attributes that are not supposed to be decrypted', () => {
+    const attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three' };
+
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrFour']),
+    });
+
+    expect(
+      service.decryptAttributesSync({ type: 'known-type-1', id: 'object-id' }, attributes)
+    ).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: 'three',
+    });
+  });
+
+  it('decrypts only attributes that are supposed to be decrypted', () => {
+    const attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three', attrFour: null };
+
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrOne', 'attrThree', 'attrFour']),
+    });
+
+    const encryptedAttributes = service.encryptAttributesSync(
+      { type: 'known-type-1', id: 'object-id' },
+      attributes
+    );
+    expect(encryptedAttributes).toEqual({
+      attrOne: expect.not.stringMatching(/^one$/),
+      attrTwo: 'two',
+      attrThree: expect.not.stringMatching(/^three$/),
+      attrFour: null,
+    });
+
+    expect(
+      service.decryptAttributesSync({ type: 'known-type-1', id: 'object-id' }, encryptedAttributes)
+    ).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: 'three',
+      attrFour: null,
+    });
+  });
+
+  it('decrypts only attributes that are supposed to be encrypted even if not all provided', () => {
+    const attributes = { attrTwo: 'two', attrThree: 'three' };
+
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrOne', 'attrThree']),
+    });
+
+    const encryptedAttributes = service.encryptAttributesSync(
+      { type: 'known-type-1', id: 'object-id' },
+      attributes
+    );
+    expect(encryptedAttributes).toEqual({
+      attrTwo: 'two',
+      attrThree: expect.not.stringMatching(/^three$/),
+    });
+
+    expect(
+      service.decryptAttributesSync({ type: 'known-type-1', id: 'object-id' }, encryptedAttributes)
+    ).toEqual({
+      attrTwo: 'two',
+      attrThree: 'three',
+    });
+  });
+
+  it('decrypts if all attributes that contribute to AAD are present', () => {
+    const attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three' };
+
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrThree']),
+      attributesToExcludeFromAAD: new Set(['attrOne']),
+    });
+
+    const encryptedAttributes = service.encryptAttributesSync(
+      { type: 'known-type-1', id: 'object-id' },
+      attributes
+    );
+    expect(encryptedAttributes).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: expect.not.stringMatching(/^three$/),
+    });
+
+    const attributesWithoutAttr = { attrTwo: 'two', attrThree: encryptedAttributes.attrThree };
+
+    expect(
+      service.decryptAttributesSync(
+        { type: 'known-type-1', id: 'object-id' },
+        attributesWithoutAttr
+      )
+    ).toEqual({
+      attrTwo: 'two',
+      attrThree: 'three',
+    });
+  });
+
+  it('decrypts even if attributes in AAD are defined in a different order', () => {
+    const attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three' };
+
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrThree']),
+    });
+
+    const encryptedAttributes = service.encryptAttributesSync(
+      { type: 'known-type-1', id: 'object-id' },
+      attributes
+    );
+    expect(encryptedAttributes).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: expect.not.stringMatching(/^three$/),
+    });
+
+    const attributesInDifferentOrder = {
+      attrThree: encryptedAttributes.attrThree,
+      attrTwo: 'two',
+      attrOne: 'one',
+    };
+
+    expect(
+      service.decryptAttributesSync(
+        { type: 'known-type-1', id: 'object-id' },
+        attributesInDifferentOrder
+      )
+    ).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: 'three',
+    });
+  });
+
+  it('decrypts if correct namespace is provided', () => {
+    const attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three' };
+
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrThree']),
+    });
+
+    const encryptedAttributes = service.encryptAttributesSync(
+      { type: 'known-type-1', id: 'object-id', namespace: 'object-ns' },
+      attributes
+    );
+    expect(encryptedAttributes).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: expect.not.stringMatching(/^three$/),
+    });
+
+    expect(
+      service.decryptAttributesSync(
+        { type: 'known-type-1', id: 'object-id', namespace: 'object-ns' },
+        encryptedAttributes
+      )
+    ).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: 'three',
+    });
+  });
+
+  it('decrypts even if no attributes are included into AAD', () => {
+    const attributes = { attrOne: 'one', attrThree: 'three' };
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrOne', 'attrThree']),
+    });
+
+    const encryptedAttributes = service.encryptAttributesSync(
+      { type: 'known-type-1', id: 'object-id' },
+      attributes
+    );
+    expect(encryptedAttributes).toEqual({
+      attrOne: expect.not.stringMatching(/^one$/),
+      attrThree: expect.not.stringMatching(/^three$/),
+    });
+
+    expect(
+      service.decryptAttributesSync({ type: 'known-type-1', id: 'object-id' }, encryptedAttributes)
+    ).toEqual({
+      attrOne: 'one',
+      attrThree: 'three',
+    });
+  });
+
+  it('decrypts non-string attributes and restores their original type', () => {
+    const attributes = {
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: 'three',
+      attrFour: null,
+      attrFive: { nested: 'five' },
+      attrSix: 6,
+    };
+
+    service.registerType({
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrOne', 'attrThree', 'attrFour', 'attrFive', 'attrSix']),
+    });
+
+    const encryptedAttributes = service.encryptAttributesSync(
+      { type: 'known-type-1', id: 'object-id' },
+      attributes
+    );
+    expect(encryptedAttributes).toEqual({
+      attrOne: expect.not.stringMatching(/^one$/),
+      attrTwo: 'two',
+      attrThree: expect.not.stringMatching(/^three$/),
+      attrFour: null,
+      attrFive: expect.any(String),
+      attrSix: expect.any(String),
+    });
+
+    expect(
+      service.decryptAttributesSync({ type: 'known-type-1', id: 'object-id' }, encryptedAttributes)
+    ).toEqual({
+      attrOne: 'one',
+      attrTwo: 'two',
+      attrThree: 'three',
+      attrFour: null,
+      attrFive: { nested: 'five' },
+      attrSix: 6,
+    });
+  });
+
+  describe('decryption failures', () => {
+    let encryptedAttributes: Record<string, string>;
+
+    const type1 = {
+      type: 'known-type-1',
+      attributesToEncrypt: new Set(['attrThree']),
+    };
+
+    const type2 = {
+      type: 'known-type-2',
+      attributesToEncrypt: new Set(['attrThree']),
+    };
+
+    beforeEach(() => {
+      service.registerType(type1);
+      service.registerType(type2);
+
+      const attributes = { attrOne: 'one', attrTwo: 'two', attrThree: 'three' };
+
+      encryptedAttributes = service.encryptAttributesSync(
+        { type: 'known-type-1', id: 'object-id' },
+        attributes
+      );
+    });
+
+    it('fails to decrypt if not all attributes that contribute to AAD are present', () => {
+      const attributesWithoutAttr = { attrTwo: 'two', attrThree: encryptedAttributes.attrThree };
+      expect(() =>
+        service.decryptAttributesSync(
+          { type: 'known-type-1', id: 'object-id' },
+          attributesWithoutAttr
+        )
+      ).toThrowError(EncryptionError);
+    });
+
+    it('fails to decrypt if ID does not match', () => {
+      expect(() =>
+        service.decryptAttributesSync(
+          { type: 'known-type-1', id: 'object-id*' },
+          encryptedAttributes
+        )
+      ).toThrowError(EncryptionError);
+    });
+
+    it('fails to decrypt if type does not match', () => {
+      expect(() =>
+        service.decryptAttributesSync(
+          { type: 'known-type-2', id: 'object-id' },
+          encryptedAttributes
+        )
+      ).toThrowError(EncryptionError);
+    });
+
+    it('fails to decrypt if namespace does not match', () => {
+      encryptedAttributes = service.encryptAttributesSync(
+        { type: 'known-type-1', id: 'object-id', namespace: 'object-ns' },
+        { attrOne: 'one', attrTwo: 'two', attrThree: 'three' }
+      );
+
+      expect(() =>
+        service.decryptAttributesSync(
+          { type: 'known-type-1', id: 'object-id', namespace: 'object-NS' },
+          encryptedAttributes
+        )
+      ).toThrowError(EncryptionError);
+    });
+
+    it('fails to decrypt if namespace is expected, but is not provided', () => {
+      encryptedAttributes = service.encryptAttributesSync(
+        { type: 'known-type-1', id: 'object-id', namespace: 'object-ns' },
+        { attrOne: 'one', attrTwo: 'two', attrThree: 'three' }
+      );
+
+      expect(() =>
+        service.decryptAttributesSync(
+          { type: 'known-type-1', id: 'object-id' },
+          encryptedAttributes
+        )
+      ).toThrowError(EncryptionError);
+    });
+
+    it('fails to decrypt if encrypted attribute is defined, but not a string', () => {
+      expect(() =>
+        service.decryptAttributesSync(
+          { type: 'known-type-1', id: 'object-id' },
+          {
+            ...encryptedAttributes,
+            attrThree: 2,
+          }
+        )
+      ).toThrowError('Encrypted "attrThree" attribute should be a string, but found number');
+    });
+
+    it('fails to decrypt if encrypted attribute is not correct', () => {
+      expect(() =>
+        service.decryptAttributesSync(
+          { type: 'known-type-1', id: 'object-id' },
+          {
+            ...encryptedAttributes,
+            attrThree: 'some-unknown-string',
+          }
+        )
+      ).toThrowError(EncryptionError);
+    });
+
+    it('fails to decrypt if the AAD attribute has changed', () => {
+      expect(() =>
+        service.decryptAttributesSync(
+          { type: 'known-type-1', id: 'object-id' },
+          {
+            ...encryptedAttributes,
+            attrOne: 'oNe',
+          }
+        )
+      ).toThrowError(EncryptionError);
+    });
+
+    it('fails if encrypted with another encryption key', () => {
+      service = new EncryptedSavedObjectsService(
+        nodeCrypto({ encryptionKey: 'encryption-key-abc*' }),
+        loggingSystemMock.create().get(),
+        mockAuditLogger
+      );
+
+      service.registerType({
+        type: 'known-type-1',
+        attributesToEncrypt: new Set(['attrThree']),
+      });
+
+      expect(() =>
+        service.decryptAttributesSync(
+          { type: 'known-type-1', id: 'object-id' },
+          encryptedAttributes
+        )
+      ).toThrowError(EncryptionError);
+    });
+  });
+});
diff --git a/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.ts b/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.ts
index 5cf3e1c2d65a..99361107047c 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_objects_service.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import nodeCrypto, { Crypto } from '@elastic/node-crypto';
-import stringify from 'json-stable-stringify';
+import { Crypto, EncryptOutput } from '@elastic/node-crypto';
 import typeDetect from 'type-detect';
+import stringify from 'json-stable-stringify';
 import { Logger } from 'src/core/server';
 import { AuthenticatedUser } from '../../../security/common/model';
 import { EncryptedSavedObjectsAuditLogger } from '../audit';
@@ -70,8 +70,6 @@ export function descriptorToArray(descriptor: SavedObjectDescriptor) {
  * attributes.
  */
 export class EncryptedSavedObjectsService {
-  private readonly crypto: Readonly<Crypto>;
-
   /**
    * Map of all registered saved object types where the `key` is saved object type and the `value`
    * is the definition (names of attributes that need to be encrypted etc.).
@@ -82,17 +80,15 @@ export class EncryptedSavedObjectsService {
   > = new Map();
 
   /**
-   * @param encryptionKey The key used to encrypt and decrypt saved objects attributes.
+   * @param crypto nodeCrypto instance.
    * @param logger Ordinary logger instance.
    * @param audit Audit logger instance.
    */
   constructor(
-    encryptionKey: string,
+    private readonly crypto: Readonly<Crypto>,
     private readonly logger: Logger,
     private readonly audit: EncryptedSavedObjectsAuditLogger
-  ) {
-    this.crypto = nodeCrypto({ encryptionKey });
-  }
+  ) {}
 
   /**
    * Registers saved object type as the one that contains attributes that should be encrypted.
@@ -193,20 +189,11 @@ export class EncryptedSavedObjectsService {
     return { attributes: clonedAttributes as T, error: decryptionError };
   }
 
-  /**
-   * Takes saved object attributes for the specified type and encrypts all of them that are supposed
-   * to be encrypted if any and returns that __NEW__ attributes dictionary back. If none of the
-   * attributes were encrypted original attributes dictionary is returned.
-   * @param descriptor Descriptor of the saved object to encrypt attributes for.
-   * @param attributes Dictionary of __ALL__ saved object attributes.
-   * @param [params] Additional parameters.
-   * @throws Will throw if encryption fails for whatever reason.
-   */
-  public async encryptAttributes<T extends Record<string, unknown>>(
+  private *attributesToEncryptIterator<T extends Record<string, unknown>>(
     descriptor: SavedObjectDescriptor,
     attributes: T,
     params?: CommonParameters
-  ): Promise<T> {
+  ): Iterator<[unknown, string], T, string> {
     const typeDefinition = this.typeDefinitions.get(descriptor.type);
     if (typeDefinition === undefined) {
       return attributes;
@@ -218,10 +205,7 @@ export class EncryptedSavedObjectsService {
       const attributeValue = attributes[attributeName];
       if (attributeValue != null) {
         try {
-          encryptedAttributes[attributeName] = await this.crypto.encrypt(
-            attributeValue,
-            encryptionAAD
-          );
+          encryptedAttributes[attributeName] = (yield [attributeValue, encryptionAAD])!;
         } catch (err) {
           this.logger.error(
             `Failed to encrypt "${attributeName}" attribute: ${err.message || err}`
@@ -263,6 +247,64 @@ export class EncryptedSavedObjectsService {
     };
   }
 
+  /**
+   * Takes saved object attributes for the specified type and encrypts all of them that are supposed
+   * to be encrypted if any and returns that __NEW__ attributes dictionary back. If none of the
+   * attributes were encrypted original attributes dictionary is returned.
+   * @param descriptor Descriptor of the saved object to encrypt attributes for.
+   * @param attributes Dictionary of __ALL__ saved object attributes.
+   * @param [params] Additional parameters.
+   * @throws Will throw if encryption fails for whatever reason.
+   */
+  public async encryptAttributes<T extends Record<string, unknown>>(
+    descriptor: SavedObjectDescriptor,
+    attributes: T,
+    params?: CommonParameters
+  ): Promise<T> {
+    const iterator = this.attributesToEncryptIterator<T>(descriptor, attributes, params);
+
+    let iteratorResult = iterator.next();
+    while (!iteratorResult.done) {
+      const [attributeValue, encryptionAAD] = iteratorResult.value;
+      try {
+        iteratorResult = iterator.next(await this.crypto.encrypt(attributeValue, encryptionAAD));
+      } catch (err) {
+        iterator.throw!(err);
+      }
+    }
+
+    return iteratorResult.value;
+  }
+
+  /**
+   * Takes saved object attributes for the specified type and encrypts all of them that are supposed
+   * to be encrypted if any and returns that __NEW__ attributes dictionary back. If none of the
+   * attributes were encrypted original attributes dictionary is returned.
+   * @param descriptor Descriptor of the saved object to encrypt attributes for.
+   * @param attributes Dictionary of __ALL__ saved object attributes.
+   * @param [params] Additional parameters.
+   * @throws Will throw if encryption fails for whatever reason.
+   */
+  public encryptAttributesSync<T extends Record<string, unknown>>(
+    descriptor: SavedObjectDescriptor,
+    attributes: T,
+    params?: CommonParameters
+  ): T {
+    const iterator = this.attributesToEncryptIterator<T>(descriptor, attributes, params);
+
+    let iteratorResult = iterator.next();
+    while (!iteratorResult.done) {
+      const [attributeValue, encryptionAAD] = iteratorResult.value;
+      try {
+        iteratorResult = iterator.next(this.crypto.encryptSync(attributeValue, encryptionAAD));
+      } catch (err) {
+        iterator.throw!(err);
+      }
+    }
+
+    return iteratorResult.value;
+  }
+
   /**
    * Takes saved object attributes for the specified type and decrypts all of them that are supposed
    * to be encrypted if any and returns that __NEW__ attributes dictionary back. If none of the
@@ -278,13 +320,65 @@ export class EncryptedSavedObjectsService {
     attributes: T,
     params?: CommonParameters
   ): Promise<T> {
+    const iterator = this.attributesToDecryptIterator<T>(descriptor, attributes, params);
+
+    let iteratorResult = iterator.next();
+    while (!iteratorResult.done) {
+      const [attributeValue, encryptionAAD] = iteratorResult.value;
+      try {
+        iteratorResult = iterator.next(
+          (await this.crypto.decrypt(attributeValue, encryptionAAD)) as string
+        );
+      } catch (err) {
+        iterator.throw!(err);
+      }
+    }
+
+    return iteratorResult.value;
+  }
+
+  /**
+   * Takes saved object attributes for the specified type and decrypts all of them that are supposed
+   * to be encrypted if any and returns that __NEW__ attributes dictionary back. If none of the
+   * attributes were decrypted original attributes dictionary is returned.
+   * @param descriptor Descriptor of the saved object to decrypt attributes for.
+   * @param attributes Dictionary of __ALL__ saved object attributes.
+   * @param [params] Additional parameters.
+   * @throws Will throw if decryption fails for whatever reason.
+   * @throws Will throw if any of the attributes to decrypt is not a string.
+   */
+  public decryptAttributesSync<T extends Record<string, unknown>>(
+    descriptor: SavedObjectDescriptor,
+    attributes: T,
+    params?: CommonParameters
+  ): T {
+    const iterator = this.attributesToDecryptIterator<T>(descriptor, attributes, params);
+
+    let iteratorResult = iterator.next();
+    while (!iteratorResult.done) {
+      const [attributeValue, encryptionAAD] = iteratorResult.value;
+      try {
+        iteratorResult = iterator.next(this.crypto.decryptSync(attributeValue, encryptionAAD));
+      } catch (err) {
+        iterator.throw!(err);
+      }
+    }
+
+    return iteratorResult.value;
+  }
+
+  private *attributesToDecryptIterator<T extends Record<string, unknown>>(
+    descriptor: SavedObjectDescriptor,
+    attributes: T,
+    params?: CommonParameters
+  ): Iterator<[string, string], T, EncryptOutput> {
     const typeDefinition = this.typeDefinitions.get(descriptor.type);
     if (typeDefinition === undefined) {
       return attributes;
     }
 
     const encryptionAAD = this.getAAD(typeDefinition, descriptor, attributes);
-    const decryptedAttributes: Record<string, string> = {};
+    const decryptedAttributes: Record<string, EncryptOutput> = {};
     for (const attributeName of typeDefinition.attributesToEncrypt) {
       const attributeValue = attributes[attributeName];
       if (attributeValue == null) {
@@ -301,10 +395,7 @@ export class EncryptedSavedObjectsService {
       }
 
       try {
-        decryptedAttributes[attributeName] = (await this.crypto.decrypt(
-          attributeValue,
-          encryptionAAD
-        )) as string;
+        decryptedAttributes[attributeName] = (yield [attributeValue, encryptionAAD])!;
       } catch (err) {
         this.logger.error(`Failed to decrypt "${attributeName}" attribute: ${err.message || err}`);
         this.audit.decryptAttributeFailure(attributeName, descriptor, params?.user);
diff --git a/x-pack/plugins/encrypted_saved_objects/server/crypto/index.mock.ts b/x-pack/plugins/encrypted_saved_objects/server/crypto/index.mock.ts
index 11a0cd6f3330..3e4983deca62 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/crypto/index.mock.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/crypto/index.mock.ts
@@ -4,71 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  EncryptedSavedObjectsService,
-  EncryptedSavedObjectTypeRegistration,
-  SavedObjectDescriptor,
-} from '.';
-
-export const encryptedSavedObjectsServiceMock = {
-  create(registrations: EncryptedSavedObjectTypeRegistration[] = []) {
-    const mock: jest.Mocked<EncryptedSavedObjectsService> = new (jest.requireMock(
-      './encrypted_saved_objects_service'
-    ).EncryptedSavedObjectsService)();
-
-    function processAttributes<T extends Record<string, any>>(
-      descriptor: Pick<SavedObjectDescriptor, 'type'>,
-      attrs: T,
-      action: (attrs: T, attrName: string, shouldExpose: boolean) => void
-    ) {
-      const registration = registrations.find((r) => r.type === descriptor.type);
-      if (!registration) {
-        return attrs;
-      }
-
-      const clonedAttrs = { ...attrs };
-      for (const attr of registration.attributesToEncrypt) {
-        const [attrName, shouldExpose] =
-          typeof attr === 'string'
-            ? [attr, false]
-            : [attr.key, attr.dangerouslyExposeValue === true];
-        if (attrName in clonedAttrs) {
-          action(clonedAttrs, attrName, shouldExpose);
-        }
-      }
-      return clonedAttrs;
-    }
-
-    mock.isRegistered.mockImplementation(
-      (type) => registrations.findIndex((r) => r.type === type) >= 0
-    );
-    mock.encryptAttributes.mockImplementation(async (descriptor, attrs) =>
-      processAttributes(
-        descriptor,
-        attrs,
-        (clonedAttrs, attrName) => (clonedAttrs[attrName] = `*${clonedAttrs[attrName]}*`)
-      )
-    );
-    mock.decryptAttributes.mockImplementation(async (descriptor, attrs) =>
-      processAttributes(
-        descriptor,
-        attrs,
-        (clonedAttrs, attrName) =>
-          (clonedAttrs[attrName] = (clonedAttrs[attrName] as string).slice(1, -1))
-      )
-    );
-    mock.stripOrDecryptAttributes.mockImplementation((descriptor, attrs) =>
-      Promise.resolve({
-        attributes: processAttributes(descriptor, attrs, (clonedAttrs, attrName, shouldExpose) => {
-          if (shouldExpose) {
-            clonedAttrs[attrName] = (clonedAttrs[attrName] as string).slice(1, -1);
-          } else {
-            delete clonedAttrs[attrName];
-          }
-        }),
-      })
-    );
-
-    return mock;
-  },
-};
+export { encryptedSavedObjectsServiceMock } from './encrypted_saved_objects_service.mocks';
diff --git a/x-pack/plugins/encrypted_saved_objects/server/crypto/index.ts b/x-pack/plugins/encrypted_saved_objects/server/crypto/index.ts
index 0849f0eb320d..75445bd24eba 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/crypto/index.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/crypto/index.ts
@@ -11,3 +11,4 @@ export {
   SavedObjectDescriptor,
 } from './encrypted_saved_objects_service';
 export { EncryptionError } from './encryption_error';
+export { EncryptedSavedObjectAttributesDefinition } from './encrypted_saved_object_type_definition';
diff --git a/x-pack/plugins/encrypted_saved_objects/server/mocks.ts b/x-pack/plugins/encrypted_saved_objects/server/mocks.ts
index 38ac8f254315..adec3a3b9fbf 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/mocks.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/mocks.ts
@@ -12,6 +12,7 @@ function createEncryptedSavedObjectsSetupMock() {
     registerType: jest.fn(),
     __legacyCompat: { registerLegacyAPI: jest.fn() },
     usingEphemeralEncryptionKey: true,
+    createMigration: jest.fn(),
   } as jest.Mocked<EncryptedSavedObjectsPluginSetup>;
 }
 
diff --git a/x-pack/plugins/encrypted_saved_objects/server/plugin.test.ts b/x-pack/plugins/encrypted_saved_objects/server/plugin.test.ts
index 4afd74488f9f..57108954f256 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/plugin.test.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/plugin.test.ts
@@ -16,6 +16,7 @@ describe('EncryptedSavedObjects Plugin', () => {
       await expect(plugin.setup(coreMock.createSetup(), { security: securityMock.createSetup() }))
         .resolves.toMatchInlineSnapshot(`
               Object {
+                "createMigration": [Function],
                 "registerType": [Function],
                 "usingEphemeralEncryptionKey": true,
               }
diff --git a/x-pack/plugins/encrypted_saved_objects/server/plugin.ts b/x-pack/plugins/encrypted_saved_objects/server/plugin.ts
index cdbdd18b9d69..69777798ddf1 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/plugin.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/plugin.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import nodeCrypto from '@elastic/node-crypto';
 import { Logger, PluginInitializerContext, CoreSetup } from 'src/core/server';
 import { first } from 'rxjs/operators';
 import { SecurityPluginSetup } from '../../security/server';
@@ -15,6 +16,7 @@ import {
 } from './crypto';
 import { EncryptedSavedObjectsAuditLogger } from './audit';
 import { setupSavedObjects, ClientInstanciator } from './saved_objects';
+import { getCreateMigration, CreateEncryptedSavedObjectsMigrationFn } from './create_migration';
 
 export interface PluginsSetup {
   security?: SecurityPluginSetup;
@@ -23,6 +25,7 @@ export interface PluginsSetup {
 export interface EncryptedSavedObjectsPluginSetup {
   registerType: (typeRegistration: EncryptedSavedObjectTypeRegistration) => void;
   usingEphemeralEncryptionKey: boolean;
+  createMigration: CreateEncryptedSavedObjectsMigrationFn;
 }
 
 export interface EncryptedSavedObjectsPluginStart {
@@ -45,18 +48,18 @@ export class Plugin {
     core: CoreSetup,
     deps: PluginsSetup
   ): Promise<EncryptedSavedObjectsPluginSetup> {
-    const { config, usingEphemeralEncryptionKey } = await createConfig$(this.initializerContext)
-      .pipe(first())
-      .toPromise();
+    const {
+      config: { encryptionKey },
+      usingEphemeralEncryptionKey,
+    } = await createConfig$(this.initializerContext).pipe(first()).toPromise();
+
+    const crypto = nodeCrypto({ encryptionKey });
 
+    const auditLogger = new EncryptedSavedObjectsAuditLogger(
+      deps.security?.audit.getLogger('encryptedSavedObjects')
+    );
     const service = Object.freeze(
-      new EncryptedSavedObjectsService(
-        config.encryptionKey,
-        this.logger,
-        new EncryptedSavedObjectsAuditLogger(
-          deps.security?.audit.getLogger('encryptedSavedObjects')
-        )
-      )
+      new EncryptedSavedObjectsService(crypto, this.logger, auditLogger)
     );
 
     this.savedObjectsSetup = setupSavedObjects({
@@ -70,6 +73,18 @@ export class Plugin {
       registerType: (typeRegistration: EncryptedSavedObjectTypeRegistration) =>
         service.registerType(typeRegistration),
       usingEphemeralEncryptionKey,
+      createMigration: getCreateMigration(
+        service,
+        (typeRegistration: EncryptedSavedObjectTypeRegistration) => {
+          const serviceForMigration = new EncryptedSavedObjectsService(
+            crypto,
+            this.logger,
+            auditLogger
+          );
+          serviceForMigration.registerType(typeRegistration);
+          return serviceForMigration;
+        }
+      ),
     };
   }
 
diff --git a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts
index ec5d81532e23..eea19bb1aa7d 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts
@@ -22,7 +22,7 @@ let encryptedSavedObjectsServiceMockInstance: jest.Mocked<EncryptedSavedObjectsS
 beforeEach(() => {
   mockBaseClient = savedObjectsClientMock.create();
   mockBaseTypeRegistry = savedObjectsTypeRegistryMock.create();
-  encryptedSavedObjectsServiceMockInstance = encryptedSavedObjectsServiceMock.create([
+  encryptedSavedObjectsServiceMockInstance = encryptedSavedObjectsServiceMock.createWithTypes([
     {
       type: 'known-type',
       attributesToEncrypt: new Set([
diff --git a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/index.test.ts b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/index.test.ts
index 8e9f12268cd7..ef9aed8706e2 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/index.test.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/index.test.ts
@@ -42,7 +42,7 @@ describe('#setupSavedObjects', () => {
     coreSetupMock = coreMock.createSetup();
     coreSetupMock.getStartServices.mockResolvedValue([coreStartMock, {}, {}]);
 
-    mockEncryptedSavedObjectsService = encryptedSavedObjectsServiceMock.create([
+    mockEncryptedSavedObjectsService = encryptedSavedObjectsServiceMock.createWithTypes([
       { type: 'known-type', attributesToEncrypt: new Set(['attrSecret']) },
     ]);
     setupContract = setupSavedObjects({
diff --git a/x-pack/test/encrypted_saved_objects_api_integration/config.ts b/x-pack/test/encrypted_saved_objects_api_integration/config.ts
index fb643c2c5a90..f061a38b72ce 100644
--- a/x-pack/test/encrypted_saved_objects_api_integration/config.ts
+++ b/x-pack/test/encrypted_saved_objects_api_integration/config.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { resolve } from 'path';
+import path from 'path';
 import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
 import { services } from './services';
 
@@ -18,12 +18,16 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     junit: {
       reportName: 'X-Pack Encrypted Saved Objects API Integration Tests',
     },
+    esArchiver: {
+      directory: path.join(__dirname, 'fixtures', 'es_archiver'),
+    },
     esTestCluster: xPackAPITestsConfig.get('esTestCluster'),
     kbnTestServer: {
       ...xPackAPITestsConfig.get('kbnTestServer'),
       serverArgs: [
         ...xPackAPITestsConfig.get('kbnTestServer.serverArgs'),
-        `--plugin-path=${resolve(__dirname, './fixtures/api_consumer_plugin')}`,
+        '--xpack.encryptedSavedObjects.encryptionKey="wuGNaIhoMpk5sO4UBxgr3NyW1sFcLgIf"',
+        `--plugin-path=${path.resolve(__dirname, './fixtures/api_consumer_plugin')}`,
       ],
     },
   };
diff --git a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/api_consumer_plugin/server/index.ts b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/api_consumer_plugin/server/index.ts
index 7fb4de9ae4dc..87bed7f41601 100644
--- a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/api_consumer_plugin/server/index.ts
+++ b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/api_consumer_plugin/server/index.ts
@@ -9,6 +9,7 @@ import {
   CoreSetup,
   PluginInitializer,
   SavedObjectsNamespaceType,
+  SavedObjectUnsanitizedDoc,
 } from '../../../../../../src/core/server';
 import {
   EncryptedSavedObjectsPluginSetup,
@@ -23,6 +24,17 @@ const SAVED_OBJECT_WITH_SECRET_AND_MULTIPLE_SPACES_TYPE =
   'saved-object-with-secret-and-multiple-spaces';
 const SAVED_OBJECT_WITHOUT_SECRET_TYPE = 'saved-object-without-secret';
 
+const SAVED_OBJECT_WITH_MIGRATION_TYPE = 'saved-object-with-migration';
+interface MigratedTypePre790 {
+  nonEncryptedAttribute: string;
+  encryptedAttribute: string;
+}
+interface MigratedType {
+  nonEncryptedAttribute: string;
+  encryptedAttribute: string;
+  additionalEncryptedAttribute: string;
+}
+
 export interface PluginsSetup {
   encryptedSavedObjects: EncryptedSavedObjectsPluginSetup;
   spaces: SpacesPluginSetup;
@@ -34,7 +46,7 @@ export interface PluginsStart {
 }
 
 export const plugin: PluginInitializer<void, void, PluginsSetup, PluginsStart> = () => ({
-  setup(core: CoreSetup<PluginsStart>, deps) {
+  setup(core: CoreSetup<PluginsStart>, deps: PluginsSetup) {
     for (const [name, namespaceType, hidden] of [
       [SAVED_OBJECT_WITH_SECRET_TYPE, 'single', false],
       [HIDDEN_SAVED_OBJECT_WITH_SECRET_TYPE, 'single', true],
@@ -71,6 +83,8 @@ export const plugin: PluginInitializer<void, void, PluginsSetup, PluginsStart> =
       mappings: deepFreeze({ properties: { publicProperty: { type: 'keyword' } } }),
     });
 
+    defineTypeWithMigration(core, deps);
+
     const router = core.http.createRouter();
     router.get(
       {
@@ -103,3 +117,83 @@ export const plugin: PluginInitializer<void, void, PluginsSetup, PluginsStart> =
   start() {},
   stop() {},
 });
+
+function defineTypeWithMigration(core: CoreSetup<PluginsStart>, deps: PluginsSetup) {
+  const typePriorTo790 = {
+    type: SAVED_OBJECT_WITH_MIGRATION_TYPE,
+    attributesToEncrypt: new Set(['encryptedAttribute']),
+  };
+
+  // current type is registered
+  deps.encryptedSavedObjects.registerType({
+    type: SAVED_OBJECT_WITH_MIGRATION_TYPE,
+    attributesToEncrypt: new Set(['encryptedAttribute', 'additionalEncryptedAttribute']),
+  });
+
+  core.savedObjects.registerType({
+    name: SAVED_OBJECT_WITH_MIGRATION_TYPE,
+    hidden: false,
+    namespaceType: 'single',
+    mappings: {
+      properties: {
+        nonEncryptedAttribute: {
+          type: 'keyword',
+        },
+        encryptedAttribute: {
+          type: 'binary',
+        },
+        additionalEncryptedAttribute: {
+          type: 'keyword',
+        },
+      },
+    },
+    migrations: {
+      // in this version we migrated a non encrypted field and type didnt change
+      '7.8.0': deps.encryptedSavedObjects.createMigration<MigratedTypePre790, MigratedTypePre790>(
+        function shouldBeMigrated(doc): doc is SavedObjectUnsanitizedDoc<MigratedTypePre790> {
+          return true;
+        },
+        (
+          doc: SavedObjectUnsanitizedDoc<MigratedTypePre790>
+        ): SavedObjectUnsanitizedDoc<MigratedTypePre790> => {
+          const {
+            attributes: { nonEncryptedAttribute },
+          } = doc;
+          return {
+            ...doc,
+            attributes: {
+              ...doc.attributes,
+              nonEncryptedAttribute: `${nonEncryptedAttribute}-migrated`,
+            },
+          };
+        },
+        // type hasn't changed as the field we're updating is not an encrypted one
+        typePriorTo790,
+        typePriorTo790
+      ),
+      // in this version we encrypted an existing non encrypted field
+      '7.9.0': deps.encryptedSavedObjects.createMigration<MigratedTypePre790, MigratedType>(
+        function shouldBeMigrated(doc): doc is SavedObjectUnsanitizedDoc<MigratedTypePre790> {
+          return true;
+        },
+        (
+          doc: SavedObjectUnsanitizedDoc<MigratedTypePre790>
+        ): SavedObjectUnsanitizedDoc<MigratedType> => {
+          const {
+            attributes: { nonEncryptedAttribute },
+          } = doc;
+          return {
+            ...doc,
+            attributes: {
+              ...doc.attributes,
+              nonEncryptedAttribute,
+              // clone and modify the non encrypted field
+              additionalEncryptedAttribute: `${nonEncryptedAttribute}-encrypted`,
+            },
+          };
+        },
+        typePriorTo790
+      ),
+    },
+  });
+}
diff --git a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/data.json b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/data.json
new file mode 100644
index 000000000000..88ec54cdf3a5
--- /dev/null
+++ b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/data.json
@@ -0,0 +1,370 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "config:8.0.0",
+    "index": ".kibana_1",
+    "source": {
+      "config": {
+        "buildNum": 9007199254740991
+      },
+      "migrationVersion": {
+        "config": "7.9.0"
+      },
+      "references": [
+      ],
+      "type": "config",
+      "updated_at": "2020-06-17T15:03:14.532Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "space:default",
+    "index": ".kibana_1",
+    "source": {
+      "migrationVersion": {
+        "space": "6.6.0"
+      },
+      "references": [
+      ],
+      "space": {
+        "_reserved": true,
+        "color": "#00bfb3",
+        "description": "This is your default space!",
+        "disabledFeatures": [
+        ],
+        "name": "Default"
+      },
+      "type": "space",
+      "updated_at": "2020-06-17T15:03:27.426Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "apm-telemetry:apm-telemetry",
+    "index": ".kibana_1",
+    "source": {
+      "apm-telemetry": {
+        "agents": {
+        },
+        "cardinality": {
+          "transaction": {
+            "name": {
+              "all_agents": {
+                "1d": 0
+              },
+              "rum": {
+                "1d": 0
+              }
+            }
+          },
+          "user_agent": {
+            "original": {
+              "all_agents": {
+                "1d": 0
+              },
+              "rum": {
+                "1d": 0
+              }
+            }
+          }
+        },
+        "counts": {
+          "agent_configuration": {
+            "all": 0
+          },
+          "error": {
+            "1d": 0,
+            "all": 0
+          },
+          "max_error_groups_per_service": {
+            "1d": 0
+          },
+          "max_transaction_groups_per_service": {
+            "1d": 0
+          },
+          "metric": {
+            "1d": 0,
+            "all": 0
+          },
+          "onboarding": {
+            "1d": 0,
+            "all": 0
+          },
+          "services": {
+            "1d": 0
+          },
+          "sourcemap": {
+            "1d": 0,
+            "all": 0
+          },
+          "span": {
+            "1d": 0,
+            "all": 0
+          },
+          "traces": {
+            "1d": 0
+          },
+          "transaction": {
+            "1d": 0,
+            "all": 0
+          }
+        },
+        "has_any_services": false,
+        "indices": {
+          "all": {
+            "total": {
+              "docs": {
+                "count": 0
+              },
+              "store": {
+                "size_in_bytes": 416
+              }
+            }
+          },
+          "shards": {
+            "total": 2
+          }
+        },
+        "integrations": {
+          "ml": {
+            "all_jobs_count": 0
+          }
+        },
+        "services_per_agent": {
+          "dotnet": 0,
+          "go": 0,
+          "java": 0,
+          "js-base": 0,
+          "nodejs": 0,
+          "python": 0,
+          "ruby": 0,
+          "rum-js": 0
+        },
+        "tasks": {
+          "agent_configuration": {
+            "took": {
+              "ms": 21
+            }
+          },
+          "agents": {
+            "took": {
+              "ms": 65
+            }
+          },
+          "cardinality": {
+            "took": {
+              "ms": 80
+            }
+          },
+          "groupings": {
+            "took": {
+              "ms": 25
+            }
+          },
+          "indices_stats": {
+            "took": {
+              "ms": 65
+            }
+          },
+          "integrations": {
+            "took": {
+              "ms": 108
+            }
+          },
+          "processor_events": {
+            "took": {
+              "ms": 113
+            }
+          },
+          "services": {
+            "took": {
+              "ms": 98
+            }
+          },
+          "versions": {
+            "took": {
+              "ms": 6
+            }
+          }
+        }
+      },
+      "references": [
+      ],
+      "type": "apm-telemetry",
+      "updated_at": "2020-06-17T15:03:47.184Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "saved-object-with-migration:74f3e6d7-b7bb-477d-ac28-92ee22728e6e",
+    "index": ".kibana_1",
+    "source": {
+      "saved-object-with-migration": {
+        "encryptedAttribute": "JuDwwSjflpKmPKUIfjgo04E0DW9iyhp8C94hwvflgkS0SUUPt+862FQ1eja4VEfEG7HVUt7xxj+BWeZv9vrf4olxgbr4/f5RrT8BVic0EOVS9nhspiDVEv12mV0uDWGtdneB/UWyaZg+0Qr0tPrwceSl8BS///U=",
+        "nonEncryptedAttribute": "elastic"
+      },
+      "migrationVersion": {
+        "saved-object-with-migration": "7.7.0"
+      },
+      "references": [
+      ],
+      "type": "saved-object-with-migration",
+      "updated_at": "2020-06-17T15:35:39.839Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "application_usage_transactional:5f01fd40-b0b0-11ea-9510-fdf248d5f2a4",
+    "index": ".kibana_1",
+    "source": {
+      "application_usage_transactional": {
+        "appId": "management",
+        "minutesOnScreen": 1.60245,
+        "numberOfClicks": 6,
+        "timestamp": "2020-06-17T15:36:54.292Z"
+      },
+      "references": [
+      ],
+      "type": "application_usage_transactional",
+      "updated_at": "2020-06-17T15:36:54.292Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "application_usage_transactional:4ca5ac00-b0b0-11ea-9510-fdf248d5f2a4",
+    "index": ".kibana_1",
+    "source": {
+      "application_usage_transactional": {
+        "appId": "home",
+        "minutesOnScreen": 0.4106666666666667,
+        "numberOfClicks": 3,
+        "timestamp": "2020-06-17T15:36:23.487Z"
+      },
+      "references": [
+      ],
+      "type": "application_usage_transactional",
+      "updated_at": "2020-06-17T15:36:23.488Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "ui-metric:kibana-user_agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36",
+    "index": ".kibana_1",
+    "source": {
+      "references": [
+      ],
+      "type": "ui-metric",
+      "ui-metric": {
+        "count": 1
+      },
+      "updated_at": "2020-06-17T15:36:23.487Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "ui-metric:Kibana_home:sampleDataDecline",
+    "index": ".kibana_1",
+    "source": {
+      "type": "ui-metric",
+      "ui-metric": {
+        "count": 1
+      },
+      "updated_at": "2020-06-17T15:36:23.488Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "ui-metric:Kibana_home:welcomeScreenMount",
+    "index": ".kibana_1",
+    "source": {
+      "type": "ui-metric",
+      "ui-metric": {
+        "count": 1
+      },
+      "updated_at": "2020-06-17T15:36:23.488Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "telemetry:telemetry",
+    "index": ".kibana_1",
+    "source": {
+      "references": [
+      ],
+      "telemetry": {
+        "lastReported": 1592408310031,
+        "reportFailureCount": 0,
+        "userHasSeenNotice": true
+      },
+      "type": "telemetry",
+      "updated_at": "2020-06-17T15:38:30.031Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "maps-telemetry:maps-telemetry",
+    "index": ".kibana_1",
+    "source": {
+      "maps-telemetry": {
+        "attributesPerMap": {
+          "dataSourcesCount": {
+            "avg": 0,
+            "max": 0,
+            "min": 0
+          },
+          "emsVectorLayersCount": {
+          },
+          "layerTypesCount": {
+          },
+          "layersCount": {
+            "avg": 0,
+            "max": 0,
+            "min": 0
+          }
+        },
+        "indexPatternsWithGeoFieldCount": 0,
+        "indexPatternsWithGeoPointFieldCount": 0,
+        "indexPatternsWithGeoShapeFieldCount": 0,
+        "mapsTotalCount": 0,
+        "settings": {
+          "showMapVisualizationTypes": false
+        },
+        "timeCaptured": "2020-06-17T16:29:27.563Z"
+      },
+      "references": [
+      ],
+      "type": "maps-telemetry",
+      "updated_at": "2020-06-17T16:29:27.563Z"
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/mappings.json b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/mappings.json
new file mode 100644
index 000000000000..c025ad9da1a9
--- /dev/null
+++ b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/mappings.json
@@ -0,0 +1,2413 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana": {
+      }
+    },
+    "index": ".kibana_1",
+    "mappings": {
+      "_meta": {
+        "migrationMappingPropertyHashes": {
+          "action": "6e96ac5e648f57523879661ea72525b7",
+          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
+          "alert": "7b44fba6773e37c806ce290ea9b7024e",
+          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
+          "apm-telemetry": "3525d7c22c42bc80f5e6e9cb3f2b26a2",
+          "application_usage_totals": "c897e4310c5f24b07caaff3db53ae2c1",
+          "application_usage_transactional": "965839e75f809fefe04f92dc4d99722a",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "cases": "32aa96a6d3855ddda53010ae2048ac22",
+          "cases-comments": "c2061fb929f585df57425102fa928b4b",
+          "cases-configure": "42711cbb311976c0687853f4c1354572",
+          "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
+          "config": "ae24d22d5986d04124cc6568f771066f",
+          "dashboard": "d00f614b29a80360e1190193fd333bab",
+          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
+          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
+          "index-pattern": "66eccb05066c5a89924f48a9e9736499",
+          "infrastructure-ui-source": "ddc0ecb18383f6b26101a2fadb2dab0c",
+          "inventory-view": "88fc7e12fd1b45b6f0787323ce4f18d2",
+          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
+          "lens": "d33c68a69ff1e78c9888dedd2164ac22",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "map": "23d7aa4a720d4938ccde3983f87bd58d",
+          "maps-telemetry": "bfd39d88aadadb4be597ea984d433dbe",
+          "metrics-explorer-view": "428e319af3e822c80a84cf87123ca35c",
+          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
+          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
+          "namespace": "2f4316de49999235636386fe51dc06c1",
+          "namespaces": "2f4316de49999235636386fe51dc06c1",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "references": "7997cf5a56cc02bdc9c93361bde732b0",
+          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
+          "search": "181661168bbadd1eff5902361e2a0d5c",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "telemetry": "36a616f7026dfa617d6655df850fe16d",
+          "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
+          "todo": "082a2cc96a590268344d5cd74c159ac4",
+          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215",
+          "type": "2f4316de49999235636386fe51dc06c1",
+          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
+          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "upgrade-assistant-reindex-operation": "296a89039fc4260292be36b1b005d8f2",
+          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
+          "uptime-dynamic-settings": "fcdb453a30092f022f2642db29523d80",
+          "url": "b675c3be8d76ecf029294d51dc7ec65d",
+          "visualization": "52d7a13ad68a150c4525b292d23e12cc"
+        }
+      },
+      "dynamic": "strict",
+      "properties": {
+        "action": {
+          "properties": {
+            "actionTypeId": {
+              "type": "keyword"
+            },
+            "config": {
+              "enabled": false,
+              "type": "object"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "secrets": {
+              "type": "binary"
+            }
+          }
+        },
+        "action_task_params": {
+          "properties": {
+            "actionId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "alert": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "actionTypeId": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              },
+              "type": "nested"
+            },
+            "alertTypeId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "apiKeyOwner": {
+              "type": "keyword"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "muteAll": {
+              "type": "boolean"
+            },
+            "mutedInstanceIds": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            },
+            "schedule": {
+              "properties": {
+                "interval": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "scheduledTaskId": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "throttle": {
+              "type": "keyword"
+            },
+            "updatedBy": {
+              "type": "keyword"
+            }
+          }
+        },
+        "saved-object-with-migration": {
+          "properties": {
+            "encryptedAttribute": {
+              "type": "binary"
+            },
+            "nonEncryptedAttribute": {
+              "type": "keyword"
+            },
+            "additionalEncryptedAttribute": {
+              "type": "binary"
+            }
+          }
+        },
+        "apm-indices": {
+          "properties": {
+            "apm_oss": {
+              "properties": {
+                "errorIndices": {
+                  "type": "keyword"
+                },
+                "metricsIndices": {
+                  "type": "keyword"
+                },
+                "onboardingIndices": {
+                  "type": "keyword"
+                },
+                "sourcemapIndices": {
+                  "type": "keyword"
+                },
+                "spanIndices": {
+                  "type": "keyword"
+                },
+                "transactionIndices": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apm-telemetry": {
+          "properties": {
+            "agents": {
+              "properties": {
+                "dotnet": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "go": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "java": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "js-base": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "nodejs": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "python": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "ruby": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "rum-js": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "cardinality": {
+              "properties": {
+                "transaction": {
+                  "properties": {
+                    "name": {
+                      "properties": {
+                        "all_agents": {
+                          "properties": {
+                            "1d": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "rum": {
+                          "properties": {
+                            "1d": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "user_agent": {
+                  "properties": {
+                    "original": {
+                      "properties": {
+                        "all_agents": {
+                          "properties": {
+                            "1d": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "rum": {
+                          "properties": {
+                            "1d": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "counts": {
+              "properties": {
+                "agent_configuration": {
+                  "properties": {
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "error": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "max_error_groups_per_service": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "max_transaction_groups_per_service": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "metric": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "onboarding": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "services": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "sourcemap": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "span": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "traces": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "transaction": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "has_any_services": {
+              "type": "boolean"
+            },
+            "indices": {
+              "properties": {
+                "all": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "docs": {
+                          "properties": {
+                            "count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "store": {
+                          "properties": {
+                            "size_in_bytes": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "shards": {
+                  "properties": {
+                    "total": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "integrations": {
+              "properties": {
+                "ml": {
+                  "properties": {
+                    "all_jobs_count": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "retainment": {
+              "properties": {
+                "error": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "metric": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "onboarding": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "span": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "transaction": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "services_per_agent": {
+              "properties": {
+                "dotnet": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "go": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "java": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "js-base": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "nodejs": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "python": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "ruby": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "rum-js": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            },
+            "tasks": {
+              "properties": {
+                "agent_configuration": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "agents": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "cardinality": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "groupings": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "indices_stats": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "integrations": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "processor_events": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "services": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "versions": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "version": {
+              "properties": {
+                "apm_server": {
+                  "properties": {
+                    "major": {
+                      "type": "long"
+                    },
+                    "minor": {
+                      "type": "long"
+                    },
+                    "patch": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "application_usage_totals": {
+          "properties": {
+            "appId": {
+              "type": "keyword"
+            },
+            "minutesOnScreen": {
+              "type": "float"
+            },
+            "numberOfClicks": {
+              "type": "long"
+            }
+          }
+        },
+        "application_usage_transactional": {
+          "properties": {
+            "appId": {
+              "type": "keyword"
+            },
+            "minutesOnScreen": {
+              "type": "float"
+            },
+            "numberOfClicks": {
+              "type": "long"
+            },
+            "timestamp": {
+              "type": "date"
+            }
+          }
+        },
+        "canvas-element": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "content": {
+              "type": "text"
+            },
+            "help": {
+              "type": "text"
+            },
+            "image": {
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "cases": {
+          "properties": {
+            "closed_at": {
+              "type": "date"
+            },
+            "closed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "external_service": {
+              "properties": {
+                "connector_id": {
+                  "type": "keyword"
+                },
+                "connector_name": {
+                  "type": "keyword"
+                },
+                "external_id": {
+                  "type": "keyword"
+                },
+                "external_title": {
+                  "type": "text"
+                },
+                "external_url": {
+                  "type": "text"
+                },
+                "pushed_at": {
+                  "type": "date"
+                },
+                "pushed_by": {
+                  "properties": {
+                    "email": {
+                      "type": "keyword"
+                    },
+                    "full_name": {
+                      "type": "keyword"
+                    },
+                    "username": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-comments": {
+          "properties": {
+            "comment": {
+              "type": "text"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "pushed_at": {
+              "type": "date"
+            },
+            "pushed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-configure": {
+          "properties": {
+            "closure_type": {
+              "type": "keyword"
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "connector_name": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-user-actions": {
+          "properties": {
+            "action": {
+              "type": "keyword"
+            },
+            "action_at": {
+              "type": "date"
+            },
+            "action_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "action_field": {
+              "type": "keyword"
+            },
+            "new_value": {
+              "type": "text"
+            },
+            "old_value": {
+              "type": "text"
+            }
+          }
+        },
+        "config": {
+          "dynamic": "true",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "dashboard": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "optionsJSON": {
+              "type": "text"
+            },
+            "panelsJSON": {
+              "type": "text"
+            },
+            "refreshInterval": {
+              "properties": {
+                "display": {
+                  "type": "keyword"
+                },
+                "pause": {
+                  "type": "boolean"
+                },
+                "section": {
+                  "type": "integer"
+                },
+                "value": {
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "type": "boolean"
+            },
+            "timeTo": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "file-upload-telemetry": {
+          "properties": {
+            "filesUploadedTotalCount": {
+              "type": "long"
+            }
+          }
+        },
+        "graph-workspace": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "numLinks": {
+              "type": "integer"
+            },
+            "numVertices": {
+              "type": "integer"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "wsState": {
+              "type": "text"
+            }
+          }
+        },
+        "index-pattern": {
+          "properties": {
+            "fieldFormatMap": {
+              "type": "text"
+            },
+            "fields": {
+              "type": "text"
+            },
+            "intervalName": {
+              "type": "keyword"
+            },
+            "notExpandable": {
+              "type": "boolean"
+            },
+            "sourceFilters": {
+              "type": "text"
+            },
+            "timeFieldName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "typeMeta": {
+              "type": "keyword"
+            }
+          }
+        },
+        "infrastructure-ui-source": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "fields": {
+              "properties": {
+                "container": {
+                  "type": "keyword"
+                },
+                "host": {
+                  "type": "keyword"
+                },
+                "pod": {
+                  "type": "keyword"
+                },
+                "tiebreaker": {
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "logAlias": {
+              "type": "keyword"
+            },
+            "logColumns": {
+              "properties": {
+                "fieldColumn": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "messageColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "timestampColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              },
+              "type": "nested"
+            },
+            "metricAlias": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text"
+            }
+          }
+        },
+        "inventory-view": {
+          "properties": {
+            "accountId": {
+              "type": "keyword"
+            },
+            "autoBounds": {
+              "type": "boolean"
+            },
+            "autoReload": {
+              "type": "boolean"
+            },
+            "boundsOverride": {
+              "properties": {
+                "max": {
+                  "type": "integer"
+                },
+                "min": {
+                  "type": "integer"
+                }
+              }
+            },
+            "customMetrics": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "customOptions": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "text": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "filterQuery": {
+              "properties": {
+                "expression": {
+                  "type": "keyword"
+                },
+                "kind": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "groupBy": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "legend": {
+              "properties": {
+                "palette": {
+                  "type": "keyword"
+                },
+                "reverseColors": {
+                  "type": "boolean"
+                },
+                "steps": {
+                  "type": "long"
+                }
+              }
+            },
+            "metric": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "nodeType": {
+              "type": "keyword"
+            },
+            "region": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "by": {
+                  "type": "keyword"
+                },
+                "direction": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "time": {
+              "type": "long"
+            },
+            "view": {
+              "type": "keyword"
+            }
+          }
+        },
+        "kql-telemetry": {
+          "properties": {
+            "optInCount": {
+              "type": "long"
+            },
+            "optOutCount": {
+              "type": "long"
+            }
+          }
+        },
+        "lens": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "expression": {
+              "index": false,
+              "type": "keyword"
+            },
+            "state": {
+              "type": "flattened"
+            },
+            "title": {
+              "type": "text"
+            },
+            "visualizationType": {
+              "type": "keyword"
+            }
+          }
+        },
+        "lens-ui-telemetry": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            },
+            "date": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "map": {
+          "properties": {
+            "bounds": {
+              "type": "geo_shape"
+            },
+            "description": {
+              "type": "text"
+            },
+            "layerListJSON": {
+              "type": "text"
+            },
+            "mapStateJSON": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "maps-telemetry": {
+          "properties": {
+            "attributesPerMap": {
+              "properties": {
+                "dataSourcesCount": {
+                  "properties": {
+                    "avg": {
+                      "type": "long"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "min": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "emsVectorLayersCount": {
+                  "dynamic": "true",
+                  "type": "object"
+                },
+                "layerTypesCount": {
+                  "dynamic": "true",
+                  "type": "object"
+                },
+                "layersCount": {
+                  "properties": {
+                    "avg": {
+                      "type": "long"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "min": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indexPatternsWithGeoFieldCount": {
+              "type": "long"
+            },
+            "indexPatternsWithGeoPointFieldCount": {
+              "type": "long"
+            },
+            "indexPatternsWithGeoShapeFieldCount": {
+              "type": "long"
+            },
+            "mapsTotalCount": {
+              "type": "long"
+            },
+            "settings": {
+              "properties": {
+                "showMapVisualizationTypes": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "timeCaptured": {
+              "type": "date"
+            }
+          }
+        },
+        "metrics-explorer-view": {
+          "properties": {
+            "chartOptions": {
+              "properties": {
+                "stack": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "yAxisMode": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "currentTimerange": {
+              "properties": {
+                "from": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "keyword"
+                },
+                "to": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "options": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "filterQuery": {
+                  "type": "keyword"
+                },
+                "forceInterval": {
+                  "type": "boolean"
+                },
+                "groupBy": {
+                  "type": "keyword"
+                },
+                "limit": {
+                  "type": "integer"
+                },
+                "metrics": {
+                  "properties": {
+                    "aggregation": {
+                      "type": "keyword"
+                    },
+                    "color": {
+                      "type": "keyword"
+                    },
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "label": {
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                }
+              }
+            }
+          }
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "alert": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "saved-object-with-migration": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "config": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "space": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ml-telemetry": {
+          "properties": {
+            "file_data_visualizer": {
+              "properties": {
+                "index_creation_count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "namespaces": {
+          "type": "keyword"
+        },
+        "query": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "filters": {
+              "enabled": false,
+              "type": "object"
+            },
+            "query": {
+              "properties": {
+                "language": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timefilter": {
+              "enabled": false,
+              "type": "object"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "sample-data-telemetry": {
+          "properties": {
+            "installCount": {
+              "type": "long"
+            },
+            "unInstallCount": {
+              "type": "long"
+            }
+          }
+        },
+        "search": {
+          "properties": {
+            "columns": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "sort": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "imageUrl": {
+              "index": false,
+              "type": "text"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "telemetry": {
+          "properties": {
+            "allowChangingOptInStatus": {
+              "type": "boolean"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "lastReported": {
+              "type": "date"
+            },
+            "lastVersionChecked": {
+              "type": "keyword"
+            },
+            "reportFailureCount": {
+              "type": "integer"
+            },
+            "reportFailureVersion": {
+              "type": "keyword"
+            },
+            "sendUsageFrom": {
+              "type": "keyword"
+            },
+            "userHasSeenNotice": {
+              "type": "boolean"
+            }
+          }
+        },
+        "timelion-sheet": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "timelion_chart_height": {
+              "type": "integer"
+            },
+            "timelion_columns": {
+              "type": "integer"
+            },
+            "timelion_interval": {
+              "type": "keyword"
+            },
+            "timelion_other_interval": {
+              "type": "keyword"
+            },
+            "timelion_rows": {
+              "type": "integer"
+            },
+            "timelion_sheet": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "todo": {
+          "properties": {
+            "icon": {
+              "type": "keyword"
+            },
+            "task": {
+              "type": "text"
+            },
+            "title": {
+              "type": "keyword"
+            }
+          }
+        },
+        "tsvb-validation-telemetry": {
+          "properties": {
+            "failedRequests": {
+              "type": "long"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "ui-metric": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            }
+          }
+        },
+        "updated_at": {
+          "type": "date"
+        },
+        "upgrade-assistant-reindex-operation": {
+          "properties": {
+            "errorMessage": {
+              "type": "keyword"
+            },
+            "indexName": {
+              "type": "keyword"
+            },
+            "lastCompletedStep": {
+              "type": "integer"
+            },
+            "locked": {
+              "type": "date"
+            },
+            "newIndexName": {
+              "type": "keyword"
+            },
+            "reindexOptions": {
+              "properties": {
+                "openAndClose": {
+                  "type": "boolean"
+                },
+                "queueSettings": {
+                  "properties": {
+                    "queuedAt": {
+                      "type": "long"
+                    },
+                    "startedAt": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "reindexTaskId": {
+              "type": "keyword"
+            },
+            "reindexTaskPercComplete": {
+              "type": "float"
+            },
+            "runningReindexCount": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "integer"
+            }
+          }
+        },
+        "upgrade-assistant-telemetry": {
+          "properties": {
+            "features": {
+              "properties": {
+                "deprecation_logging": {
+                  "properties": {
+                    "enabled": {
+                      "null_value": true,
+                      "type": "boolean"
+                    }
+                  }
+                }
+              }
+            },
+            "ui_open": {
+              "properties": {
+                "cluster": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "indices": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "overview": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            },
+            "ui_reindex": {
+              "properties": {
+                "close": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "open": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "start": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "stop": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "uptime-dynamic-settings": {
+          "properties": {
+            "certAgeThreshold": {
+              "type": "long"
+            },
+            "certExpirationThreshold": {
+              "type": "long"
+            },
+            "heartbeatIndices": {
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "url": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "visualization": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchRefName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "type": "text"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/encrypted_saved_objects_api_integration/tests/encrypted_saved_objects_api.ts b/x-pack/test/encrypted_saved_objects_api_integration/tests/encrypted_saved_objects_api.ts
index 6b3ae6201170..8bdc1715bf48 100644
--- a/x-pack/test/encrypted_saved_objects_api_integration/tests/encrypted_saved_objects_api.ts
+++ b/x-pack/test/encrypted_saved_objects_api_integration/tests/encrypted_saved_objects_api.ts
@@ -12,6 +12,7 @@ export default function ({ getService }: FtrProviderContext) {
   const es = getService('legacyEs');
   const randomness = getService('randomness');
   const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
 
   const SAVED_OBJECT_WITH_SECRET_TYPE = 'saved-object-with-secret';
   const HIDDEN_SAVED_OBJECT_WITH_SECRET_TYPE = 'hidden-saved-object-with-secret';
@@ -501,5 +502,32 @@ export default function ({ getService }: FtrProviderContext) {
         );
       });
     });
+
+    describe('migrations', () => {
+      before(async () => {
+        await esArchiver.load('encrypted_saved_objects');
+      });
+
+      after(async () => {
+        await esArchiver.unload('encrypted_saved_objects');
+      });
+
+      it('migrates unencrypted fields on saved objects', async () => {
+        const { body: decryptedResponse } = await supertest
+          .get(
+            `/api/saved_objects/get-decrypted-as-internal-user/saved-object-with-migration/74f3e6d7-b7bb-477d-ac28-92ee22728e6e`
+          )
+          .expect(200);
+
+        expect(decryptedResponse.attributes).to.eql({
+          // ensures the encrypted field can still be decrypted after the migration
+          encryptedAttribute: 'this is my secret api key',
+          // ensures the non-encrypted field has been migrated in 7.8.0
+          nonEncryptedAttribute: 'elastic-migrated',
+          // ensures the non-encrypted field has been migrated into a new encrypted field in 7.9.0
+          additionalEncryptedAttribute: 'elastic-migrated-encrypted',
+        });
+      });
+    });
   });
 }
diff --git a/yarn.lock b/yarn.lock
index bb13ee8105e0..93db6de88775 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2297,6 +2297,11 @@
   resolved "https://registry.yarnpkg.com/@elastic/node-crypto/-/node-crypto-1.1.1.tgz#619b70322c9cce4a7ee5fbf8f678b1baa7f06095"
   integrity sha512-F6tIk8Txdqjg8Siv60iAvXzO9ZdQI87K3sS/fh5xd2XaWK+T5ZfqeTvsT7srwG6fr6uCBfuQEJV1KBBl+JpLZA==
 
+"@elastic/node-crypto@1.2.1":
+  version "1.2.1"
+  resolved "https://registry.yarnpkg.com/@elastic/node-crypto/-/node-crypto-1.2.1.tgz#dfd9218f9b5729fa519762e6a6968aaf61b86eb0"
+  integrity sha512-RlZg+poLA2SwZZUM5RMJDJiKojlSB1mJkumIvLgXvvTCcCliC6rM0lUaNecV9pbQLIHrGlX2BrbwiuPWhv0czQ==
+
 "@elastic/numeral@^2.5.0":
   version "2.5.0"
   resolved "https://registry.yarnpkg.com/@elastic/numeral/-/numeral-2.5.0.tgz#8da714827fc278f17546601fdfe55f5c920e2bc5"

From 40c746e3fdbdb17ddf3e25ef3c34d79b0df98552 Mon Sep 17 00:00:00 2001
From: Aaron Caldwell <aaron.caldwell@elastic.co>
Date: Thu, 25 Jun 2020 10:38:53 -0600
Subject: [PATCH 13/78] [Maps] Remove maps-telemetry saved object as it is no
 longer in use (#69871)

---
 x-pack/plugins/maps/common/constants.ts       |  1 -
 .../maps_telemetry/collectors/register.ts     |  4 +-
 x-pack/plugins/maps/server/plugin.ts          |  3 +-
 .../maps/server/saved_objects/index.ts        |  1 -
 .../server/saved_objects/maps_telemetry.ts    | 46 -------------------
 5 files changed, 2 insertions(+), 53 deletions(-)
 delete mode 100644 x-pack/plugins/maps/server/saved_objects/maps_telemetry.ts

diff --git a/x-pack/plugins/maps/common/constants.ts b/x-pack/plugins/maps/common/constants.ts
index 1d795c370dc0..ea722c18e700 100644
--- a/x-pack/plugins/maps/common/constants.ts
+++ b/x-pack/plugins/maps/common/constants.ts
@@ -25,7 +25,6 @@ export const EMS_TILES_VECTOR_TILE_PATH = 'vector/tile';
 export const MAP_SAVED_OBJECT_TYPE = 'map';
 export const APP_ID = 'maps';
 export const APP_ICON = 'gisApp';
-export const TELEMETRY_TYPE = APP_ID;
 
 export const MAP_APP_PATH = `app/${APP_ID}`;
 export const GIS_API_PATH = `api/${APP_ID}`;
diff --git a/x-pack/plugins/maps/server/maps_telemetry/collectors/register.ts b/x-pack/plugins/maps/server/maps_telemetry/collectors/register.ts
index 383d7773663c..f54776f5ab62 100644
--- a/x-pack/plugins/maps/server/maps_telemetry/collectors/register.ts
+++ b/x-pack/plugins/maps/server/maps_telemetry/collectors/register.ts
@@ -6,8 +6,6 @@
 
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { getMapsTelemetry } from '../maps_telemetry';
-// @ts-ignore
-import { TELEMETRY_TYPE } from '../../../common/constants';
 import { MapsConfigType } from '../../../config';
 
 export function registerMapsUsageCollector(
@@ -19,7 +17,7 @@ export function registerMapsUsageCollector(
   }
 
   const mapsUsageCollector = usageCollection.makeUsageCollector({
-    type: TELEMETRY_TYPE,
+    type: 'maps',
     isReady: () => true,
     fetch: async () => await getMapsTelemetry(config),
   });
diff --git a/x-pack/plugins/maps/server/plugin.ts b/x-pack/plugins/maps/server/plugin.ts
index f2331b9a1a96..fe2b73df7978 100644
--- a/x-pack/plugins/maps/server/plugin.ts
+++ b/x-pack/plugins/maps/server/plugin.ts
@@ -15,7 +15,7 @@ import { getFlightsSavedObjects } from './sample_data/flights_saved_objects.js';
 import { getWebLogsSavedObjects } from './sample_data/web_logs_saved_objects.js';
 import { registerMapsUsageCollector } from './maps_telemetry/collectors/register';
 import { APP_ID, APP_ICON, MAP_SAVED_OBJECT_TYPE, createMapPath } from '../common/constants';
-import { mapSavedObjects, mapsTelemetrySavedObjects } from './saved_objects';
+import { mapSavedObjects } from './saved_objects';
 import { MapsXPackConfig } from '../config';
 // @ts-ignore
 import { setInternalRepository } from './kibana_server_services';
@@ -191,7 +191,6 @@ export class MapsPlugin implements Plugin {
       },
     });
 
-    core.savedObjects.registerType(mapsTelemetrySavedObjects);
     core.savedObjects.registerType(mapSavedObjects);
     registerMapsUsageCollector(usageCollection, currentConfig);
 
diff --git a/x-pack/plugins/maps/server/saved_objects/index.ts b/x-pack/plugins/maps/server/saved_objects/index.ts
index c4b779183a2d..804d720a13ab 100644
--- a/x-pack/plugins/maps/server/saved_objects/index.ts
+++ b/x-pack/plugins/maps/server/saved_objects/index.ts
@@ -3,5 +3,4 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-export { mapsTelemetrySavedObjects } from './maps_telemetry';
 export { mapSavedObjects } from './map';
diff --git a/x-pack/plugins/maps/server/saved_objects/maps_telemetry.ts b/x-pack/plugins/maps/server/saved_objects/maps_telemetry.ts
deleted file mode 100644
index ad0b17af36dd..000000000000
--- a/x-pack/plugins/maps/server/saved_objects/maps_telemetry.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { SavedObjectsType } from 'src/core/server';
-
-export const mapsTelemetrySavedObjects: SavedObjectsType = {
-  name: 'maps',
-  hidden: false,
-  namespaceType: 'agnostic',
-  mappings: {
-    properties: {
-      settings: {
-        properties: {
-          showMapVisualizationTypes: { type: 'boolean' },
-        },
-      },
-      indexPatternsWithGeoFieldCount: { type: 'long' },
-      indexPatternsWithGeoPointFieldCount: { type: 'long' },
-      indexPatternsWithGeoShapeFieldCount: { type: 'long' },
-      mapsTotalCount: { type: 'long' },
-      timeCaptured: { type: 'date' },
-      attributesPerMap: {
-        properties: {
-          dataSourcesCount: {
-            properties: {
-              min: { type: 'long' },
-              max: { type: 'long' },
-              avg: { type: 'long' },
-            },
-          },
-          layersCount: {
-            properties: {
-              min: { type: 'long' },
-              max: { type: 'long' },
-              avg: { type: 'long' },
-            },
-          },
-          layerTypesCount: { dynamic: 'true', properties: {} },
-          emsVectorLayersCount: { dynamic: 'true', properties: {} },
-        },
-      },
-    },
-  },
-};

From 71ea1a05c3a0d05efd653011d92ad0627e1ebc23 Mon Sep 17 00:00:00 2001
From: Zacqary Adam Xeper <Zacqary@users.noreply.github.com>
Date: Thu, 25 Jun 2020 12:00:58 -0500
Subject: [PATCH 14/78] [Metrics UI] Prefill alerts from the global dropdown
 (#68967)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../inventory/components/alert_dropdown.tsx   |  12 +-
 .../hooks/use_inventory_alert_prefill.ts      |  24 ++
 .../components/alert_dropdown.tsx             |  12 +-
 .../components/expression.test.tsx            | 118 ++++++++++
 .../components/expression.tsx                 |  31 ++-
 .../components/validation.tsx                 |   2 +-
 .../use_metric_threshold_alert_prefill.ts     |  34 +++
 .../public/alerting/metric_threshold/types.ts |   9 +
 .../public/alerting/use_alert_prefill.ts      |  18 ++
 .../containers/with_kuery_autocompletion.tsx  |   2 +-
 .../infra/public/pages/metrics/index.tsx      | 216 +++++++++---------
 .../hooks/use_waffle_filters.test.ts          |  56 +++++
 .../hooks/use_waffle_filters.ts               |   5 +
 .../hooks/use_waffle_options.test.ts          |  62 +++++
 .../hooks/use_waffle_options.ts               |   8 +
 .../use_metrics_explorer_options.test.tsx     |  42 +++-
 .../hooks/use_metrics_explorer_options.ts     |  18 +-
 .../common/expression_items/threshold.tsx     |   4 +-
 18 files changed, 538 insertions(+), 135 deletions(-)
 create mode 100644 x-pack/plugins/infra/public/alerting/inventory/hooks/use_inventory_alert_prefill.ts
 create mode 100644 x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.test.tsx
 create mode 100644 x-pack/plugins/infra/public/alerting/metric_threshold/hooks/use_metric_threshold_alert_prefill.ts
 create mode 100644 x-pack/plugins/infra/public/alerting/use_alert_prefill.ts
 create mode 100644 x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_filters.test.ts
 create mode 100644 x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_options.test.ts

diff --git a/x-pack/plugins/infra/public/alerting/inventory/components/alert_dropdown.tsx b/x-pack/plugins/infra/public/alerting/inventory/components/alert_dropdown.tsx
index 47a0f037816b..04642a01c15b 100644
--- a/x-pack/plugins/infra/public/alerting/inventory/components/alert_dropdown.tsx
+++ b/x-pack/plugins/infra/public/alerting/inventory/components/alert_dropdown.tsx
@@ -7,6 +7,7 @@
 import React, { useState, useCallback, useMemo } from 'react';
 import { EuiPopover, EuiButtonEmpty, EuiContextMenuItem, EuiContextMenuPanel } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { useAlertPrefillContext } from '../../../alerting/use_alert_prefill';
 import { AlertFlyout } from './alert_flyout';
 import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
 
@@ -15,6 +16,9 @@ export const InventoryAlertDropdown = () => {
   const [flyoutVisible, setFlyoutVisible] = useState(false);
   const kibana = useKibana();
 
+  const { inventoryPrefill } = useAlertPrefillContext();
+  const { nodeType, metric, filterQuery } = inventoryPrefill;
+
   const closePopover = useCallback(() => {
     setPopoverOpen(false);
   }, [setPopoverOpen]);
@@ -57,7 +61,13 @@ export const InventoryAlertDropdown = () => {
       >
         <EuiContextMenuPanel items={menuItems} />
       </EuiPopover>
-      <AlertFlyout setVisible={setFlyoutVisible} visible={flyoutVisible} />
+      <AlertFlyout
+        setVisible={setFlyoutVisible}
+        visible={flyoutVisible}
+        nodeType={nodeType}
+        options={{ metric }}
+        filter={filterQuery}
+      />
     </>
   );
 };
diff --git a/x-pack/plugins/infra/public/alerting/inventory/hooks/use_inventory_alert_prefill.ts b/x-pack/plugins/infra/public/alerting/inventory/hooks/use_inventory_alert_prefill.ts
new file mode 100644
index 000000000000..d659057b95ed
--- /dev/null
+++ b/x-pack/plugins/infra/public/alerting/inventory/hooks/use_inventory_alert_prefill.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useState } from 'react';
+import { SnapshotMetricInput } from '../../../../common/http_api/snapshot_api';
+import { InventoryItemType } from '../../../../common/inventory_models/types';
+
+export const useInventoryAlertPrefill = () => {
+  const [nodeType, setNodeType] = useState<InventoryItemType>('host');
+  const [filterQuery, setFilterQuery] = useState<string | undefined>();
+  const [metric, setMetric] = useState<SnapshotMetricInput>({ type: 'cpu' });
+
+  return {
+    nodeType,
+    filterQuery,
+    metric,
+    setNodeType,
+    setFilterQuery,
+    setMetric,
+  };
+};
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/components/alert_dropdown.tsx b/x-pack/plugins/infra/public/alerting/metric_threshold/components/alert_dropdown.tsx
index d26575f65dfe..384a93e796db 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/components/alert_dropdown.tsx
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/components/alert_dropdown.tsx
@@ -7,14 +7,18 @@
 import React, { useState, useCallback, useMemo } from 'react';
 import { EuiPopover, EuiButtonEmpty, EuiContextMenuItem, EuiContextMenuPanel } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { AlertFlyout } from './alert_flyout';
 import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
+import { useAlertPrefillContext } from '../../use_alert_prefill';
+import { AlertFlyout } from './alert_flyout';
 
 export const MetricsAlertDropdown = () => {
   const [popoverOpen, setPopoverOpen] = useState(false);
   const [flyoutVisible, setFlyoutVisible] = useState(false);
   const kibana = useKibana();
 
+  const { metricThresholdPrefill } = useAlertPrefillContext();
+  const { groupBy, filterQuery, metrics } = metricThresholdPrefill;
+
   const closePopover = useCallback(() => {
     setPopoverOpen(false);
   }, [setPopoverOpen]);
@@ -57,7 +61,11 @@ export const MetricsAlertDropdown = () => {
       >
         <EuiContextMenuPanel items={menuItems} />
       </EuiPopover>
-      <AlertFlyout setVisible={setFlyoutVisible} visible={flyoutVisible} />
+      <AlertFlyout
+        setVisible={setFlyoutVisible}
+        visible={flyoutVisible}
+        options={{ groupBy, filterQuery, metrics }}
+      />
     </>
   );
 };
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.test.tsx b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.test.tsx
new file mode 100644
index 000000000000..fa535e28c0b7
--- /dev/null
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.test.tsx
@@ -0,0 +1,118 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { mountWithIntl, nextTick } from 'test_utils/enzyme_helpers';
+import { actionTypeRegistryMock } from '../../../../../triggers_actions_ui/public/application/action_type_registry.mock';
+import { alertTypeRegistryMock } from '../../../../../triggers_actions_ui/public/application/alert_type_registry.mock';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
+import { AlertsContextValue } from '../../../../../triggers_actions_ui/public/application/context/alerts_context';
+import { AlertContextMeta } from '../types';
+import { MetricsExplorerMetric } from '../../../../common/http_api/metrics_explorer';
+import React from 'react';
+import { Expressions } from './expression';
+import { act } from 'react-dom/test-utils';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { Comparator } from '../../../../server/lib/alerting/metric_threshold/types';
+
+jest.mock('../../../containers/source/use_source_via_http', () => ({
+  useSourceViaHttp: () => ({
+    source: { id: 'default' },
+    createDerivedIndexPattern: () => ({ fields: [], title: 'metricbeat-*' }),
+  }),
+}));
+
+describe('Expression', () => {
+  async function setup(currentOptions: {
+    metrics?: MetricsExplorerMetric[];
+    filterQuery?: string;
+    groupBy?: string;
+  }) {
+    const alertParams = {
+      criteria: [],
+      groupBy: undefined,
+      filterQueryText: '',
+    };
+
+    const mocks = coreMock.createSetup();
+    const [
+      {
+        application: { capabilities },
+      },
+    ] = await mocks.getStartServices();
+
+    const context: AlertsContextValue<AlertContextMeta> = {
+      http: mocks.http,
+      toastNotifications: mocks.notifications.toasts,
+      actionTypeRegistry: actionTypeRegistryMock.create() as any,
+      alertTypeRegistry: alertTypeRegistryMock.create() as any,
+      docLinks: mocks.docLinks,
+      capabilities: {
+        ...capabilities,
+        actions: {
+          delete: true,
+          save: true,
+          show: true,
+        },
+      },
+      metadata: {
+        currentOptions,
+      },
+    };
+
+    const wrapper = mountWithIntl(
+      <Expressions
+        alertsContext={context}
+        alertInterval="1m"
+        alertParams={alertParams}
+        errors={[]}
+        setAlertParams={(key, value) => Reflect.set(alertParams, key, value)}
+        setAlertProperty={() => {}}
+      />
+    );
+
+    const update = async () =>
+      await act(async () => {
+        await nextTick();
+        wrapper.update();
+      });
+
+    await update();
+
+    return { wrapper, update, alertParams };
+  }
+
+  it('should prefill the alert using the context metadata', async () => {
+    const currentOptions = {
+      groupBy: 'host.hostname',
+      filterQuery: 'foo',
+      metrics: [
+        { aggregation: 'avg', field: 'system.load.1' },
+        { aggregation: 'cardinality', field: 'system.cpu.user.pct' },
+      ] as MetricsExplorerMetric[],
+    };
+    const { alertParams } = await setup(currentOptions);
+    expect(alertParams.groupBy).toBe('host.hostname');
+    expect(alertParams.filterQueryText).toBe('foo');
+    expect(alertParams.criteria).toEqual([
+      {
+        metric: 'system.load.1',
+        comparator: Comparator.GT,
+        threshold: [],
+        timeSize: 1,
+        timeUnit: 'm',
+        aggType: 'avg',
+      },
+      {
+        metric: 'system.cpu.user.pct',
+        comparator: Comparator.GT,
+        threshold: [],
+        timeSize: 1,
+        timeUnit: 'm',
+        aggType: 'cardinality',
+      },
+    ]);
+  });
+});
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
index 3c3351f4ddd7..f45474f28448 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { debounce, pick } from 'lodash';
+import { debounce, pick, omit } from 'lodash';
 import { Unit } from '@elastic/datemath';
 import * as rt from 'io-ts';
 import React, { ChangeEvent, useCallback, useMemo, useEffect, useState } from 'react';
@@ -52,7 +52,7 @@ import { useSourceViaHttp } from '../../../containers/source/use_source_via_http
 import { convertKueryToElasticSearchQuery } from '../../../utils/kuery';
 
 import { ExpressionRow } from './expression_row';
-import { AlertContextMeta, TimeUnit, MetricExpression } from '../types';
+import { AlertContextMeta, TimeUnit, MetricExpression, AlertParams } from '../types';
 import { ExpressionChart } from './expression_chart';
 import { validateMetricThreshold } from './validation';
 
@@ -60,14 +60,7 @@ const FILTER_TYPING_DEBOUNCE_MS = 500;
 
 interface Props {
   errors: IErrorObject[];
-  alertParams: {
-    criteria: MetricExpression[];
-    groupBy?: string;
-    filterQuery?: string;
-    sourceId?: string;
-    filterQueryText?: string;
-    alertOnNoData?: boolean;
-  };
+  alertParams: AlertParams;
   alertsContext: AlertsContextValue<AlertContextMeta>;
   alertInterval: string;
   setAlertParams(key: string, value: any): void;
@@ -81,6 +74,7 @@ const defaultExpression = {
   timeSize: 1,
   timeUnit: 'm',
 } as MetricExpression;
+export { defaultExpression };
 
 export const Expressions: React.FC<Props> = (props) => {
   const { setAlertParams, alertParams, errors, alertsContext, alertInterval } = props;
@@ -247,6 +241,13 @@ export const Expressions: React.FC<Props> = (props) => {
     }
   }, [alertsContext.metadata, derivedIndexPattern, setAlertParams]);
 
+  const preFillAlertGroupBy = useCallback(() => {
+    const md = alertsContext.metadata;
+    if (md && md.currentOptions?.groupBy && !md.series) {
+      setAlertParams('groupBy', md.currentOptions.groupBy);
+    }
+  }, [alertsContext.metadata, setAlertParams]);
+
   const onSelectPreviewLookbackInterval = useCallback((e) => {
     setPreviewLookbackInterval(e.target.value);
     setPreviewResult(null);
@@ -286,6 +287,10 @@ export const Expressions: React.FC<Props> = (props) => {
       preFillAlertFilter();
     }
 
+    if (!alertParams.groupBy) {
+      preFillAlertGroupBy();
+    }
+
     if (!alertParams.sourceId) {
       setAlertParams('sourceId', source?.id || 'default');
     }
@@ -465,7 +470,7 @@ export const Expressions: React.FC<Props> = (props) => {
                 id="selectPreviewLookbackInterval"
                 value={previewLookbackInterval}
                 onChange={onSelectPreviewLookbackInterval}
-                options={previewOptions}
+                options={previewDOMOptions}
               />
             </EuiFlexItem>
             <EuiFlexItem grow={false}>
@@ -588,6 +593,10 @@ export const Expressions: React.FC<Props> = (props) => {
   );
 };
 
+const previewDOMOptions: Array<{ text: string; value: string }> = previewOptions.map((o) =>
+  omit(o, 'shortText')
+);
+
 // required for dynamic import
 // eslint-disable-next-line import/no-default-export
 export default Expressions;
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/components/validation.tsx b/x-pack/plugins/infra/public/alerting/metric_threshold/components/validation.tsx
index da342f0a4542..2221d3cd4fe1 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/components/validation.tsx
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/components/validation.tsx
@@ -50,7 +50,7 @@ export function validateMetricThreshold({
     if (!c.aggType) {
       errors[id].aggField.push(
         i18n.translate('xpack.infra.metrics.alertFlyout.error.aggregationRequired', {
-          defaultMessage: 'Aggreation is required.',
+          defaultMessage: 'Aggregation is required.',
         })
       );
     }
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/hooks/use_metric_threshold_alert_prefill.ts b/x-pack/plugins/infra/public/alerting/metric_threshold/hooks/use_metric_threshold_alert_prefill.ts
new file mode 100644
index 000000000000..366d6aa7003e
--- /dev/null
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/hooks/use_metric_threshold_alert_prefill.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { isEqual } from 'lodash';
+import { useState } from 'react';
+import { MetricsExplorerMetric } from '../../../../common/http_api/metrics_explorer';
+
+interface MetricThresholdPrefillOptions {
+  groupBy: string | string[] | undefined;
+  filterQuery: string | undefined;
+  metrics: MetricsExplorerMetric[];
+}
+
+export const useMetricThresholdAlertPrefill = () => {
+  const [prefillOptionsState, setPrefillOptionsState] = useState<MetricThresholdPrefillOptions>({
+    groupBy: undefined,
+    filterQuery: undefined,
+    metrics: [],
+  });
+
+  const { groupBy, filterQuery, metrics } = prefillOptionsState;
+
+  return {
+    groupBy,
+    filterQuery,
+    metrics,
+    setPrefillOptions(newState: MetricThresholdPrefillOptions) {
+      if (!isEqual(newState, prefillOptionsState)) setPrefillOptionsState(newState);
+    },
+  };
+};
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts b/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts
index feeec4b0ce8b..2f8d7ec0ba6f 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts
@@ -51,3 +51,12 @@ export interface ExpressionChartData {
   id: string;
   series: ExpressionChartSeries;
 }
+
+export interface AlertParams {
+  criteria: MetricExpression[];
+  groupBy?: string;
+  filterQuery?: string;
+  sourceId?: string;
+  filterQueryText?: string;
+  alertOnNoData?: boolean;
+}
diff --git a/x-pack/plugins/infra/public/alerting/use_alert_prefill.ts b/x-pack/plugins/infra/public/alerting/use_alert_prefill.ts
new file mode 100644
index 000000000000..eff2fe462509
--- /dev/null
+++ b/x-pack/plugins/infra/public/alerting/use_alert_prefill.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import createContainer from 'constate';
+import { useMetricThresholdAlertPrefill } from './metric_threshold/hooks/use_metric_threshold_alert_prefill';
+import { useInventoryAlertPrefill } from './inventory/hooks/use_inventory_alert_prefill';
+
+const useAlertPrefill = () => {
+  const metricThresholdPrefill = useMetricThresholdAlertPrefill();
+  const inventoryPrefill = useInventoryAlertPrefill();
+
+  return { metricThresholdPrefill, inventoryPrefill };
+};
+
+export const [AlertPrefillProvider, useAlertPrefillContext] = createContainer(useAlertPrefill);
diff --git a/x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx b/x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx
index a04897d9c738..2c76b3bb925e 100644
--- a/x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx
+++ b/x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx
@@ -59,7 +59,7 @@ class WithKueryAutocompletionComponent extends React.Component<
   ) => {
     const { indexPattern } = this.props;
     const language = 'kuery';
-    const hasQuerySuggestions = this.props.kibana.services.data.autocomplete.hasQuerySuggestions(
+    const hasQuerySuggestions = this.props.kibana.services.data?.autocomplete.hasQuerySuggestions(
       language
     );
 
diff --git a/x-pack/plugins/infra/public/pages/metrics/index.tsx b/x-pack/plugins/infra/public/pages/metrics/index.tsx
index ab7f41e3066b..121748f8e522 100644
--- a/x-pack/plugins/infra/public/pages/metrics/index.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/index.tsx
@@ -31,6 +31,7 @@ import { WaffleFiltersProvider } from './inventory_view/hooks/use_waffle_filters
 
 import { InventoryAlertDropdown } from '../../alerting/inventory/components/alert_dropdown';
 import { MetricsAlertDropdown } from '../../alerting/metric_threshold/components/alert_dropdown';
+import { AlertPrefillProvider } from '../../alerting/use_alert_prefill';
 
 const ADD_DATA_LABEL = i18n.translate('xpack.infra.metricsHeaderAddDataButtonLabel', {
   defaultMessage: 'Add data',
@@ -44,114 +45,119 @@ export const InfrastructurePage = ({ match }: RouteComponentProps) => {
   return (
     <EuiErrorBoundary>
       <Source.Provider sourceId="default">
-        <WaffleOptionsProvider>
-          <WaffleTimeProvider>
-            <WaffleFiltersProvider>
-              <ColumnarPage>
-                <DocumentTitle
-                  title={i18n.translate('xpack.infra.homePage.documentTitle', {
-                    defaultMessage: 'Metrics',
-                  })}
-                />
-
-                <HelpCenterContent
-                  feedbackLink="https://discuss.elastic.co/c/metrics"
-                  appName={i18n.translate('xpack.infra.header.infrastructureHelpAppName', {
-                    defaultMessage: 'Metrics',
-                  })}
-                />
+        <AlertPrefillProvider>
+          <WaffleOptionsProvider>
+            <WaffleTimeProvider>
+              <WaffleFiltersProvider>
+                <ColumnarPage>
+                  <DocumentTitle
+                    title={i18n.translate('xpack.infra.homePage.documentTitle', {
+                      defaultMessage: 'Metrics',
+                    })}
+                  />
 
-                <Header
-                  breadcrumbs={[
-                    {
-                      text: i18n.translate('xpack.infra.header.infrastructureTitle', {
-                        defaultMessage: 'Metrics',
-                      }),
-                    },
-                  ]}
-                  readOnlyBadge={!uiCapabilities?.infrastructure?.save}
-                />
-                <AppNavigation
-                  aria-label={i18n.translate('xpack.infra.header.infrastructureNavigationTitle', {
-                    defaultMessage: 'Metrics',
-                  })}
-                >
-                  <EuiFlexGroup gutterSize={'none'} alignItems={'center'}>
-                    <EuiFlexItem>
-                      <RoutedTabs
-                        tabs={[
-                          {
-                            app: 'metrics',
-                            title: i18n.translate('xpack.infra.homePage.inventoryTabTitle', {
-                              defaultMessage: 'Inventory',
-                            }),
-                            pathname: '/inventory',
-                          },
-                          {
-                            app: 'metrics',
-                            title: i18n.translate('xpack.infra.homePage.metricsExplorerTabTitle', {
-                              defaultMessage: 'Metrics Explorer',
-                            }),
-                            pathname: '/explorer',
-                          },
-                          {
-                            app: 'metrics',
-                            title: i18n.translate('xpack.infra.homePage.settingsTabTitle', {
-                              defaultMessage: 'Settings',
-                            }),
-                            pathname: '/settings',
-                          },
-                        ]}
-                      />
-                    </EuiFlexItem>
-                    <EuiFlexItem grow={false}>
-                      <Route path={'/explorer'} component={MetricsAlertDropdown} />
-                      <Route path={'/inventory'} component={InventoryAlertDropdown} />
-                    </EuiFlexItem>
-                    <EuiFlexItem grow={false}>
-                      <EuiButtonEmpty
-                        href={kibana.services?.application?.getUrlForApp(
-                          '/home#/tutorial_directory/metrics'
-                        )}
-                        size="s"
-                        color="primary"
-                        iconType="plusInCircle"
-                      >
-                        {ADD_DATA_LABEL}
-                      </EuiButtonEmpty>
-                    </EuiFlexItem>
-                  </EuiFlexGroup>
-                </AppNavigation>
+                  <HelpCenterContent
+                    feedbackLink="https://discuss.elastic.co/c/metrics"
+                    appName={i18n.translate('xpack.infra.header.infrastructureHelpAppName', {
+                      defaultMessage: 'Metrics',
+                    })}
+                  />
 
-                <Switch>
-                  <Route path={'/inventory'} component={SnapshotPage} />
-                  <Route
-                    path={'/explorer'}
-                    render={(props) => (
-                      <WithSource>
-                        {({ configuration, createDerivedIndexPattern }) => (
-                          <MetricsExplorerOptionsContainer.Provider>
-                            <WithMetricsExplorerOptionsUrlState />
-                            {configuration ? (
-                              <MetricsExplorerPage
-                                derivedIndexPattern={createDerivedIndexPattern('metrics')}
-                                source={configuration}
-                                {...props}
-                              />
-                            ) : (
-                              <SourceLoadingPage />
-                            )}
-                          </MetricsExplorerOptionsContainer.Provider>
-                        )}
-                      </WithSource>
-                    )}
+                  <Header
+                    breadcrumbs={[
+                      {
+                        text: i18n.translate('xpack.infra.header.infrastructureTitle', {
+                          defaultMessage: 'Metrics',
+                        }),
+                      },
+                    ]}
+                    readOnlyBadge={!uiCapabilities?.infrastructure?.save}
                   />
-                  <Route path={'/settings'} component={MetricsSettingsPage} />
-                </Switch>
-              </ColumnarPage>
-            </WaffleFiltersProvider>
-          </WaffleTimeProvider>
-        </WaffleOptionsProvider>
+                  <AppNavigation
+                    aria-label={i18n.translate('xpack.infra.header.infrastructureNavigationTitle', {
+                      defaultMessage: 'Metrics',
+                    })}
+                  >
+                    <EuiFlexGroup gutterSize={'none'} alignItems={'center'}>
+                      <EuiFlexItem>
+                        <RoutedTabs
+                          tabs={[
+                            {
+                              app: 'metrics',
+                              title: i18n.translate('xpack.infra.homePage.inventoryTabTitle', {
+                                defaultMessage: 'Inventory',
+                              }),
+                              pathname: '/inventory',
+                            },
+                            {
+                              app: 'metrics',
+                              title: i18n.translate(
+                                'xpack.infra.homePage.metricsExplorerTabTitle',
+                                {
+                                  defaultMessage: 'Metrics Explorer',
+                                }
+                              ),
+                              pathname: '/explorer',
+                            },
+                            {
+                              app: 'metrics',
+                              title: i18n.translate('xpack.infra.homePage.settingsTabTitle', {
+                                defaultMessage: 'Settings',
+                              }),
+                              pathname: '/settings',
+                            },
+                          ]}
+                        />
+                      </EuiFlexItem>
+                      <EuiFlexItem grow={false}>
+                        <Route path={'/explorer'} component={MetricsAlertDropdown} />
+                        <Route path={'/inventory'} component={InventoryAlertDropdown} />
+                      </EuiFlexItem>
+                      <EuiFlexItem grow={false}>
+                        <EuiButtonEmpty
+                          href={kibana.services?.application?.getUrlForApp(
+                            '/home#/tutorial_directory/metrics'
+                          )}
+                          size="s"
+                          color="primary"
+                          iconType="plusInCircle"
+                        >
+                          {ADD_DATA_LABEL}
+                        </EuiButtonEmpty>
+                      </EuiFlexItem>
+                    </EuiFlexGroup>
+                  </AppNavigation>
+
+                  <Switch>
+                    <Route path={'/inventory'} component={SnapshotPage} />
+                    <Route
+                      path={'/explorer'}
+                      render={(props) => (
+                        <WithSource>
+                          {({ configuration, createDerivedIndexPattern }) => (
+                            <MetricsExplorerOptionsContainer.Provider>
+                              <WithMetricsExplorerOptionsUrlState />
+                              {configuration ? (
+                                <MetricsExplorerPage
+                                  derivedIndexPattern={createDerivedIndexPattern('metrics')}
+                                  source={configuration}
+                                  {...props}
+                                />
+                              ) : (
+                                <SourceLoadingPage />
+                              )}
+                            </MetricsExplorerOptionsContainer.Provider>
+                          )}
+                        </WithSource>
+                      )}
+                    />
+                    <Route path={'/settings'} component={MetricsSettingsPage} />
+                  </Switch>
+                </ColumnarPage>
+              </WaffleFiltersProvider>
+            </WaffleTimeProvider>
+          </WaffleOptionsProvider>
+        </AlertPrefillProvider>
       </Source.Provider>
     </EuiErrorBoundary>
   );
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_filters.test.ts b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_filters.test.ts
new file mode 100644
index 000000000000..93b6b635183d
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_filters.test.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { renderHook, act } from '@testing-library/react-hooks';
+
+import { useWaffleFilters, WaffleFiltersState } from './use_waffle_filters';
+
+// Mock useUrlState hook
+jest.mock('react-router-dom', () => ({
+  useHistory: () => ({
+    location: '',
+    replace: () => {},
+  }),
+}));
+
+jest.mock('../../../../containers/source', () => ({
+  useSourceContext: () => ({
+    createDerivedIndexPattern: () => 'jestbeat-*',
+  }),
+}));
+
+let PREFILL: Record<string, any> = {};
+jest.mock('../../../../alerting/use_alert_prefill', () => ({
+  useAlertPrefillContext: () => ({
+    inventoryPrefill: {
+      setFilterQuery(filterQuery: string) {
+        PREFILL = { filterQuery };
+      },
+    },
+  }),
+}));
+
+const renderUseWaffleFiltersHook = () => renderHook(() => useWaffleFilters());
+
+describe('useWaffleFilters', () => {
+  beforeEach(() => {
+    PREFILL = {};
+  });
+
+  it('should sync the options to the inventory alert preview context', () => {
+    const { result, rerender } = renderUseWaffleFiltersHook();
+
+    const newQuery = {
+      expression: 'foo',
+      kind: 'kuery',
+    } as WaffleFiltersState;
+    act(() => {
+      result.current.applyFilterQuery(newQuery);
+    });
+    rerender();
+    expect(PREFILL.filterQuery).toEqual(newQuery.expression);
+  });
+});
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_filters.ts b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_filters.ts
index 63d9d08796f0..d4fb1356be77 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_filters.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_filters.ts
@@ -10,6 +10,7 @@ import { pipe } from 'fp-ts/lib/pipeable';
 import { fold } from 'fp-ts/lib/Either';
 import { constant, identity } from 'fp-ts/lib/function';
 import createContainter from 'constate';
+import { useAlertPrefillContext } from '../../../../alerting/use_alert_prefill';
 import { useUrlState } from '../../../../utils/use_url_state';
 import { useSourceContext } from '../../../../containers/source';
 import { convertKueryToElasticSearchQuery } from '../../../../utils/kuery';
@@ -68,6 +69,10 @@ export const useWaffleFilters = () => {
     filterQueryDraft,
   ]);
 
+  const { inventoryPrefill } = useAlertPrefillContext();
+  const prefillContext = useMemo(() => inventoryPrefill, [inventoryPrefill]); // For Jest compatibility
+  useEffect(() => prefillContext.setFilterQuery(state.expression), [prefillContext, state]);
+
   return {
     filterQuery: urlState,
     filterQueryDraft,
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_options.test.ts b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_options.test.ts
new file mode 100644
index 000000000000..579073e9500d
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_options.test.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { renderHook, act } from '@testing-library/react-hooks';
+
+import { useWaffleOptions, WaffleOptionsState } from './use_waffle_options';
+
+// Mock useUrlState hook
+jest.mock('react-router-dom', () => ({
+  useHistory: () => ({
+    location: '',
+    replace: () => {},
+  }),
+}));
+
+// Jest can't access variables outside the scope of the mock factory function except to
+// reassign them, so we can't make these both part of the same object
+let PREFILL_NODETYPE: WaffleOptionsState['nodeType'] | undefined;
+let PREFILL_METRIC: WaffleOptionsState['metric'] | undefined;
+jest.mock('../../../../alerting/use_alert_prefill', () => ({
+  useAlertPrefillContext: () => ({
+    inventoryPrefill: {
+      setNodeType(nodeType: WaffleOptionsState['nodeType']) {
+        PREFILL_NODETYPE = nodeType;
+      },
+      setMetric(metric: WaffleOptionsState['metric']) {
+        PREFILL_METRIC = metric;
+      },
+    },
+  }),
+}));
+
+const renderUseWaffleOptionsHook = () => renderHook(() => useWaffleOptions());
+
+describe('useWaffleOptions', () => {
+  beforeEach(() => {
+    PREFILL_NODETYPE = undefined;
+    PREFILL_METRIC = undefined;
+  });
+
+  it('should sync the options to the inventory alert preview context', () => {
+    const { result, rerender } = renderUseWaffleOptionsHook();
+
+    const newOptions = {
+      nodeType: 'pod',
+      metric: { type: 'memory' },
+    } as WaffleOptionsState;
+    act(() => {
+      result.current.changeNodeType(newOptions.nodeType);
+    });
+    rerender();
+    expect(PREFILL_NODETYPE).toEqual(newOptions.nodeType);
+    act(() => {
+      result.current.changeMetric(newOptions.metric);
+    });
+    rerender();
+    expect(PREFILL_METRIC).toEqual(newOptions.metric);
+  });
+});
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_options.ts b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_options.ts
index 975e33cf2415..a3132c838497 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_options.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_options.ts
@@ -10,6 +10,7 @@ import { pipe } from 'fp-ts/lib/pipeable';
 import { fold } from 'fp-ts/lib/Either';
 import { constant, identity } from 'fp-ts/lib/function';
 import createContainer from 'constate';
+import { useAlertPrefillContext } from '../../../../alerting/use_alert_prefill';
 import { InventoryColorPaletteRT } from '../../../../lib/lib';
 import {
   SnapshotMetricInput,
@@ -121,6 +122,13 @@ export const useWaffleOptions = () => {
     [setState]
   );
 
+  const { inventoryPrefill } = useAlertPrefillContext();
+  useEffect(() => {
+    const { setNodeType, setMetric } = inventoryPrefill;
+    setNodeType(state.nodeType);
+    setMetric(state.metric);
+  }, [state, inventoryPrefill]);
+
   return {
     ...DEFAULT_WAFFLE_OPTIONS_STATE,
     ...state,
diff --git a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_options.test.tsx b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_options.test.tsx
index 1381ed9da656..c35e9f17bdcc 100644
--- a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_options.test.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_options.test.tsx
@@ -4,26 +4,27 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
 import { renderHook, act } from '@testing-library/react-hooks';
 import {
   useMetricsExplorerOptions,
-  MetricsExplorerOptionsContainer,
   MetricsExplorerOptions,
   MetricsExplorerTimeOptions,
   DEFAULT_OPTIONS,
   DEFAULT_TIMERANGE,
 } from './use_metrics_explorer_options';
 
-const renderUseMetricsExplorerOptionsHook = () =>
-  renderHook(() => useMetricsExplorerOptions(), {
-    initialProps: {},
-    wrapper: ({ children }) => (
-      <MetricsExplorerOptionsContainer.Provider>
-        {children}
-      </MetricsExplorerOptionsContainer.Provider>
-    ),
-  });
+let PREFILL: Record<string, any> = {};
+jest.mock('../../../../alerting/use_alert_prefill', () => ({
+  useAlertPrefillContext: () => ({
+    metricThresholdPrefill: {
+      setPrefillOptions(opts: Record<string, any>) {
+        PREFILL = opts;
+      },
+    },
+  }),
+}));
+
+const renderUseMetricsExplorerOptionsHook = () => renderHook(() => useMetricsExplorerOptions());
 
 interface LocalStore {
   [key: string]: string;
@@ -52,6 +53,7 @@ describe('useMetricExplorerOptions', () => {
   beforeEach(() => {
     delete STORE.MetricsExplorerOptions;
     delete STORE.MetricsExplorerTimeRange;
+    PREFILL = {};
   });
 
   it('should just work', () => {
@@ -100,4 +102,22 @@ describe('useMetricExplorerOptions', () => {
     const { result } = renderUseMetricsExplorerOptionsHook();
     expect(result.current.options).toEqual(newOptions);
   });
+
+  it('should sync the options to the threshold alert preview context', () => {
+    const { result, rerender } = renderUseMetricsExplorerOptionsHook();
+
+    const newOptions: MetricsExplorerOptions = {
+      ...DEFAULT_OPTIONS,
+      metrics: [{ aggregation: 'count' }],
+      filterQuery: 'foo',
+      groupBy: 'host.hostname',
+    };
+    act(() => {
+      result.current.setOptions(newOptions);
+    });
+    rerender();
+    expect(PREFILL.metrics).toEqual(newOptions.metrics);
+    expect(PREFILL.groupBy).toEqual(newOptions.groupBy);
+    expect(PREFILL.filterQuery).toEqual(newOptions.filterQuery);
+  });
 });
diff --git a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_options.ts b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_options.ts
index 56595c09aadd..8abdffd39ed3 100644
--- a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_options.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_options.ts
@@ -5,7 +5,8 @@
  */
 
 import createContainer from 'constate';
-import { useState, useEffect, Dispatch, SetStateAction } from 'react';
+import { useState, useEffect, useMemo, Dispatch, SetStateAction } from 'react';
+import { useAlertPrefillContext } from '../../../../alerting/use_alert_prefill';
 import { MetricsExplorerColor } from '../../../../../common/color_palette';
 import {
   MetricsExplorerAggregation,
@@ -122,6 +123,21 @@ export const useMetricsExplorerOptions = () => {
     DEFAULT_CHART_OPTIONS
   );
   const [isAutoReloading, setAutoReloading] = useState<boolean>(false);
+
+  const { metricThresholdPrefill } = useAlertPrefillContext();
+  // For Jest compatibility; including metricThresholdPrefill as a dep in useEffect causes an
+  // infinite loop in test environment
+  const prefillContext = useMemo(() => metricThresholdPrefill, [metricThresholdPrefill]);
+
+  useEffect(() => {
+    if (prefillContext) {
+      const { setPrefillOptions } = prefillContext;
+      const { metrics, groupBy, filterQuery } = options;
+
+      setPrefillOptions({ metrics, groupBy, filterQuery });
+    }
+  }, [options, prefillContext]);
+
   return {
     defaultViewState: {
       options: DEFAULT_OPTIONS,
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx
index 09acf4fe1ef6..fe592aadb37a 100644
--- a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx
@@ -136,14 +136,14 @@ export const ThresholdExpression = ({
                 ) : null}
                 <EuiFlexItem grow={false}>
                   <EuiFormRow
-                    isInvalid={errors[`threshold${i}`].length > 0 || !threshold[i]}
+                    isInvalid={errors[`threshold${i}`]?.length > 0 || !threshold[i]}
                     error={errors[`threshold${i}`]}
                   >
                     <EuiFieldNumber
                       data-test-subj="alertThresholdInput"
                       min={0}
                       value={!threshold || threshold[i] === undefined ? '' : threshold[i]}
-                      isInvalid={errors[`threshold${i}`].length > 0 || !threshold[i]}
+                      isInvalid={errors[`threshold${i}`]?.length > 0 || !threshold[i]}
                       onChange={(e) => {
                         const { value } = e.target;
                         const thresholdVal = value !== '' ? parseFloat(value) : undefined;

From 86895ef89f49cc78567b4e0fdf299fde3ca67741 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=B8ren=20Louv-Jansen?= <sorenlouv@gmail.com>
Date: Thu, 25 Jun 2020 19:11:47 +0200
Subject: [PATCH 15/78] [APM] Add callout to inform users of high cardinality
 in unique transaction names (#69112)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [APM] Add callout

Showing a callout to inform the user we have detected a high cardinality in unique transaction names and enabling them how to fix it.

* Changed color and icon

* Updated copy and styling

* Check number of returned buckets

* Add translations and docs

* Update docs link

Co-authored-by: Brandon Morelli <bmorelli25@gmail.com>

* Fix tests

Co-authored-by: Casper Hübertz <casper@formgeist.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Brandon Morelli <bmorelli25@gmail.com>
---
 .../components/app/TraceOverview/index.tsx    | 12 ++-
 .../app/TransactionOverview/index.tsx         | 46 ++++++++-
 .../apm/public/hooks/useTransactionList.ts    | 26 ++++-
 .../public/services/rest/createCallApmApi.ts  | 10 +-
 .../__snapshots__/fetcher.test.ts.snap        |  4 +-
 .../__snapshots__/queries.test.ts.snap        |  4 +-
 .../lib/transaction_groups/fetcher.test.ts    |  7 +-
 .../server/lib/transaction_groups/fetcher.ts  |  7 +-
 .../server/lib/transaction_groups/index.ts    |  8 +-
 .../lib/transaction_groups/queries.test.ts    |  8 +-
 .../lib/transaction_groups/transform.test.ts  | 96 ++++++++++++++-----
 .../lib/transaction_groups/transform.ts       | 29 ++++--
 12 files changed, 202 insertions(+), 55 deletions(-)

diff --git a/x-pack/plugins/apm/public/components/app/TraceOverview/index.tsx b/x-pack/plugins/apm/public/components/app/TraceOverview/index.tsx
index cb6003c58e90..cdebb3aac129 100644
--- a/x-pack/plugins/apm/public/components/app/TraceOverview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TraceOverview/index.tsx
@@ -12,11 +12,19 @@ import { useUrlParams } from '../../../hooks/useUrlParams';
 import { useTrackPageview } from '../../../../../observability/public';
 import { LocalUIFilters } from '../../shared/LocalUIFilters';
 import { PROJECTION } from '../../../../common/projections/typings';
+import { APIReturnType } from '../../../services/rest/createCallApmApi';
+
+type TracesAPIResponse = APIReturnType<'/api/apm/traces'>;
+const DEFAULT_RESPONSE: TracesAPIResponse = {
+  items: [],
+  isAggregationAccurate: true,
+  bucketSize: 0,
+};
 
 export function TraceOverview() {
   const { urlParams, uiFilters } = useUrlParams();
   const { start, end } = urlParams;
-  const { status, data = [] } = useFetcher(
+  const { status, data = DEFAULT_RESPONSE } = useFetcher(
     (callApmApi) => {
       if (start && end) {
         return callApmApi({
@@ -56,7 +64,7 @@ export function TraceOverview() {
         <EuiFlexItem grow={7}>
           <EuiPanel>
             <TraceList
-              items={data}
+              items={data.items}
               isLoading={status === FETCH_STATUS.LOADING}
             />
           </EuiPanel>
diff --git a/x-pack/plugins/apm/public/components/app/TransactionOverview/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionOverview/index.tsx
index fc5347d08131..a1e01b61d5c1 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionOverview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionOverview/index.tsx
@@ -11,16 +11,21 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
   EuiHorizontalRule,
+  EuiCallOut,
+  EuiCode,
 } from '@elastic/eui';
 import { Location } from 'history';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { first } from 'lodash';
 import React, { useMemo } from 'react';
+import { i18n } from '@kbn/i18n';
 import { useTransactionList } from '../../../hooks/useTransactionList';
 import { useTransactionCharts } from '../../../hooks/useTransactionCharts';
 import { IUrlParams } from '../../../context/UrlParamsContext/types';
 import { TransactionCharts } from '../../shared/charts/TransactionCharts';
 import { TransactionBreakdown } from '../../shared/TransactionBreakdown';
 import { TransactionList } from './List';
+import { ElasticDocsLink } from '../../shared/Links/ElasticDocsLink';
 import { useRedirect } from './useRedirect';
 import { history } from '../../../utils/history';
 import { useLocation } from '../../../hooks/useLocation';
@@ -140,9 +145,48 @@ export function TransactionOverview() {
               <h3>Transactions</h3>
             </EuiTitle>
             <EuiSpacer size="s" />
+            {!transactionListData.isAggregationAccurate && (
+              <EuiCallOut
+                title={i18n.translate(
+                  'xpack.apm.transactionCardinalityWarning.title',
+                  {
+                    defaultMessage:
+                      'This view shows a subset of reported transactions.',
+                  }
+                )}
+                color="danger"
+                iconType="alert"
+              >
+                <p>
+                  <FormattedMessage
+                    id="xpack.apm.transactionCardinalityWarning.body"
+                    defaultMessage="The number of unique transaction names exceeds the configured value of {bucketSize}. Try reconfiguring your agents to group similar transactions or increase the value of {codeBlock}"
+                    values={{
+                      bucketSize: transactionListData.bucketSize,
+                      codeBlock: (
+                        <EuiCode>
+                          xpack.apm.ui.transactionGroupBucketSize
+                        </EuiCode>
+                      ),
+                    }}
+                  />
+
+                  <ElasticDocsLink
+                    section="/kibana"
+                    path="/troubleshooting.html#troubleshooting-too-many-transactions"
+                  >
+                    {i18n.translate(
+                      'xpack.apm.transactionCardinalityWarning.docsLink',
+                      { defaultMessage: 'Learn more in the docs' }
+                    )}
+                  </ElasticDocsLink>
+                </p>
+              </EuiCallOut>
+            )}
+            <EuiSpacer size="s" />
             <TransactionList
               isLoading={transactionListStatus === 'loading'}
-              items={transactionListData}
+              items={transactionListData.items}
             />
           </EuiPanel>
         </EuiFlexItem>
diff --git a/x-pack/plugins/apm/public/hooks/useTransactionList.ts b/x-pack/plugins/apm/public/hooks/useTransactionList.ts
index 202437ae7225..ed6bb9309a55 100644
--- a/x-pack/plugins/apm/public/hooks/useTransactionList.ts
+++ b/x-pack/plugins/apm/public/hooks/useTransactionList.ts
@@ -8,8 +8,7 @@ import { useMemo } from 'react';
 import { IUrlParams } from '../context/UrlParamsContext/types';
 import { useUiFilters } from '../context/UrlParamsContext';
 import { useFetcher } from './useFetcher';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { TransactionGroupListAPIResponse } from '../../server/lib/transaction_groups';
+import { APIReturnType } from '../services/rest/createCallApmApi';
 
 const getRelativeImpact = (
   impact: number,
@@ -21,7 +20,11 @@ const getRelativeImpact = (
     1
   );
 
-function getWithRelativeImpact(items: TransactionGroupListAPIResponse) {
+type TransactionsAPIResponse = APIReturnType<
+  '/api/apm/services/{serviceName}/transaction_groups'
+>;
+
+function getWithRelativeImpact(items: TransactionsAPIResponse['items']) {
   const impacts = items
     .map(({ impact }) => impact)
     .filter((impact) => impact !== null) as number[];
@@ -40,10 +43,16 @@ function getWithRelativeImpact(items: TransactionGroupListAPIResponse) {
   });
 }
 
+const DEFAULT_RESPONSE: TransactionsAPIResponse = {
+  items: [],
+  isAggregationAccurate: true,
+  bucketSize: 0,
+};
+
 export function useTransactionList(urlParams: IUrlParams) {
   const { serviceName, transactionType, start, end } = urlParams;
   const uiFilters = useUiFilters(urlParams);
-  const { data = [], error, status } = useFetcher(
+  const { data = DEFAULT_RESPONSE, error, status } = useFetcher(
     (callApmApi) => {
       if (serviceName && start && end && transactionType) {
         return callApmApi({
@@ -63,7 +72,14 @@ export function useTransactionList(urlParams: IUrlParams) {
     [serviceName, start, end, transactionType, uiFilters]
   );
 
-  const memoizedData = useMemo(() => getWithRelativeImpact(data), [data]);
+  const memoizedData = useMemo(
+    () => ({
+      items: getWithRelativeImpact(data.items),
+      isAggregationAccurate: data.isAggregationAccurate,
+      bucketSize: data.bucketSize,
+    }),
+    [data]
+  );
   return {
     data: memoizedData,
     status,
diff --git a/x-pack/plugins/apm/public/services/rest/createCallApmApi.ts b/x-pack/plugins/apm/public/services/rest/createCallApmApi.ts
index 44768c94f3b1..8babc72ef129 100644
--- a/x-pack/plugins/apm/public/services/rest/createCallApmApi.ts
+++ b/x-pack/plugins/apm/public/services/rest/createCallApmApi.ts
@@ -8,7 +8,7 @@ import { callApi, FetchOptions } from './callApi';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { APMAPI } from '../../../server/routes/create_apm_api';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { Client } from '../../../server/routes/typings';
+import { Client, HttpMethod } from '../../../server/routes/typings';
 
 export type APMClient = Client<APMAPI['_S']>;
 export type APMClientOptions = Omit<FetchOptions, 'query' | 'body'> & {
@@ -43,3 +43,11 @@ export function createCallApmApi(http: HttpSetup) {
     });
   }) as APMClient;
 }
+
+// infer return type from API
+export type APIReturnType<
+  TPath extends keyof APMAPI['_S'],
+  TMethod extends HttpMethod = 'GET'
+> = APMAPI['_S'][TPath] extends { [key in TMethod]: { ret: any } }
+  ? APMAPI['_S'][TPath][TMethod]['ret']
+  : unknown;
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/fetcher.test.ts.snap b/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/fetcher.test.ts.snap
index 64f06ad0a81c..087dc6afc9a5 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/fetcher.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/fetcher.test.ts.snap
@@ -46,7 +46,7 @@ Array [
               },
             },
             "composite": Object {
-              "size": 10000,
+              "size": 101,
               "sources": Array [
                 Object {
                   "service": Object {
@@ -159,7 +159,7 @@ Array [
               },
             },
             "composite": Object {
-              "size": 10000,
+              "size": 101,
               "sources": Array [
                 Object {
                   "transaction": Object {
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/queries.test.ts.snap b/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/queries.test.ts.snap
index b93f842b878c..496533cf97e6 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/queries.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/queries.test.ts.snap
@@ -44,7 +44,7 @@ Object {
           },
         },
         "composite": Object {
-          "size": 10000,
+          "size": 101,
           "sources": Array [
             Object {
               "service": Object {
@@ -153,7 +153,7 @@ Object {
           },
         },
         "composite": Object {
-          "size": 10000,
+          "size": 101,
           "sources": Array [
             Object {
               "transaction": Object {
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.test.ts b/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.test.ts
index 00702be6744e..a26c3d85a3fc 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.test.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.test.ts
@@ -39,7 +39,8 @@ describe('transactionGroupsFetcher', () => {
   describe('type: top_traces', () => {
     it('should call client.search with correct query', async () => {
       const setup = getSetup();
-      await transactionGroupsFetcher({ type: 'top_traces' }, setup);
+      const bucketSize = 100;
+      await transactionGroupsFetcher({ type: 'top_traces' }, setup, bucketSize);
       expect(setup.client.search.mock.calls).toMatchSnapshot();
     });
   });
@@ -47,13 +48,15 @@ describe('transactionGroupsFetcher', () => {
   describe('type: top_transactions', () => {
     it('should call client.search with correct query', async () => {
       const setup = getSetup();
+      const bucketSize = 100;
       await transactionGroupsFetcher(
         {
           type: 'top_transactions',
           serviceName: 'opbeans-node',
           transactionType: 'request',
         },
-        setup
+        setup,
+        bucketSize
       );
       expect(setup.client.search.mock.calls).toMatchSnapshot();
     });
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts b/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts
index d10c45ecbdbf..595ee9d8da2d 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts
@@ -36,9 +36,10 @@ interface TopTraceOptions {
 export type Options = TopTransactionOptions | TopTraceOptions;
 
 export type ESResponse = PromiseReturnType<typeof transactionGroupsFetcher>;
-export function transactionGroupsFetcher(
+export async function transactionGroupsFetcher(
   options: Options,
-  setup: Setup & SetupTimeRange & SetupUIFilters
+  setup: Setup & SetupTimeRange & SetupUIFilters,
+  bucketSize: number
 ) {
   const { client } = setup;
 
@@ -71,7 +72,7 @@ export function transactionGroupsFetcher(
       aggs: {
         transaction_groups: {
           composite: {
-            size: 10000,
+            size: bucketSize + 1, // 1 extra bucket is added to check whether the total number of buckets exceed the specified bucket size.
             sources: [
               ...(isTopTraces
                 ? [{ service: { terms: { field: SERVICE_NAME } } }]
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/index.ts b/x-pack/plugins/apm/server/lib/transaction_groups/index.ts
index 30c497512048..893e586b351a 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/index.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/index.ts
@@ -11,20 +11,18 @@ import {
 } from '../helpers/setup_request';
 import { transactionGroupsFetcher, Options } from './fetcher';
 import { transactionGroupsTransformer } from './transform';
-import { PromiseReturnType } from '../../../../observability/typings/common';
 
-export type TransactionGroupListAPIResponse = PromiseReturnType<
-  typeof getTransactionGroupList
->;
 export async function getTransactionGroupList(
   options: Options,
   setup: Setup & SetupTimeRange & SetupUIFilters
 ) {
   const { start, end } = setup;
-  const response = await transactionGroupsFetcher(options, setup);
+  const bucketSize = setup.config['xpack.apm.ui.transactionGroupBucketSize'];
+  const response = await transactionGroupsFetcher(options, setup, bucketSize);
   return transactionGroupsTransformer({
     response,
     start,
     end,
+    bucketSize,
   });
 }
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/queries.test.ts b/x-pack/plugins/apm/server/lib/transaction_groups/queries.test.ts
index 58d770bebce9..2c5aa79bb348 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/queries.test.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/queries.test.ts
@@ -18,6 +18,7 @@ describe('transaction group queries', () => {
   });
 
   it('fetches top transactions', async () => {
+    const bucketSize = 100;
     mock = await inspectSearchParams((setup) =>
       transactionGroupsFetcher(
         {
@@ -25,7 +26,8 @@ describe('transaction group queries', () => {
           serviceName: 'foo',
           transactionType: 'bar',
         },
-        setup
+        setup,
+        bucketSize
       )
     );
 
@@ -33,12 +35,14 @@ describe('transaction group queries', () => {
   });
 
   it('fetches top traces', async () => {
+    const bucketSize = 100;
     mock = await inspectSearchParams((setup) =>
       transactionGroupsFetcher(
         {
           type: 'top_traces',
         },
-        setup
+        setup,
+        bucketSize
       )
     );
 
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/transform.test.ts b/x-pack/plugins/apm/server/lib/transaction_groups/transform.test.ts
index e5ec9a8eae78..0bb29e27f021 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/transform.test.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/transform.test.ts
@@ -10,13 +10,20 @@ import { transactionGroupsTransformer } from './transform';
 
 describe('transactionGroupsTransformer', () => {
   it('should match snapshot', () => {
-    expect(
-      transactionGroupsTransformer({
-        response: transactionGroupsResponse,
-        start: 100,
-        end: 2000,
-      })
-    ).toMatchSnapshot();
+    const {
+      bucketSize,
+      isAggregationAccurate,
+      items,
+    } = transactionGroupsTransformer({
+      response: transactionGroupsResponse,
+      start: 100,
+      end: 2000,
+      bucketSize: 100,
+    });
+
+    expect(bucketSize).toBe(100);
+    expect(isAggregationAccurate).toBe(true);
+    expect(items).toMatchSnapshot();
   });
 
   it('should transform response correctly', () => {
@@ -43,17 +50,59 @@ describe('transactionGroupsTransformer', () => {
     } as unknown) as ESResponse;
 
     expect(
-      transactionGroupsTransformer({ response, start: 100, end: 20000 })
-    ).toEqual([
-      {
-        averageResponseTime: 255966.30555555556,
-        impact: 0,
-        name: 'POST /api/orders',
-        p95: 320238.5,
-        sample: 'sample source',
-        transactionsPerMinute: 542.713567839196,
+      transactionGroupsTransformer({
+        response,
+        start: 100,
+        end: 20000,
+        bucketSize: 100,
+      })
+    ).toEqual({
+      bucketSize: 100,
+      isAggregationAccurate: true,
+      items: [
+        {
+          averageResponseTime: 255966.30555555556,
+          impact: 0,
+          name: 'POST /api/orders',
+          p95: 320238.5,
+          sample: 'sample source',
+          transactionsPerMinute: 542.713567839196,
+        },
+      ],
+    });
+  });
+
+  it('`isAggregationAccurate` should be false if number of bucket is higher than `bucketSize`', () => {
+    const bucket = {
+      key: { transaction: 'POST /api/orders' },
+      doc_count: 180,
+      avg: { value: 255966.30555555556 },
+      p95: { values: { '95.0': 320238.5 } },
+      sum: { value: 3000000000 },
+      sample: {
+        hits: {
+          total: 180,
+          hits: [{ _source: 'sample source' }],
+        },
       },
-    ]);
+    };
+
+    const response = ({
+      aggregations: {
+        transaction_groups: {
+          buckets: [bucket, bucket, bucket, bucket], // four buckets returned
+        },
+      },
+    } as unknown) as ESResponse;
+
+    const { isAggregationAccurate } = transactionGroupsTransformer({
+      response,
+      start: 100,
+      end: 20000,
+      bucketSize: 3, // bucket size of three
+    });
+
+    expect(isAggregationAccurate).toEqual(false);
   });
 
   it('should calculate impact from sum', () => {
@@ -74,10 +123,13 @@ describe('transactionGroupsTransformer', () => {
       },
     } as unknown) as ESResponse;
 
-    expect(
-      transactionGroupsTransformer({ response, start: 100, end: 20000 }).map(
-        (bucket) => bucket.impact
-      )
-    ).toEqual([100, 25, 0]);
+    const { items } = transactionGroupsTransformer({
+      response,
+      start: 100,
+      end: 20000,
+      bucketSize: 100,
+    });
+
+    expect(items.map((bucket) => bucket.impact)).toEqual([100, 25, 0]);
   });
 });
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/transform.ts b/x-pack/plugins/apm/server/lib/transaction_groups/transform.ts
index 2f34d365e5be..81dba39e9d71 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/transform.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/transform.ts
@@ -8,15 +8,15 @@ import moment from 'moment';
 import { sortByOrder } from 'lodash';
 import { ESResponse } from './fetcher';
 
-function calculateRelativeImpacts(transactionGroups: ITransactionGroup[]) {
-  const values = transactionGroups
+function calculateRelativeImpacts(items: ITransactionGroup[]) {
+  const values = items
     .map(({ impact }) => impact)
     .filter((value) => value !== null) as number[];
 
   const max = Math.max(...values);
   const min = Math.min(...values);
 
-  return transactionGroups.map((bucket) => ({
+  return items.map((bucket) => ({
     ...bucket,
     impact:
       bucket.impact !== null
@@ -60,17 +60,30 @@ export function transactionGroupsTransformer({
   response,
   start,
   end,
+  bucketSize,
 }: {
   response: ESResponse;
   start: number;
   end: number;
-}): ITransactionGroup[] {
+  bucketSize: number;
+}): {
+  items: ITransactionGroup[];
+  isAggregationAccurate: boolean;
+  bucketSize: number;
+} {
   const buckets = getBuckets(response);
   const duration = moment.duration(end - start);
   const minutes = duration.asMinutes();
-  const transactionGroups = buckets.map((bucket) =>
-    getTransactionGroup(bucket, minutes)
-  );
+  const items = buckets.map((bucket) => getTransactionGroup(bucket, minutes));
 
-  return calculateRelativeImpacts(transactionGroups);
+  const itemsWithRelativeImpact = calculateRelativeImpacts(items);
+
+  return {
+    items: itemsWithRelativeImpact,
+
+    // The aggregation is considered accurate if the configured bucket size is larger or equal to the number of buckets returned
+    // the actual number of buckets retrieved are `bucketsize + 1` to detect whether it's above the limit
+    isAggregationAccurate: bucketSize >= buckets.length,
+    bucketSize,
+  };
 }

From e79e84c3fbe729f5553768d6b8b8db8c15ea1cd2 Mon Sep 17 00:00:00 2001
From: Rashmi Kulkarni <rashmi.kulkarni@elastic.co>
Date: Thu, 25 Jun 2020 10:20:28 -0700
Subject: [PATCH 16/78] Search profiler functional test -- using "test_user"
 with limited role. (#69841)

* using test_user with limited read permission to search profiler test

* gitcheck

* search profiler test using test_user
---
 .../apps/dev_tools/searchprofiler_editor.ts           |  6 ++++++
 x-pack/test/functional/config.js                      | 11 +++++++++++
 2 files changed, 17 insertions(+)

diff --git a/x-pack/test/functional/apps/dev_tools/searchprofiler_editor.ts b/x-pack/test/functional/apps/dev_tools/searchprofiler_editor.ts
index 3483ddf769e5..bf2a4192af54 100644
--- a/x-pack/test/functional/apps/dev_tools/searchprofiler_editor.ts
+++ b/x-pack/test/functional/apps/dev_tools/searchprofiler_editor.ts
@@ -12,15 +12,21 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const aceEditor = getService('aceEditor');
   const retry = getService('retry');
+  const security = getService('security');
 
   const editorTestSubjectSelector = 'searchProfilerEditor';
 
   describe('Search Profiler Editor', () => {
     before(async () => {
+      await security.testUser.setRoles(['global_devtools_read']);
       await PageObjects.common.navigateToApp('searchProfiler');
       expect(await testSubjects.exists('searchProfilerEditor')).to.be(true);
     });
 
+    after(async () => {
+      await security.testUser.restoreDefaults();
+    });
+
     it('correctly parses triple quotes in JSON', async () => {
       // The below inputs are written to work _with_ ace's autocomplete unlike console's unit test
       // counterparts in src/legacy/core_plugins/console/public/tests/src/editor.test.js
diff --git a/x-pack/test/functional/config.js b/x-pack/test/functional/config.js
index d5e3f82878d6..14e05d21b875 100644
--- a/x-pack/test/functional/config.js
+++ b/x-pack/test/functional/config.js
@@ -231,6 +231,17 @@ export default async function ({ readConfigFile }) {
           ],
         },
 
+        global_devtools_read: {
+          kibana: [
+            {
+              feature: {
+                dev_tools: ['read'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        },
+
         //Kibana feature privilege isn't specific to advancedSetting. It can be anything. https://github.com/elastic/kibana/issues/35965
         test_api_keys: {
           elasticsearch: {

From 4eafb8e1b02a0872e048b8225cf2bf71657bea44 Mon Sep 17 00:00:00 2001
From: Steph Milovic <stephanie.milovic@elastic.co>
Date: Thu, 25 Jun 2020 11:32:15 -0600
Subject: [PATCH 17/78] [Security Solution] [Timeline] fix bug for filter
 manager #69870

---
 .../draggable_wrapper_hover_content.test.tsx  | 80 ++++++++++++++++---
 .../draggable_wrapper_hover_content.tsx       | 20 +++--
 2 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
index 16207fcec3b2..ee1dc73b27fe 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
@@ -20,6 +20,7 @@ import {
   ManageGlobalTimeline,
   timelineDefaults,
 } from '../../../timelines/components/manage_timeline';
+import { TimelineId } from '../../../../common/types/timeline';
 
 jest.mock('../link_to');
 
@@ -41,9 +42,24 @@ jest.mock('uuid', () => {
 });
 
 jest.mock('../../hooks/use_add_to_timeline');
+const mockAddFilters = jest.fn();
+const mockGetTimelineFilterManager = jest.fn().mockReturnValue({
+  addFilters: mockAddFilters,
+});
+jest.mock('../../../timelines/components/manage_timeline', () => {
+  const original = jest.requireActual('../../../timelines/components/manage_timeline');
+
+  return {
+    ...original,
+    useManageTimeline: () => ({
+      getTimelineFilterManager: mockGetTimelineFilterManager,
+      isManagedTimeline: jest.fn().mockReturnValue(false),
+    }),
+  };
+});
 
 const mockUiSettingsForFilterManager = createKibanaCoreStartMock().uiSettings;
-const timelineId = 'cool-id';
+const timelineId = TimelineId.active;
 const field = 'process.name';
 const value = 'nice';
 const toggleTopN = jest.fn();
@@ -88,6 +104,9 @@ describe('DraggableWrapperHoverContent', () => {
 
   forOrOut.forEach((hoverAction) => {
     describe(`Filter ${hoverAction} value`, () => {
+      beforeEach(() => {
+        jest.clearAllMocks();
+      });
       test(`it renders the 'Filter ${hoverAction} value' button when showTopN is false`, () => {
         const wrapper = mount(
           <TestProviders>
@@ -111,21 +130,16 @@ describe('DraggableWrapperHoverContent', () => {
           wrapper.find(`[data-test-subj="filter-${hoverAction}-value"]`).first().exists()
         ).toBe(false);
       });
-
       describe('when run in the context of a timeline', () => {
-        let filterManager: FilterManager;
         let wrapper: ReactWrapper;
         let onFilterAdded: () => void;
 
         beforeEach(() => {
-          filterManager = new FilterManager(mockUiSettingsForFilterManager);
-          filterManager.addFilters = jest.fn();
           onFilterAdded = jest.fn();
           const manageTimelineForTesting = {
             [timelineId]: {
               ...timelineDefaults,
               id: timelineId,
-              filterManager,
             },
           };
 
@@ -141,7 +155,7 @@ describe('DraggableWrapperHoverContent', () => {
           wrapper.find(`[data-test-subj="filter-${hoverAction}-value"]`).first().simulate('click');
           wrapper.update();
 
-          expect(filterManager.addFilters).toBeCalledWith({
+          expect(mockAddFilters).toBeCalledWith({
             meta: {
               alias: null,
               disabled: false,
@@ -174,7 +188,9 @@ describe('DraggableWrapperHoverContent', () => {
 
           wrapper = mount(
             <TestProviders>
-              <DraggableWrapperHoverContent {...{ ...defaultProps, onFilterAdded }} />
+              <DraggableWrapperHoverContent
+                {...{ ...defaultProps, onFilterAdded, timelineId: 'not-active-timeline' }}
+              />
             </TestProviders>
           );
         });
@@ -263,7 +279,7 @@ describe('DraggableWrapperHoverContent', () => {
           wrapper.find(`[data-test-subj="filter-${hoverAction}-value"]`).first().simulate('click');
           wrapper.update();
 
-          expect(filterManager.addFilters).toBeCalledWith(expected);
+          expect(mockAddFilters).toBeCalledWith(expected);
         });
       });
 
@@ -278,7 +294,14 @@ describe('DraggableWrapperHoverContent', () => {
 
           wrapper = mount(
             <TestProviders>
-              <DraggableWrapperHoverContent {...{ ...defaultProps, onFilterAdded, value: '' }} />
+              <DraggableWrapperHoverContent
+                {...{
+                  ...defaultProps,
+                  onFilterAdded,
+                  timelineId: 'not-active-timeline',
+                  value: '',
+                }}
+              />
             </TestProviders>
           );
         });
@@ -544,4 +567,41 @@ describe('DraggableWrapperHoverContent', () => {
       expect(wrapper.find(`[data-test-subj="copy-to-clipboard"]`).first().exists()).toBe(false);
     });
   });
+
+  describe('Filter Manager', () => {
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+    test('filter manager, not active timeline', () => {
+      mount(
+        <TestProviders>
+          <DraggableWrapperHoverContent
+            {...{ ...defaultProps, timelineId: 'not-active-timeline' }}
+          />
+        </TestProviders>
+      );
+
+      expect(mockGetTimelineFilterManager).not.toBeCalled();
+    });
+    test('filter manager, active timeline', () => {
+      mount(
+        <TestProviders>
+          <DraggableWrapperHoverContent {...defaultProps} />
+        </TestProviders>
+      );
+
+      expect(mockGetTimelineFilterManager).toBeCalled();
+    });
+    test('filter manager, active timeline in draggableId', () => {
+      mount(
+        <TestProviders>
+          <DraggableWrapperHoverContent
+            {...{ ...defaultProps, draggableId: `blahblah-${TimelineId.active}-lala` }}
+          />
+        </TestProviders>
+      );
+
+      expect(mockGetTimelineFilterManager).toBeCalled();
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.tsx
index e805750cf247..4efdea5eee43 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.tsx
@@ -13,11 +13,12 @@ import { useAddToTimeline } from '../../hooks/use_add_to_timeline';
 import { WithCopyToClipboard } from '../../lib/clipboard/with_copy_to_clipboard';
 import { useKibana } from '../../lib/kibana';
 import { createFilter } from '../add_filter_to_global_search_bar';
-import { ACTIVE_TIMELINE_REDUX_ID, StatefulTopN } from '../top_n';
+import { StatefulTopN } from '../top_n';
 
 import { allowTopN } from './helpers';
 import * as i18n from './translations';
 import { useManageTimeline } from '../../../timelines/components/manage_timeline';
+import { TimelineId } from '../../../../common/types/timeline';
 
 interface Props {
   draggableId?: DraggableId;
@@ -34,7 +35,7 @@ const DraggableWrapperHoverContentComponent: React.FC<Props> = ({
   field,
   onFilterAdded,
   showTopN,
-  timelineId = ACTIVE_TIMELINE_REDUX_ID,
+  timelineId,
   toggleTopN,
   value,
 }) => {
@@ -44,11 +45,16 @@ const DraggableWrapperHoverContentComponent: React.FC<Props> = ({
     kibana.services.data.query.filterManager,
   ]);
   const { getTimelineFilterManager } = useManageTimeline();
-  const filterManager = useMemo(() => getTimelineFilterManager(timelineId) ?? filterManagerBackup, [
-    timelineId,
-    getTimelineFilterManager,
-    filterManagerBackup,
-  ]);
+
+  const filterManager = useMemo(
+    () =>
+      timelineId === TimelineId.active ||
+      (draggableId != null && draggableId?.includes(TimelineId.active))
+        ? getTimelineFilterManager(TimelineId.active)
+        : filterManagerBackup,
+    [draggableId, timelineId, getTimelineFilterManager, filterManagerBackup]
+  );
+
   const filterForValue = useCallback(() => {
     const filter =
       value?.length === 0 ? createFilter(field, undefined) : createFilter(field, value);

From d25ced2dd3f7d6f9047fee9568f127a226c94c6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Istv=C3=A1n=20Zolt=C3=A1n=20Szab=C3=B3?=
 <istvan.szabo@elastic.co>
Date: Thu, 25 Jun 2020 19:37:25 +0200
Subject: [PATCH 18/78] [ML] Changes create DFA job page title (#69925)

---
 .../data_frame_analytics/pages/analytics_management/page.tsx    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx
index c0b7d63e623c..07442124959d 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx
@@ -48,7 +48,7 @@ export const Page: FC = () => {
                 <h1>
                   <FormattedMessage
                     id="xpack.ml.dataframe.analyticsList.title"
-                    defaultMessage="Analytics jobs"
+                    defaultMessage="Data frame analytics jobs"
                   />
                   <span>&nbsp;</span>
                   <EuiBetaBadge

From e0449400eb2abc30264e66c6e6df92eade120c2e Mon Sep 17 00:00:00 2001
From: Pierre Gayvallet <pierre.gayvallet@elastic.co>
Date: Thu, 25 Jun 2020 19:46:41 +0200
Subject: [PATCH 19/78] delete testbed plugins (#69661)

* delete testbed plugins

* remove FTR tests based on KP testbed
---
 src/dev/build/tasks/copy_source_task.js       |   2 -
 src/legacy/core_plugins/testbed/README.md     |   8 --
 src/legacy/core_plugins/testbed/index.js      |  30 -----
 src/legacy/core_plugins/testbed/package.json  |   4 -
 .../core_plugins/testbed/public/index.js      |  20 ---
 .../core_plugins/testbed/public/testbed.html  |  12 --
 .../core_plugins/testbed/public/testbed.js    |  29 -----
 src/plugins/testbed/kibana.json               |   8 --
 src/plugins/testbed/public/index.ts           |  25 ----
 src/plugins/testbed/public/plugin.ts          |  48 --------
 src/plugins/testbed/server/index.ts           | 114 ------------------
 test/api_integration/apis/core/index.js       |  13 --
 12 files changed, 313 deletions(-)
 delete mode 100644 src/legacy/core_plugins/testbed/README.md
 delete mode 100644 src/legacy/core_plugins/testbed/index.js
 delete mode 100644 src/legacy/core_plugins/testbed/package.json
 delete mode 100644 src/legacy/core_plugins/testbed/public/index.js
 delete mode 100644 src/legacy/core_plugins/testbed/public/testbed.html
 delete mode 100644 src/legacy/core_plugins/testbed/public/testbed.js
 delete mode 100644 src/plugins/testbed/kibana.json
 delete mode 100644 src/plugins/testbed/public/index.ts
 delete mode 100644 src/plugins/testbed/public/plugin.ts
 delete mode 100644 src/plugins/testbed/server/index.ts

diff --git a/src/dev/build/tasks/copy_source_task.js b/src/dev/build/tasks/copy_source_task.js
index ddc6d000bca1..32eb7bf8712e 100644
--- a/src/dev/build/tasks/copy_source_task.js
+++ b/src/dev/build/tasks/copy_source_task.js
@@ -34,9 +34,7 @@ export const CopySourceTask = {
         '!src/test_utils/**',
         '!src/fixtures/**',
         '!src/legacy/core_plugins/tests_bundle/**',
-        '!src/legacy/core_plugins/testbed/**',
         '!src/legacy/core_plugins/console/public/tests/**',
-        '!src/plugins/testbed/**',
         '!src/cli/cluster/**',
         '!src/cli/repl/**',
         '!src/es_archiver/**',
diff --git a/src/legacy/core_plugins/testbed/README.md b/src/legacy/core_plugins/testbed/README.md
deleted file mode 100644
index ac50ffbb804b..000000000000
--- a/src/legacy/core_plugins/testbed/README.md
+++ /dev/null
@@ -1,8 +0,0 @@
-## Kibana Testbed
-
-Sometimes when developing for Kibana, it is useful to have an isolated routable space to demonstrate new functionality. This Testbed provides such a space.
-
-To make use of the testbed, edit the testbed.js, testbed.html, and testbed.less files as necessary. When you are done demonstrating
-your new functionality, remember to cleanup your changes and restore the testbed to its pristine state for the next person.
-
-To access the testbed, visit `http://localhost:5601/app/kibana#/testbed`
diff --git a/src/legacy/core_plugins/testbed/index.js b/src/legacy/core_plugins/testbed/index.js
deleted file mode 100644
index f0b61ea0c3de..000000000000
--- a/src/legacy/core_plugins/testbed/index.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { resolve } from 'path';
-
-export default function (kibana) {
-  return new kibana.Plugin({
-    id: 'testbed',
-    publicDir: resolve(__dirname, 'public'),
-    uiExports: {
-      hacks: ['plugins/testbed'],
-    },
-  });
-}
diff --git a/src/legacy/core_plugins/testbed/package.json b/src/legacy/core_plugins/testbed/package.json
deleted file mode 100644
index 98fcaf7eda95..000000000000
--- a/src/legacy/core_plugins/testbed/package.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
- "name": "testbed",
- "version": "kibana" 
-}
\ No newline at end of file
diff --git a/src/legacy/core_plugins/testbed/public/index.js b/src/legacy/core_plugins/testbed/public/index.js
deleted file mode 100644
index c6687de249cf..000000000000
--- a/src/legacy/core_plugins/testbed/public/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import './testbed';
diff --git a/src/legacy/core_plugins/testbed/public/testbed.html b/src/legacy/core_plugins/testbed/public/testbed.html
deleted file mode 100644
index 52455beb0236..000000000000
--- a/src/legacy/core_plugins/testbed/public/testbed.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<div class="kuiViewContent">
-  <div class="kuiViewContentItem">
-
-  <pre ng-if="testbed.data">{{ testbed.data }}</pre>
-
-    <!-- All markup within the CONTENT section below can be deleted and replaced with whatever markup you need to   demonstrate your functionality. Nothing need be preserved. -->
-    <!-- CONTENT START -->
-
-    <!-- CONTENT END -->
-
-  </div>
-</div>
diff --git a/src/legacy/core_plugins/testbed/public/testbed.js b/src/legacy/core_plugins/testbed/public/testbed.js
deleted file mode 100644
index 13005a6106ca..000000000000
--- a/src/legacy/core_plugins/testbed/public/testbed.js
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import uiRoutes from 'ui/routes';
-import template from './testbed.html';
-
-uiRoutes.when('/testbed', {
-  template: template,
-  controllerAs: 'testbed',
-  controller: class TestbedController {
-    constructor() {}
-  },
-});
diff --git a/src/plugins/testbed/kibana.json b/src/plugins/testbed/kibana.json
deleted file mode 100644
index 9afe357b7a01..000000000000
--- a/src/plugins/testbed/kibana.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "id": "testbed",
-  "version": "0.0.1",
-  "kibanaVersion": "kibana",
-  "configPath": ["core", "testbed"],
-  "server": true,
-  "ui": true
-}
diff --git a/src/plugins/testbed/public/index.ts b/src/plugins/testbed/public/index.ts
deleted file mode 100644
index 601db10f6f8b..000000000000
--- a/src/plugins/testbed/public/index.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { PluginInitializer, PluginInitializerContext } from 'kibana/public';
-import { TestbedPlugin, TestbedPluginSetup, TestbedPluginStart } from './plugin';
-
-export const plugin: PluginInitializer<TestbedPluginSetup, TestbedPluginStart> = (
-  initializerContext: PluginInitializerContext
-) => new TestbedPlugin(initializerContext);
diff --git a/src/plugins/testbed/public/plugin.ts b/src/plugins/testbed/public/plugin.ts
deleted file mode 100644
index 8c70485d9ee8..000000000000
--- a/src/plugins/testbed/public/plugin.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Plugin, CoreSetup, PluginInitializerContext } from 'kibana/public';
-
-interface ConfigType {
-  uiProp: string;
-}
-
-export class TestbedPlugin implements Plugin<TestbedPluginSetup, TestbedPluginStart> {
-  constructor(private readonly initializerContext: PluginInitializerContext) {}
-
-  public async setup(core: CoreSetup, deps: {}) {
-    const config = this.initializerContext.config.get<ConfigType>();
-
-    // eslint-disable-next-line no-console
-    console.log(`Testbed plugin set up. uiProp: '${config.uiProp}'`);
-    return {
-      foo: 'bar',
-    };
-  }
-
-  public start() {
-    // eslint-disable-next-line no-console
-    console.log(`Testbed plugin started`);
-  }
-
-  public stop() {}
-}
-
-export type TestbedPluginSetup = ReturnType<TestbedPlugin['setup']>;
-export type TestbedPluginStart = ReturnType<TestbedPlugin['start']>;
diff --git a/src/plugins/testbed/server/index.ts b/src/plugins/testbed/server/index.ts
deleted file mode 100644
index 21f97259c97f..000000000000
--- a/src/plugins/testbed/server/index.ts
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { map } from 'rxjs/operators';
-import { schema, TypeOf } from '@kbn/config-schema';
-
-import {
-  CoreSetup,
-  CoreStart,
-  Logger,
-  PluginInitializerContext,
-  PluginConfigDescriptor,
-  PluginName,
-} from 'kibana/server';
-
-const configSchema = schema.object({
-  secret: schema.string({ defaultValue: 'Not really a secret :/' }),
-  uiProp: schema.string({ defaultValue: 'Accessible from client' }),
-});
-
-type ConfigType = TypeOf<typeof configSchema>;
-
-export const config: PluginConfigDescriptor = {
-  exposeToBrowser: {
-    uiProp: true,
-  },
-  schema: configSchema,
-  deprecations: ({ rename, unused, renameFromRoot }) => [
-    rename('securityKey', 'secret'),
-    renameFromRoot('oldtestbed.uiProp', 'testbed.uiProp'),
-    unused('deprecatedProperty'),
-  ],
-};
-
-class Plugin {
-  private readonly log: Logger;
-
-  constructor(private readonly initializerContext: PluginInitializerContext) {
-    this.log = this.initializerContext.logger.get();
-  }
-
-  public setup(core: CoreSetup, deps: Record<PluginName, unknown>) {
-    this.log.debug(
-      `Setting up TestBed with core contract [${Object.keys(core)}] and deps [${Object.keys(deps)}]`
-    );
-
-    const router = core.http.createRouter();
-    router.get(
-      { path: '/requestcontext/elasticsearch', validate: false },
-      async (context, req, res) => {
-        const response = await context.core.elasticsearch.legacy.client.callAsInternalUser('ping');
-        return res.ok({ body: `Elasticsearch: ${response}` });
-      }
-    );
-
-    router.get(
-      { path: '/requestcontext/savedobjectsclient', validate: false },
-      async (context, req, res) => {
-        const response = await context.core.savedObjects.client.find({ type: 'TYPE' });
-        return res.ok({ body: `SavedObjects client: ${JSON.stringify(response)}` });
-      }
-    );
-
-    return {
-      data$: this.initializerContext.config.create<ConfigType>().pipe(
-        map((configValue) => {
-          this.log.debug(`I've got value from my config: ${configValue.secret}`);
-          return `Some exposed data derived from config: ${configValue.secret}`;
-        })
-      ),
-      pingElasticsearch: async () => {
-        const [coreStart] = await core.getStartServices();
-        return coreStart.elasticsearch.legacy.client.callAsInternalUser('ping');
-      },
-    };
-  }
-
-  public start(core: CoreStart, deps: Record<PluginName, unknown>) {
-    this.log.debug(
-      `Starting up TestBed testbed with core contract [${Object.keys(
-        core
-      )}] and deps [${Object.keys(deps)}]`
-    );
-
-    return {
-      getStartContext() {
-        return core;
-      },
-    };
-  }
-
-  public stop() {
-    this.log.debug(`Stopping TestBed`);
-  }
-}
-
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new Plugin(initializerContext);
diff --git a/test/api_integration/apis/core/index.js b/test/api_integration/apis/core/index.js
index c522acaea25a..ab9bb8d33c2d 100644
--- a/test/api_integration/apis/core/index.js
+++ b/test/api_integration/apis/core/index.js
@@ -22,19 +22,6 @@ export default function ({ getService }) {
   const supertest = getService('supertest');
 
   describe('core', () => {
-    describe('request context', () => {
-      it('provides access to elasticsearch', async () =>
-        await supertest.get('/requestcontext/elasticsearch').expect(200, 'Elasticsearch: true'));
-
-      it('provides access to SavedObjects client', async () =>
-        await supertest
-          .get('/requestcontext/savedobjectsclient')
-          .expect(
-            200,
-            'SavedObjects client: {"page":1,"per_page":20,"total":0,"saved_objects":[]}'
-          ));
-    });
-
     describe('compression', () => {
       it(`uses compression when there isn't a referer`, async () => {
         await supertest

From c7aec6ec08931363c93fe49bab97ef305bb40afa Mon Sep 17 00:00:00 2001
From: Robert Austin <robert.austin@elastic.co>
Date: Thu, 25 Jun 2020 14:54:05 -0400
Subject: [PATCH 20/78] Rename Resolver types to include 'Resolver' (#69926)

Include the word 'Resolver' in some Resolver specific types in order to
improve readability and ease of auto-importing.
---
 .../security_solution/common/endpoint/types.ts |  8 ++++----
 .../public/resolver/store/middleware.ts        |  6 +++---
 .../routes/resolver/utils/children_helper.ts   | 10 +++++++---
 .../endpoint/routes/resolver/utils/fetch.ts    |  6 +++---
 .../endpoint/routes/resolver/utils/node.ts     | 11 +++++++----
 .../api_integration/apis/endpoint/resolver.ts  | 18 +++++++++++-------
 6 files changed, 35 insertions(+), 24 deletions(-)

diff --git a/x-pack/plugins/security_solution/common/endpoint/types.ts b/x-pack/plugins/security_solution/common/endpoint/types.ts
index 4f13fd97ce44..42f5f4b220da 100644
--- a/x-pack/plugins/security_solution/common/endpoint/types.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/types.ts
@@ -74,7 +74,7 @@ export interface ResolverNodeStats {
 /**
  * A child node can also have additional children so we need to provide a pagination cursor.
  */
-export interface ChildNode extends LifecycleNode {
+export interface ResolverChildNode extends ResolverLifecycleNode {
   /**
    * A child node's pagination cursor can be null for a couple reasons:
    * 1. At the time of querying it could have no children in ES, in which case it will be marked as
@@ -89,7 +89,7 @@ export interface ChildNode extends LifecycleNode {
  * has an array of lifecycle events.
  */
 export interface ResolverChildren {
-  childNodes: ChildNode[];
+  childNodes: ResolverChildNode[];
   /**
    * This is the children cursor for the origin of a tree.
    */
@@ -116,7 +116,7 @@ export interface ResolverTree {
 /**
  * The lifecycle events (start, end etc) for a node.
  */
-export interface LifecycleNode {
+export interface ResolverLifecycleNode {
   entityID: string;
   lifecycle: ResolverEvent[];
   /**
@@ -132,7 +132,7 @@ export interface ResolverAncestry {
   /**
    * An array of ancestors with the lifecycle events grouped together
    */
-  ancestors: LifecycleNode[];
+  ancestors: ResolverLifecycleNode[];
   /**
    * A cursor for retrieving additional ancestors for a particular node. `null` indicates that there were no additional
    * ancestors when the request returned. More could have been ingested by ES after the fact though.
diff --git a/x-pack/plugins/security_solution/public/resolver/store/middleware.ts b/x-pack/plugins/security_solution/public/resolver/store/middleware.ts
index a352a076e5a9..343b4e1a1447 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/middleware.ts
@@ -12,7 +12,7 @@ import {
   ResolverEvent,
   ResolverChildren,
   ResolverAncestry,
-  LifecycleNode,
+  ResolverLifecycleNode,
   ResolverNodeStats,
   ResolverRelatedEvents,
 } from '../../../common/endpoint/types';
@@ -25,10 +25,10 @@ type MiddlewareFactory<S = ResolverState> = (
 ) => (next: Dispatch<ResolverAction>) => (action: ResolverAction) => unknown;
 
 function getLifecycleEventsAndStats(
-  nodes: LifecycleNode[],
+  nodes: ResolverLifecycleNode[],
   stats: Map<string, ResolverNodeStats>
 ): ResolverEvent[] {
-  return nodes.reduce((flattenedEvents: ResolverEvent[], currentNode: LifecycleNode) => {
+  return nodes.reduce((flattenedEvents: ResolverEvent[], currentNode: ResolverLifecycleNode) => {
     if (currentNode.lifecycle && currentNode.lifecycle.length > 0) {
       flattenedEvents.push(...currentNode.lifecycle);
     }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts
index 7a3e1fc591e8..e60e5087c30a 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts
@@ -9,7 +9,11 @@ import {
   parentEntityId,
   isProcessStart,
 } from '../../../../../common/endpoint/models/event';
-import { ChildNode, ResolverEvent, ResolverChildren } from '../../../../../common/endpoint/types';
+import {
+  ResolverChildNode,
+  ResolverEvent,
+  ResolverChildren,
+} from '../../../../../common/endpoint/types';
 import { PaginationBuilder } from './pagination';
 import { createChild } from './node';
 
@@ -17,7 +21,7 @@ import { createChild } from './node';
  * This class helps construct the children structure when building a resolver tree.
  */
 export class ChildrenNodesHelper {
-  private readonly cache: Map<string, ChildNode> = new Map();
+  private readonly cache: Map<string, ResolverChildNode> = new Map();
 
   constructor(private readonly rootID: string) {
     this.cache.set(rootID, createChild(rootID));
@@ -27,7 +31,7 @@ export class ChildrenNodesHelper {
    * Constructs a ResolverChildren response based on the children that were previously add.
    */
   getNodes(): ResolverChildren {
-    const cacheCopy: Map<string, ChildNode> = new Map(this.cache);
+    const cacheCopy: Map<string, ResolverChildNode> = new Map(this.cache);
     const rootNode = cacheCopy.get(this.rootID);
     let rootNextChild = null;
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/fetch.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/fetch.ts
index d448649ae447..0af2fca7106b 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/fetch.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/fetch.ts
@@ -10,7 +10,7 @@ import {
   ResolverRelatedEvents,
   ResolverAncestry,
   ResolverRelatedAlerts,
-  LifecycleNode,
+  ResolverLifecycleNode,
   ResolverEvent,
 } from '../../../../../common/endpoint/types';
 import {
@@ -143,7 +143,7 @@ export class Fetcher {
     return tree;
   }
 
-  private async getNode(entityID: string): Promise<LifecycleNode | undefined> {
+  private async getNode(entityID: string): Promise<ResolverLifecycleNode | undefined> {
     const query = new LifecycleQuery(this.eventsIndexPattern, this.endpointID);
     const results = await query.search(this.client, entityID);
     if (results.length === 0) {
@@ -186,7 +186,7 @@ export class Fetcher {
 
     // bucket the start and end events together for a single node
     const ancestryNodes = results.reduce(
-      (nodes: Map<string, LifecycleNode>, ancestorEvent: ResolverEvent) => {
+      (nodes: Map<string, ResolverLifecycleNode>, ancestorEvent: ResolverEvent) => {
         const nodeId = entityId(ancestorEvent);
         let node = nodes.get(nodeId);
         if (!node) {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/node.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/node.ts
index 58aa9efc1fc5..57a2ebfcc179 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/node.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/node.ts
@@ -7,10 +7,10 @@
 import {
   ResolverEvent,
   ResolverAncestry,
-  LifecycleNode,
+  ResolverLifecycleNode,
   ResolverRelatedEvents,
   ResolverTree,
-  ChildNode,
+  ResolverChildNode,
   ResolverRelatedAlerts,
 } from '../../../../../common/endpoint/types';
 
@@ -49,7 +49,7 @@ export function createRelatedAlerts(
  *
  * @param entityID the entity_id of the child
  */
-export function createChild(entityID: string): ChildNode {
+export function createChild(entityID: string): ResolverChildNode {
   const lifecycle = createLifecycle(entityID, []);
   return {
     ...lifecycle,
@@ -70,7 +70,10 @@ export function createAncestry(): ResolverAncestry {
  * @param id the entity_id that these lifecycle nodes should have
  * @param lifecycle an array of lifecycle events
  */
-export function createLifecycle(entityID: string, lifecycle: ResolverEvent[]): LifecycleNode {
+export function createLifecycle(
+  entityID: string,
+  lifecycle: ResolverEvent[]
+): ResolverLifecycleNode {
   return { entityID, lifecycle };
 }
 
diff --git a/x-pack/test/api_integration/apis/endpoint/resolver.ts b/x-pack/test/api_integration/apis/endpoint/resolver.ts
index 67b828b8df30..eeca8ee54e32 100644
--- a/x-pack/test/api_integration/apis/endpoint/resolver.ts
+++ b/x-pack/test/api_integration/apis/endpoint/resolver.ts
@@ -6,8 +6,8 @@
 import _ from 'lodash';
 import expect from '@kbn/expect';
 import {
-  ChildNode,
-  LifecycleNode,
+  ResolverChildNode,
+  ResolverLifecycleNode,
   ResolverAncestry,
   ResolverEvent,
   ResolverRelatedEvents,
@@ -35,7 +35,7 @@ import { Options, GeneratedTrees } from '../../services/resolver';
  * @param node a lifecycle node containing the start and end events for a node
  * @param nodeMap a map of entity_ids to nodes to look for the passed in `node`
  */
-const expectLifecycleNodeInMap = (node: LifecycleNode, nodeMap: Map<string, TreeNode>) => {
+const expectLifecycleNodeInMap = (node: ResolverLifecycleNode, nodeMap: Map<string, TreeNode>) => {
   const genNode = nodeMap.get(node.entityID);
   expect(genNode).to.be.ok();
   compareArrays(genNode!.lifecycle, node.lifecycle, true);
@@ -49,7 +49,11 @@ const expectLifecycleNodeInMap = (node: LifecycleNode, nodeMap: Map<string, Tree
  * @param verifyLastParent a boolean indicating whether to check the last ancestor. If the ancestors array intentionally
  *  does not contain all the ancestors, the last one will not have the parent
  */
-const verifyAncestry = (ancestors: LifecycleNode[], tree: Tree, verifyLastParent: boolean) => {
+const verifyAncestry = (
+  ancestors: ResolverLifecycleNode[],
+  tree: Tree,
+  verifyLastParent: boolean
+) => {
   // group the ancestors by their entity_id mapped to a lifecycle node
   const groupedAncestors = _.groupBy(ancestors, (ancestor) => ancestor.entityID);
   // group by parent entity_id
@@ -97,7 +101,7 @@ const verifyAncestry = (ancestors: LifecycleNode[], tree: Tree, verifyLastParent
  *
  * @param ancestors an array of ancestor nodes
  */
-const retrieveDistantAncestor = (ancestors: LifecycleNode[]) => {
+const retrieveDistantAncestor = (ancestors: ResolverLifecycleNode[]) => {
   // group the ancestors by their entity_id mapped to a lifecycle node
   const groupedAncestors = _.groupBy(ancestors, (ancestor) => ancestor.entityID);
   let node = ancestors[0];
@@ -124,7 +128,7 @@ const retrieveDistantAncestor = (ancestors: LifecycleNode[]) => {
  * @param childrenPerParent an optional number to compare that there are a certain number of children for each parent
  */
 const verifyChildren = (
-  children: ChildNode[],
+  children: ResolverChildNode[],
   tree: Tree,
   numberOfParents?: number,
   childrenPerParent?: number
@@ -210,7 +214,7 @@ const verifyStats = (
  * @param categories the related event info used when generating the resolver tree
  */
 const verifyLifecycleStats = (
-  nodes: LifecycleNode[],
+  nodes: ResolverLifecycleNode[],
   categories: RelatedEventInfo[],
   relatedAlerts: number
 ) => {

From 61a69f3825283d7c7e429090f64e37d13a750e02 Mon Sep 17 00:00:00 2001
From: Rudolf Meijering <skaapgif@gmail.com>
Date: Thu, 25 Jun 2020 21:44:57 +0200
Subject: [PATCH 21/78] Use TS to discourage SO mappings with dynamic: false /
 dynamic: true (#69927)

* Use TS to discourage SO mappings with dynamic

* Some unrelated docs changes
---
 ...re-public.chromestart.getcustomnavlink_.md | 17 +++++++++++++
 .../kibana-plugin-core-public.chromestart.md  |  2 ++
 ...ore-public.chromestart.setcustomnavlink.md | 24 +++++++++++++++++++
 .../core/server/kibana-plugin-core-server.md  |  2 +-
 ...savedobjectscomplexfieldmapping.dynamic.md | 11 ---------
 ...-server.savedobjectscomplexfieldmapping.md |  3 ++-
 .../server/saved_objects/mappings/types.ts    |  6 ++++-
 .../migrations/core/build_active_mappings.ts  |  2 ++
 src/core/server/server.api.md                 |  2 --
 .../server/saved_objects/index.ts             |  2 +-
 10 files changed, 54 insertions(+), 17 deletions(-)
 create mode 100644 docs/development/core/public/kibana-plugin-core-public.chromestart.getcustomnavlink_.md
 create mode 100644 docs/development/core/public/kibana-plugin-core-public.chromestart.setcustomnavlink.md
 delete mode 100644 docs/development/core/server/kibana-plugin-core-server.savedobjectscomplexfieldmapping.dynamic.md

diff --git a/docs/development/core/public/kibana-plugin-core-public.chromestart.getcustomnavlink_.md b/docs/development/core/public/kibana-plugin-core-public.chromestart.getcustomnavlink_.md
new file mode 100644
index 000000000000..64805eefbfea
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.chromestart.getcustomnavlink_.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [ChromeStart](./kibana-plugin-core-public.chromestart.md) &gt; [getCustomNavLink$](./kibana-plugin-core-public.chromestart.getcustomnavlink_.md)
+
+## ChromeStart.getCustomNavLink$() method
+
+Get an observable of the current custom nav link
+
+<b>Signature:</b>
+
+```typescript
+getCustomNavLink$(): Observable<Partial<ChromeNavLink> | undefined>;
+```
+<b>Returns:</b>
+
+`Observable<Partial<ChromeNavLink> | undefined>`
+
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromestart.md b/docs/development/core/public/kibana-plugin-core-public.chromestart.md
index b4eadc93fe78..e983ad50d2af 100644
--- a/docs/development/core/public/kibana-plugin-core-public.chromestart.md
+++ b/docs/development/core/public/kibana-plugin-core-public.chromestart.md
@@ -55,6 +55,7 @@ core.chrome.setHelpExtension(elem => {
 |  [getBadge$()](./kibana-plugin-core-public.chromestart.getbadge_.md) | Get an observable of the current badge |
 |  [getBrand$()](./kibana-plugin-core-public.chromestart.getbrand_.md) | Get an observable of the current brand information. |
 |  [getBreadcrumbs$()](./kibana-plugin-core-public.chromestart.getbreadcrumbs_.md) | Get an observable of the current list of breadcrumbs |
+|  [getCustomNavLink$()](./kibana-plugin-core-public.chromestart.getcustomnavlink_.md) | Get an observable of the current custom nav link |
 |  [getHelpExtension$()](./kibana-plugin-core-public.chromestart.gethelpextension_.md) | Get an observable of the current custom help conttent |
 |  [getIsNavDrawerLocked$()](./kibana-plugin-core-public.chromestart.getisnavdrawerlocked_.md) | Get an observable of the current locked state of the nav drawer. |
 |  [getIsVisible$()](./kibana-plugin-core-public.chromestart.getisvisible_.md) | Get an observable of the current visibility state of the chrome. |
@@ -64,6 +65,7 @@ core.chrome.setHelpExtension(elem => {
 |  [setBadge(badge)](./kibana-plugin-core-public.chromestart.setbadge.md) | Override the current badge |
 |  [setBrand(brand)](./kibana-plugin-core-public.chromestart.setbrand.md) | Set the brand configuration. |
 |  [setBreadcrumbs(newBreadcrumbs)](./kibana-plugin-core-public.chromestart.setbreadcrumbs.md) | Override the current set of breadcrumbs |
+|  [setCustomNavLink(newCustomNavLink)](./kibana-plugin-core-public.chromestart.setcustomnavlink.md) | Override the current set of custom nav link |
 |  [setHelpExtension(helpExtension)](./kibana-plugin-core-public.chromestart.sethelpextension.md) | Override the current set of custom help content |
 |  [setHelpSupportUrl(url)](./kibana-plugin-core-public.chromestart.sethelpsupporturl.md) | Override the default support URL shown in the help menu |
 |  [setIsVisible(isVisible)](./kibana-plugin-core-public.chromestart.setisvisible.md) | Set the temporary visibility for the chrome. This does nothing if the chrome is hidden by default and should be used to hide the chrome for things like full-screen modes with an exit button. |
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromestart.setcustomnavlink.md b/docs/development/core/public/kibana-plugin-core-public.chromestart.setcustomnavlink.md
new file mode 100644
index 000000000000..adfb57f9c5ff
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.chromestart.setcustomnavlink.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [ChromeStart](./kibana-plugin-core-public.chromestart.md) &gt; [setCustomNavLink](./kibana-plugin-core-public.chromestart.setcustomnavlink.md)
+
+## ChromeStart.setCustomNavLink() method
+
+Override the current set of custom nav link
+
+<b>Signature:</b>
+
+```typescript
+setCustomNavLink(newCustomNavLink?: Partial<ChromeNavLink>): void;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  newCustomNavLink | <code>Partial&lt;ChromeNavLink&gt;</code> |  |
+
+<b>Returns:</b>
+
+`void`
+
diff --git a/docs/development/core/server/kibana-plugin-core-server.md b/docs/development/core/server/kibana-plugin-core-server.md
index 1a03ac5ee3d1..29c340bc390f 100644
--- a/docs/development/core/server/kibana-plugin-core-server.md
+++ b/docs/development/core/server/kibana-plugin-core-server.md
@@ -150,7 +150,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [SavedObjectsBulkUpdateResponse](./kibana-plugin-core-server.savedobjectsbulkupdateresponse.md) |  |
 |  [SavedObjectsClientProviderOptions](./kibana-plugin-core-server.savedobjectsclientprovideroptions.md) | Options to control the creation of the Saved Objects Client. |
 |  [SavedObjectsClientWrapperOptions](./kibana-plugin-core-server.savedobjectsclientwrapperoptions.md) | Options passed to each SavedObjectsClientWrapperFactory to aid in creating the wrapper instance. |
-|  [SavedObjectsComplexFieldMapping](./kibana-plugin-core-server.savedobjectscomplexfieldmapping.md) | See [SavedObjectsFieldMapping](./kibana-plugin-core-server.savedobjectsfieldmapping.md) for documentation. |
+|  [SavedObjectsComplexFieldMapping](./kibana-plugin-core-server.savedobjectscomplexfieldmapping.md) | See [SavedObjectsFieldMapping](./kibana-plugin-core-server.savedobjectsfieldmapping.md) for documentation.<!-- -->Note: this type intentially doesn't include a type definition for defining the <code>dynamic</code> mapping parameter. Saved Object fields should always inherit the <code>dynamic: 'strict'</code> paramater. If you are unsure of the shape of your data use <code>type: 'object', enabled: false</code> instead. |
 |  [SavedObjectsCoreFieldMapping](./kibana-plugin-core-server.savedobjectscorefieldmapping.md) | See [SavedObjectsFieldMapping](./kibana-plugin-core-server.savedobjectsfieldmapping.md) for documentation. |
 |  [SavedObjectsCreateOptions](./kibana-plugin-core-server.savedobjectscreateoptions.md) |  |
 |  [SavedObjectsDeleteByNamespaceOptions](./kibana-plugin-core-server.savedobjectsdeletebynamespaceoptions.md) |  |
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectscomplexfieldmapping.dynamic.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectscomplexfieldmapping.dynamic.md
deleted file mode 100644
index e63e543e68d5..000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.savedobjectscomplexfieldmapping.dynamic.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [SavedObjectsComplexFieldMapping](./kibana-plugin-core-server.savedobjectscomplexfieldmapping.md) &gt; [dynamic](./kibana-plugin-core-server.savedobjectscomplexfieldmapping.dynamic.md)
-
-## SavedObjectsComplexFieldMapping.dynamic property
-
-<b>Signature:</b>
-
-```typescript
-dynamic?: string;
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectscomplexfieldmapping.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectscomplexfieldmapping.md
index 60e62212609d..a7d13b0015e3 100644
--- a/docs/development/core/server/kibana-plugin-core-server.savedobjectscomplexfieldmapping.md
+++ b/docs/development/core/server/kibana-plugin-core-server.savedobjectscomplexfieldmapping.md
@@ -6,6 +6,8 @@
 
 See [SavedObjectsFieldMapping](./kibana-plugin-core-server.savedobjectsfieldmapping.md) for documentation.
 
+Note: this type intentially doesn't include a type definition for defining the `dynamic` mapping parameter. Saved Object fields should always inherit the `dynamic: 'strict'` paramater. If you are unsure of the shape of your data use `type: 'object', enabled: false` instead.
+
 <b>Signature:</b>
 
 ```typescript
@@ -16,7 +18,6 @@ export interface SavedObjectsComplexFieldMapping
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [dynamic](./kibana-plugin-core-server.savedobjectscomplexfieldmapping.dynamic.md) | <code>string</code> |  |
 |  [properties](./kibana-plugin-core-server.savedobjectscomplexfieldmapping.properties.md) | <code>SavedObjectsMappingProperties</code> |  |
 |  [type](./kibana-plugin-core-server.savedobjectscomplexfieldmapping.type.md) | <code>string</code> |  |
 
diff --git a/src/core/server/saved_objects/mappings/types.ts b/src/core/server/saved_objects/mappings/types.ts
index 8362d1f16bd2..c037ed733549 100644
--- a/src/core/server/saved_objects/mappings/types.ts
+++ b/src/core/server/saved_objects/mappings/types.ts
@@ -145,10 +145,14 @@ export interface SavedObjectsCoreFieldMapping {
 /**
  * See {@link SavedObjectsFieldMapping} for documentation.
  *
+ * Note: this type intentially doesn't include a type definition for defining
+ * the `dynamic` mapping parameter. Saved Object fields should always inherit
+ * the `dynamic: 'strict'` paramater. If you are unsure of the shape of your
+ * data use `type: 'object', enabled: false` instead.
+ *
  * @public
  */
 export interface SavedObjectsComplexFieldMapping {
-  dynamic?: string;
   type?: string;
   properties: SavedObjectsMappingProperties;
 }
diff --git a/src/core/server/saved_objects/migrations/core/build_active_mappings.ts b/src/core/server/saved_objects/migrations/core/build_active_mappings.ts
index c2a7b11e057c..4561f4d30e10 100644
--- a/src/core/server/saved_objects/migrations/core/build_active_mappings.ts
+++ b/src/core/server/saved_objects/migrations/core/build_active_mappings.ts
@@ -130,6 +130,8 @@ function defaultMapping(): IndexMapping {
     dynamic: 'strict',
     properties: {
       migrationVersion: {
+        // Saved Objects can't redefine dynamic, but we cheat here to support migrations
+        // @ts-expect-error
         dynamic: 'true',
         type: 'object',
       },
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index 4d6316fceb56..00ec217bc858 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -1970,8 +1970,6 @@ export interface SavedObjectsClientWrapperOptions {
 
 // @public
 export interface SavedObjectsComplexFieldMapping {
-    // (undocumented)
-    dynamic?: string;
     // (undocumented)
     properties: SavedObjectsMappingProperties;
     // (undocumented)
diff --git a/x-pack/plugins/ingest_manager/server/saved_objects/index.ts b/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
index 703ddb521c83..482fe181e2b7 100644
--- a/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
+++ b/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
@@ -246,7 +246,7 @@ const savedObjectTypes: { [key: string]: SavedObjectsType } = {
         internal: { type: 'boolean' },
         removable: { type: 'boolean' },
         es_index_patterns: {
-          dynamic: 'false',
+          enabled: false,
           type: 'object',
         },
         installed: {

From 3b9bbdb1a02bfaaaaea6a36fc785bd1841859a80 Mon Sep 17 00:00:00 2001
From: Zacqary Adam Xeper <Zacqary@users.noreply.github.com>
Date: Thu, 25 Jun 2020 15:03:09 -0500
Subject: [PATCH 22/78] Fix uncaught typecheck merge conflict (#70001)

---
 .../alerting/metric_threshold/components/expression.test.tsx   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.test.tsx b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.test.tsx
index fa535e28c0b7..f6119107ac13 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.test.tsx
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.test.tsx
@@ -37,6 +37,7 @@ describe('Expression', () => {
     };
 
     const mocks = coreMock.createSetup();
+    const startMocks = coreMock.createStart();
     const [
       {
         application: { capabilities },
@@ -48,7 +49,7 @@ describe('Expression', () => {
       toastNotifications: mocks.notifications.toasts,
       actionTypeRegistry: actionTypeRegistryMock.create() as any,
       alertTypeRegistry: alertTypeRegistryMock.create() as any,
-      docLinks: mocks.docLinks,
+      docLinks: startMocks.docLinks,
       capabilities: {
         ...capabilities,
         actions: {

From 77df0365587c615bbe9d6599a31dd2e6ea5cca2e Mon Sep 17 00:00:00 2001
From: Josh Dover <me@joshdover.com>
Date: Thu, 25 Jun 2020 15:28:48 -0600
Subject: [PATCH 23/78] Add featureUsage API to licensing context provider
 (#69838)

---
 x-pack/mocks.ts                               |  2 +-
 .../features/server/routes/index.test.ts      |  4 +---
 .../licensing_route_handler_context.test.ts   | 24 +++++++++++++++++--
 .../server/licensing_route_handler_context.ts | 14 ++++++++---
 x-pack/plugins/licensing/server/mocks.ts      | 18 +++++++++++++-
 x-pack/plugins/licensing/server/plugin.ts     |  5 +++-
 x-pack/plugins/licensing/server/types.ts      | 13 +++++++---
 7 files changed, 66 insertions(+), 14 deletions(-)

diff --git a/x-pack/mocks.ts b/x-pack/mocks.ts
index 28c589bee4ba..777c8d0a0813 100644
--- a/x-pack/mocks.ts
+++ b/x-pack/mocks.ts
@@ -9,7 +9,7 @@ import { licensingMock } from './plugins/licensing/server/mocks';
 function createCoreRequestHandlerContextMock() {
   return {
     core: coreMock.createRequestHandlerContext(),
-    licensing: { license: licensingMock.createLicense() },
+    licensing: licensingMock.createRequestHandlerContext(),
   };
 }
 
diff --git a/x-pack/plugins/features/server/routes/index.test.ts b/x-pack/plugins/features/server/routes/index.test.ts
index c2e8cd6129d8..3d1efc8a479b 100644
--- a/x-pack/plugins/features/server/routes/index.test.ts
+++ b/x-pack/plugins/features/server/routes/index.test.ts
@@ -16,9 +16,7 @@ import { FeatureConfig } from '../../common';
 function createContextMock(licenseType: LicenseType = 'gold') {
   return {
     core: coreMock.createRequestHandlerContext(),
-    licensing: {
-      license: licensingMock.createLicense({ license: { type: licenseType } }),
-    },
+    licensing: licensingMock.createRequestHandlerContext({ license: { type: licenseType } }),
   };
 }
 
diff --git a/x-pack/plugins/licensing/server/licensing_route_handler_context.test.ts b/x-pack/plugins/licensing/server/licensing_route_handler_context.test.ts
index 29bff4029395..4942d21f64ee 100644
--- a/x-pack/plugins/licensing/server/licensing_route_handler_context.test.ts
+++ b/x-pack/plugins/licensing/server/licensing_route_handler_context.test.ts
@@ -5,9 +5,19 @@
  */
 
 import { BehaviorSubject } from 'rxjs';
-import { licenseMock } from '../common/licensing.mock';
 
+import { licenseMock } from '../common/licensing.mock';
 import { createRouteHandlerContext } from './licensing_route_handler_context';
+import { featureUsageMock } from './services/feature_usage_service.mock';
+import { FeatureUsageServiceStart } from './services';
+import { StartServicesAccessor } from 'src/core/server';
+import { LicensingPluginStart } from './types';
+
+const createStartServices = (
+  featureUsage: FeatureUsageServiceStart = featureUsageMock.createStart()
+): StartServicesAccessor<{}, LicensingPluginStart> => {
+  return async () => [{} as any, {}, { featureUsage } as LicensingPluginStart];
+};
 
 describe('createRouteHandlerContext', () => {
   it('returns a function providing the last license value', async () => {
@@ -15,7 +25,7 @@ describe('createRouteHandlerContext', () => {
     const secondLicense = licenseMock.createLicense();
     const license$ = new BehaviorSubject(firstLicense);
 
-    const routeHandler = createRouteHandlerContext(license$);
+    const routeHandler = createRouteHandlerContext(license$, createStartServices());
 
     const firstCtx = await routeHandler({} as any, {} as any, {} as any);
     license$.next(secondLicense);
@@ -24,4 +34,14 @@ describe('createRouteHandlerContext', () => {
     expect(firstCtx.license).toBe(firstLicense);
     expect(secondCtx.license).toBe(secondLicense);
   });
+
+  it('returns a the feature usage API', async () => {
+    const license$ = new BehaviorSubject(licenseMock.createLicense());
+    const featureUsage = featureUsageMock.createStart();
+
+    const routeHandler = createRouteHandlerContext(license$, createStartServices(featureUsage));
+    const ctx = await routeHandler({} as any, {} as any, {} as any);
+
+    expect(ctx.featureUsage).toBe(featureUsage);
+  });
 });
diff --git a/x-pack/plugins/licensing/server/licensing_route_handler_context.ts b/x-pack/plugins/licensing/server/licensing_route_handler_context.ts
index 42cb0959fc37..736a2151a3db 100644
--- a/x-pack/plugins/licensing/server/licensing_route_handler_context.ts
+++ b/x-pack/plugins/licensing/server/licensing_route_handler_context.ts
@@ -4,11 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IContextProvider, RequestHandler } from 'src/core/server';
+import { IContextProvider, RequestHandler, StartServicesAccessor } from 'src/core/server';
 import { Observable } from 'rxjs';
 import { take } from 'rxjs/operators';
 
 import { ILicense } from '../common/types';
+import { LicensingPluginStart } from './types';
 
 /**
  * Create a route handler context for access to Kibana license information.
@@ -16,9 +17,16 @@ import { ILicense } from '../common/types';
  * @public
  */
 export function createRouteHandlerContext(
-  license$: Observable<ILicense>
+  license$: Observable<ILicense>,
+  getStartServices: StartServicesAccessor<{}, LicensingPluginStart>
 ): IContextProvider<RequestHandler<any, any, any>, 'licensing'> {
   return async function licensingRouteHandlerContext() {
-    return { license: await license$.pipe(take(1)).toPromise() };
+    const [, , { featureUsage }] = await getStartServices();
+    const license = await license$.pipe(take(1)).toPromise();
+
+    return {
+      featureUsage,
+      license,
+    };
   };
 }
diff --git a/x-pack/plugins/licensing/server/mocks.ts b/x-pack/plugins/licensing/server/mocks.ts
index 0d154f76d513..1a2b543b47df 100644
--- a/x-pack/plugins/licensing/server/mocks.ts
+++ b/x-pack/plugins/licensing/server/mocks.ts
@@ -4,7 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { BehaviorSubject } from 'rxjs';
-import { LicensingPluginSetup, LicensingPluginStart } from './types';
+import {
+  LicensingPluginSetup,
+  LicensingPluginStart,
+  LicensingRequestHandlerContext,
+} from './types';
 import { licenseMock } from '../common/licensing.mock';
 import { featureUsageMock } from './services/feature_usage_service.mock';
 
@@ -43,8 +47,20 @@ const createStartMock = (): jest.Mocked<LicensingPluginStart> => {
   return mock;
 };
 
+const createRequestHandlerContextMock = (
+  ...options: Parameters<typeof licenseMock.createLicense>
+): jest.Mocked<LicensingRequestHandlerContext> => {
+  const mock: jest.Mocked<LicensingRequestHandlerContext> = {
+    license: licenseMock.createLicense(...options),
+    featureUsage: featureUsageMock.createStart(),
+  };
+
+  return mock;
+};
+
 export const licensingMock = {
   createSetup: createSetupMock,
   createStart: createStartMock,
+  createRequestHandlerContext: createRequestHandlerContextMock,
   ...licenseMock,
 };
diff --git a/x-pack/plugins/licensing/server/plugin.ts b/x-pack/plugins/licensing/server/plugin.ts
index e1aa4a1b3251..0a6964b1b829 100644
--- a/x-pack/plugins/licensing/server/plugin.ts
+++ b/x-pack/plugins/licensing/server/plugin.ts
@@ -128,7 +128,10 @@ export class LicensingPlugin implements Plugin<LicensingPluginSetup, LicensingPl
       pollingFrequency.asMilliseconds()
     );
 
-    core.http.registerRouteHandlerContext('licensing', createRouteHandlerContext(license$));
+    core.http.registerRouteHandlerContext(
+      'licensing',
+      createRouteHandlerContext(license$, core.getStartServices)
+    );
 
     registerRoutes(core.http.createRouter(), core.getStartServices);
     core.http.registerOnPreResponse(createOnPreResponseHandler(refresh, license$));
diff --git a/x-pack/plugins/licensing/server/types.ts b/x-pack/plugins/licensing/server/types.ts
index eca08b8595ef..53d9a8ddfcb8 100644
--- a/x-pack/plugins/licensing/server/types.ts
+++ b/x-pack/plugins/licensing/server/types.ts
@@ -40,11 +40,18 @@ export interface RawLicense {
   mode: LicenseType;
 }
 
+/**
+ * The APIs exposed on the `licensing` key of {@link RequestHandlerContext} for plugins that depend on licensing.
+ * @public
+ */
+export interface LicensingRequestHandlerContext {
+  featureUsage: FeatureUsageServiceStart;
+  license: ILicense;
+}
+
 declare module 'src/core/server' {
   interface RequestHandlerContext {
-    licensing: {
-      license: ILicense;
-    };
+    licensing: LicensingRequestHandlerContext;
   }
 }
 

From ae51bf03ef10dd430d41cc991fd3c436013fff44 Mon Sep 17 00:00:00 2001
From: Nick Partridge <nick.ryan.partridge@gmail.com>
Date: Thu, 25 Jun 2020 16:31:05 -0500
Subject: [PATCH 24/78] [Discover] set minBarHeight for high cardinality data
 (#69875)

---
 .../discover/public/application/angular/directives/histogram.tsx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/plugins/discover/public/application/angular/directives/histogram.tsx b/src/plugins/discover/public/application/angular/directives/histogram.tsx
index 8b646106fe52..9afe5e48bc5b 100644
--- a/src/plugins/discover/public/application/angular/directives/histogram.tsx
+++ b/src/plugins/discover/public/application/angular/directives/histogram.tsx
@@ -323,6 +323,7 @@ export class DiscoverHistogram extends Component<DiscoverHistogramProps, Discove
         />
         <HistogramBarSeries
           id="discover-histogram"
+          minBarHeight={2}
           xScaleType={ScaleType.Time}
           yScaleType={ScaleType.Linear}
           xAccessor="x"

From 83da3a8b4d6fa048384cc4c179697acaa9140a32 Mon Sep 17 00:00:00 2001
From: Joel Griffith <joel.griffith@elastic.co>
Date: Thu, 25 Jun 2020 14:48:31 -0700
Subject: [PATCH 25/78] Add reporting assets to the eslint ignore file (#69968)

---
 .eslintignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.eslintignore b/.eslintignore
index fbdd70703f3c..9de2cc287296 100644
--- a/.eslintignore
+++ b/.eslintignore
@@ -33,6 +33,7 @@ target
 /x-pack/plugins/canvas/shareable_runtime/build
 /x-pack/plugins/canvas/storybook
 /x-pack/plugins/monitoring/public/lib/jquery_flot
+/x-pack/plugins/reporting/server/export_types/printable_pdf/server/lib/pdf/assets/**
 /x-pack/legacy/plugins/infra/common/graphql/types.ts
 /x-pack/legacy/plugins/infra/public/graphql/types.ts
 /x-pack/legacy/plugins/infra/server/graphql/types.ts

From e1439052238cb7711f226d3cddbfcae22e18b157 Mon Sep 17 00:00:00 2001
From: Tim Sullivan <tsullivan@users.noreply.github.com>
Date: Thu, 25 Jun 2020 14:52:30 -0700
Subject: [PATCH 26/78] [Reporting] ReportingStore module (#69426)

* Add store class

* fix tests

* fix the createIndex bug

* add reportingstore test

* change function args

* nits

* add test for automatic index creation failure recovery
---
 x-pack/plugins/reporting/server/core.ts       |   2 +
 .../reporting/server/lib/create_queue.ts      |  16 +-
 .../reporting/server/lib/enqueue_job.ts       |  49 +-
 .../esqueue/__tests__/helpers/create_index.js | 100 -----
 .../__tests__/helpers/index_timestamp.js      |  93 ----
 .../server/lib/esqueue/__tests__/job.js       | 420 ------------------
 .../reporting/server/lib/esqueue/index.js     |  24 +-
 .../reporting/server/lib/esqueue/job.js       | 142 ------
 .../reporting/server/lib/esqueue/worker.js    |  12 +-
 x-pack/plugins/reporting/server/lib/index.ts  |   1 +
 .../reporting/server/lib/store/index.ts       |   8 +
 .../index_timestamp.ts}                       |   9 +-
 .../reporting/server/lib/store/mapping.ts     |  65 +++
 .../reporting/server/lib/store/report.test.ts |  77 ++++
 .../reporting/server/lib/store/report.ts      |  85 ++++
 .../reporting/server/lib/store/store.test.ts  | 166 +++++++
 .../reporting/server/lib/store/store.ts       | 169 +++++++
 x-pack/plugins/reporting/server/plugin.ts     |  15 +-
 .../test_helpers/create_mock_levellogger.ts   |  23 +
 .../create_mock_reportingplugin.ts            |  27 +-
 .../reporting_api_integration/services.ts     |   3 +-
 21 files changed, 665 insertions(+), 841 deletions(-)
 delete mode 100644 x-pack/plugins/reporting/server/lib/esqueue/__tests__/helpers/create_index.js
 delete mode 100644 x-pack/plugins/reporting/server/lib/esqueue/__tests__/helpers/index_timestamp.js
 delete mode 100644 x-pack/plugins/reporting/server/lib/esqueue/__tests__/job.js
 delete mode 100644 x-pack/plugins/reporting/server/lib/esqueue/job.js
 create mode 100644 x-pack/plugins/reporting/server/lib/store/index.ts
 rename x-pack/plugins/reporting/server/lib/{esqueue/helpers/index_timestamp.js => store/index_timestamp.ts} (80%)
 create mode 100644 x-pack/plugins/reporting/server/lib/store/mapping.ts
 create mode 100644 x-pack/plugins/reporting/server/lib/store/report.test.ts
 create mode 100644 x-pack/plugins/reporting/server/lib/store/report.ts
 create mode 100644 x-pack/plugins/reporting/server/lib/store/store.test.ts
 create mode 100644 x-pack/plugins/reporting/server/lib/store/store.ts
 create mode 100644 x-pack/plugins/reporting/server/test_helpers/create_mock_levellogger.ts

diff --git a/x-pack/plugins/reporting/server/core.ts b/x-pack/plugins/reporting/server/core.ts
index 9acd359fa0db..eccd6c7db169 100644
--- a/x-pack/plugins/reporting/server/core.ts
+++ b/x-pack/plugins/reporting/server/core.ts
@@ -24,6 +24,7 @@ import { screenshotsObservableFactory } from './export_types/common/lib/screensh
 import { checkLicense, getExportTypesRegistry } from './lib';
 import { ESQueueInstance } from './lib/create_queue';
 import { EnqueueJobFn } from './lib/enqueue_job';
+import { ReportingStore } from './lib/store';
 
 export interface ReportingInternalSetup {
   elasticsearch: ElasticsearchServiceSetup;
@@ -37,6 +38,7 @@ export interface ReportingInternalStart {
   browserDriverFactory: HeadlessChromiumDriverFactory;
   enqueueJob: EnqueueJobFn;
   esqueue: ESQueueInstance;
+  store: ReportingStore;
   savedObjects: SavedObjectsServiceStart;
   uiSettings: UiSettingsServiceStart;
 }
diff --git a/x-pack/plugins/reporting/server/lib/create_queue.ts b/x-pack/plugins/reporting/server/lib/create_queue.ts
index 5d09af312a41..a8dcb92c55b2 100644
--- a/x-pack/plugins/reporting/server/lib/create_queue.ts
+++ b/x-pack/plugins/reporting/server/lib/create_queue.ts
@@ -8,17 +8,16 @@ import { ReportingCore } from '../core';
 import { JobSource, TaskRunResult } from '../types';
 import { createTaggedLogger } from './create_tagged_logger'; // TODO remove createTaggedLogger once esqueue is removed
 import { createWorkerFactory } from './create_worker';
-import { Job } from './enqueue_job';
 // @ts-ignore
 import { Esqueue } from './esqueue';
 import { LevelLogger } from './level_logger';
+import { ReportingStore } from './store';
 
 interface ESQueueWorker {
   on: (event: string, handler: any) => void;
 }
 
 export interface ESQueueInstance {
-  addJob: (type: string, payload: unknown, options: object) => Job;
   registerWorker: <JobParamsType>(
     pluginId: string,
     workerFn: GenericWorkerFn<JobParamsType>,
@@ -37,26 +36,25 @@ type GenericWorkerFn<JobParamsType> = (
   ...workerRestArgs: any[]
 ) => void | Promise<TaskRunResult>;
 
-export async function createQueueFactory<JobParamsType, JobPayloadType>(
+export async function createQueueFactory(
   reporting: ReportingCore,
+  store: ReportingStore,
   logger: LevelLogger
 ): Promise<ESQueueInstance> {
   const config = reporting.getConfig();
-  const queueIndexInterval = config.get('queue', 'indexInterval');
+
+  // esqueue-related
   const queueTimeout = config.get('queue', 'timeout');
-  const queueIndex = config.get('index');
   const isPollingEnabled = config.get('queue', 'pollEnabled');
 
-  const elasticsearch = await reporting.getElasticsearchService();
+  const elasticsearch = reporting.getElasticsearchService();
   const queueOptions = {
-    interval: queueIndexInterval,
     timeout: queueTimeout,
-    dateSeparator: '.',
     client: elasticsearch.legacy.client,
     logger: createTaggedLogger(logger, ['esqueue', 'queue-worker']),
   };
 
-  const queue: ESQueueInstance = new Esqueue(queueIndex, queueOptions);
+  const queue: ESQueueInstance = new Esqueue(store, queueOptions);
 
   if (isPollingEnabled) {
     // create workers to poll the index for idle jobs waiting to be claimed and executed
diff --git a/x-pack/plugins/reporting/server/lib/enqueue_job.ts b/x-pack/plugins/reporting/server/lib/enqueue_job.ts
index 625da90f3b4f..d1554a03b938 100644
--- a/x-pack/plugins/reporting/server/lib/enqueue_job.ts
+++ b/x-pack/plugins/reporting/server/lib/enqueue_job.ts
@@ -4,39 +4,24 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EventEmitter } from 'events';
 import { KibanaRequest, RequestHandlerContext } from 'src/core/server';
 import { AuthenticatedUser } from '../../../security/server';
 import { ESQueueCreateJobFn } from '../../server/types';
 import { ReportingCore } from '../core';
-// @ts-ignore
-import { events as esqueueEvents } from './esqueue';
-import { LevelLogger } from './level_logger';
+import { LevelLogger } from './';
+import { ReportingStore, Report } from './store';
 
-interface ConfirmedJob {
-  id: string;
-  index: string;
-  _seq_no: number;
-  _primary_term: number;
-}
-
-export type Job = EventEmitter & {
-  id: string;
-  toJSON: () => {
-    id: string;
-  };
-};
-
-export type EnqueueJobFn = <JobParamsType>(
+export type EnqueueJobFn = (
   exportTypeId: string,
-  jobParams: JobParamsType,
+  jobParams: unknown,
   user: AuthenticatedUser | null,
   context: RequestHandlerContext,
   request: KibanaRequest
-) => Promise<Job>;
+) => Promise<Report>;
 
 export function enqueueJobFactory(
   reporting: ReportingCore,
+  store: ReportingStore,
   parentLogger: LevelLogger
 ): EnqueueJobFn {
   const config = reporting.getConfig();
@@ -45,16 +30,16 @@ export function enqueueJobFactory(
   const maxAttempts = config.get('capture', 'maxAttempts');
   const logger = parentLogger.clone(['queue-job']);
 
-  return async function enqueueJob<JobParamsType>(
+  return async function enqueueJob(
     exportTypeId: string,
-    jobParams: JobParamsType,
+    jobParams: unknown,
     user: AuthenticatedUser | null,
     context: RequestHandlerContext,
     request: KibanaRequest
-  ): Promise<Job> {
-    type ScheduleTaskFnType = ESQueueCreateJobFn<JobParamsType>;
+  ) {
+    type ScheduleTaskFnType = ESQueueCreateJobFn<unknown>;
+
     const username = user ? user.username : false;
-    const esqueue = await reporting.getEsqueue();
     const exportType = reporting.getExportTypesRegistry().getById(exportTypeId);
 
     if (exportType == null) {
@@ -71,16 +56,6 @@ export function enqueueJobFactory(
       max_attempts: maxAttempts,
     };
 
-    return new Promise((resolve, reject) => {
-      const job = esqueue.addJob(exportType.jobType, payload, options);
-
-      job.on(esqueueEvents.EVENT_JOB_CREATED, (createdJob: ConfirmedJob) => {
-        if (createdJob.id === job.id) {
-          logger.info(`Successfully queued job: ${createdJob.id}`);
-          resolve(job);
-        }
-      });
-      job.on(esqueueEvents.EVENT_JOB_CREATE_ERROR, reject);
-    });
+    return await store.addReport(exportType.jobType, payload, options);
   };
 }
diff --git a/x-pack/plugins/reporting/server/lib/esqueue/__tests__/helpers/create_index.js b/x-pack/plugins/reporting/server/lib/esqueue/__tests__/helpers/create_index.js
deleted file mode 100644
index 691bd4f618a1..000000000000
--- a/x-pack/plugins/reporting/server/lib/esqueue/__tests__/helpers/create_index.js
+++ /dev/null
@@ -1,100 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-import { createIndex } from '../../helpers/create_index';
-import { ClientMock } from '../fixtures/legacy_elasticsearch';
-import { constants } from '../../constants';
-
-describe('Create Index', function () {
-  describe('Does not exist', function () {
-    let client;
-    let createSpy;
-
-    beforeEach(function () {
-      client = new ClientMock();
-      createSpy = sinon.spy(client, 'callAsInternalUser').withArgs('indices.create');
-    });
-
-    it('should return true', function () {
-      const indexName = 'test-index';
-      const result = createIndex(client, indexName);
-
-      return result.then((exists) => expect(exists).to.be(true));
-    });
-
-    it('should create the index with mappings and default settings', function () {
-      const indexName = 'test-index';
-      const settings = constants.DEFAULT_SETTING_INDEX_SETTINGS;
-      const result = createIndex(client, indexName);
-
-      return result.then(function () {
-        const payload = createSpy.getCall(0).args[1];
-        sinon.assert.callCount(createSpy, 1);
-        expect(payload).to.have.property('index', indexName);
-        expect(payload).to.have.property('body');
-        expect(payload.body).to.have.property('settings');
-        expect(payload.body.settings).to.eql(settings);
-        expect(payload.body).to.have.property('mappings');
-        expect(payload.body.mappings).to.have.property('properties');
-      });
-    });
-
-    it('should create the index with custom settings', function () {
-      const indexName = 'test-index';
-      const settings = {
-        ...constants.DEFAULT_SETTING_INDEX_SETTINGS,
-        auto_expand_replicas: false,
-        number_of_shards: 3000,
-        number_of_replicas: 1,
-        format: '3000',
-      };
-      const result = createIndex(client, indexName, settings);
-
-      return result.then(function () {
-        const payload = createSpy.getCall(0).args[1];
-        sinon.assert.callCount(createSpy, 1);
-        expect(payload).to.have.property('index', indexName);
-        expect(payload).to.have.property('body');
-        expect(payload.body).to.have.property('settings');
-        expect(payload.body.settings).to.eql(settings);
-        expect(payload.body).to.have.property('mappings');
-        expect(payload.body.mappings).to.have.property('properties');
-      });
-    });
-  });
-
-  describe('Does exist', function () {
-    let client;
-    let createSpy;
-
-    beforeEach(function () {
-      client = new ClientMock();
-      sinon
-        .stub(client, 'callAsInternalUser')
-        .withArgs('indices.exists')
-        .callsFake(() => Promise.resolve(true));
-      createSpy = client.callAsInternalUser.withArgs('indices.create');
-    });
-
-    it('should return true', function () {
-      const indexName = 'test-index';
-      const result = createIndex(client, indexName);
-
-      return result.then((exists) => expect(exists).to.be(true));
-    });
-
-    it('should not create the index', function () {
-      const indexName = 'test-index';
-      const result = createIndex(client, indexName);
-
-      return result.then(function () {
-        sinon.assert.callCount(createSpy, 0);
-      });
-    });
-  });
-});
diff --git a/x-pack/plugins/reporting/server/lib/esqueue/__tests__/helpers/index_timestamp.js b/x-pack/plugins/reporting/server/lib/esqueue/__tests__/helpers/index_timestamp.js
deleted file mode 100644
index 71dc8a363e42..000000000000
--- a/x-pack/plugins/reporting/server/lib/esqueue/__tests__/helpers/index_timestamp.js
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-import moment from 'moment';
-import { constants } from '../../constants';
-import { indexTimestamp } from '../../helpers/index_timestamp';
-
-const anchor = '2016-04-02T01:02:03.456'; // saturday
-
-describe('Index timestamp interval', function () {
-  describe('construction', function () {
-    it('should throw given an invalid interval', function () {
-      const init = () => indexTimestamp('bananas');
-      expect(init).to.throwException(/invalid.+interval/i);
-    });
-  });
-
-  describe('timestamps', function () {
-    let clock;
-    let separator;
-
-    beforeEach(function () {
-      separator = constants.DEFAULT_SETTING_DATE_SEPARATOR;
-      clock = sinon.useFakeTimers(moment(anchor).valueOf());
-    });
-
-    afterEach(function () {
-      clock.restore();
-    });
-
-    describe('formats', function () {
-      it('should return the year', function () {
-        const timestamp = indexTimestamp('year');
-        const str = `2016`;
-        expect(timestamp).to.equal(str);
-      });
-
-      it('should return the year and month', function () {
-        const timestamp = indexTimestamp('month');
-        const str = `2016${separator}04`;
-        expect(timestamp).to.equal(str);
-      });
-
-      it('should return the year, month, and first day of the week', function () {
-        const timestamp = indexTimestamp('week');
-        const str = `2016${separator}03${separator}27`;
-        expect(timestamp).to.equal(str);
-      });
-
-      it('should return the year, month, and day of the week', function () {
-        const timestamp = indexTimestamp('day');
-        const str = `2016${separator}04${separator}02`;
-        expect(timestamp).to.equal(str);
-      });
-
-      it('should return the year, month, day and hour', function () {
-        const timestamp = indexTimestamp('hour');
-        const str = `2016${separator}04${separator}02${separator}01`;
-        expect(timestamp).to.equal(str);
-      });
-
-      it('should return the year, month, day, hour and minute', function () {
-        const timestamp = indexTimestamp('minute');
-        const str = `2016${separator}04${separator}02${separator}01${separator}02`;
-        expect(timestamp).to.equal(str);
-      });
-    });
-
-    describe('date separator', function () {
-      it('should be customizable', function () {
-        const separators = ['-', '.', '_'];
-        separators.forEach((customSep) => {
-          const str = `2016${customSep}04${customSep}02${customSep}01${customSep}02`;
-          const timestamp = indexTimestamp('minute', customSep);
-          expect(timestamp).to.equal(str);
-        });
-      });
-
-      it('should throw if a letter is used', function () {
-        const separators = ['a', 'B', 'YYYY'];
-        separators.forEach((customSep) => {
-          const fn = () => indexTimestamp('minute', customSep);
-          expect(fn).to.throwException();
-        });
-      });
-    });
-  });
-});
diff --git a/x-pack/plugins/reporting/server/lib/esqueue/__tests__/job.js b/x-pack/plugins/reporting/server/lib/esqueue/__tests__/job.js
deleted file mode 100644
index 955eed8d6572..000000000000
--- a/x-pack/plugins/reporting/server/lib/esqueue/__tests__/job.js
+++ /dev/null
@@ -1,420 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import events from 'events';
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-import proxyquire from 'proxyquire';
-import { QueueMock } from './fixtures/queue';
-import { ClientMock } from './fixtures/legacy_elasticsearch';
-import { constants } from '../constants';
-
-const createIndexMock = sinon.stub();
-const { Job } = proxyquire.noPreserveCache()('../job', {
-  './helpers/create_index': { createIndex: createIndexMock },
-});
-
-const maxPriority = 20;
-const minPriority = -20;
-const defaultPriority = 10;
-const defaultCreatedBy = false;
-
-function validateDoc(spy) {
-  sinon.assert.callCount(spy, 1);
-  const spyCall = spy.getCall(0);
-  return spyCall.args[1];
-}
-
-describe('Job Class', function () {
-  let mockQueue;
-  let client;
-  let index;
-
-  let type;
-  let payload;
-  let options;
-
-  beforeEach(function () {
-    createIndexMock.resetHistory();
-    createIndexMock.returns(Promise.resolve('mock'));
-    index = 'test';
-
-    client = new ClientMock();
-    mockQueue = new QueueMock();
-    mockQueue.setClient(client);
-  });
-
-  it('should be an event emitter', function () {
-    const job = new Job(mockQueue, index, 'test', {});
-    expect(job).to.be.an(events.EventEmitter);
-  });
-
-  describe('invalid construction', function () {
-    it('should throw with a missing type', function () {
-      const init = () => new Job(mockQueue, index);
-      expect(init).to.throwException(/type.+string/i);
-    });
-
-    it('should throw with an invalid type', function () {
-      const init = () => new Job(mockQueue, index, { 'not a string': true });
-      expect(init).to.throwException(/type.+string/i);
-    });
-
-    it('should throw with an invalid payload', function () {
-      const init = () => new Job(mockQueue, index, 'type1', [1, 2, 3]);
-      expect(init).to.throwException(/plain.+object/i);
-    });
-
-    it(`should throw error if invalid maxAttempts`, function () {
-      const init = () => new Job(mockQueue, index, 'type1', { id: '123' }, { max_attempts: -1 });
-      expect(init).to.throwException(/invalid.+max_attempts/i);
-    });
-  });
-
-  describe('construction', function () {
-    let indexSpy;
-    beforeEach(function () {
-      type = 'type1';
-      payload = { id: '123' };
-      indexSpy = sinon.spy(client, 'callAsInternalUser').withArgs('index');
-    });
-
-    it('should create the target index', function () {
-      const job = new Job(mockQueue, index, type, payload, options);
-      return job.ready.then(() => {
-        sinon.assert.calledOnce(createIndexMock);
-        const args = createIndexMock.getCall(0).args;
-        expect(args[0]).to.equal(client);
-        expect(args[1]).to.equal(index);
-      });
-    });
-
-    it('should index the payload', function () {
-      const job = new Job(mockQueue, index, type, payload);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs).to.have.property('index', index);
-        expect(indexArgs).to.have.property('body');
-        expect(indexArgs.body).to.have.property('payload', payload);
-      });
-    });
-
-    it('should index the job type', function () {
-      const job = new Job(mockQueue, index, type, payload);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs).to.have.property('index', index);
-        expect(indexArgs).to.have.property('body');
-        expect(indexArgs.body).to.have.property('jobtype', type);
-      });
-    });
-
-    it('should set event creation time', function () {
-      const job = new Job(mockQueue, index, type, payload);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('created_at');
-      });
-    });
-
-    it('should refresh the index', function () {
-      const refreshSpy = client.callAsInternalUser.withArgs('indices.refresh');
-
-      const job = new Job(mockQueue, index, type, payload);
-      return job.ready.then(() => {
-        sinon.assert.calledOnce(refreshSpy);
-        const spyCall = refreshSpy.getCall(0);
-        expect(spyCall.args[1]).to.have.property('index', index);
-      });
-    });
-
-    it('should emit the job information on success', function (done) {
-      const job = new Job(mockQueue, index, type, payload);
-      job.once(constants.EVENT_JOB_CREATED, (jobDoc) => {
-        try {
-          expect(jobDoc).to.have.property('id');
-          expect(jobDoc).to.have.property('index');
-          expect(jobDoc).to.have.property('_seq_no');
-          expect(jobDoc).to.have.property('_primary_term');
-          done();
-        } catch (e) {
-          done(e);
-        }
-      });
-    });
-
-    it('should emit error on index creation failure', function (done) {
-      const errMsg = 'test index creation failure';
-
-      createIndexMock.returns(Promise.reject(new Error(errMsg)));
-      const job = new Job(mockQueue, index, type, payload);
-
-      job.once(constants.EVENT_JOB_CREATE_ERROR, (err) => {
-        try {
-          expect(err.message).to.equal(errMsg);
-          done();
-        } catch (e) {
-          done(e);
-        }
-      });
-    });
-
-    it('should emit error on client index failure', function (done) {
-      const errMsg = 'test document index failure';
-
-      client.callAsInternalUser.restore();
-      sinon
-        .stub(client, 'callAsInternalUser')
-        .withArgs('index')
-        .callsFake(() => Promise.reject(new Error(errMsg)));
-      const job = new Job(mockQueue, index, type, payload);
-
-      job.once(constants.EVENT_JOB_CREATE_ERROR, (err) => {
-        try {
-          expect(err.message).to.equal(errMsg);
-          done();
-        } catch (e) {
-          done(e);
-        }
-      });
-    });
-  });
-
-  describe('event emitting', function () {
-    it('should trigger events on the queue instance', function (done) {
-      const eventName = 'test event';
-      const payload1 = {
-        test: true,
-        deep: { object: 'ok' },
-      };
-      const payload2 = 'two';
-      const payload3 = new Error('test error');
-
-      const job = new Job(mockQueue, index, type, payload, options);
-
-      mockQueue.on(eventName, (...args) => {
-        try {
-          expect(args[0]).to.equal(payload1);
-          expect(args[1]).to.equal(payload2);
-          expect(args[2]).to.equal(payload3);
-          done();
-        } catch (e) {
-          done(e);
-        }
-      });
-
-      job.emit(eventName, payload1, payload2, payload3);
-    });
-  });
-
-  describe('default values', function () {
-    let indexSpy;
-    beforeEach(function () {
-      type = 'type1';
-      payload = { id: '123' };
-      indexSpy = sinon.spy(client, 'callAsInternalUser').withArgs('index');
-    });
-
-    it('should set attempt count to 0', function () {
-      const job = new Job(mockQueue, index, type, payload);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('attempts', 0);
-      });
-    });
-
-    it('should index default created_by value', function () {
-      const job = new Job(mockQueue, index, type, payload);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('created_by', defaultCreatedBy);
-      });
-    });
-
-    it('should set an expired process_expiration time', function () {
-      const now = new Date().getTime();
-      const job = new Job(mockQueue, index, type, payload);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('process_expiration');
-        expect(indexArgs.body.process_expiration.getTime()).to.be.lessThan(now);
-      });
-    });
-
-    it('should set status as pending', function () {
-      const job = new Job(mockQueue, index, type, payload);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('status', constants.JOB_STATUS_PENDING);
-      });
-    });
-
-    it('should have a default priority of 10', function () {
-      const job = new Job(mockQueue, index, type, payload, options);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('priority', defaultPriority);
-      });
-    });
-
-    it('should set a browser type', function () {
-      const job = new Job(mockQueue, index, type, payload);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('browser_type');
-      });
-    });
-  });
-
-  describe('option passing', function () {
-    let indexSpy;
-    beforeEach(function () {
-      type = 'type1';
-      payload = { id: '123' };
-      options = {
-        timeout: 4567,
-        max_attempts: 9,
-        headers: {
-          authorization: 'Basic cXdlcnR5',
-        },
-      };
-      indexSpy = sinon.spy(client, 'callAsInternalUser').withArgs('index');
-    });
-
-    it('should index the created_by value', function () {
-      const createdBy = 'user_identifier';
-      const job = new Job(mockQueue, index, type, payload, {
-        created_by: createdBy,
-        ...options,
-      });
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('created_by', createdBy);
-      });
-    });
-
-    it('should index timeout value from options', function () {
-      const job = new Job(mockQueue, index, type, payload, options);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('timeout', options.timeout);
-      });
-    });
-
-    it('should set max attempt count', function () {
-      const job = new Job(mockQueue, index, type, payload, options);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('max_attempts', options.max_attempts);
-      });
-    });
-
-    it('should add headers to the request params', function () {
-      const job = new Job(mockQueue, index, type, payload, options);
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs).to.have.property('headers', options.headers);
-      });
-    });
-
-    it(`should use upper priority of ${maxPriority}`, function () {
-      const job = new Job(mockQueue, index, type, payload, { priority: maxPriority * 2 });
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('priority', maxPriority);
-      });
-    });
-
-    it(`should use lower priority of ${minPriority}`, function () {
-      const job = new Job(mockQueue, index, type, payload, { priority: minPriority * 2 });
-      return job.ready.then(() => {
-        const indexArgs = validateDoc(indexSpy);
-        expect(indexArgs.body).to.have.property('priority', minPriority);
-      });
-    });
-  });
-
-  describe('get method', function () {
-    beforeEach(function () {
-      type = 'type2';
-      payload = { id: '123' };
-    });
-
-    it('should return the job document', function () {
-      const job = new Job(mockQueue, index, type, payload);
-
-      return job.get().then((doc) => {
-        const jobDoc = job.document; // document should be resolved
-        expect(doc).to.have.property('index', index);
-        expect(doc).to.have.property('id', jobDoc.id);
-        expect(doc).to.have.property('_seq_no', jobDoc._seq_no);
-        expect(doc).to.have.property('_primary_term', jobDoc._primary_term);
-        expect(doc).to.have.property('created_by', defaultCreatedBy);
-
-        expect(doc).to.have.property('payload');
-        expect(doc).to.have.property('jobtype');
-        expect(doc).to.have.property('priority');
-        expect(doc).to.have.property('timeout');
-      });
-    });
-
-    it('should contain optional data', function () {
-      const optionals = {
-        created_by: 'some_ident',
-      };
-
-      const job = new Job(mockQueue, index, type, payload, optionals);
-      return Promise.resolve(client.callAsInternalUser('get', {}, optionals))
-        .then((doc) => {
-          sinon.stub(client, 'callAsInternalUser').withArgs('get').returns(Promise.resolve(doc));
-        })
-        .then(() => {
-          return job.get().then((doc) => {
-            expect(doc).to.have.property('created_by', optionals.created_by);
-          });
-        });
-    });
-  });
-
-  describe('toJSON method', function () {
-    beforeEach(function () {
-      type = 'type2';
-      payload = { id: '123' };
-      options = {
-        timeout: 4567,
-        max_attempts: 9,
-        priority: 8,
-      };
-    });
-
-    it('should return the static information about the job', function () {
-      const job = new Job(mockQueue, index, type, payload, options);
-
-      // toJSON is sync, should work before doc is written to elasticsearch
-      expect(job.document).to.be(undefined);
-
-      const doc = job.toJSON();
-      expect(doc).to.have.property('index', index);
-      expect(doc).to.have.property('jobtype', type);
-      expect(doc).to.have.property('created_by', defaultCreatedBy);
-      expect(doc).to.have.property('timeout', options.timeout);
-      expect(doc).to.have.property('max_attempts', options.max_attempts);
-      expect(doc).to.have.property('priority', options.priority);
-      expect(doc).to.have.property('id');
-      expect(doc).to.not.have.property('version');
-    });
-
-    it('should contain optional data', function () {
-      const optionals = {
-        created_by: 'some_ident',
-      };
-
-      const job = new Job(mockQueue, index, type, payload, optionals);
-      const doc = job.toJSON();
-      expect(doc).to.have.property('created_by', optionals.created_by);
-    });
-  });
-});
diff --git a/x-pack/plugins/reporting/server/lib/esqueue/index.js b/x-pack/plugins/reporting/server/lib/esqueue/index.js
index 735d19f8f6c4..0fbcb54c673d 100644
--- a/x-pack/plugins/reporting/server/lib/esqueue/index.js
+++ b/x-pack/plugins/reporting/server/lib/esqueue/index.js
@@ -5,20 +5,17 @@
  */
 
 import { EventEmitter } from 'events';
-import { Job } from './job';
 import { Worker } from './worker';
 import { constants } from './constants';
-import { indexTimestamp } from './helpers/index_timestamp';
 import { omit } from 'lodash';
 
 export { events } from './constants/events';
 
 export class Esqueue extends EventEmitter {
-  constructor(index, options = {}) {
-    if (!index) throw new Error('Must specify an index to write to');
-
+  constructor(store, options = {}) {
     super();
-    this.index = index;
+    this.store = store; // for updating jobs in ES
+    this.index = this.store.indexPrefix; // for polling for pending jobs
     this.settings = {
       interval: constants.DEFAULT_SETTING_INTERVAL,
       timeout: constants.DEFAULT_SETTING_TIMEOUT,
@@ -40,21 +37,6 @@ export class Esqueue extends EventEmitter {
     });
   }
 
-  addJob(jobtype, payload, opts = {}) {
-    const timestamp = indexTimestamp(this.settings.interval, this.settings.dateSeparator);
-    const index = `${this.index}-${timestamp}`;
-    const defaults = {
-      timeout: this.settings.timeout,
-    };
-
-    const options = Object.assign(defaults, opts, {
-      indexSettings: this.settings.indexSettings,
-      logger: this._logger,
-    });
-
-    return new Job(this, index, jobtype, payload, options);
-  }
-
   registerWorker(type, workerFn, opts) {
     const worker = new Worker(this, type, workerFn, { ...opts, logger: this._logger });
     this._workers.push(worker);
diff --git a/x-pack/plugins/reporting/server/lib/esqueue/job.js b/x-pack/plugins/reporting/server/lib/esqueue/job.js
deleted file mode 100644
index 6ab78eeb1b86..000000000000
--- a/x-pack/plugins/reporting/server/lib/esqueue/job.js
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import events from 'events';
-import Puid from 'puid';
-import { constants } from './constants';
-import { createIndex } from './helpers/create_index';
-import { isPlainObject } from 'lodash';
-
-const puid = new Puid();
-
-export class Job extends events.EventEmitter {
-  constructor(queue, index, jobtype, payload, options = {}) {
-    if (typeof jobtype !== 'string') throw new Error('Jobtype must be a string');
-    if (!isPlainObject(payload)) throw new Error('Payload must be a plain object');
-
-    super();
-
-    this.queue = queue;
-    this._client = this.queue.client;
-    this.id = puid.generate();
-    this.index = index;
-    this.jobtype = jobtype;
-    this.payload = payload;
-    this.created_by = options.created_by || false;
-    this.timeout = options.timeout || 10000;
-    this.maxAttempts = options.max_attempts || 3;
-    this.priority = Math.max(Math.min(options.priority || 10, 20), -20);
-    this.indexSettings = options.indexSettings || {};
-    this.browser_type = options.browser_type;
-
-    if (typeof this.maxAttempts !== 'number' || this.maxAttempts < 1) {
-      throw new Error(`Invalid max_attempts: ${this.maxAttempts}`);
-    }
-
-    this.debug = (msg, err) => {
-      const logger = options.logger || function () {};
-      const message = `${this.id} - ${msg}`;
-      const tags = ['debug'];
-
-      if (err) {
-        logger(`${message}: ${err}`, tags);
-        return;
-      }
-
-      logger(message, tags);
-    };
-
-    const indexParams = {
-      index: this.index,
-      id: this.id,
-      body: {
-        jobtype: this.jobtype,
-        meta: {
-          // We are copying these values out of payload because these fields are indexed and can be aggregated on
-          // for tracking stats, while payload contents are not.
-          objectType: payload.objectType,
-          layout: payload.layout ? payload.layout.id : 'none',
-        },
-        payload: this.payload,
-        priority: this.priority,
-        created_by: this.created_by,
-        timeout: this.timeout,
-        process_expiration: new Date(0), // use epoch so the job query works
-        created_at: new Date(),
-        attempts: 0,
-        max_attempts: this.maxAttempts,
-        status: constants.JOB_STATUS_PENDING,
-        browser_type: this.browser_type,
-      },
-    };
-
-    if (options.headers) {
-      indexParams.headers = options.headers;
-    }
-
-    this.ready = createIndex(this._client, this.index, this.indexSettings)
-      .then(() => this._client.callAsInternalUser('index', indexParams))
-      .then((doc) => {
-        this.document = {
-          id: doc._id,
-          index: doc._index,
-          _seq_no: doc._seq_no,
-          _primary_term: doc._primary_term,
-        };
-        this.debug(`Job created in index ${this.index}`);
-
-        return this._client
-          .callAsInternalUser('indices.refresh', {
-            index: this.index,
-          })
-          .then(() => {
-            this.debug(`Job index refreshed ${this.index}`);
-            this.emit(constants.EVENT_JOB_CREATED, this.document);
-          });
-      })
-      .catch((err) => {
-        this.debug('Job creation failed', err);
-        this.emit(constants.EVENT_JOB_CREATE_ERROR, err);
-      });
-  }
-
-  emit(name, ...args) {
-    super.emit(name, ...args);
-    this.queue.emit(name, ...args);
-  }
-
-  get() {
-    return this.ready
-      .then(() => {
-        return this._client.callAsInternalUser('get', {
-          index: this.index,
-          id: this.id,
-        });
-      })
-      .then((doc) => {
-        return Object.assign(doc._source, {
-          index: doc._index,
-          id: doc._id,
-          _seq_no: doc._seq_no,
-          _primary_term: doc._primary_term,
-        });
-      });
-  }
-
-  toJSON() {
-    return {
-      id: this.id,
-      index: this.index,
-      jobtype: this.jobtype,
-      created_by: this.created_by,
-      payload: this.payload,
-      timeout: this.timeout,
-      max_attempts: this.maxAttempts,
-      priority: this.priority,
-      browser_type: this.browser_type,
-    };
-  }
-}
diff --git a/x-pack/plugins/reporting/server/lib/esqueue/worker.js b/x-pack/plugins/reporting/server/lib/esqueue/worker.js
index b26ed731c683..469bafd69461 100644
--- a/x-pack/plugins/reporting/server/lib/esqueue/worker.js
+++ b/x-pack/plugins/reporting/server/lib/esqueue/worker.js
@@ -158,8 +158,8 @@ export class Worker extends events.EventEmitter {
       kibana_name: this.kibanaName,
     };
 
-    return this._client
-      .callAsInternalUser('update', {
+    return this.queue.store
+      .updateReport({
         index: job._index,
         id: job._id,
         if_seq_no: job._seq_no,
@@ -197,8 +197,8 @@ export class Worker extends events.EventEmitter {
       output: docOutput,
     });
 
-    return this._client
-      .callAsInternalUser('update', {
+    return this.queue.store
+      .updateReport({
         index: job._index,
         id: job._id,
         if_seq_no: job._seq_no,
@@ -294,8 +294,8 @@ export class Worker extends events.EventEmitter {
           output: docOutput,
         };
 
-        return this._client
-          .callAsInternalUser('update', {
+        return this.queue.store
+          .updateReport({
             index: job._index,
             id: job._id,
             if_seq_no: job._seq_no,
diff --git a/x-pack/plugins/reporting/server/lib/index.ts b/x-pack/plugins/reporting/server/lib/index.ts
index 0e9c49b17088..f5a50fca28b7 100644
--- a/x-pack/plugins/reporting/server/lib/index.ts
+++ b/x-pack/plugins/reporting/server/lib/index.ts
@@ -12,3 +12,4 @@ export { enqueueJobFactory } from './enqueue_job';
 export { getExportTypesRegistry } from './export_types_registry';
 export { runValidations } from './validate';
 export { startTrace } from './trace';
+export { ReportingStore } from './store';
diff --git a/x-pack/plugins/reporting/server/lib/store/index.ts b/x-pack/plugins/reporting/server/lib/store/index.ts
new file mode 100644
index 000000000000..a88d36d3fdf9
--- /dev/null
+++ b/x-pack/plugins/reporting/server/lib/store/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { Report } from './report';
+export { ReportingStore } from './store';
diff --git a/x-pack/plugins/reporting/server/lib/esqueue/helpers/index_timestamp.js b/x-pack/plugins/reporting/server/lib/store/index_timestamp.ts
similarity index 80%
rename from x-pack/plugins/reporting/server/lib/esqueue/helpers/index_timestamp.js
rename to x-pack/plugins/reporting/server/lib/store/index_timestamp.ts
index ceb4ef43b2d9..71ce0b1e572f 100644
--- a/x-pack/plugins/reporting/server/lib/esqueue/helpers/index_timestamp.js
+++ b/x-pack/plugins/reporting/server/lib/store/index_timestamp.ts
@@ -4,19 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import moment from 'moment';
+import moment, { unitOfTime } from 'moment';
 
 export const intervals = ['year', 'month', 'week', 'day', 'hour', 'minute'];
 
 // TODO: This helper function can be removed by using `schema.duration` objects in the reporting config schema
-export function indexTimestamp(intervalStr, separator = '-') {
+export function indexTimestamp(intervalStr: string, separator = '-') {
+  const startOf = intervalStr as unitOfTime.StartOf;
   if (separator.match(/[a-z]/i)) throw new Error('Interval separator can not be a letter');
 
   const index = intervals.indexOf(intervalStr);
-  if (index === -1) throw new Error('Invalid index interval: ', intervalStr);
+  if (index === -1) throw new Error('Invalid index interval: ' + intervalStr);
 
   const m = moment();
-  m.startOf(intervalStr);
+  m.startOf(startOf);
 
   let dateString;
   switch (intervalStr) {
diff --git a/x-pack/plugins/reporting/server/lib/store/mapping.ts b/x-pack/plugins/reporting/server/lib/store/mapping.ts
new file mode 100644
index 000000000000..a819923e2f10
--- /dev/null
+++ b/x-pack/plugins/reporting/server/lib/store/mapping.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const mapping = {
+  meta: {
+    // We are indexing these properties with both text and keyword fields because that's what will be auto generated
+    // when an index already exists. This schema is only used when a reporting index doesn't exist.  This way existing
+    // reporting indexes and new reporting indexes will look the same and the data can be queried in the same
+    // manner.
+    properties: {
+      /**
+       * Type of object that is triggering this report. Should be either search, visualization or dashboard.
+       * Used for job listing and telemetry stats only.
+       */
+      objectType: {
+        type: 'text',
+        fields: {
+          keyword: {
+            type: 'keyword',
+            ignore_above: 256,
+          },
+        },
+      },
+      /**
+       * Can be either preserve_layout, print or none (in the case of csv export).
+       * Used for phone home stats only.
+       */
+      layout: {
+        type: 'text',
+        fields: {
+          keyword: {
+            type: 'keyword',
+            ignore_above: 256,
+          },
+        },
+      },
+    },
+  },
+  browser_type: { type: 'keyword' },
+  jobtype: { type: 'keyword' },
+  payload: { type: 'object', enabled: false },
+  priority: { type: 'byte' },
+  timeout: { type: 'long' },
+  process_expiration: { type: 'date' },
+  created_by: { type: 'keyword' },
+  created_at: { type: 'date' },
+  started_at: { type: 'date' },
+  completed_at: { type: 'date' },
+  attempts: { type: 'short' },
+  max_attempts: { type: 'short' },
+  kibana_name: { type: 'keyword' },
+  kibana_id: { type: 'keyword' },
+  status: { type: 'keyword' },
+  output: {
+    type: 'object',
+    properties: {
+      content_type: { type: 'keyword' },
+      size: { type: 'long' },
+      content: { type: 'object', enabled: false },
+    },
+  },
+};
diff --git a/x-pack/plugins/reporting/server/lib/store/report.test.ts b/x-pack/plugins/reporting/server/lib/store/report.test.ts
new file mode 100644
index 000000000000..83444494e61d
--- /dev/null
+++ b/x-pack/plugins/reporting/server/lib/store/report.test.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Report } from './report';
+
+describe('Class Report', () => {
+  it('constructs Report instance', () => {
+    const opts = {
+      index: '.reporting-test-index-12345',
+      jobtype: 'test-report',
+      created_by: 'created_by_test_string',
+      browser_type: 'browser_type_test_string',
+      max_attempts: 50,
+      payload: { payload_test_field: 1 },
+      timeout: 30000,
+      priority: 1,
+    };
+    const report = new Report(opts);
+    expect(report.toJSON()).toMatchObject({
+      _primary_term: undefined,
+      _seq_no: undefined,
+      browser_type: 'browser_type_test_string',
+      created_by: 'created_by_test_string',
+      jobtype: 'test-report',
+      max_attempts: 50,
+      payload: {
+        payload_test_field: 1,
+      },
+      priority: 1,
+      timeout: 30000,
+    });
+
+    expect(report.id).toBeDefined();
+  });
+
+  it('updateWithDoc method syncs takes fields to sync ES metadata', () => {
+    const opts = {
+      index: '.reporting-test-index-12345',
+      jobtype: 'test-report',
+      created_by: 'created_by_test_string',
+      browser_type: 'browser_type_test_string',
+      max_attempts: 50,
+      payload: { payload_test_field: 1 },
+      timeout: 30000,
+      priority: 1,
+    };
+    const report = new Report(opts);
+
+    const metadata = {
+      _index: '.reporting-test-update',
+      _id: '12342p9o387549o2345',
+      _primary_term: 77,
+      _seq_no: 99,
+    };
+    report.updateWithDoc(metadata);
+
+    expect(report.toJSON()).toMatchObject({
+      index: '.reporting-test-update',
+      _primary_term: 77,
+      _seq_no: 99,
+      browser_type: 'browser_type_test_string',
+      created_by: 'created_by_test_string',
+      jobtype: 'test-report',
+      max_attempts: 50,
+      payload: {
+        payload_test_field: 1,
+      },
+      priority: 1,
+      timeout: 30000,
+    });
+
+    expect(report._id).toBe('12342p9o387549o2345');
+  });
+});
diff --git a/x-pack/plugins/reporting/server/lib/store/report.ts b/x-pack/plugins/reporting/server/lib/store/report.ts
new file mode 100644
index 000000000000..cc9967e64b6e
--- /dev/null
+++ b/x-pack/plugins/reporting/server/lib/store/report.ts
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+// @ts-ignore no module definition
+import Puid from 'puid';
+
+interface Payload {
+  id?: string;
+  index: string;
+  jobtype: string;
+  created_by: string | boolean;
+  payload: unknown;
+  browser_type: string;
+  priority: number;
+  max_attempts: number;
+  timeout: number;
+}
+
+const puid = new Puid();
+
+export class Report {
+  public readonly jobtype: string;
+  public readonly created_by: string | boolean;
+  public readonly payload: unknown;
+  public readonly browser_type: string;
+  public readonly id: string;
+
+  public readonly priority: number;
+  // queue stuff, to be removed with Task Manager integration
+  public readonly max_attempts: number;
+  public readonly timeout: number;
+
+  public _index: string;
+  public _id?: string; // set by ES
+  public _primary_term?: unknown; // set by ES
+  public _seq_no: unknown; // set by ES
+
+  /*
+   * Create an unsaved report
+   */
+  constructor(opts: Payload) {
+    this.jobtype = opts.jobtype;
+    this.created_by = opts.created_by;
+    this.payload = opts.payload;
+    this.browser_type = opts.browser_type;
+    this.priority = opts.priority;
+    this.max_attempts = opts.max_attempts;
+    this.timeout = opts.timeout;
+    this.id = puid.generate();
+
+    this._index = opts.index;
+  }
+
+  /*
+   * Update the report with "live" storage metadata
+   */
+  updateWithDoc(doc: Partial<Report>) {
+    if (doc._index) {
+      this._index = doc._index; // can not be undefined
+    }
+
+    this._id = doc._id;
+    this._primary_term = doc._primary_term;
+    this._seq_no = doc._seq_no;
+  }
+
+  toJSON() {
+    return {
+      id: this.id,
+      index: this._index,
+      _seq_no: this._seq_no,
+      _primary_term: this._primary_term,
+      jobtype: this.jobtype,
+      created_by: this.created_by,
+      payload: this.payload,
+      timeout: this.timeout,
+      max_attempts: this.max_attempts,
+      priority: this.priority,
+      browser_type: this.browser_type,
+    };
+  }
+}
diff --git a/x-pack/plugins/reporting/server/lib/store/store.test.ts b/x-pack/plugins/reporting/server/lib/store/store.test.ts
new file mode 100644
index 000000000000..4868a1dfdd8f
--- /dev/null
+++ b/x-pack/plugins/reporting/server/lib/store/store.test.ts
@@ -0,0 +1,166 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import sinon from 'sinon';
+import { ReportingConfig, ReportingCore } from '../..';
+import { createMockReportingCore } from '../../test_helpers';
+import { createMockLevelLogger } from '../../test_helpers/create_mock_levellogger';
+import { ReportingStore } from './store';
+import { ElasticsearchServiceSetup } from 'src/core/server';
+
+const getMockConfig = (mockConfigGet: sinon.SinonStub) => ({
+  get: mockConfigGet,
+  kbnConfig: { get: mockConfigGet },
+});
+
+describe('ReportingStore', () => {
+  const mockLogger = createMockLevelLogger();
+  let mockConfig: ReportingConfig;
+  let mockCore: ReportingCore;
+
+  const callClusterStub = sinon.stub();
+  const mockElasticsearch = { legacy: { client: { callAsInternalUser: callClusterStub } } };
+
+  beforeEach(async () => {
+    const mockConfigGet = sinon.stub();
+    mockConfigGet.withArgs('index').returns('.reporting-test');
+    mockConfigGet.withArgs('queue', 'indexInterval').returns('week');
+    mockConfig = getMockConfig(mockConfigGet);
+    mockCore = await createMockReportingCore(mockConfig);
+
+    callClusterStub.withArgs('indices.exists').resolves({});
+    callClusterStub.withArgs('indices.create').resolves({});
+    callClusterStub.withArgs('index').resolves({});
+    callClusterStub.withArgs('indices.refresh').resolves({});
+    callClusterStub.withArgs('update').resolves({});
+
+    mockCore.getElasticsearchService = () =>
+      (mockElasticsearch as unknown) as ElasticsearchServiceSetup;
+  });
+
+  describe('addReport', () => {
+    it('returns Report object', async () => {
+      const store = new ReportingStore(mockCore, mockLogger);
+      const reportType = 'unknowntype';
+      const reportPayload = {};
+      const reportOptions = {
+        timeout: 10000,
+        created_by: 'created_by_string',
+        browser_type: 'browser_type_string',
+        max_attempts: 1,
+      };
+      await expect(
+        store.addReport(reportType, reportPayload, reportOptions)
+      ).resolves.toMatchObject({
+        _primary_term: undefined,
+        _seq_no: undefined,
+        browser_type: 'browser_type_string',
+        created_by: 'created_by_string',
+        jobtype: 'unknowntype',
+        max_attempts: 1,
+        payload: {},
+        priority: 10,
+        timeout: 10000,
+      });
+    });
+
+    it('throws if options has invalid indexInterval', async () => {
+      const mockConfigGet = sinon.stub();
+      mockConfigGet.withArgs('index').returns('.reporting-test');
+      mockConfigGet.withArgs('queue', 'indexInterval').returns('centurially');
+      mockConfig = getMockConfig(mockConfigGet);
+      mockCore = await createMockReportingCore(mockConfig);
+
+      const store = new ReportingStore(mockCore, mockLogger);
+      const reportType = 'unknowntype';
+      const reportPayload = {};
+      const reportOptions = {
+        timeout: 10000,
+        created_by: 'created_by_string',
+        browser_type: 'browser_type_string',
+        max_attempts: 1,
+      };
+      expect(
+        store.addReport(reportType, reportPayload, reportOptions)
+      ).rejects.toMatchInlineSnapshot(`[Error: Invalid index interval: centurially]`);
+    });
+
+    it('handles error creating the index', async () => {
+      // setup
+      callClusterStub.withArgs('indices.exists').resolves(false);
+      callClusterStub.withArgs('indices.create').rejects(new Error('error'));
+
+      const store = new ReportingStore(mockCore, mockLogger);
+      const reportType = 'unknowntype';
+      const reportPayload = {};
+      const reportOptions = {
+        timeout: 10000,
+        created_by: 'created_by_string',
+        browser_type: 'browser_type_string',
+        max_attempts: 1,
+      };
+      await expect(
+        store.addReport(reportType, reportPayload, reportOptions)
+      ).rejects.toMatchInlineSnapshot(`[Error: error]`);
+    });
+
+    /* Creating the index will fail, if there were multiple jobs staged in
+     * parallel and creation completed from another Kibana instance.  Only the
+     * first request in line can successfully create it.
+     * In spite of that race condition, adding the new job in Elasticsearch is
+     * fine.
+     */
+    it('ignores index creation error if the index already exists and continues adding the report', async () => {
+      // setup
+      callClusterStub.withArgs('indices.exists').resolves(false);
+      callClusterStub.withArgs('indices.create').rejects(new Error('error'));
+
+      const store = new ReportingStore(mockCore, mockLogger);
+      const reportType = 'unknowntype';
+      const reportPayload = {};
+      const reportOptions = {
+        timeout: 10000,
+        created_by: 'created_by_string',
+        browser_type: 'browser_type_string',
+        max_attempts: 1,
+      };
+      await expect(
+        store.addReport(reportType, reportPayload, reportOptions)
+      ).rejects.toMatchInlineSnapshot(`[Error: error]`);
+    });
+
+    it('skips creating the index if already exists', async () => {
+      // setup
+      callClusterStub.withArgs('indices.exists').resolves(false);
+      callClusterStub
+        .withArgs('indices.create')
+        .rejects(new Error('resource_already_exists_exception')); // will be triggered but ignored
+
+      const store = new ReportingStore(mockCore, mockLogger);
+      const reportType = 'unknowntype';
+      const reportPayload = {};
+      const reportOptions = {
+        timeout: 10000,
+        created_by: 'created_by_string',
+        browser_type: 'browser_type_string',
+        max_attempts: 1,
+      };
+      await expect(
+        store.addReport(reportType, reportPayload, reportOptions)
+      ).resolves.toMatchObject({
+        _primary_term: undefined,
+        _seq_no: undefined,
+        browser_type: 'browser_type_string',
+        created_by: 'created_by_string',
+        jobtype: 'unknowntype',
+        max_attempts: 1,
+        payload: {},
+        priority: 10,
+        timeout: 10000,
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/reporting/server/lib/store/store.ts b/x-pack/plugins/reporting/server/lib/store/store.ts
new file mode 100644
index 000000000000..1cb964a7bbfa
--- /dev/null
+++ b/x-pack/plugins/reporting/server/lib/store/store.ts
@@ -0,0 +1,169 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ElasticsearchServiceSetup } from 'src/core/server';
+import { LevelLogger } from '../';
+import { ReportingCore } from '../../';
+import { LayoutInstance } from '../../export_types/common/layouts';
+import { indexTimestamp } from './index_timestamp';
+import { mapping } from './mapping';
+import { Report } from './report';
+
+export const statuses = {
+  JOB_STATUS_PENDING: 'pending',
+  JOB_STATUS_PROCESSING: 'processing',
+  JOB_STATUS_COMPLETED: 'completed',
+  JOB_STATUS_WARNINGS: 'completed_with_warnings',
+  JOB_STATUS_FAILED: 'failed',
+  JOB_STATUS_CANCELLED: 'cancelled',
+};
+
+interface AddReportOpts {
+  timeout: number;
+  created_by: string | boolean;
+  browser_type: string;
+  max_attempts: number;
+}
+
+interface UpdateQuery {
+  index: string;
+  id: string;
+  if_seq_no: unknown;
+  if_primary_term: unknown;
+  body: { doc: Partial<Report> };
+}
+
+/*
+ * A class to give an interface to historical reports in the reporting.index
+ * - track the state: pending, processing, completed, etc
+ * - handle updates and deletes to the reporting document
+ * - interface for downloading the report
+ */
+export class ReportingStore {
+  public readonly indexPrefix: string;
+  public readonly indexInterval: string;
+
+  private client: ElasticsearchServiceSetup['legacy']['client'];
+  private logger: LevelLogger;
+
+  constructor(reporting: ReportingCore, logger: LevelLogger) {
+    const config = reporting.getConfig();
+    const elasticsearch = reporting.getElasticsearchService();
+
+    this.client = elasticsearch.legacy.client;
+    this.indexPrefix = config.get('index');
+    this.indexInterval = config.get('queue', 'indexInterval');
+
+    this.logger = logger;
+  }
+
+  private async createIndex(indexName: string) {
+    return this.client
+      .callAsInternalUser('indices.exists', {
+        index: indexName,
+      })
+      .then((exists) => {
+        if (exists) {
+          return exists;
+        }
+
+        const indexSettings = {
+          number_of_shards: 1,
+          auto_expand_replicas: '0-1',
+        };
+        const body = {
+          settings: indexSettings,
+          mappings: {
+            properties: mapping,
+          },
+        };
+
+        return this.client
+          .callAsInternalUser('indices.create', {
+            index: indexName,
+            body,
+          })
+          .then(() => true)
+          .catch((err: Error) => {
+            const isIndexExistsError = err.message.match(/resource_already_exists_exception/);
+            if (isIndexExistsError) {
+              // Do not fail a job if the job runner hits the race condition.
+              this.logger.warn(`Automatic index creation failed: index already exists: ${err}`);
+              return;
+            }
+
+            throw err;
+          });
+      });
+  }
+
+  private async saveReport(report: Report) {
+    const payload = report.payload as { objectType: string; layout: LayoutInstance };
+
+    const indexParams = {
+      index: report._index,
+      id: report.id,
+      body: {
+        jobtype: report.jobtype,
+        meta: {
+          // We are copying these values out of payload because these fields are indexed and can be aggregated on
+          // for tracking stats, while payload contents are not.
+          objectType: payload.objectType,
+          layout: payload.layout ? payload.layout.id : 'none',
+        },
+        payload: report.payload,
+        created_by: report.created_by,
+        timeout: report.timeout,
+        process_expiration: new Date(0), // use epoch so the job query works
+        created_at: new Date(),
+        attempts: 0,
+        max_attempts: report.max_attempts,
+        status: statuses.JOB_STATUS_PENDING,
+        browser_type: report.browser_type,
+      },
+    };
+    return this.client.callAsInternalUser('index', indexParams);
+  }
+
+  private async refreshIndex(index: string) {
+    return this.client.callAsInternalUser('indices.refresh', { index });
+  }
+
+  public async addReport(type: string, payload: unknown, options: AddReportOpts): Promise<Report> {
+    const timestamp = indexTimestamp(this.indexInterval);
+    const index = `${this.indexPrefix}-${timestamp}`;
+    await this.createIndex(index);
+
+    const report = new Report({
+      index,
+      payload,
+      jobtype: type,
+      created_by: options.created_by,
+      browser_type: options.browser_type,
+      max_attempts: options.max_attempts,
+      timeout: options.timeout,
+      priority: 10, // unused
+    });
+
+    const doc = await this.saveReport(report);
+    report.updateWithDoc(doc);
+
+    await this.refreshIndex(index);
+    this.logger.info(`Successfully queued pending job: ${report._index}/${report.id}`);
+
+    return report;
+  }
+
+  public async updateReport(query: UpdateQuery): Promise<Report> {
+    return this.client.callAsInternalUser('update', {
+      index: query.index,
+      id: query.id,
+      if_seq_no: query.if_seq_no,
+      if_primary_term: query.if_primary_term,
+      body: { doc: query.body.doc },
+    });
+  }
+}
diff --git a/x-pack/plugins/reporting/server/plugin.ts b/x-pack/plugins/reporting/server/plugin.ts
index 693b0917603f..cedc9dc14a23 100644
--- a/x-pack/plugins/reporting/server/plugin.ts
+++ b/x-pack/plugins/reporting/server/plugin.ts
@@ -8,7 +8,13 @@ import { CoreSetup, CoreStart, Plugin, PluginInitializerContext } from 'src/core
 import { ReportingCore } from './';
 import { initializeBrowserDriverFactory } from './browsers';
 import { buildConfig, ReportingConfigType } from './config';
-import { createQueueFactory, enqueueJobFactory, LevelLogger, runValidations } from './lib';
+import {
+  createQueueFactory,
+  enqueueJobFactory,
+  LevelLogger,
+  runValidations,
+  ReportingStore,
+} from './lib';
 import { registerRoutes } from './routes';
 import { setFieldFormats } from './services';
 import { ReportingSetup, ReportingSetupDeps, ReportingStart, ReportingStartDeps } from './types';
@@ -86,9 +92,9 @@ export class ReportingPlugin
       const config = reportingCore.getConfig();
 
       const browserDriverFactory = await initializeBrowserDriverFactory(config, logger);
-
-      const esqueue = await createQueueFactory(reportingCore, logger); // starts polling for pending jobs
-      const enqueueJob = enqueueJobFactory(reportingCore, logger); // called from generation routes
+      const store = new ReportingStore(reportingCore, logger);
+      const esqueue = await createQueueFactory(reportingCore, store, logger); // starts polling for pending jobs
+      const enqueueJob = enqueueJobFactory(reportingCore, store, logger); // called from generation routes
 
       reportingCore.pluginStart({
         browserDriverFactory,
@@ -96,6 +102,7 @@ export class ReportingPlugin
         uiSettings: core.uiSettings,
         esqueue,
         enqueueJob,
+        store,
       });
 
       // run self-check validations
diff --git a/x-pack/plugins/reporting/server/test_helpers/create_mock_levellogger.ts b/x-pack/plugins/reporting/server/test_helpers/create_mock_levellogger.ts
new file mode 100644
index 000000000000..f5e9a44281cb
--- /dev/null
+++ b/x-pack/plugins/reporting/server/test_helpers/create_mock_levellogger.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { LevelLogger } from '../lib';
+
+export function createMockLevelLogger() {
+  // eslint-disable-next-line no-console
+  const consoleLogger = (tag: string) => (message: unknown) => console.log(tag, message);
+  const innerLogger = {
+    get: () => innerLogger,
+    debug: consoleLogger('debug'),
+    info: consoleLogger('info'),
+    warn: consoleLogger('warn'),
+    trace: consoleLogger('trace'),
+    error: consoleLogger('error'),
+    fatal: consoleLogger('fatal'),
+    log: consoleLogger('log'),
+  };
+  return new LevelLogger(innerLogger);
+}
diff --git a/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts b/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
index 579035a46f61..427a6362a725 100644
--- a/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
+++ b/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
@@ -20,6 +20,8 @@ import {
 } from '../browsers';
 import { ReportingInternalSetup, ReportingInternalStart } from '../core';
 import { ReportingStartDeps } from '../types';
+import { ReportingStore } from '../lib';
+import { createMockLevelLogger } from './create_mock_levellogger';
 
 (initializeBrowserDriverFactory as jest.Mock<
   Promise<HeadlessChromiumDriverFactory>
@@ -37,13 +39,19 @@ const createMockPluginSetup = (setupMock?: any): ReportingInternalSetup => {
   };
 };
 
-const createMockPluginStart = (startMock?: any): ReportingInternalStart => {
+const createMockPluginStart = (
+  mockReportingCore: ReportingCore,
+  startMock?: any
+): ReportingInternalStart => {
+  const logger = createMockLevelLogger();
+  const store = new ReportingStore(mockReportingCore, logger);
   return {
     browserDriverFactory: startMock.browserDriverFactory,
     enqueueJob: startMock.enqueueJob,
     esqueue: startMock.esqueue,
     savedObjects: startMock.savedObjects || { getScopedClient: jest.fn() },
     uiSettings: startMock.uiSettings || { asScopedToClient: () => ({ get: jest.fn() }) },
+    store,
   };
 };
 
@@ -60,9 +68,22 @@ export const createMockStartDeps = (startMock?: any): ReportingStartDeps => ({
 
 export const createMockReportingCore = async (
   config: ReportingConfig,
-  setupDepsMock: ReportingInternalSetup | undefined = createMockPluginSetup({}),
-  startDepsMock: ReportingInternalStart | undefined = createMockPluginStart({})
+  setupDepsMock: ReportingInternalSetup | undefined = undefined,
+  startDepsMock: ReportingInternalStart | undefined = undefined
 ) => {
+  if (!setupDepsMock) {
+    setupDepsMock = createMockPluginSetup({});
+  }
+
+  const mockReportingCore = {
+    getConfig: () => config,
+    getElasticsearchService: () => setupDepsMock?.elasticsearch,
+  } as ReportingCore;
+
+  if (!startDepsMock) {
+    startDepsMock = createMockPluginStart(mockReportingCore, {});
+  }
+
   config = config || {};
   const core = new ReportingCore();
 
diff --git a/x-pack/test/reporting_api_integration/services.ts b/x-pack/test/reporting_api_integration/services.ts
index dadb466d4598..85f5a98c69b2 100644
--- a/x-pack/test/reporting_api_integration/services.ts
+++ b/x-pack/test/reporting_api_integration/services.ts
@@ -7,8 +7,7 @@
 import expect from '@kbn/expect';
 import * as Rx from 'rxjs';
 import { filter, first, mapTo, switchMap, timeout } from 'rxjs/operators';
-// @ts-ignore no module definition
-import { indexTimestamp } from '../../plugins/reporting/server/lib/esqueue/helpers/index_timestamp';
+import { indexTimestamp } from '../../plugins/reporting/server/lib/store/index_timestamp';
 import { services as xpackServices } from '../functional/services';
 import { FtrProviderContext } from './ftr_provider_context';
 

From 368849829cb18be4ded97e628a72c01b12d473a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=B8ren=20Louv-Jansen?= <sorenlouv@gmail.com>
Date: Fri, 26 Jun 2020 00:42:17 +0200
Subject: [PATCH 27/78] Fix backport (#70003)

---
 scripts/backport.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/backport.js b/scripts/backport.js
index 64cd5721834e..2094534e2c4b 100644
--- a/scripts/backport.js
+++ b/scripts/backport.js
@@ -18,4 +18,5 @@
  */
 
 require('../src/setup_node_env/node_version_validator');
-require('backport');
+var backport = require('backport');
+backport.run();

From 0f9efa8d60a147436ea481cb559886d809286743 Mon Sep 17 00:00:00 2001
From: Jonathan Budzenski <jon@budzenski.me>
Date: Thu, 25 Jun 2020 19:10:27 -0500
Subject: [PATCH 28/78] [test] skip status.allowAnonymous tests on cloud
 (#69017)

* skip cloud status page

* move skipcloud to describe block

* merge includeFireFox and skipCloud

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 x-pack/test/functional/apps/status_page/status_page.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/test/functional/apps/status_page/status_page.ts b/x-pack/test/functional/apps/status_page/status_page.ts
index b6f0fdce8b28..eeb9bc9b8445 100644
--- a/x-pack/test/functional/apps/status_page/status_page.ts
+++ b/x-pack/test/functional/apps/status_page/status_page.ts
@@ -13,7 +13,7 @@ export default function statusPageFunctonalTests({
   const PageObjects = getPageObjects(['security', 'statusPage', 'home']);
 
   describe('Status Page', function () {
-    this.tags('includeFirefox');
+    this.tags(['skipCloud', 'includeFirefox']);
     before(async () => await esArchiver.load('empty_kibana'));
     after(async () => await esArchiver.unload('empty_kibana'));
 

From 7163c678bdaab063213b7f853ff7d126d1d67e53 Mon Sep 17 00:00:00 2001
From: Nicolas Chaulet <nicolas.chaulet@elastic.co>
Date: Thu, 25 Jun 2020 20:32:29 -0400
Subject: [PATCH 29/78] [Ingest Manager] Fix typo in constant name (#69919)

---
 x-pack/plugins/ingest_manager/server/constants/index.ts     | 2 +-
 x-pack/plugins/ingest_manager/server/saved_objects/index.ts | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/x-pack/plugins/ingest_manager/server/constants/index.ts b/x-pack/plugins/ingest_manager/server/constants/index.ts
index 4d60b9031414..ebcce6320ec4 100644
--- a/x-pack/plugins/ingest_manager/server/constants/index.ts
+++ b/x-pack/plugins/ingest_manager/server/constants/index.ts
@@ -36,7 +36,7 @@ export {
   PACKAGES_SAVED_OBJECT_TYPE,
   INDEX_PATTERN_SAVED_OBJECT_TYPE,
   ENROLLMENT_API_KEYS_SAVED_OBJECT_TYPE,
-  GLOBAL_SETTINGS_SAVED_OBJECT_TYPE as GLOBAL_SETTINGS_SAVED_OBJET_TYPE,
+  GLOBAL_SETTINGS_SAVED_OBJECT_TYPE,
   // Defaults
   DEFAULT_AGENT_CONFIG,
   DEFAULT_OUTPUT,
diff --git a/x-pack/plugins/ingest_manager/server/saved_objects/index.ts b/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
index 482fe181e2b7..1199c9d198e3 100644
--- a/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
+++ b/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
@@ -15,7 +15,7 @@ import {
   AGENT_EVENT_SAVED_OBJECT_TYPE,
   AGENT_ACTION_SAVED_OBJECT_TYPE,
   ENROLLMENT_API_KEYS_SAVED_OBJECT_TYPE,
-  GLOBAL_SETTINGS_SAVED_OBJET_TYPE,
+  GLOBAL_SETTINGS_SAVED_OBJECT_TYPE,
 } from '../constants';
 import { migrateDatasourcesToV790 } from './migrations/datasources_v790';
 import { migrateAgentConfigToV790 } from './migrations/agent_config_v790';
@@ -26,8 +26,8 @@ import { migrateAgentConfigToV790 } from './migrations/agent_config_v790';
  */
 
 const savedObjectTypes: { [key: string]: SavedObjectsType } = {
-  [GLOBAL_SETTINGS_SAVED_OBJET_TYPE]: {
-    name: GLOBAL_SETTINGS_SAVED_OBJET_TYPE,
+  [GLOBAL_SETTINGS_SAVED_OBJECT_TYPE]: {
+    name: GLOBAL_SETTINGS_SAVED_OBJECT_TYPE,
     hidden: false,
     namespaceType: 'agnostic',
     management: {

From 0465e86bf3786e5afcea47e9dfb369dccff05641 Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Thu, 25 Jun 2020 20:20:59 -0600
Subject: [PATCH 30/78] [Maps] Fix icon palettes are not working (#69937)

* [Maps] Fix icon palettes are not working

* unit test mapbox icon-image expression

* fix unit test expect statements
---
 x-pack/plugins/maps/common/constants.ts       | 12 ++++
 .../ems_file_source/ems_file_source.tsx       |  7 +-
 .../es_geo_grid_source/es_geo_grid_source.js  |  6 +-
 .../es_pew_pew_source/es_pew_pew_source.js    |  5 +-
 .../es_search_source/es_search_source.js      |  6 +-
 .../mvt_single_layer_vector_source.ts         |  7 +-
 .../classes/sources/vector_feature_types.ts   | 11 ---
 .../sources/vector_source/vector_source.d.ts  |  4 +-
 .../sources/vector_source/vector_source.js    |  4 +-
 .../vector/components/vector_style_editor.js  | 24 +++----
 .../dynamic_icon_property.test.tsx.snap       | 20 +++++-
 .../properties/dynamic_color_property.js      |  4 +-
 .../properties/dynamic_icon_property.js       |  2 +-
 .../properties/dynamic_icon_property.test.tsx | 58 ++++++++++++---
 .../properties/dynamic_size_property.js       |  8 ++-
 ...{style_util.test.js => style_util.test.ts} | 72 ++++++++++++-------
 .../vector/{style_util.js => style_util.ts}   | 45 ++++++++----
 .../classes/styles/vector/symbol_utils.js     |  2 +-
 .../classes/styles/vector/vector_style.js     | 26 +++----
 .../styles/vector/vector_style.test.js        |  5 +-
 20 files changed, 211 insertions(+), 117 deletions(-)
 delete mode 100644 x-pack/plugins/maps/public/classes/sources/vector_feature_types.ts
 rename x-pack/plugins/maps/public/classes/styles/vector/{style_util.test.js => style_util.test.ts} (60%)
 rename x-pack/plugins/maps/public/classes/styles/vector/{style_util.js => style_util.ts} (57%)

diff --git a/x-pack/plugins/maps/common/constants.ts b/x-pack/plugins/maps/common/constants.ts
index ea722c18e700..bf30006441c9 100644
--- a/x-pack/plugins/maps/common/constants.ts
+++ b/x-pack/plugins/maps/common/constants.ts
@@ -232,3 +232,15 @@ export enum LAYER_WIZARD_CATEGORY {
   REFERENCE = 'REFERENCE',
   SOLUTIONS = 'SOLUTIONS',
 }
+
+export enum VECTOR_SHAPE_TYPE {
+  POINT = 'POINT',
+  LINE = 'LINE',
+  POLYGON = 'POLYGON',
+}
+
+// https://docs.mapbox.com/mapbox-gl-js/style-spec/expressions/#data-expressions
+export enum MB_LOOKUP_FUNCTION {
+  GET = 'get',
+  FEATURE_STATE = 'feature-state',
+}
diff --git a/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.tsx b/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.tsx
index f7fb0078764c..f55a7434d121 100644
--- a/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.tsx
@@ -11,8 +11,7 @@ import { Adapters } from 'src/plugins/inspector/public';
 import { FileLayer } from '@elastic/ems-client';
 import { Attribution, ImmutableSourceProperty, SourceEditorArgs } from '../source';
 import { AbstractVectorSource, GeoJsonWithMeta, IVectorSource } from '../vector_source';
-import { VECTOR_SHAPE_TYPES } from '../vector_feature_types';
-import { SOURCE_TYPES, FIELD_ORIGIN } from '../../../../common/constants';
+import { SOURCE_TYPES, FIELD_ORIGIN, VECTOR_SHAPE_TYPE } from '../../../../common/constants';
 import { getEmsFileLayers } from '../../../meta';
 import { getDataSourceLabel } from '../../../../common/i18n_getters';
 import { UpdateSourceEditor } from './update_source_editor';
@@ -179,8 +178,8 @@ export class EMSFileSource extends AbstractVectorSource implements IEmsFileSourc
     return Promise.all(promises);
   }
 
-  async getSupportedShapeTypes(): Promise<VECTOR_SHAPE_TYPES[]> {
-    return [VECTOR_SHAPE_TYPES.POLYGON];
+  async getSupportedShapeTypes(): Promise<VECTOR_SHAPE_TYPE[]> {
+    return [VECTOR_SHAPE_TYPE.POLYGON];
   }
 }
 
diff --git a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.js b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.js
index c05c1f2dd7c1..b613f577067b 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.js
+++ b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.js
@@ -7,7 +7,6 @@
 import React from 'react';
 import uuid from 'uuid/v4';
 
-import { VECTOR_SHAPE_TYPES } from '../vector_feature_types';
 import { convertCompositeRespToGeoJson, convertRegularRespToGeoJson } from './convert_to_geojson';
 import { UpdateSourceEditor } from './update_source_editor';
 import {
@@ -15,6 +14,7 @@ import {
   DEFAULT_MAX_BUCKETS_LIMIT,
   RENDER_AS,
   GRID_RESOLUTION,
+  VECTOR_SHAPE_TYPE,
 } from '../../../../common/constants';
 import { i18n } from '@kbn/i18n';
 import { getDataSourceLabel } from '../../../../common/i18n_getters';
@@ -326,10 +326,10 @@ export class ESGeoGridSource extends AbstractESAggSource {
 
   async getSupportedShapeTypes() {
     if (this._descriptor.requestType === RENDER_AS.GRID) {
-      return [VECTOR_SHAPE_TYPES.POLYGON];
+      return [VECTOR_SHAPE_TYPE.POLYGON];
     }
 
-    return [VECTOR_SHAPE_TYPES.POINT];
+    return [VECTOR_SHAPE_TYPE.POINT];
   }
 }
 
diff --git a/x-pack/plugins/maps/public/classes/sources/es_pew_pew_source/es_pew_pew_source.js b/x-pack/plugins/maps/public/classes/sources/es_pew_pew_source/es_pew_pew_source.js
index fda73bc0f73a..076e7a758a4f 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_pew_pew_source/es_pew_pew_source.js
+++ b/x-pack/plugins/maps/public/classes/sources/es_pew_pew_source/es_pew_pew_source.js
@@ -7,10 +7,9 @@
 import React from 'react';
 import uuid from 'uuid/v4';
 
-import { VECTOR_SHAPE_TYPES } from '../vector_feature_types';
 import { UpdateSourceEditor } from './update_source_editor';
 import { i18n } from '@kbn/i18n';
-import { SOURCE_TYPES } from '../../../../common/constants';
+import { SOURCE_TYPES, VECTOR_SHAPE_TYPE } from '../../../../common/constants';
 import { getDataSourceLabel } from '../../../../common/i18n_getters';
 import { convertToLines } from './convert_to_lines';
 import { AbstractESAggSource } from '../es_agg_source';
@@ -61,7 +60,7 @@ export class ESPewPewSource extends AbstractESAggSource {
   }
 
   async getSupportedShapeTypes() {
-    return [VECTOR_SHAPE_TYPES.LINE];
+    return [VECTOR_SHAPE_TYPE.LINE];
   }
 
   async getImmutableProperties() {
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.js b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.js
index 51dd57ffad0d..c8f14f1dc6a4 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.js
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.js
@@ -7,7 +7,6 @@
 import _ from 'lodash';
 import React from 'react';
 
-import { VECTOR_SHAPE_TYPES } from '../vector_feature_types';
 import { AbstractESSource } from '../es_source';
 import { getSearchService } from '../../../kibana_services';
 import { hitsToGeoJson } from '../../../elasticsearch_geo_utils';
@@ -18,6 +17,7 @@ import {
   DEFAULT_MAX_BUCKETS_LIMIT,
   SORT_ORDER,
   SCALING_TYPES,
+  VECTOR_SHAPE_TYPE,
 } from '../../../../common/constants';
 import { i18n } from '@kbn/i18n';
 import { getDataSourceLabel } from '../../../../common/i18n_getters';
@@ -471,10 +471,10 @@ export class ESSearchSource extends AbstractESSource {
     }
 
     if (geoFieldType === ES_GEO_FIELD_TYPE.GEO_POINT) {
-      return [VECTOR_SHAPE_TYPES.POINT];
+      return [VECTOR_SHAPE_TYPE.POINT];
     }
 
-    return [VECTOR_SHAPE_TYPES.POINT, VECTOR_SHAPE_TYPES.LINE, VECTOR_SHAPE_TYPES.POLYGON];
+    return [VECTOR_SHAPE_TYPE.POINT, VECTOR_SHAPE_TYPE.LINE, VECTOR_SHAPE_TYPE.POLYGON];
   }
 
   getSourceTooltipContent(sourceDataRequest) {
diff --git a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.ts b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.ts
index 86a1589a7a03..03b91df22d3c 100644
--- a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.ts
+++ b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.ts
@@ -8,8 +8,7 @@ import { i18n } from '@kbn/i18n';
 import uuid from 'uuid/v4';
 import { AbstractSource, ImmutableSourceProperty } from '../source';
 import { BoundsFilters, GeoJsonWithMeta, ITiledSingleLayerVectorSource } from '../vector_source';
-import { MAX_ZOOM, MIN_ZOOM, SOURCE_TYPES } from '../../../../common/constants';
-import { VECTOR_SHAPE_TYPES } from '../vector_feature_types';
+import { MAX_ZOOM, MIN_ZOOM, SOURCE_TYPES, VECTOR_SHAPE_TYPE } from '../../../../common/constants';
 import { IField } from '../../fields/field';
 import { registerSource } from '../source_registry';
 import { getDataSourceLabel, getUrlLabel } from '../../../../common/i18n_getters';
@@ -116,8 +115,8 @@ export class MVTSingleLayerVectorSource extends AbstractSource
     };
   }
 
-  async getSupportedShapeTypes(): Promise<VECTOR_SHAPE_TYPES[]> {
-    return [VECTOR_SHAPE_TYPES.POINT, VECTOR_SHAPE_TYPES.LINE, VECTOR_SHAPE_TYPES.POLYGON];
+  async getSupportedShapeTypes(): Promise<VECTOR_SHAPE_TYPE[]> {
+    return [VECTOR_SHAPE_TYPE.POINT, VECTOR_SHAPE_TYPE.LINE, VECTOR_SHAPE_TYPE.POLYGON];
   }
 
   canFormatFeatureProperties() {
diff --git a/x-pack/plugins/maps/public/classes/sources/vector_feature_types.ts b/x-pack/plugins/maps/public/classes/sources/vector_feature_types.ts
deleted file mode 100644
index 9f03357e17da..000000000000
--- a/x-pack/plugins/maps/public/classes/sources/vector_feature_types.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export enum VECTOR_SHAPE_TYPES {
-  POINT = 'POINT',
-  LINE = 'LINE',
-  POLYGON = 'POLYGON',
-}
diff --git a/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts b/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
index 711b7d600d74..99a7478cd836 100644
--- a/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
+++ b/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
@@ -16,7 +16,7 @@ import {
   VectorSourceRequestMeta,
   VectorSourceSyncMeta,
 } from '../../../../common/descriptor_types';
-import { VECTOR_SHAPE_TYPES } from '../vector_feature_types';
+import { VECTOR_SHAPE_TYPE } from '../../../../common/constants';
 import { ITooltipProperty } from '../../tooltips/tooltip_property';
 
 export type GeoJsonFetchMeta = ESSearchSourceResponseMeta;
@@ -68,7 +68,7 @@ export class AbstractVectorSource extends AbstractSource implements IVectorSourc
   getFields(): Promise<IField[]>;
   getFieldByName(fieldName: string): IField | null;
   getSyncMeta(): VectorSourceSyncMeta;
-  getSupportedShapeTypes(): Promise<VECTOR_SHAPE_TYPES[]>;
+  getSupportedShapeTypes(): Promise<VECTOR_SHAPE_TYPE[]>;
   canFormatFeatureProperties(): boolean;
   getApplyGlobalQuery(): boolean;
   getFieldNames(): string[];
diff --git a/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.js b/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.js
index ccf6c7963c9b..ecb13bb87572 100644
--- a/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.js
+++ b/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.js
@@ -9,7 +9,7 @@ import { AbstractSource } from './../source';
 import * as topojson from 'topojson-client';
 import _ from 'lodash';
 import { i18n } from '@kbn/i18n';
-import { VECTOR_SHAPE_TYPES } from './../vector_feature_types';
+import { VECTOR_SHAPE_TYPE } from '../../../../common/constants';
 
 export class AbstractVectorSource extends AbstractSource {
   static async getGeoJson({ format, featureCollectionPath, fetchUrl }) {
@@ -127,7 +127,7 @@ export class AbstractVectorSource extends AbstractSource {
   }
 
   async getSupportedShapeTypes() {
-    return [VECTOR_SHAPE_TYPES.POINT, VECTOR_SHAPE_TYPES.LINE, VECTOR_SHAPE_TYPES.POLYGON];
+    return [VECTOR_SHAPE_TYPE.POINT, VECTOR_SHAPE_TYPE.LINE, VECTOR_SHAPE_TYPE.POLYGON];
   }
 
   getSourceTooltipContent(/* sourceDataRequest */) {
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/components/vector_style_editor.js b/x-pack/plugins/maps/public/classes/styles/vector/components/vector_style_editor.js
index 3424a972fed0..7856a4ddaff3 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/components/vector_style_editor.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/components/vector_style_editor.js
@@ -16,7 +16,6 @@ import { VectorStyleLabelBorderSizeEditor } from './label/vector_style_label_bor
 import { OrientationEditor } from './orientation/orientation_editor';
 import { getDefaultDynamicProperties, getDefaultStaticProperties } from '../vector_style_defaults';
 import { DEFAULT_FILL_COLORS, DEFAULT_LINE_COLORS } from '../../color_utils';
-import { VECTOR_SHAPE_TYPES } from '../../../sources/vector_feature_types';
 import { i18n } from '@kbn/i18n';
 
 import { EuiSpacer, EuiButtonGroup, EuiFormRow, EuiSwitch } from '@elastic/eui';
@@ -26,6 +25,7 @@ import {
   LABEL_BORDER_SIZES,
   VECTOR_STYLES,
   STYLE_TYPE,
+  VECTOR_SHAPE_TYPE,
 } from '../../../../../common/constants';
 
 export class VectorStyleEditor extends Component {
@@ -96,11 +96,11 @@ export class VectorStyleEditor extends Component {
     }
 
     if (this.state.selectedFeature === null) {
-      let selectedFeature = VECTOR_SHAPE_TYPES.POLYGON;
+      let selectedFeature = VECTOR_SHAPE_TYPE.POLYGON;
       if (this.props.isPointsOnly) {
-        selectedFeature = VECTOR_SHAPE_TYPES.POINT;
+        selectedFeature = VECTOR_SHAPE_TYPE.POINT;
       } else if (this.props.isLinesOnly) {
-        selectedFeature = VECTOR_SHAPE_TYPES.LINE;
+        selectedFeature = VECTOR_SHAPE_TYPE.LINE;
       }
       this.setState({
         selectedFeature: selectedFeature,
@@ -414,30 +414,30 @@ export class VectorStyleEditor extends Component {
 
     if (supportedFeatures.length === 1) {
       switch (supportedFeatures[0]) {
-        case VECTOR_SHAPE_TYPES.POINT:
+        case VECTOR_SHAPE_TYPE.POINT:
           return this._renderPointProperties();
-        case VECTOR_SHAPE_TYPES.LINE:
+        case VECTOR_SHAPE_TYPE.LINE:
           return this._renderLineProperties();
-        case VECTOR_SHAPE_TYPES.POLYGON:
+        case VECTOR_SHAPE_TYPE.POLYGON:
           return this._renderPolygonProperties();
       }
     }
 
     const featureButtons = [
       {
-        id: VECTOR_SHAPE_TYPES.POINT,
+        id: VECTOR_SHAPE_TYPE.POINT,
         label: i18n.translate('xpack.maps.vectorStyleEditor.pointLabel', {
           defaultMessage: 'Points',
         }),
       },
       {
-        id: VECTOR_SHAPE_TYPES.LINE,
+        id: VECTOR_SHAPE_TYPE.LINE,
         label: i18n.translate('xpack.maps.vectorStyleEditor.lineLabel', {
           defaultMessage: 'Lines',
         }),
       },
       {
-        id: VECTOR_SHAPE_TYPES.POLYGON,
+        id: VECTOR_SHAPE_TYPE.POLYGON,
         label: i18n.translate('xpack.maps.vectorStyleEditor.polygonLabel', {
           defaultMessage: 'Polygons',
         }),
@@ -445,9 +445,9 @@ export class VectorStyleEditor extends Component {
     ];
 
     let styleProperties = this._renderPolygonProperties();
-    if (selectedFeature === VECTOR_SHAPE_TYPES.LINE) {
+    if (selectedFeature === VECTOR_SHAPE_TYPE.LINE) {
       styleProperties = this._renderLineProperties();
-    } else if (selectedFeature === VECTOR_SHAPE_TYPES.POINT) {
+    } else if (selectedFeature === VECTOR_SHAPE_TYPE.POINT) {
       styleProperties = this._renderPointProperties();
     }
 
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/__snapshots__/dynamic_icon_property.test.tsx.snap b/x-pack/plugins/maps/public/classes/styles/vector/properties/__snapshots__/dynamic_icon_property.test.tsx.snap
index b4843324a0de..631a6117a111 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/__snapshots__/dynamic_icon_property.test.tsx.snap
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/__snapshots__/dynamic_icon_property.test.tsx.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`Should render categorical legend with breaks 1`] = `
+exports[`renderLegendDetailRow Should render categorical legend with breaks 1`] = `
 <div>
   <EuiFlexGroup
     gutterSize="xs"
@@ -61,6 +61,24 @@ exports[`Should render categorical legend with breaks 1`] = `
         symbolId="marker"
       />
     </EuiFlexItem>
+    <EuiFlexItem
+      key="2"
+    >
+      <Category
+        color="grey"
+        isLinesOnly={false}
+        isPointsOnly={true}
+        label={
+          <EuiTextColor
+            color="secondary"
+          >
+            Other
+          </EuiTextColor>
+        }
+        styleName="icon"
+        symbolId="square"
+      />
+    </EuiFlexItem>
   </EuiFlexGroup>
 </div>
 `;
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.js b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.js
index 4c02dee762e9..556bb2b79e83 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.js
@@ -13,7 +13,7 @@ import {
   GRADIENT_INTERVALS,
 } from '../../color_utils';
 import React from 'react';
-import { COLOR_MAP_TYPE } from '../../../../../common/constants';
+import { COLOR_MAP_TYPE, MB_LOOKUP_FUNCTION } from '../../../../../common/constants';
 import {
   isCategoricalStopsInvalid,
   getOtherCategoryLabel,
@@ -152,7 +152,7 @@ export class DynamicColorProperty extends DynamicStyleProperty {
         makeMbClampedNumberExpression({
           minValue: rangeFieldMeta.min,
           maxValue: rangeFieldMeta.max,
-          lookupFunction: 'feature-state',
+          lookupFunction: MB_LOOKUP_FUNCTION.FEATURE_STATE,
           fallback: lessThanFirstStopValue,
           fieldName: targetName,
         }),
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.js b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.js
index c7620512710d..665317569e5e 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.js
@@ -23,7 +23,7 @@ export class DynamicIconProperty extends DynamicStyleProperty {
 
   getNumberOfCategories() {
     const palette = getIconPalette(this._options.iconPaletteId);
-    return palette ? palette.length : 0;
+    return palette.length;
   }
 
   syncIconWithMb(symbolLayerId, mbMap, iconPixelSize) {
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx
index 505c08ac35ba..132c0b3f2760 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx
@@ -34,8 +34,8 @@ const makeProperty = (options: Partial<IconDynamicOptions>, field: IField = mock
   );
 };
 
-describe('DynamicIconProperty', () => {
-  it('should derive category number from palettes', async () => {
+describe('getNumberOfCategories', () => {
+  test('should derive category number from palettes', async () => {
     const filled = makeProperty({
       iconPaletteId: 'filledShapes',
     });
@@ -47,15 +47,53 @@ describe('DynamicIconProperty', () => {
   });
 });
 
-test('Should render categorical legend with breaks', async () => {
-  const iconStyle = makeProperty({
-    iconPaletteId: 'filledShapes',
+describe('renderLegendDetailRow', () => {
+  test('Should render categorical legend with breaks', async () => {
+    const iconStyle = makeProperty({
+      iconPaletteId: 'filledShapes',
+    });
+
+    const legendRow = iconStyle.renderLegendDetailRow({ isPointsOnly: true, isLinesOnly: false });
+    const component = shallow(legendRow);
+    await new Promise((resolve) => process.nextTick(resolve));
+    component.update();
+
+    expect(component).toMatchSnapshot();
   });
+});
 
-  const legendRow = iconStyle.renderLegendDetailRow({ isPointsOnly: true, isLinesOnly: false });
-  const component = shallow(legendRow);
-  await new Promise((resolve) => process.nextTick(resolve));
-  component.update();
+describe('get mapbox icon-image expression (via internal _getMbIconImageExpression)', () => {
+  describe('categorical icon palette', () => {
+    test('should return mapbox expression for pre-defined icon palette', async () => {
+      const iconStyle = makeProperty({
+        iconPaletteId: 'filledShapes',
+      });
+      expect(iconStyle._getMbIconImageExpression(15)).toEqual([
+        'match',
+        ['to-string', ['get', 'foobar']],
+        'US',
+        'circle-15',
+        'CN',
+        'marker-15',
+        'square-15',
+      ]);
+    });
 
-  expect(component).toMatchSnapshot();
+    test('should return mapbox expression for custom icon palette', async () => {
+      const iconStyle = makeProperty({
+        useCustomIconMap: true,
+        customIconStops: [
+          { stop: null, icon: 'circle' },
+          { stop: 'MX', icon: 'marker' },
+        ],
+      });
+      expect(iconStyle._getMbIconImageExpression(15)).toEqual([
+        'match',
+        ['to-string', ['get', 'foobar']],
+        'MX',
+        'marker-15',
+        'circle-15',
+      ]);
+    });
+  });
 });
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.js b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.js
index a0af2fbb939d..662d1ccf33b9 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.js
@@ -12,7 +12,7 @@ import {
   LARGE_MAKI_ICON_SIZE,
   SMALL_MAKI_ICON_SIZE,
 } from '../symbol_utils';
-import { VECTOR_STYLES } from '../../../../../common/constants';
+import { MB_LOOKUP_FUNCTION, VECTOR_STYLES } from '../../../../../common/constants';
 import _ from 'lodash';
 import React from 'react';
 
@@ -60,7 +60,7 @@ export class DynamicSizeProperty extends DynamicStyleProperty {
           minValue: rangeFieldMeta.min,
           maxValue: rangeFieldMeta.max,
           fallback: 0,
-          lookupFunction: 'get',
+          lookupFunction: MB_LOOKUP_FUNCTION.GET,
           fieldName: targetName,
         }),
         rangeFieldMeta.min,
@@ -109,7 +109,9 @@ export class DynamicSizeProperty extends DynamicStyleProperty {
   }
 
   _getMbDataDrivenSize({ targetName, minSize, maxSize, minValue, maxValue }) {
-    const lookup = this.supportsMbFeatureState() ? 'feature-state' : 'get';
+    const lookup = this.supportsMbFeatureState()
+      ? MB_LOOKUP_FUNCTION.FEATURE_STATE
+      : MB_LOOKUP_FUNCTION.GET;
 
     const stops =
       minValue === maxValue ? [maxValue, maxSize] : [minValue, minSize, maxValue, maxSize];
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/style_util.test.js b/x-pack/plugins/maps/public/classes/styles/vector/style_util.test.ts
similarity index 60%
rename from x-pack/plugins/maps/public/classes/styles/vector/style_util.test.js
rename to x-pack/plugins/maps/public/classes/styles/vector/style_util.test.ts
index eb4c6708fb2d..6c1f060383d0 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/style_util.test.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/style_util.test.ts
@@ -5,58 +5,67 @@
  */
 
 import { isOnlySingleFeatureType, assignCategoriesToPalette, dynamicRound } from './style_util';
-import { VECTOR_SHAPE_TYPES } from '../../sources/vector_feature_types';
+import { VECTOR_SHAPE_TYPE } from '../../../../common/constants';
 
 describe('isOnlySingleFeatureType', () => {
   describe('source supports single feature type', () => {
-    const supportedFeatures = [VECTOR_SHAPE_TYPES.POINT];
+    const supportedFeatures = [VECTOR_SHAPE_TYPE.POINT];
+    const hasFeatureType = {
+      [VECTOR_SHAPE_TYPE.POINT]: false,
+      [VECTOR_SHAPE_TYPE.LINE]: false,
+      [VECTOR_SHAPE_TYPE.POLYGON]: false,
+    };
 
     test('Is only single feature type when only supported feature type is target feature type', () => {
-      expect(isOnlySingleFeatureType(VECTOR_SHAPE_TYPES.POINT, supportedFeatures)).toBe(true);
+      expect(
+        isOnlySingleFeatureType(VECTOR_SHAPE_TYPE.POINT, supportedFeatures, hasFeatureType)
+      ).toBe(true);
     });
 
     test('Is not single feature type when only supported feature type is not target feature type', () => {
-      expect(isOnlySingleFeatureType(VECTOR_SHAPE_TYPES.LINE, supportedFeatures)).toBe(false);
+      expect(
+        isOnlySingleFeatureType(VECTOR_SHAPE_TYPE.LINE, supportedFeatures, hasFeatureType)
+      ).toBe(false);
     });
   });
 
   describe('source supports multiple feature types', () => {
     const supportedFeatures = [
-      VECTOR_SHAPE_TYPES.POINT,
-      VECTOR_SHAPE_TYPES.LINE,
-      VECTOR_SHAPE_TYPES.POLYGON,
+      VECTOR_SHAPE_TYPE.POINT,
+      VECTOR_SHAPE_TYPE.LINE,
+      VECTOR_SHAPE_TYPE.POLYGON,
     ];
 
     test('Is only single feature type when data only has target feature type', () => {
       const hasFeatureType = {
-        [VECTOR_SHAPE_TYPES.POINT]: true,
-        [VECTOR_SHAPE_TYPES.LINE]: false,
-        [VECTOR_SHAPE_TYPES.POLYGON]: false,
+        [VECTOR_SHAPE_TYPE.POINT]: true,
+        [VECTOR_SHAPE_TYPE.LINE]: false,
+        [VECTOR_SHAPE_TYPE.POLYGON]: false,
       };
       expect(
-        isOnlySingleFeatureType(VECTOR_SHAPE_TYPES.POINT, supportedFeatures, hasFeatureType)
+        isOnlySingleFeatureType(VECTOR_SHAPE_TYPE.POINT, supportedFeatures, hasFeatureType)
       ).toBe(true);
     });
 
     test('Is not single feature type when data has multiple feature types', () => {
       const hasFeatureType = {
-        [VECTOR_SHAPE_TYPES.POINT]: true,
-        [VECTOR_SHAPE_TYPES.LINE]: true,
-        [VECTOR_SHAPE_TYPES.POLYGON]: true,
+        [VECTOR_SHAPE_TYPE.POINT]: true,
+        [VECTOR_SHAPE_TYPE.LINE]: true,
+        [VECTOR_SHAPE_TYPE.POLYGON]: true,
       };
       expect(
-        isOnlySingleFeatureType(VECTOR_SHAPE_TYPES.LINE, supportedFeatures, hasFeatureType)
+        isOnlySingleFeatureType(VECTOR_SHAPE_TYPE.LINE, supportedFeatures, hasFeatureType)
       ).toBe(false);
     });
 
     test('Is not single feature type when data does not have target feature types', () => {
       const hasFeatureType = {
-        [VECTOR_SHAPE_TYPES.POINT]: false,
-        [VECTOR_SHAPE_TYPES.LINE]: true,
-        [VECTOR_SHAPE_TYPES.POLYGON]: false,
+        [VECTOR_SHAPE_TYPE.POINT]: false,
+        [VECTOR_SHAPE_TYPE.LINE]: true,
+        [VECTOR_SHAPE_TYPE.POLYGON]: false,
       };
       expect(
-        isOnlySingleFeatureType(VECTOR_SHAPE_TYPES.POINT, supportedFeatures, hasFeatureType)
+        isOnlySingleFeatureType(VECTOR_SHAPE_TYPE.POINT, supportedFeatures, hasFeatureType)
       ).toBe(false);
     });
   });
@@ -64,7 +73,12 @@ describe('isOnlySingleFeatureType', () => {
 
 describe('assignCategoriesToPalette', () => {
   test('Categories and palette values have same length', () => {
-    const categories = [{ key: 'alpah' }, { key: 'bravo' }, { key: 'charlie' }, { key: 'delta' }];
+    const categories = [
+      { key: 'alpah', count: 1 },
+      { key: 'bravo', count: 1 },
+      { key: 'charlie', count: 1 },
+      { key: 'delta', count: 1 },
+    ];
     const paletteValues = ['red', 'orange', 'yellow', 'green'];
     expect(assignCategoriesToPalette({ categories, paletteValues })).toEqual({
       stops: [
@@ -72,31 +86,39 @@ describe('assignCategoriesToPalette', () => {
         { stop: 'bravo', style: 'orange' },
         { stop: 'charlie', style: 'yellow' },
       ],
-      fallback: 'green',
+      fallbackSymbolId: 'green',
     });
   });
 
   test('Should More categories than palette values', () => {
-    const categories = [{ key: 'alpah' }, { key: 'bravo' }, { key: 'charlie' }, { key: 'delta' }];
+    const categories = [
+      { key: 'alpah', count: 1 },
+      { key: 'bravo', count: 1 },
+      { key: 'charlie', count: 1 },
+      { key: 'delta', count: 1 },
+    ];
     const paletteValues = ['red', 'orange', 'yellow'];
     expect(assignCategoriesToPalette({ categories, paletteValues })).toEqual({
       stops: [
         { stop: 'alpah', style: 'red' },
         { stop: 'bravo', style: 'orange' },
       ],
-      fallback: 'yellow',
+      fallbackSymbolId: 'yellow',
     });
   });
 
   test('Less categories than palette values', () => {
-    const categories = [{ key: 'alpah' }, { key: 'bravo' }];
+    const categories = [
+      { key: 'alpah', count: 1 },
+      { key: 'bravo', count: 1 },
+    ];
     const paletteValues = ['red', 'orange', 'yellow', 'green', 'blue'];
     expect(assignCategoriesToPalette({ categories, paletteValues })).toEqual({
       stops: [
         { stop: 'alpah', style: 'red' },
         { stop: 'bravo', style: 'orange' },
       ],
-      fallback: 'yellow',
+      fallbackSymbolId: 'yellow',
     });
   });
 });
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/style_util.js b/x-pack/plugins/maps/public/classes/styles/vector/style_util.ts
similarity index 57%
rename from x-pack/plugins/maps/public/classes/styles/vector/style_util.js
rename to x-pack/plugins/maps/public/classes/styles/vector/style_util.ts
index 3b62dcb27dce..d190a62e6f30 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/style_util.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/style_util.ts
@@ -5,6 +5,8 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { MB_LOOKUP_FUNCTION, VECTOR_SHAPE_TYPE } from '../../../../common/constants';
+import { Category } from '../../../../common/descriptor_types';
 
 export function getOtherCategoryLabel() {
   return i18n.translate('xpack.maps.styles.categorical.otherCategoryLabel', {
@@ -12,29 +14,32 @@ export function getOtherCategoryLabel() {
   });
 }
 
-export function getComputedFieldName(styleName, fieldName) {
+export function getComputedFieldName(styleName: string, fieldName: string) {
   return `${getComputedFieldNamePrefix(fieldName)}__${styleName}`;
 }
 
-export function getComputedFieldNamePrefix(fieldName) {
+export function getComputedFieldNamePrefix(fieldName: string) {
   return `__kbn__dynamic__${fieldName}`;
 }
 
-export function isOnlySingleFeatureType(featureType, supportedFeatures, hasFeatureType) {
+export function isOnlySingleFeatureType(
+  featureType: VECTOR_SHAPE_TYPE,
+  supportedFeatures: VECTOR_SHAPE_TYPE[],
+  hasFeatureType: { [key in keyof typeof VECTOR_SHAPE_TYPE]: boolean }
+): boolean {
   if (supportedFeatures.length === 1) {
     return supportedFeatures[0] === featureType;
   }
 
   const featureTypes = Object.keys(hasFeatureType);
-  return featureTypes.reduce((isOnlyTargetFeatureType, featureTypeKey) => {
+  // @ts-expect-error
+  return featureTypes.reduce((accumulator: boolean, featureTypeKey: VECTOR_SHAPE_TYPE) => {
     const hasFeature = hasFeatureType[featureTypeKey];
-    return featureTypeKey === featureType
-      ? isOnlyTargetFeatureType && hasFeature
-      : isOnlyTargetFeatureType && !hasFeature;
+    return featureTypeKey === featureType ? accumulator && hasFeature : accumulator && !hasFeature;
   }, true);
 }
 
-export function dynamicRound(value) {
+export function dynamicRound(value: number | string) {
   if (typeof value !== 'number') {
     return value;
   }
@@ -49,13 +54,19 @@ export function dynamicRound(value) {
   return precision === 0 ? Math.round(value) : parseFloat(value.toFixed(precision + 1));
 }
 
-export function assignCategoriesToPalette({ categories, paletteValues }) {
+export function assignCategoriesToPalette({
+  categories,
+  paletteValues,
+}: {
+  categories: Category[];
+  paletteValues: string[];
+}) {
   const stops = [];
-  let fallback = null;
+  let fallbackSymbolId = null;
 
-  if (categories && categories.length && paletteValues && paletteValues.length) {
+  if (categories.length && paletteValues.length) {
     const maxLength = Math.min(paletteValues.length, categories.length + 1);
-    fallback = paletteValues[maxLength - 1];
+    fallbackSymbolId = paletteValues[maxLength - 1];
     for (let i = 0; i < maxLength - 1; i++) {
       stops.push({
         stop: categories[i].key,
@@ -66,7 +77,7 @@ export function assignCategoriesToPalette({ categories, paletteValues }) {
 
   return {
     stops,
-    fallback,
+    fallbackSymbolId,
   };
 }
 
@@ -76,6 +87,12 @@ export function makeMbClampedNumberExpression({
   minValue,
   maxValue,
   fallback,
+}: {
+  lookupFunction: MB_LOOKUP_FUNCTION;
+  fieldName: string;
+  minValue: number;
+  maxValue: number;
+  fallback: number;
 }) {
   const clamp = ['max', ['min', ['to-number', [lookupFunction, fieldName]], maxValue], minValue];
   return [
@@ -83,7 +100,7 @@ export function makeMbClampedNumberExpression({
     [
       'case',
       ['==', [lookupFunction, fieldName], null],
-      minValue - 1, //== does a JS-y like check where returns true for null and undefined
+      minValue - 1, // == does a JS-y like check where returns true for null and undefined
       clamp,
     ],
     fallback,
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/symbol_utils.js b/x-pack/plugins/maps/public/classes/styles/vector/symbol_utils.js
index 1672af8eccff..04df9d73d75c 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/symbol_utils.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/symbol_utils.js
@@ -140,5 +140,5 @@ export function getIconPaletteOptions(isDarkMode) {
 
 export function getIconPalette(paletteId) {
   const palette = ICON_PALETTES.find(({ id }) => id === paletteId);
-  return palette ? [...palette.icons] : null;
+  return palette ? [...palette.icons] : [];
 }
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.js b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.js
index 989ac268c055..04a5381fa259 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.js
@@ -16,12 +16,12 @@ import {
   SOURCE_FORMATTERS_DATA_REQUEST_ID,
   LAYER_STYLE_TYPE,
   DEFAULT_ICON,
+  VECTOR_SHAPE_TYPE,
   VECTOR_STYLES,
 } from '../../../../common/constants';
 import { StyleMeta } from './style_meta';
 import { VectorIcon } from './components/legend/vector_icon';
 import { VectorStyleLegend } from './components/legend/vector_style_legend';
-import { VECTOR_SHAPE_TYPES } from '../../sources/vector_feature_types';
 import { getComputedFieldName, isOnlySingleFeatureType } from './style_util';
 import { StaticStyleProperty } from './properties/static_style_property';
 import { DynamicStyleProperty } from './properties/dynamic_style_property';
@@ -249,24 +249,24 @@ export class VectorStyle extends AbstractStyle {
 
     const supportedFeatures = await this._source.getSupportedShapeTypes();
     const hasFeatureType = {
-      [VECTOR_SHAPE_TYPES.POINT]: false,
-      [VECTOR_SHAPE_TYPES.LINE]: false,
-      [VECTOR_SHAPE_TYPES.POLYGON]: false,
+      [VECTOR_SHAPE_TYPE.POINT]: false,
+      [VECTOR_SHAPE_TYPE.LINE]: false,
+      [VECTOR_SHAPE_TYPE.POLYGON]: false,
     };
     if (supportedFeatures.length > 1) {
       for (let i = 0; i < features.length; i++) {
         const feature = features[i];
-        if (!hasFeatureType[VECTOR_SHAPE_TYPES.POINT] && POINTS.includes(feature.geometry.type)) {
-          hasFeatureType[VECTOR_SHAPE_TYPES.POINT] = true;
+        if (!hasFeatureType[VECTOR_SHAPE_TYPE.POINT] && POINTS.includes(feature.geometry.type)) {
+          hasFeatureType[VECTOR_SHAPE_TYPE.POINT] = true;
         }
-        if (!hasFeatureType[VECTOR_SHAPE_TYPES.LINE] && LINES.includes(feature.geometry.type)) {
-          hasFeatureType[VECTOR_SHAPE_TYPES.LINE] = true;
+        if (!hasFeatureType[VECTOR_SHAPE_TYPE.LINE] && LINES.includes(feature.geometry.type)) {
+          hasFeatureType[VECTOR_SHAPE_TYPE.LINE] = true;
         }
         if (
-          !hasFeatureType[VECTOR_SHAPE_TYPES.POLYGON] &&
+          !hasFeatureType[VECTOR_SHAPE_TYPE.POLYGON] &&
           POLYGONS.includes(feature.geometry.type)
         ) {
-          hasFeatureType[VECTOR_SHAPE_TYPES.POLYGON] = true;
+          hasFeatureType[VECTOR_SHAPE_TYPE.POLYGON] = true;
         }
       }
     }
@@ -274,17 +274,17 @@ export class VectorStyle extends AbstractStyle {
     const styleMeta = {
       geometryTypes: {
         isPointsOnly: isOnlySingleFeatureType(
-          VECTOR_SHAPE_TYPES.POINT,
+          VECTOR_SHAPE_TYPE.POINT,
           supportedFeatures,
           hasFeatureType
         ),
         isLinesOnly: isOnlySingleFeatureType(
-          VECTOR_SHAPE_TYPES.LINE,
+          VECTOR_SHAPE_TYPE.LINE,
           supportedFeatures,
           hasFeatureType
         ),
         isPolygonsOnly: isOnlySingleFeatureType(
-          VECTOR_SHAPE_TYPES.POLYGON,
+          VECTOR_SHAPE_TYPE.POLYGON,
           supportedFeatures,
           hasFeatureType
         ),
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.test.js b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.test.js
index 426f1d6afa95..a0dc07b8e545 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.test.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.test.js
@@ -6,8 +6,7 @@
 
 import { VectorStyle } from './vector_style';
 import { DataRequest } from '../../util/data_request';
-import { VECTOR_SHAPE_TYPES } from '../../sources/vector_feature_types';
-import { FIELD_ORIGIN, STYLE_TYPE } from '../../../../common/constants';
+import { FIELD_ORIGIN, STYLE_TYPE, VECTOR_SHAPE_TYPE } from '../../../../common/constants';
 
 jest.mock('../../../kibana_services');
 jest.mock('ui/new_platform');
@@ -28,7 +27,7 @@ class MockField {
 
 class MockSource {
   constructor({ supportedShapeTypes } = {}) {
-    this._supportedShapeTypes = supportedShapeTypes || Object.values(VECTOR_SHAPE_TYPES);
+    this._supportedShapeTypes = supportedShapeTypes || Object.values(VECTOR_SHAPE_TYPE);
   }
   getSupportedShapeTypes() {
     return this._supportedShapeTypes;

From be3886b77f085ea3807f9e37ce17b21675525aaf Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Thu, 25 Jun 2020 20:25:05 -0600
Subject: [PATCH 31/78] [Maps] avoid using MAP_SAVED_OBJECT_TYPE constant when
 defining URL paths (#69723)

* [Maps] avoid using MAP_SAVED_OBJECT_TYPE constant when defining URL paths

* rename methods

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 x-pack/plugins/maps/common/constants.ts               | 11 +++++++----
 .../maps/public/embeddable/map_embeddable_factory.ts  |  4 ++--
 x-pack/plugins/maps/public/maps_vis_type_alias.js     |  4 ++--
 .../routing/bootstrap/services/saved_gis_map.js       |  4 ++--
 .../maps/public/routing/page_elements/breadcrumbs.js  |  4 ++--
 x-pack/plugins/maps/server/plugin.ts                  |  8 ++++----
 x-pack/plugins/maps/server/saved_objects/map.ts       |  4 ++--
 x-pack/plugins/maps/server/tutorials/ems/index.ts     |  4 ++--
 8 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/x-pack/plugins/maps/common/constants.ts b/x-pack/plugins/maps/common/constants.ts
index bf30006441c9..f7374ba91f8f 100644
--- a/x-pack/plugins/maps/common/constants.ts
+++ b/x-pack/plugins/maps/common/constants.ts
@@ -26,14 +26,17 @@ export const MAP_SAVED_OBJECT_TYPE = 'map';
 export const APP_ID = 'maps';
 export const APP_ICON = 'gisApp';
 
-export const MAP_APP_PATH = `app/${APP_ID}`;
+export const MAPS_APP_PATH = `app/${APP_ID}`;
+export const MAP_PATH = 'map';
 export const GIS_API_PATH = `api/${APP_ID}`;
 export const INDEX_SETTINGS_API_PATH = `${GIS_API_PATH}/indexSettings`;
 export const FONTS_API_PATH = `${GIS_API_PATH}/fonts`;
 
-export const MAP_BASE_URL = `/${MAP_APP_PATH}/${MAP_SAVED_OBJECT_TYPE}`;
-
-export function createMapPath(id: string) {
+const MAP_BASE_URL = `/${MAPS_APP_PATH}/${MAP_PATH}`;
+export function getNewMapPath() {
+  return MAP_BASE_URL;
+}
+export function getExistingMapPath(id: string) {
   return `${MAP_BASE_URL}/${id}`;
 }
 
diff --git a/x-pack/plugins/maps/public/embeddable/map_embeddable_factory.ts b/x-pack/plugins/maps/public/embeddable/map_embeddable_factory.ts
index c73225fc4285..8fb0ecb50b28 100644
--- a/x-pack/plugins/maps/public/embeddable/map_embeddable_factory.ts
+++ b/x-pack/plugins/maps/public/embeddable/map_embeddable_factory.ts
@@ -12,7 +12,7 @@ import {
   IContainer,
 } from '../../../../../src/plugins/embeddable/public';
 import '../index.scss';
-import { createMapPath, MAP_SAVED_OBJECT_TYPE, APP_ICON } from '../../common/constants';
+import { getExistingMapPath, MAP_SAVED_OBJECT_TYPE, APP_ICON } from '../../common/constants';
 import { LayerDescriptor } from '../../common/descriptor_types';
 import { MapEmbeddableInput } from './types';
 import { lazyLoadMapModules } from '../lazy_load_bundle';
@@ -113,7 +113,7 @@ export class MapEmbeddableFactory implements EmbeddableFactoryDefinition {
       {
         layerList,
         title: savedMap.title,
-        editUrl: getHttp().basePath.prepend(createMapPath(savedObjectId)),
+        editUrl: getHttp().basePath.prepend(getExistingMapPath(savedObjectId)),
         indexPatterns,
         editable: await this.isEditable(),
         settings,
diff --git a/x-pack/plugins/maps/public/maps_vis_type_alias.js b/x-pack/plugins/maps/public/maps_vis_type_alias.js
index cb7b3db17eab..d90674f0f772 100644
--- a/x-pack/plugins/maps/public/maps_vis_type_alias.js
+++ b/x-pack/plugins/maps/public/maps_vis_type_alias.js
@@ -5,7 +5,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { APP_ID, APP_ICON, MAP_SAVED_OBJECT_TYPE } from '../common/constants';
+import { APP_ID, APP_ICON, MAP_PATH } from '../common/constants';
 import { getShowMapVisualizationTypes, getVisualizations } from './kibana_services';
 
 export function getMapsVisTypeAlias() {
@@ -28,7 +28,7 @@ The Maps app offers more functionality and is easier to use.`,
 
   return {
     aliasApp: APP_ID,
-    aliasPath: `/${MAP_SAVED_OBJECT_TYPE}`,
+    aliasPath: `/${MAP_PATH}`,
     name: APP_ID,
     title: i18n.translate('xpack.maps.visTypeAlias.title', {
       defaultMessage: 'Maps',
diff --git a/x-pack/plugins/maps/public/routing/bootstrap/services/saved_gis_map.js b/x-pack/plugins/maps/public/routing/bootstrap/services/saved_gis_map.js
index f24c7be65afa..f8c783f673ba 100644
--- a/x-pack/plugins/maps/public/routing/bootstrap/services/saved_gis_map.js
+++ b/x-pack/plugins/maps/public/routing/bootstrap/services/saved_gis_map.js
@@ -19,7 +19,7 @@ import {
 import { getIsLayerTOCOpen, getOpenTOCDetails } from '../../../selectors/ui_selectors';
 import { copyPersistentState } from '../../../reducers/util';
 import { extractReferences, injectReferences } from '../../../../common/migrations/references';
-import { MAP_BASE_URL, MAP_SAVED_OBJECT_TYPE } from '../../../../common/constants';
+import { getExistingMapPath, MAP_SAVED_OBJECT_TYPE } from '../../../../common/constants';
 import { getStore } from '../../store_operations';
 
 export function createSavedGisMapClass(services) {
@@ -76,7 +76,7 @@ export function createSavedGisMapClass(services) {
     }
 
     getFullPath() {
-      return `${MAP_BASE_URL}/${this.id}`;
+      return getExistingMapPath(this.id);
     }
 
     getLayerList() {
diff --git a/x-pack/plugins/maps/public/routing/page_elements/breadcrumbs.js b/x-pack/plugins/maps/public/routing/page_elements/breadcrumbs.js
index 36a355719d94..de2ee42b4917 100644
--- a/x-pack/plugins/maps/public/routing/page_elements/breadcrumbs.js
+++ b/x-pack/plugins/maps/public/routing/page_elements/breadcrumbs.js
@@ -6,7 +6,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { getCoreChrome } from '../../kibana_services';
-import { MAP_SAVED_OBJECT_TYPE } from '../../../common/constants';
+import { MAP_PATH } from '../../../common/constants';
 import _ from 'lodash';
 import { getLayerListRaw } from '../../selectors/map_selectors';
 import { copyPersistentState } from '../../reducers/util';
@@ -31,7 +31,7 @@ function hasUnsavedChanges(savedMap, initialLayerListConfig) {
 }
 
 export const updateBreadcrumbs = (savedMap, initialLayerListConfig, currentPath = '') => {
-  const isOnMapNow = currentPath.startsWith(`/${MAP_SAVED_OBJECT_TYPE}`);
+  const isOnMapNow = currentPath.startsWith(`/${MAP_PATH}`);
   const breadCrumbs = isOnMapNow
     ? [
         {
diff --git a/x-pack/plugins/maps/server/plugin.ts b/x-pack/plugins/maps/server/plugin.ts
index fe2b73df7978..60f3a9b68202 100644
--- a/x-pack/plugins/maps/server/plugin.ts
+++ b/x-pack/plugins/maps/server/plugin.ts
@@ -14,7 +14,7 @@ import { getFlightsSavedObjects } from './sample_data/flights_saved_objects.js';
 // @ts-ignore
 import { getWebLogsSavedObjects } from './sample_data/web_logs_saved_objects.js';
 import { registerMapsUsageCollector } from './maps_telemetry/collectors/register';
-import { APP_ID, APP_ICON, MAP_SAVED_OBJECT_TYPE, createMapPath } from '../common/constants';
+import { APP_ID, APP_ICON, MAP_SAVED_OBJECT_TYPE, getExistingMapPath } from '../common/constants';
 import { mapSavedObjects } from './saved_objects';
 import { MapsXPackConfig } from '../config';
 // @ts-ignore
@@ -58,7 +58,7 @@ export class MapsPlugin implements Plugin {
 
       home.sampleData.addAppLinksToSampleDataset('ecommerce', [
         {
-          path: createMapPath('2c9c1f60-1909-11e9-919b-ffe5949a18d2'),
+          path: getExistingMapPath('2c9c1f60-1909-11e9-919b-ffe5949a18d2'),
           label: sampleDataLinkLabel,
           icon: APP_ICON,
         },
@@ -80,7 +80,7 @@ export class MapsPlugin implements Plugin {
 
       home.sampleData.addAppLinksToSampleDataset('flights', [
         {
-          path: createMapPath('5dd88580-1906-11e9-919b-ffe5949a18d2'),
+          path: getExistingMapPath('5dd88580-1906-11e9-919b-ffe5949a18d2'),
           label: sampleDataLinkLabel,
           icon: APP_ICON,
         },
@@ -101,7 +101,7 @@ export class MapsPlugin implements Plugin {
       home.sampleData.addSavedObjectsToSampleDataset('logs', getWebLogsSavedObjects());
       home.sampleData.addAppLinksToSampleDataset('logs', [
         {
-          path: createMapPath('de71f4f0-1902-11e9-919b-ffe5949a18d2'),
+          path: getExistingMapPath('de71f4f0-1902-11e9-919b-ffe5949a18d2'),
           label: sampleDataLinkLabel,
           icon: APP_ICON,
         },
diff --git a/x-pack/plugins/maps/server/saved_objects/map.ts b/x-pack/plugins/maps/server/saved_objects/map.ts
index 0fcadc5a9720..ce9d57913786 100644
--- a/x-pack/plugins/maps/server/saved_objects/map.ts
+++ b/x-pack/plugins/maps/server/saved_objects/map.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { SavedObjectsType } from 'src/core/server';
-import { APP_ICON, createMapPath } from '../../common/constants';
+import { APP_ICON, getExistingMapPath } from '../../common/constants';
 // @ts-ignore
 import { migrations } from './migrations';
 
@@ -31,7 +31,7 @@ export const mapSavedObjects: SavedObjectsType = {
     },
     getInAppUrl(obj) {
       return {
-        path: createMapPath(obj.id),
+        path: getExistingMapPath(obj.id),
         uiCapabilitiesPath: 'maps.show',
       };
     },
diff --git a/x-pack/plugins/maps/server/tutorials/ems/index.ts b/x-pack/plugins/maps/server/tutorials/ems/index.ts
index e96af89e5268..be15120cb19e 100644
--- a/x-pack/plugins/maps/server/tutorials/ems/index.ts
+++ b/x-pack/plugins/maps/server/tutorials/ems/index.ts
@@ -6,7 +6,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { TutorialsCategory } from '../../../../../../src/plugins/home/server';
-import { MAP_BASE_URL } from '../../../common/constants';
+import { getNewMapPath } from '../../../common/constants';
 
 export function emsBoundariesSpecProvider({
   emsLandingPageUrl,
@@ -64,7 +64,7 @@ Indexing EMS administrative boundaries in Elasticsearch allows for search on bou
 2. Click `Add layer`, then select `Upload GeoJSON`.\n\
 3. Upload the GeoJSON file and click `Import file`.',
                     values: {
-                      newMapUrl: prependBasePath(MAP_BASE_URL),
+                      newMapUrl: prependBasePath(getNewMapPath()),
                     },
                   }),
                 },

From c4b2e6f1119b3fff883c4a034b82db78fb307a64 Mon Sep 17 00:00:00 2001
From: Matthias Wilhelm <matthias.wilhelm@elastic.co>
Date: Fri, 26 Jun 2020 06:51:13 +0200
Subject: [PATCH 32/78] [Discover] Validate timerange before submitting query
 to ES (#69363)

---
 .../public/application/angular/discover.js    | 15 ++++--
 .../helpers/validate_time_range.test.ts       | 47 ++++++++++++++++++
 .../helpers/validate_time_range.ts            | 49 +++++++++++++++++++
 test/functional/apps/discover/_discover.js    | 11 +++++
 test/functional/page_objects/common_page.ts   |  2 +-
 5 files changed, 120 insertions(+), 4 deletions(-)
 create mode 100644 src/plugins/discover/public/application/helpers/validate_time_range.test.ts
 create mode 100644 src/plugins/discover/public/application/helpers/validate_time_range.ts

diff --git a/src/plugins/discover/public/application/angular/discover.js b/src/plugins/discover/public/application/angular/discover.js
index 65868b0b7cd4..f7f88603b833 100644
--- a/src/plugins/discover/public/application/angular/discover.js
+++ b/src/plugins/discover/public/application/angular/discover.js
@@ -64,6 +64,7 @@ const {
 } = getServices();
 
 import { getRootBreadcrumbs, getSavedSearchBreadcrumbs } from '../helpers/breadcrumbs';
+import { validateTimeRange } from '../helpers/validate_time_range';
 import {
   esFilters,
   indexPatterns as indexPatternsUtils,
@@ -784,6 +785,10 @@ function discoverController(
     if (!init.complete) return;
     $scope.fetchCounter++;
     $scope.fetchError = undefined;
+    if (!validateTimeRange(timefilter.getTime(), toastNotifications)) {
+      $scope.resultState = 'none';
+      return;
+    }
 
     // Abort any in-progress requests before fetching again
     if (abortController) abortController.abort();
@@ -916,14 +921,18 @@ function discoverController(
   }
 
   $scope.updateTime = function () {
-    //this is the timerange for the histogram, should be refactored
+    const { from, to } = timefilter.getTime();
+    // this is the timerange for the histogram, should be refactored
     $scope.timeRange = {
-      from: dateMath.parse(timefilter.getTime().from),
-      to: dateMath.parse(timefilter.getTime().to, { roundUp: true }),
+      from: dateMath.parse(from),
+      to: dateMath.parse(to, { roundUp: true }),
     };
   };
 
   $scope.toMoment = function (datetime) {
+    if (!datetime) {
+      return;
+    }
     return moment(datetime).format(config.get('dateFormat'));
   };
 
diff --git a/src/plugins/discover/public/application/helpers/validate_time_range.test.ts b/src/plugins/discover/public/application/helpers/validate_time_range.test.ts
new file mode 100644
index 000000000000..a61a729caa22
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/validate_time_range.test.ts
@@ -0,0 +1,47 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { validateTimeRange } from './validate_time_range';
+import { notificationServiceMock } from '../../../../../core/public/mocks';
+
+describe('Discover validateTimeRange', () => {
+  test('validates given time ranges correctly', async () => {
+    const { toasts } = notificationServiceMock.createStartContract();
+    [
+      { from: '', to: '', result: false },
+      { from: 'now', to: 'now+1h', result: true },
+      { from: 'now', to: 'lala+1h', result: false },
+      { from: '', to: 'now', result: false },
+      { from: 'now', to: '', result: false },
+      { from: ' 2020-06-02T13:36:13.689Z', to: 'now', result: true },
+      { from: ' 2020-06-02T13:36:13.689Z', to: '2020-06-02T13:36:13.690Z', result: true },
+    ].map((test) => {
+      expect(validateTimeRange({ from: test.from, to: test.to }, toasts)).toEqual(test.result);
+    });
+  });
+
+  test('displays a toast when invalid data is entered', async () => {
+    const { toasts } = notificationServiceMock.createStartContract();
+    expect(validateTimeRange({ from: 'now', to: 'null' }, toasts)).toEqual(false);
+    expect(toasts.addDanger).toHaveBeenCalledWith({
+      title: 'Invalid time range',
+      text: "The provided time range is invalid. (from: 'now', to: 'null')",
+    });
+  });
+});
diff --git a/src/plugins/discover/public/application/helpers/validate_time_range.ts b/src/plugins/discover/public/application/helpers/validate_time_range.ts
new file mode 100644
index 000000000000..411147f82733
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/validate_time_range.ts
@@ -0,0 +1,49 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import dateMath from '@elastic/datemath';
+import { i18n } from '@kbn/i18n';
+import { ToastsStart } from 'kibana/public';
+
+/**
+ * Validates a given time filter range, provided by URL or UI
+ * Unless valid, it returns false and displays a notification
+ */
+export function validateTimeRange(
+  { from, to }: { from: string; to: string },
+  toastNotifications: ToastsStart
+): boolean {
+  const fromMoment = dateMath.parse(from);
+  const toMoment = dateMath.parse(to);
+  if (!fromMoment || !toMoment || !fromMoment.isValid() || !toMoment.isValid()) {
+    toastNotifications.addDanger({
+      title: i18n.translate('discover.notifications.invalidTimeRangeTitle', {
+        defaultMessage: `Invalid time range`,
+      }),
+      text: i18n.translate('discover.notifications.invalidTimeRangeText', {
+        defaultMessage: `The provided time range is invalid. (from: '{from}', to: '{to}')`,
+        values: {
+          from,
+          to,
+        },
+      }),
+    });
+    return false;
+  }
+  return true;
+}
diff --git a/test/functional/apps/discover/_discover.js b/test/functional/apps/discover/_discover.js
index ecaa5aa2da97..de9606f3d02e 100644
--- a/test/functional/apps/discover/_discover.js
+++ b/test/functional/apps/discover/_discover.js
@@ -257,5 +257,16 @@ export default function ({ getService, getPageObjects }) {
         expect(refreshedTimeString).not.to.be(initialTimeString);
       });
     });
+
+    describe('invalid time range in URL', function () {
+      it('should display a "Invalid time range toast"', async function () {
+        await PageObjects.common.navigateToUrl('discover', '#/?_g=(time:(from:now-15m,to:null))', {
+          useActualUrl: true,
+        });
+        await PageObjects.header.awaitKibanaChrome();
+        const toastMessage = await PageObjects.common.closeToast();
+        expect(toastMessage).to.be('Invalid time range');
+      });
+    });
   });
 }
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index 236b2fb9f2f1..8c5a99204bab 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -399,7 +399,7 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
       const toast = await find.byCssSelector('.euiToast', 2 * defaultFindTimeout);
       await toast.moveMouseTo();
       const title = await (await find.byCssSelector('.euiToastHeader__title')).getVisibleText();
-      log.debug(`Toast title: ${title}`);
+
       await find.clickByCssSelector('.euiToast__closeButton');
       return title;
     }

From f4868017571fc7bc68eaf6c70d79865673b6052f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Istv=C3=A1n=20Zolt=C3=A1n=20Szab=C3=B3?=
 <istvan.szabo@elastic.co>
Date: Fri, 26 Jun 2020 07:58:55 +0200
Subject: [PATCH 33/78] [DOCS] Fixes wording in Upload a CSV section (#69969)

---
 docs/setup/connect-to-elasticsearch.asciidoc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/setup/connect-to-elasticsearch.asciidoc b/docs/setup/connect-to-elasticsearch.asciidoc
index 0575b8532508..bffb3f97cd1b 100644
--- a/docs/setup/connect-to-elasticsearch.asciidoc
+++ b/docs/setup/connect-to-elasticsearch.asciidoc
@@ -23,8 +23,8 @@ experimental[]
 To visualize data in a CSV, JSON, or log file, you can upload it using the File 
 Data Visualizer. On the home page, click *Import a CSV, NDSON, or log file*, and 
 then drag your file into the File Data Visualizer. Alternatively, you can open 
-it by navigating to the Machine Learning app page from the sidebar menu and 
-selecting the Data Visualizer from the top navigation bar on the opening page.
+it by navigating to *Machine Learning* from the side navigation and selecting 
+*Data Visualizer*.
 
 [role="screenshot"]
 image::images/data-viz-homepage.jpg[File Data Visualizer on the home page]

From eedc86fbe3246344d66eaee40b3602ebc0037abc Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Fri, 26 Jun 2020 09:37:58 +0300
Subject: [PATCH 34/78] Fixes bug on color picker defaults on TSVB (#69889)

* Fixes bug on color picker defaults on TSVB

* Add test to ensure that the input text of the picker is set up correctly
---
 .../components/color_picker.test.tsx           | 18 ++++++++++++++++++
 .../application/components/color_picker.tsx    |  6 ++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/plugins/vis_type_timeseries/public/application/components/color_picker.test.tsx b/src/plugins/vis_type_timeseries/public/application/components/color_picker.test.tsx
index ca8750a991d8..7c930fa2e296 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/color_picker.test.tsx
+++ b/src/plugins/vis_type_timeseries/public/application/components/color_picker.test.tsx
@@ -22,6 +22,8 @@ import { ColorPicker, ColorPickerProps } from './color_picker';
 import { mount } from 'enzyme';
 import { ReactWrapper } from 'enzyme';
 import { EuiColorPicker, EuiIconTip } from '@elastic/eui';
+// @ts-ignore
+import { findTestSubject } from '@elastic/eui/lib/test';
 
 describe('ColorPicker', () => {
   const defaultProps: ColorPickerProps = {
@@ -42,6 +44,22 @@ describe('ColorPicker', () => {
     expect(component.find('.tvbColorPicker__clear').length).toBe(0);
   });
 
+  it('should render the correct value to the input text if the prop value is hex', () => {
+    const props = { ...defaultProps, value: '#68BC00' };
+    component = mount(<ColorPicker {...props} />);
+    component.find('.tvbColorPicker button').simulate('click');
+    const input = findTestSubject(component, 'topColorPickerInput');
+    expect(input.props().value).toBe('#68BC00');
+  });
+
+  it('should render the correct value to the input text if the prop value is rgba', () => {
+    const props = { ...defaultProps, value: 'rgba(85,66,177,1)' };
+    component = mount(<ColorPicker {...props} />);
+    component.find('.tvbColorPicker button').simulate('click');
+    const input = findTestSubject(component, 'topColorPickerInput');
+    expect(input.props().value).toBe('85,66,177,1');
+  });
+
   it('should render the correct aria label to the color swatch button', () => {
     const props = { ...defaultProps, value: 'rgba(85,66,177,0.59)' };
     component = mount(<ColorPicker {...props} />);
diff --git a/src/plugins/vis_type_timeseries/public/application/components/color_picker.tsx b/src/plugins/vis_type_timeseries/public/application/components/color_picker.tsx
index be580c80d594..444e5c90c7a6 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/color_picker.tsx
+++ b/src/plugins/vis_type_timeseries/public/application/components/color_picker.tsx
@@ -43,8 +43,10 @@ export interface ColorPickerProps {
 }
 
 export function ColorPicker({ name, value, disableTrash = false, onChange }: ColorPickerProps) {
-  const initialColorValue = value ? value.replace(COMMAS_NUMS_ONLY_RE, '') : '';
-  const [color, setColor] = useState(initialColorValue);
+  const initialColorValue = value?.includes('rgba')
+    ? value.replace(COMMAS_NUMS_ONLY_RE, '')
+    : value;
+  const [color, setColor] = useState(initialColorValue || '');
 
   const handleColorChange: EuiColorPickerProps['onChange'] = (text: string, { rgba, hex }) => {
     setColor(text);

From 67e48527e7b46222bdfd861689f01341a77d1c46 Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Fri, 26 Jun 2020 09:38:35 +0200
Subject: [PATCH 35/78] [Lens] Add toolbar api (#69263)

---
 .../_workspace_panel_wrapper.scss             |  5 +-
 .../editor_frame/editor_frame.tsx             | 30 +++----
 .../editor_frame/workspace_panel.tsx          | 26 ++++--
 .../workspace_panel_wrapper.test.tsx          | 65 ++++++++++++++
 .../editor_frame/workspace_panel_wrapper.tsx  | 89 ++++++++++++++++---
 x-pack/plugins/lens/public/types.ts           | 11 +++
 6 files changed, 188 insertions(+), 38 deletions(-)
 create mode 100644 x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel_wrapper.test.tsx

diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/_workspace_panel_wrapper.scss b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/_workspace_panel_wrapper.scss
index 4ba19cb4ab05..e663754707e0 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/_workspace_panel_wrapper.scss
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/_workspace_panel_wrapper.scss
@@ -10,11 +10,14 @@
   .lnsWorkspacePanelWrapper__pageContentHeader {
     @include euiTitle('xs');
     padding: $euiSizeM;
-    border-bottom: $euiBorderThin;
     // override EuiPage
     margin-bottom: 0 !important; // sass-lint:disable-line no-important
   }
 
+  .lnsWorkspacePanelWrapper__pageContentHeader--unsaved {
+    color: $euiTextSubduedColor;
+  }
+
   .lnsWorkspacePanelWrapper__pageContentBody {
     @include euiScrollBar;
     flex-grow: 1;
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.tsx
index 07c76a81ed62..af3d0ed068d2 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.tsx
@@ -23,7 +23,6 @@ import { WorkspacePanel } from './workspace_panel';
 import { Document } from '../../persistence/saved_object_store';
 import { RootDragDropProvider } from '../../drag_drop';
 import { getSavedObjectFormat } from './save';
-import { WorkspacePanelWrapper } from './workspace_panel_wrapper';
 import { generateId } from '../../id_generator';
 import { Filter, Query, SavedQuery } from '../../../../../../src/plugins/data/public';
 import { EditorFrameStartPlugins } from '../service';
@@ -275,21 +274,20 @@ export function EditorFrame(props: EditorFrameProps) {
         }
         workspacePanel={
           allLoaded && (
-            <WorkspacePanelWrapper title={state.title}>
-              <WorkspacePanel
-                activeDatasourceId={state.activeDatasourceId}
-                activeVisualizationId={state.visualization.activeId}
-                datasourceMap={props.datasourceMap}
-                datasourceStates={state.datasourceStates}
-                framePublicAPI={framePublicAPI}
-                visualizationState={state.visualization.state}
-                visualizationMap={props.visualizationMap}
-                dispatch={dispatch}
-                ExpressionRenderer={props.ExpressionRenderer}
-                core={props.core}
-                plugins={props.plugins}
-              />
-            </WorkspacePanelWrapper>
+            <WorkspacePanel
+              title={state.title}
+              activeDatasourceId={state.activeDatasourceId}
+              activeVisualizationId={state.visualization.activeId}
+              datasourceMap={props.datasourceMap}
+              datasourceStates={state.datasourceStates}
+              framePublicAPI={framePublicAPI}
+              visualizationState={state.visualization.state}
+              visualizationMap={props.visualizationMap}
+              dispatch={dispatch}
+              ExpressionRenderer={props.ExpressionRenderer}
+              core={props.core}
+              plugins={props.plugins}
+            />
           )
         }
         suggestionsPanel={
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel.tsx
index e4d37772eac2..670afe28293a 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel.tsx
@@ -37,6 +37,7 @@ import { trackUiEvent } from '../../lens_ui_telemetry';
 import { UiActionsStart } from '../../../../../../src/plugins/ui_actions/public';
 import { VIS_EVENT_TO_TRIGGER } from '../../../../../../src/plugins/visualizations/public';
 import { DataPublicPluginStart } from '../../../../../../src/plugins/data/public';
+import { WorkspacePanelWrapper } from './workspace_panel_wrapper';
 
 export interface WorkspacePanelProps {
   activeVisualizationId: string | null;
@@ -56,6 +57,7 @@ export interface WorkspacePanelProps {
   ExpressionRenderer: ReactExpressionRendererType;
   core: CoreStart | CoreSetup;
   plugins: { uiActions?: UiActionsStart; data: DataPublicPluginStart };
+  title?: string;
 }
 
 export const WorkspacePanel = debouncedComponent(InnerWorkspacePanel);
@@ -73,6 +75,7 @@ export function InnerWorkspacePanel({
   core,
   plugins,
   ExpressionRenderer: ExpressionRendererComponent,
+  title,
 }: WorkspacePanelProps) {
   const IS_DARK_THEME = core.uiSettings.get('theme:darkMode');
   const emptyStateGraphicURL = IS_DARK_THEME
@@ -291,13 +294,22 @@ export function InnerWorkspacePanel({
   }
 
   return (
-    <DragDrop
-      data-test-subj="lnsWorkspace"
-      draggable={false}
-      droppable={Boolean(suggestionForDraggedField)}
-      onDrop={onDrop}
+    <WorkspacePanelWrapper
+      title={title}
+      framePublicAPI={framePublicAPI}
+      dispatch={dispatch}
+      emptyExpression={expression === null}
+      visualizationState={visualizationState}
+      activeVisualization={activeVisualization}
     >
-      {renderVisualization()}
-    </DragDrop>
+      <DragDrop
+        data-test-subj="lnsWorkspace"
+        draggable={false}
+        droppable={Boolean(suggestionForDraggedField)}
+        onDrop={onDrop}
+      >
+        {renderVisualization()}
+      </DragDrop>
+    </WorkspacePanelWrapper>
   );
 }
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel_wrapper.test.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel_wrapper.test.tsx
new file mode 100644
index 000000000000..517dff5b5e74
--- /dev/null
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel_wrapper.test.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { Visualization } from '../../types';
+import { createMockVisualization, createMockFramePublicAPI, FrameMock } from '../mocks';
+import { mountWithIntl as mount } from 'test_utils/enzyme_helpers';
+import { ReactWrapper } from 'enzyme';
+import { WorkspacePanelWrapper, WorkspacePanelWrapperProps } from './workspace_panel_wrapper';
+
+describe('workspace_panel_wrapper', () => {
+  let mockVisualization: jest.Mocked<Visualization>;
+  let mockFrameAPI: FrameMock;
+  let instance: ReactWrapper<WorkspacePanelWrapperProps>;
+
+  beforeEach(() => {
+    mockVisualization = createMockVisualization();
+    mockFrameAPI = createMockFramePublicAPI();
+  });
+
+  afterEach(() => {
+    instance.unmount();
+  });
+
+  it('should render its children', () => {
+    const MyChild = () => <span>The child elements</span>;
+    instance = mount(
+      <WorkspacePanelWrapper
+        dispatch={jest.fn()}
+        framePublicAPI={mockFrameAPI}
+        visualizationState={{}}
+        activeVisualization={mockVisualization}
+        emptyExpression={false}
+      >
+        <MyChild />
+      </WorkspacePanelWrapper>
+    );
+
+    expect(instance.find(MyChild)).toHaveLength(1);
+  });
+
+  it('should call the toolbar renderer if provided', () => {
+    const renderToolbarMock = jest.fn();
+    const visState = { internalState: 123 };
+    instance = mount(
+      <WorkspacePanelWrapper
+        dispatch={jest.fn()}
+        framePublicAPI={mockFrameAPI}
+        visualizationState={visState}
+        children={<span />}
+        activeVisualization={{ ...mockVisualization, renderToolbar: renderToolbarMock }}
+        emptyExpression={false}
+      />
+    );
+
+    expect(renderToolbarMock).toHaveBeenCalledWith(expect.any(Element), {
+      state: visState,
+      frame: mockFrameAPI,
+      setState: expect.anything(),
+    });
+  });
+});
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel_wrapper.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel_wrapper.tsx
index cc91510146f3..17461b9fc274 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel_wrapper.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel_wrapper.tsx
@@ -4,25 +4,86 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
-import { EuiPageContent, EuiPageContentHeader, EuiPageContentBody } from '@elastic/eui';
+import React, { useCallback } from 'react';
+import { i18n } from '@kbn/i18n';
+import classNames from 'classnames';
+import {
+  EuiPageContent,
+  EuiPageContentBody,
+  EuiPageContentHeader,
+  EuiFlexGroup,
+  EuiFlexItem,
+} from '@elastic/eui';
+import { FramePublicAPI, Visualization } from '../../types';
+import { NativeRenderer } from '../../native_renderer';
+import { Action } from './state_management';
 
-interface Props {
-  title: string;
+export interface WorkspacePanelWrapperProps {
   children: React.ReactNode | React.ReactNode[];
+  framePublicAPI: FramePublicAPI;
+  visualizationState: unknown;
+  activeVisualization: Visualization | null;
+  dispatch: (action: Action) => void;
+  emptyExpression: boolean;
+  title?: string;
 }
 
-export function WorkspacePanelWrapper({ children, title }: Props) {
+export function WorkspacePanelWrapper({
+  children,
+  framePublicAPI,
+  visualizationState,
+  activeVisualization,
+  dispatch,
+  title,
+  emptyExpression,
+}: WorkspacePanelWrapperProps) {
+  const setVisualizationState = useCallback(
+    (newState: unknown) => {
+      if (!activeVisualization) {
+        return;
+      }
+      dispatch({
+        type: 'UPDATE_VISUALIZATION_STATE',
+        visualizationId: activeVisualization.id,
+        newState,
+        clearStagedPreview: false,
+      });
+    },
+    [dispatch]
+  );
   return (
-    <EuiPageContent className="lnsWorkspacePanelWrapper">
-      {title && (
-        <EuiPageContentHeader className="lnsWorkspacePanelWrapper__pageContentHeader">
-          <span data-test-subj="lns_ChartTitle">{title}</span>
-        </EuiPageContentHeader>
+    <EuiFlexGroup gutterSize="s" direction="column" alignItems="stretch">
+      {activeVisualization && activeVisualization.renderToolbar && (
+        <EuiFlexItem grow={false}>
+          <NativeRenderer
+            render={activeVisualization.renderToolbar}
+            nativeProps={{
+              frame: framePublicAPI,
+              state: visualizationState,
+              setState: setVisualizationState,
+            }}
+          />
+        </EuiFlexItem>
       )}
-      <EuiPageContentBody className="lnsWorkspacePanelWrapper__pageContentBody">
-        {children}
-      </EuiPageContentBody>
-    </EuiPageContent>
+      <EuiFlexItem>
+        <EuiPageContent className="lnsWorkspacePanelWrapper">
+          {(!emptyExpression || title) && (
+            <EuiPageContentHeader
+              className={classNames('lnsWorkspacePanelWrapper__pageContentHeader', {
+                'lnsWorkspacePanelWrapper__pageContentHeader--unsaved': !title,
+              })}
+            >
+              <span data-test-subj="lns_ChartTitle">
+                {title ||
+                  i18n.translate('xpack.lens.chartTitle.unsaved', { defaultMessage: 'Unsaved' })}
+              </span>
+            </EuiPageContentHeader>
+          )}
+          <EuiPageContentBody className="lnsWorkspacePanelWrapper__pageContentBody">
+            {children}
+          </EuiPageContentBody>
+        </EuiPageContent>
+      </EuiFlexItem>
+    </EuiFlexGroup>
   );
 }
diff --git a/x-pack/plugins/lens/public/types.ts b/x-pack/plugins/lens/public/types.ts
index c2437aa3cc3c..d451e312446b 100644
--- a/x-pack/plugins/lens/public/types.ts
+++ b/x-pack/plugins/lens/public/types.ts
@@ -290,6 +290,12 @@ export type VisualizationLayerWidgetProps<T = unknown> = VisualizationConfigProp
   setState: (newState: T) => void;
 };
 
+export interface VisualizationToolbarProps<T = unknown> {
+  setState: (newState: T) => void;
+  frame: FramePublicAPI;
+  state: T;
+}
+
 export type VisualizationDimensionEditorProps<T = unknown> = VisualizationConfigProps<T> & {
   groupId: string;
   accessor: string;
@@ -454,6 +460,11 @@ export interface Visualization<T = unknown, P = unknown> {
    * for extra configurability, such as for styling the legend or axis
    */
   renderLayerContextMenu?: (domElement: Element, props: VisualizationLayerWidgetProps<T>) => void;
+  /**
+   * Toolbar rendered above the visualization. This is meant to be used to provide chart-level
+   * settings for the visualization.
+   */
+  renderToolbar?: (domElement: Element, props: VisualizationToolbarProps<T>) => void;
   /**
    * Visualizations can provide a custom icon which will open a layer-specific popover
    * If no icon is provided, gear icon is default

From 8448ae8b4bb23817e826a79f542af62cc70378c1 Mon Sep 17 00:00:00 2001
From: Marta Bondyra <marta.bondyra@elastic.co>
Date: Fri, 26 Jun 2020 09:50:13 +0200
Subject: [PATCH 36/78] [Lens] Fix delete button position in dimension panel
 for long labels (#69495)

---
 .../editor_frame/config_panel/_dimension_popover.scss           | 2 ++
 .../lens/public/indexpattern_datasource/_field_item.scss        | 1 +
 2 files changed, 3 insertions(+)

diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_dimension_popover.scss b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_dimension_popover.scss
index 254807d06d38..691cda9ff0d7 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_dimension_popover.scss
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_dimension_popover.scss
@@ -1,9 +1,11 @@
 .lnsDimensionPopover {
   line-height: 0;
   flex-grow: 1;
+  max-width: calc(100% - #{$euiSizeL});
 }
 
 .lnsDimensionPopover__trigger {
   max-width: 100%;
   display: block;
+  word-break: break-word;
 }
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/_field_item.scss b/x-pack/plugins/lens/public/indexpattern_datasource/_field_item.scss
index 41919b900c71..6e51c45ad02c 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/_field_item.scss
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/_field_item.scss
@@ -29,6 +29,7 @@
   .lnsFieldItem__name {
     margin-left: $euiSizeS;
     flex-grow: 1;
+    word-break: break-word;
   }
 
   .lnsFieldListPanel__fieldIcon,

From 41ecf39539272d492573ccfc6367f186154954e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cau=C3=AA=20Marcondes?=
 <55978943+cauemarcondes@users.noreply.github.com>
Date: Fri, 26 Jun 2020 10:11:42 +0100
Subject: [PATCH 37/78] [APM]Create API to return data to be used on the
 Overview page (#69137)

* Adding apm data fetcher

* removing error rate

* chaging observability dashboard routes

* APM observability fetch data

* fixing imports

* adding unit test

* addressing PR comments

* adding processor event in the query, and refactoring theme

* fixing ts issues

* fixing unit tests
---
 x-pack/plugins/apm/public/plugin.ts           |  18 +++
 .../rest/observability.dashboard.test.ts      | 121 ++++++++++++++++++
 .../services/rest/observability_dashboard.ts  |  71 ++++++++++
 x-pack/plugins/apm/public/utils/get_theme.ts  |  13 ++
 .../get_service_count.ts                      |  52 ++++++++
 .../get_transaction_coordinates.ts            |  57 +++++++++
 .../lib/observability_dashboard/has_data.ts   |  26 ++++
 .../apm/server/routes/create_apm_api.ts       |  10 +-
 .../server/routes/observability_dashboard.ts  |  41 ++++++
 .../observability/public/data_handler.ts      |   2 +-
 10 files changed, 409 insertions(+), 2 deletions(-)
 create mode 100644 x-pack/plugins/apm/public/services/rest/observability.dashboard.test.ts
 create mode 100644 x-pack/plugins/apm/public/services/rest/observability_dashboard.ts
 create mode 100644 x-pack/plugins/apm/public/utils/get_theme.ts
 create mode 100644 x-pack/plugins/apm/server/lib/observability_dashboard/get_service_count.ts
 create mode 100644 x-pack/plugins/apm/server/lib/observability_dashboard/get_transaction_coordinates.ts
 create mode 100644 x-pack/plugins/apm/server/lib/observability_dashboard/has_data.ts
 create mode 100644 x-pack/plugins/apm/server/routes/observability_dashboard.ts

diff --git a/x-pack/plugins/apm/public/plugin.ts b/x-pack/plugins/apm/public/plugin.ts
index e9de8fcd890d..0e495391c94f 100644
--- a/x-pack/plugins/apm/public/plugin.ts
+++ b/x-pack/plugins/apm/public/plugin.ts
@@ -38,6 +38,11 @@ import { setHelpExtension } from './setHelpExtension';
 import { toggleAppLinkInNav } from './toggleAppLinkInNav';
 import { setReadonlyBadge } from './updateBadge';
 import { createStaticIndexPattern } from './services/rest/index_pattern';
+import {
+  fetchLandingPageData,
+  hasData,
+} from './services/rest/observability_dashboard';
+import { getTheme } from './utils/get_theme';
 
 export type ApmPluginSetup = void;
 export type ApmPluginStart = void;
@@ -73,6 +78,19 @@ export class ApmPlugin implements Plugin<ApmPluginSetup, ApmPluginStart> {
     pluginSetupDeps.home.environment.update({ apmUi: true });
     pluginSetupDeps.home.featureCatalogue.register(featureCatalogueEntry);
 
+    if (plugins.observability) {
+      const theme = getTheme({
+        isDarkMode: core.uiSettings.get('theme:darkMode'),
+      });
+      plugins.observability.dashboard.register({
+        appName: 'apm',
+        fetchData: async (params) => {
+          return fetchLandingPageData(params, { theme });
+        },
+        hasData,
+      });
+    }
+
     core.application.register({
       id: 'apm',
       title: 'APM',
diff --git a/x-pack/plugins/apm/public/services/rest/observability.dashboard.test.ts b/x-pack/plugins/apm/public/services/rest/observability.dashboard.test.ts
new file mode 100644
index 000000000000..1ee8d79ee99a
--- /dev/null
+++ b/x-pack/plugins/apm/public/services/rest/observability.dashboard.test.ts
@@ -0,0 +1,121 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { fetchLandingPageData, hasData } from './observability_dashboard';
+import * as createCallApmApi from './createCallApmApi';
+import { getTheme } from '../../utils/get_theme';
+
+const theme = getTheme({ isDarkMode: false });
+
+describe('Observability dashboard data', () => {
+  const callApmApiMock = jest.spyOn(createCallApmApi, 'callApmApi');
+  afterEach(() => {
+    callApmApiMock.mockClear();
+  });
+  describe('hasData', () => {
+    it('returns false when no data is available', async () => {
+      callApmApiMock.mockImplementation(() => Promise.resolve(false));
+      const response = await hasData();
+      expect(response).toBeFalsy();
+    });
+    it('returns true when data is available', async () => {
+      callApmApiMock.mockImplementation(() => Promise.resolve(true));
+      const response = await hasData();
+      expect(response).toBeTruthy();
+    });
+  });
+
+  describe('fetchLandingPageData', () => {
+    it('returns APM data with series and stats', async () => {
+      callApmApiMock.mockImplementation(() =>
+        Promise.resolve({
+          serviceCount: 10,
+          transactionCoordinates: [
+            { x: 1, y: 1 },
+            { x: 2, y: 2 },
+            { x: 3, y: 3 },
+          ],
+        })
+      );
+      const response = await fetchLandingPageData(
+        {
+          startTime: '1',
+          endTime: '2',
+          bucketSize: '3',
+        },
+        { theme }
+      );
+      expect(response).toEqual({
+        title: 'APM',
+        appLink: '/app/apm',
+        stats: {
+          services: {
+            type: 'number',
+            label: 'Services',
+            value: 10,
+          },
+          transactions: {
+            type: 'number',
+            label: 'Transactions',
+            value: 6,
+            color: '#6092c0',
+          },
+        },
+        series: {
+          transactions: {
+            label: 'Transactions',
+            coordinates: [
+              { x: 1, y: 1 },
+              { x: 2, y: 2 },
+              { x: 3, y: 3 },
+            ],
+            color: '#6092c0',
+          },
+        },
+      });
+    });
+    it('returns empty transaction coordinates', async () => {
+      callApmApiMock.mockImplementation(() =>
+        Promise.resolve({
+          serviceCount: 0,
+          transactionCoordinates: [],
+        })
+      );
+      const response = await fetchLandingPageData(
+        {
+          startTime: '1',
+          endTime: '2',
+          bucketSize: '3',
+        },
+        { theme }
+      );
+      expect(response).toEqual({
+        title: 'APM',
+        appLink: '/app/apm',
+        stats: {
+          services: {
+            type: 'number',
+            label: 'Services',
+            value: 0,
+          },
+          transactions: {
+            type: 'number',
+            label: 'Transactions',
+            value: 0,
+            color: '#6092c0',
+          },
+        },
+        series: {
+          transactions: {
+            label: 'Transactions',
+            coordinates: [],
+            color: '#6092c0',
+          },
+        },
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/apm/public/services/rest/observability_dashboard.ts b/x-pack/plugins/apm/public/services/rest/observability_dashboard.ts
new file mode 100644
index 000000000000..2221904932b6
--- /dev/null
+++ b/x-pack/plugins/apm/public/services/rest/observability_dashboard.ts
@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { sum } from 'lodash';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { FetchDataParams } from '../../../../observability/public/data_handler';
+import { ApmFetchDataResponse } from '../../../../observability/public/typings/fetch_data_response';
+import { callApmApi } from './createCallApmApi';
+import { Theme } from '../../utils/get_theme';
+
+interface Options {
+  theme: Theme;
+}
+
+export const fetchLandingPageData = async (
+  { startTime, endTime, bucketSize }: FetchDataParams,
+  { theme }: Options
+): Promise<ApmFetchDataResponse> => {
+  const data = await callApmApi({
+    pathname: '/api/apm/observability_dashboard',
+    params: { query: { start: startTime, end: endTime, bucketSize } },
+  });
+
+  const { serviceCount, transactionCoordinates } = data;
+
+  return {
+    title: i18n.translate('xpack.apm.observabilityDashboard.title', {
+      defaultMessage: 'APM',
+    }),
+    appLink: '/app/apm',
+    stats: {
+      services: {
+        type: 'number',
+        label: i18n.translate(
+          'xpack.apm.observabilityDashboard.stats.services',
+          { defaultMessage: 'Services' }
+        ),
+        value: serviceCount,
+      },
+      transactions: {
+        type: 'number',
+        label: i18n.translate(
+          'xpack.apm.observabilityDashboard.stats.transactions',
+          { defaultMessage: 'Transactions' }
+        ),
+        value: sum(transactionCoordinates.map((coordinates) => coordinates.y)),
+        color: theme.euiColorVis1,
+      },
+    },
+    series: {
+      transactions: {
+        label: i18n.translate(
+          'xpack.apm.observabilityDashboard.chart.transactions',
+          { defaultMessage: 'Transactions' }
+        ),
+        color: theme.euiColorVis1,
+        coordinates: transactionCoordinates,
+      },
+    },
+  };
+};
+
+export async function hasData() {
+  return await callApmApi({
+    pathname: '/api/apm/observability_dashboard/has_data',
+  });
+}
diff --git a/x-pack/plugins/apm/public/utils/get_theme.ts b/x-pack/plugins/apm/public/utils/get_theme.ts
new file mode 100644
index 000000000000..e5020202b772
--- /dev/null
+++ b/x-pack/plugins/apm/public/utils/get_theme.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import lightTheme from '@elastic/eui/dist/eui_theme_light.json';
+import darkTheme from '@elastic/eui/dist/eui_theme_dark.json';
+
+export type Theme = ReturnType<typeof getTheme>;
+
+export function getTheme({ isDarkMode }: { isDarkMode: boolean }) {
+  return isDarkMode ? darkTheme : lightTheme;
+}
diff --git a/x-pack/plugins/apm/server/lib/observability_dashboard/get_service_count.ts b/x-pack/plugins/apm/server/lib/observability_dashboard/get_service_count.ts
new file mode 100644
index 000000000000..4c4d058c7139
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/observability_dashboard/get_service_count.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ProcessorEvent } from '../../../common/processor_event';
+import { rangeFilter } from '../../../common/utils/range_filter';
+import {
+  SERVICE_NAME,
+  PROCESSOR_EVENT,
+} from '../../../common/elasticsearch_fieldnames';
+import { Setup, SetupTimeRange } from '../helpers/setup_request';
+
+export async function getServiceCount({
+  setup,
+}: {
+  setup: Setup & SetupTimeRange;
+}) {
+  const { client, indices, start, end } = setup;
+
+  const params = {
+    index: [
+      indices['apm_oss.transactionIndices'],
+      indices['apm_oss.errorIndices'],
+      indices['apm_oss.metricsIndices'],
+    ],
+    body: {
+      size: 0,
+      query: {
+        bool: {
+          filter: [
+            { range: rangeFilter(start, end) },
+            {
+              terms: {
+                [PROCESSOR_EVENT]: [
+                  ProcessorEvent.error,
+                  ProcessorEvent.transaction,
+                  ProcessorEvent.metric,
+                ],
+              },
+            },
+          ],
+        },
+      },
+      aggs: { serviceCount: { cardinality: { field: SERVICE_NAME } } },
+    },
+  };
+
+  const { aggregations } = await client.search(params);
+  return aggregations?.serviceCount.value || 0;
+}
diff --git a/x-pack/plugins/apm/server/lib/observability_dashboard/get_transaction_coordinates.ts b/x-pack/plugins/apm/server/lib/observability_dashboard/get_transaction_coordinates.ts
new file mode 100644
index 000000000000..78ed11d839ad
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/observability_dashboard/get_transaction_coordinates.ts
@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { rangeFilter } from '../../../common/utils/range_filter';
+import { Coordinates } from '../../../../observability/public/typings/fetch_data_response';
+import { PROCESSOR_EVENT } from '../../../common/elasticsearch_fieldnames';
+import { Setup, SetupTimeRange } from '../helpers/setup_request';
+import { ProcessorEvent } from '../../../common/processor_event';
+
+export async function getTransactionCoordinates({
+  setup,
+  bucketSize,
+}: {
+  setup: Setup & SetupTimeRange;
+  bucketSize: string;
+}): Promise<Coordinates[]> {
+  const { client, indices, start, end } = setup;
+
+  const { aggregations } = await client.search({
+    index: indices['apm_oss.transactionIndices'],
+    body: {
+      size: 0,
+      query: {
+        bool: {
+          filter: [
+            { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
+            { range: rangeFilter(start, end) },
+          ],
+        },
+      },
+      aggs: {
+        distribution: {
+          date_histogram: {
+            field: '@timestamp',
+            fixed_interval: bucketSize,
+            min_doc_count: 0,
+            extended_bounds: { min: start, max: end },
+          },
+        },
+      },
+    },
+  });
+
+  return (
+    aggregations?.distribution.buckets.map((bucket) => ({
+      x: bucket.key,
+      y: bucket.doc_count,
+    })) || []
+  );
+}
diff --git a/x-pack/plugins/apm/server/lib/observability_dashboard/has_data.ts b/x-pack/plugins/apm/server/lib/observability_dashboard/has_data.ts
new file mode 100644
index 000000000000..73cc2d273ec6
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/observability_dashboard/has_data.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { Setup } from '../helpers/setup_request';
+
+export async function hasData({ setup }: { setup: Setup }) {
+  const { client, indices } = setup;
+  try {
+    const params = {
+      index: [
+        indices['apm_oss.transactionIndices'],
+        indices['apm_oss.errorIndices'],
+        indices['apm_oss.metricsIndices'],
+      ],
+      terminateAfter: 1,
+      size: 0,
+    };
+
+    const response = await client.search(params);
+    return response.hits.total.value > 0;
+  } catch (e) {
+    return false;
+  }
+}
diff --git a/x-pack/plugins/apm/server/routes/create_apm_api.ts b/x-pack/plugins/apm/server/routes/create_apm_api.ts
index a34690aff43b..02be2e7e4dcd 100644
--- a/x-pack/plugins/apm/server/routes/create_apm_api.ts
+++ b/x-pack/plugins/apm/server/routes/create_apm_api.ts
@@ -76,6 +76,10 @@ import {
   rumPageViewsTrendRoute,
   rumPageLoadDistributionRoute,
 } from './rum_client';
+import {
+  observabilityDashboardHasDataRoute,
+  observabilityDashboardDataRoute,
+} from './observability_dashboard';
 
 const createApmApi = () => {
   const api = createApi()
@@ -160,7 +164,11 @@ const createApmApi = () => {
     .add(rumOverviewLocalFiltersRoute)
     .add(rumPageViewsTrendRoute)
     .add(rumPageLoadDistributionRoute)
-    .add(rumClientMetricsRoute);
+    .add(rumClientMetricsRoute)
+
+    // Observability dashboard
+    .add(observabilityDashboardHasDataRoute)
+    .add(observabilityDashboardDataRoute);
 
   return api;
 };
diff --git a/x-pack/plugins/apm/server/routes/observability_dashboard.ts b/x-pack/plugins/apm/server/routes/observability_dashboard.ts
new file mode 100644
index 000000000000..10c74295fe3e
--- /dev/null
+++ b/x-pack/plugins/apm/server/routes/observability_dashboard.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as t from 'io-ts';
+import { setupRequest } from '../lib/helpers/setup_request';
+import { hasData } from '../lib/observability_dashboard/has_data';
+import { createRoute } from './create_route';
+import { rangeRt } from './default_api_types';
+import { getServiceCount } from '../lib/observability_dashboard/get_service_count';
+import { getTransactionCoordinates } from '../lib/observability_dashboard/get_transaction_coordinates';
+
+export const observabilityDashboardHasDataRoute = createRoute(() => ({
+  path: '/api/apm/observability_dashboard/has_data',
+  handler: async ({ context, request }) => {
+    const setup = await setupRequest(context, request);
+    return await hasData({ setup });
+  },
+}));
+
+export const observabilityDashboardDataRoute = createRoute(() => ({
+  path: '/api/apm/observability_dashboard',
+  params: {
+    query: t.intersection([rangeRt, t.type({ bucketSize: t.string })]),
+  },
+  handler: async ({ context, request }) => {
+    const setup = await setupRequest(context, request);
+    const { bucketSize } = context.params.query;
+    const serviceCountPromise = getServiceCount({ setup });
+    const transactionCoordinatesPromise = getTransactionCoordinates({
+      setup,
+      bucketSize,
+    });
+    const [serviceCount, transactionCoordinates] = await Promise.all([
+      serviceCountPromise,
+      transactionCoordinatesPromise,
+    ]);
+    return { serviceCount, transactionCoordinates };
+  },
+}));
diff --git a/x-pack/plugins/observability/public/data_handler.ts b/x-pack/plugins/observability/public/data_handler.ts
index 288da3d78bf3..65f2c52a4e32 100644
--- a/x-pack/plugins/observability/public/data_handler.ts
+++ b/x-pack/plugins/observability/public/data_handler.ts
@@ -7,7 +7,7 @@
 import { ObservabilityFetchDataResponse, FetchDataResponse } from './typings/fetch_data_response';
 import { ObservabilityApp } from '../typings/common';
 
-interface FetchDataParams {
+export interface FetchDataParams {
   // The start timestamp in milliseconds of the queried time interval
   startTime: string;
   // The end timestamp in milliseconds of the queried time interval

From 1ab5b4ab8bdfd2214a83f1e2271b0b7cf2133952 Mon Sep 17 00:00:00 2001
From: Gidi Meir Morris <github@gidi.io>
Date: Fri, 26 Jun 2020 12:04:42 +0100
Subject: [PATCH 38/78] [alerting] migrates the old `alerting` consumer to be
 `alerts` (#69982)

This PR migrates all old alerts with the `alerting` consumer to have `alerts` instead.
This is because in 7.9 we changed the feature ID and we need these to remain in sync otherwise the RBAC work (https://github.com/elastic/kibana/pull/67157) will break old alerts.
---
 .../alerts/server/saved_objects/index.ts      |   2 +
 .../server/saved_objects/migrations.test.ts   |  87 +++++
 .../alerts/server/saved_objects/migrations.ts |  49 +++
 .../alerting_api_integration/common/config.ts |   1 +
 .../tests/actions/type_not_enabled.ts         |   4 +-
 .../spaces_only/tests/alerting/index.ts       |   1 +
 .../spaces_only/tests/alerting/migrations.ts  |  34 ++
 .../{alerting => actions}/data.json           |   0
 .../functional/es_archives/alerts/data.json   |  41 +++
 .../es_archives/alerts/mappings.json          | 345 ++++++++++++++++++
 10 files changed, 562 insertions(+), 2 deletions(-)
 create mode 100644 x-pack/plugins/alerts/server/saved_objects/migrations.test.ts
 create mode 100644 x-pack/plugins/alerts/server/saved_objects/migrations.ts
 create mode 100644 x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts
 rename x-pack/test/functional/es_archives/{alerting => actions}/data.json (100%)
 create mode 100644 x-pack/test/functional/es_archives/alerts/data.json
 create mode 100644 x-pack/test/functional/es_archives/alerts/mappings.json

diff --git a/x-pack/plugins/alerts/server/saved_objects/index.ts b/x-pack/plugins/alerts/server/saved_objects/index.ts
index c98d9bcbd9ae..06ce8d673e6b 100644
--- a/x-pack/plugins/alerts/server/saved_objects/index.ts
+++ b/x-pack/plugins/alerts/server/saved_objects/index.ts
@@ -6,6 +6,7 @@
 
 import { SavedObjectsServiceSetup } from 'kibana/server';
 import mappings from './mappings.json';
+import { getMigrations } from './migrations';
 import { EncryptedSavedObjectsPluginSetup } from '../../../encrypted_saved_objects/server';
 
 export function setupSavedObjects(
@@ -16,6 +17,7 @@ export function setupSavedObjects(
     name: 'alert',
     hidden: true,
     namespaceType: 'single',
+    migrations: getMigrations(encryptedSavedObjects),
     mappings: mappings.alert,
   });
 
diff --git a/x-pack/plugins/alerts/server/saved_objects/migrations.test.ts b/x-pack/plugins/alerts/server/saved_objects/migrations.test.ts
new file mode 100644
index 000000000000..38cda5a9a0f7
--- /dev/null
+++ b/x-pack/plugins/alerts/server/saved_objects/migrations.test.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import uuid from 'uuid';
+import { getMigrations } from './migrations';
+import { RawAlert } from '../types';
+import { SavedObjectUnsanitizedDoc } from 'kibana/server';
+import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/mocks';
+import { migrationMocks } from 'src/core/server/mocks';
+
+const { log } = migrationMocks.createContext();
+const encryptedSavedObjectsSetup = encryptedSavedObjectsMock.createSetup();
+
+describe('7.9.0', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+    encryptedSavedObjectsSetup.createMigration.mockImplementation(
+      (shouldMigrateWhenPredicate, migration) => migration
+    );
+  });
+
+  test('changes nothing on alerts by other plugins', () => {
+    const migration790 = getMigrations(encryptedSavedObjectsSetup)['7.9.0'];
+    const alert = getMockData({});
+    expect(migration790(alert, { log })).toMatchObject(alert);
+
+    expect(encryptedSavedObjectsSetup.createMigration).toHaveBeenCalledWith(
+      expect.any(Function),
+      expect.any(Function)
+    );
+  });
+
+  test('migrates the consumer for alerting', () => {
+    const migration790 = getMigrations(encryptedSavedObjectsSetup)['7.9.0'];
+    const alert = getMockData({
+      consumer: 'alerting',
+    });
+    expect(migration790(alert, { log })).toMatchObject({
+      ...alert,
+      attributes: {
+        ...alert.attributes,
+        consumer: 'alerts',
+      },
+    });
+  });
+});
+
+function getMockData(
+  overwrites: Record<string, unknown> = {}
+): SavedObjectUnsanitizedDoc<RawAlert> {
+  return {
+    attributes: {
+      enabled: true,
+      name: 'abc',
+      tags: ['foo'],
+      alertTypeId: '123',
+      consumer: 'bar',
+      apiKey: '',
+      apiKeyOwner: '',
+      schedule: { interval: '10s' },
+      throttle: null,
+      params: {
+        bar: true,
+      },
+      muteAll: false,
+      mutedInstanceIds: [],
+      createdBy: new Date().toISOString(),
+      updatedBy: new Date().toISOString(),
+      createdAt: new Date().toISOString(),
+      actions: [
+        {
+          group: 'default',
+          actionRef: '1',
+          actionTypeId: '1',
+          params: {
+            foo: true,
+          },
+        },
+      ],
+      ...overwrites,
+    },
+    id: uuid.v4(),
+    type: 'alert',
+  };
+}
diff --git a/x-pack/plugins/alerts/server/saved_objects/migrations.ts b/x-pack/plugins/alerts/server/saved_objects/migrations.ts
new file mode 100644
index 000000000000..142102dd711c
--- /dev/null
+++ b/x-pack/plugins/alerts/server/saved_objects/migrations.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import {
+  SavedObjectMigrationMap,
+  SavedObjectUnsanitizedDoc,
+  SavedObjectMigrationFn,
+} from '../../../../../src/core/server';
+import { RawAlert } from '../types';
+import { EncryptedSavedObjectsPluginSetup } from '../../../encrypted_saved_objects/server';
+
+export function getMigrations(
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup
+): SavedObjectMigrationMap {
+  return {
+    '7.9.0': changeAlertingConsumer(encryptedSavedObjects),
+  };
+}
+
+/**
+ * In v7.9.0 we changed the Alerting plugin so it uses the `consumer` value of `alerts`
+ * prior to that we were using `alerting` and we need to keep these in sync
+ */
+function changeAlertingConsumer(
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup
+): SavedObjectMigrationFn<RawAlert, RawAlert> {
+  const consumerMigration = new Map<string, string>();
+  consumerMigration.set('alerting', 'alerts');
+
+  return encryptedSavedObjects.createMigration<RawAlert, RawAlert>(
+    function shouldBeMigrated(doc): doc is SavedObjectUnsanitizedDoc<RawAlert> {
+      return consumerMigration.has(doc.attributes.consumer);
+    },
+    (doc: SavedObjectUnsanitizedDoc<RawAlert>): SavedObjectUnsanitizedDoc<RawAlert> => {
+      const {
+        attributes: { consumer },
+      } = doc;
+      return {
+        ...doc,
+        attributes: {
+          ...doc.attributes,
+          consumer: consumerMigration.get(consumer) ?? consumer,
+        },
+      };
+    }
+  );
+}
diff --git a/x-pack/test/alerting_api_integration/common/config.ts b/x-pack/test/alerting_api_integration/common/config.ts
index bc209e2bb492..0877fdc949dc 100644
--- a/x-pack/test/alerting_api_integration/common/config.ts
+++ b/x-pack/test/alerting_api_integration/common/config.ts
@@ -82,6 +82,7 @@ export function createTestConfig(name: string, options: CreateTestConfigOptions)
             'localhost',
             'some.non.existent.com',
           ])}`,
+          '--xpack.encryptedSavedObjects.encryptionKey="wuGNaIhoMpk5sO4UBxgr3NyW1sFcLgIf"',
           `--xpack.actions.enabledActionTypes=${JSON.stringify(enabledActionTypes)}`,
           '--xpack.eventLog.logEntries=true',
           `--xpack.actions.preconfigured=${JSON.stringify({
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/type_not_enabled.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/type_not_enabled.ts
index 912b0dc339a2..b8963d72ead5 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/type_not_enabled.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/type_not_enabled.ts
@@ -17,8 +17,8 @@ export default function typeNotEnabledTests({ getService }: FtrProviderContext)
 
   describe('actionType not enabled', () => {
     // loads action PREWRITTEN_ACTION_ID with actionType DISABLED_ACTION_TYPE
-    before(() => esArchiver.load('alerting'));
-    after(() => esArchiver.unload('alerting'));
+    before(() => esArchiver.load('actions'));
+    after(() => esArchiver.unload('actions'));
 
     it('should handle create action with disabled actionType request appropriately', async () => {
       const response = await supertest.post(`/api/actions/action`).set('kbn-xsrf', 'foo').send({
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
index a0c4da361bd3..2fc35ddaa3c6 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
@@ -26,5 +26,6 @@ export default function alertingTests({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./alerts_space1'));
     loadTestFile(require.resolve('./alerts_default_space'));
     loadTestFile(require.resolve('./builtin_alert_types'));
+    loadTestFile(require.resolve('./migrations'));
   });
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts
new file mode 100644
index 000000000000..fc61f59d129d
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { getUrlPrefix } from '../../../common/lib';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default function createGetTests({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+
+  describe('migrations', () => {
+    before(async () => {
+      await esArchiver.load('alerts');
+    });
+
+    after(async () => {
+      await esArchiver.unload('alerts');
+    });
+
+    it('7.9.0 migrates the `alerting` consumer to be the `alerts`', async () => {
+      const response = await supertest.get(
+        `${getUrlPrefix(``)}/api/alerts/alert/74f3e6d7-b7bb-477d-ac28-92ee22728e6e`
+      );
+
+      expect(response.status).to.eql(200);
+      expect(response.body.consumer).to.equal('alerts');
+    });
+  });
+}
diff --git a/x-pack/test/functional/es_archives/alerting/data.json b/x-pack/test/functional/es_archives/actions/data.json
similarity index 100%
rename from x-pack/test/functional/es_archives/alerting/data.json
rename to x-pack/test/functional/es_archives/actions/data.json
diff --git a/x-pack/test/functional/es_archives/alerts/data.json b/x-pack/test/functional/es_archives/alerts/data.json
new file mode 100644
index 000000000000..3703473606ea
--- /dev/null
+++ b/x-pack/test/functional/es_archives/alerts/data.json
@@ -0,0 +1,41 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "alert:74f3e6d7-b7bb-477d-ac28-92ee22728e6e",
+    "index": ".kibana_1",
+    "source": {
+      "alert": {
+        "actions": [
+        ],
+        "alertTypeId": "example.always-firing",
+        "apiKey": "QIUT8u0/kbOakEHSj50jDpVR90MrqOxanEscboYOoa8PxQvcA5jfHash+fqH3b+KNjJ1LpnBcisGuPkufY9j1e32gKzwGZV5Bfys87imHvygJvIM8uKiFF8bQ8Y4NTaxOJO9fAmZPrFy07ZcQMCAQz+DUTgBFqs=",
+        "apiKeyOwner": "elastic",
+        "consumer": "alerting",
+        "createdAt": "2020-06-17T15:35:38.497Z",
+        "createdBy": "elastic",
+        "enabled": true,
+        "muteAll": false,
+        "mutedInstanceIds": [
+        ],
+        "name": "always-firing-alert",
+        "params": {
+        },
+        "schedule": {
+          "interval": "1m"
+        },
+        "scheduledTaskId": "329798f0-b0b0-11ea-9510-fdf248d5f2a4",
+        "tags": [
+        ],
+        "throttle": null,
+        "updatedBy": "elastic"
+      },
+      "migrationVersion": {
+        "alert": "7.8.0"
+      },
+      "references": [
+      ],
+      "type": "alert",
+      "updated_at": "2020-06-17T15:35:39.839Z"
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/alerts/mappings.json b/x-pack/test/functional/es_archives/alerts/mappings.json
new file mode 100644
index 000000000000..287d9a79a68c
--- /dev/null
+++ b/x-pack/test/functional/es_archives/alerts/mappings.json
@@ -0,0 +1,345 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana": {
+      }
+    },
+    "index": ".kibana_1",
+    "mappings": {
+      "_meta": {
+        "migrationMappingPropertyHashes": {
+          "action": "6e96ac5e648f57523879661ea72525b7",
+          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
+          "alert": "7b44fba6773e37c806ce290ea9b7024e",
+          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
+          "apm-telemetry": "3525d7c22c42bc80f5e6e9cb3f2b26a2",
+          "application_usage_totals": "c897e4310c5f24b07caaff3db53ae2c1",
+          "application_usage_transactional": "965839e75f809fefe04f92dc4d99722a",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "cases": "32aa96a6d3855ddda53010ae2048ac22",
+          "cases-comments": "c2061fb929f585df57425102fa928b4b",
+          "cases-configure": "42711cbb311976c0687853f4c1354572",
+          "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
+          "config": "ae24d22d5986d04124cc6568f771066f",
+          "dashboard": "d00f614b29a80360e1190193fd333bab",
+          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
+          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
+          "index-pattern": "66eccb05066c5a89924f48a9e9736499",
+          "infrastructure-ui-source": "ddc0ecb18383f6b26101a2fadb2dab0c",
+          "inventory-view": "88fc7e12fd1b45b6f0787323ce4f18d2",
+          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
+          "lens": "d33c68a69ff1e78c9888dedd2164ac22",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "map": "23d7aa4a720d4938ccde3983f87bd58d",
+          "maps-telemetry": "bfd39d88aadadb4be597ea984d433dbe",
+          "metrics-explorer-view": "428e319af3e822c80a84cf87123ca35c",
+          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
+          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
+          "namespace": "2f4316de49999235636386fe51dc06c1",
+          "namespaces": "2f4316de49999235636386fe51dc06c1",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "references": "7997cf5a56cc02bdc9c93361bde732b0",
+          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
+          "search": "181661168bbadd1eff5902361e2a0d5c",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "telemetry": "36a616f7026dfa617d6655df850fe16d",
+          "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
+          "todo": "082a2cc96a590268344d5cd74c159ac4",
+          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215",
+          "type": "2f4316de49999235636386fe51dc06c1",
+          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
+          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "upgrade-assistant-reindex-operation": "296a89039fc4260292be36b1b005d8f2",
+          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
+          "uptime-dynamic-settings": "fcdb453a30092f022f2642db29523d80",
+          "url": "b675c3be8d76ecf029294d51dc7ec65d",
+          "visualization": "52d7a13ad68a150c4525b292d23e12cc"
+        }
+      },
+      "dynamic": "strict",
+      "properties": {
+        "action": {
+          "properties": {
+            "actionTypeId": {
+              "type": "keyword"
+            },
+            "config": {
+              "enabled": false,
+              "type": "object"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "secrets": {
+              "type": "binary"
+            }
+          }
+        },
+        "action_task_params": {
+          "properties": {
+            "actionId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "alert": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "actionTypeId": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              },
+              "type": "nested"
+            },
+            "alertTypeId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "apiKeyOwner": {
+              "type": "keyword"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "muteAll": {
+              "type": "boolean"
+            },
+            "mutedInstanceIds": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            },
+            "schedule": {
+              "properties": {
+                "interval": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "scheduledTaskId": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "throttle": {
+              "type": "keyword"
+            },
+            "updatedBy": {
+              "type": "keyword"
+            }
+          }
+        },
+        "config": {
+          "dynamic": "true",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "alert": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "config": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "space": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "namespaces": {
+          "type": "keyword"
+        },
+        "query": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "filters": {
+              "enabled": false,
+              "type": "object"
+            },
+            "query": {
+              "properties": {
+                "language": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timefilter": {
+              "enabled": false,
+              "type": "object"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "search": {
+          "properties": {
+            "columns": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "sort": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "imageUrl": {
+              "index": false,
+              "type": "text"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "updated_at": {
+          "type": "date"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file

From 3e7c3801ab223ba187f1f42696858ada99162c5e Mon Sep 17 00:00:00 2001
From: Vadim Dalecky <streamich@gmail.com>
Date: Fri, 26 Jun 2020 13:20:58 +0200
Subject: [PATCH 39/78] =?UTF-8?q?refactor:=20=F0=9F=92=A1=20fix=20typo=20i?=
 =?UTF-8?q?n=20embeddable=20(#69417)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../embeddable/public/lib/embeddables/embeddable.tsx     | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/plugins/embeddable/public/lib/embeddables/embeddable.tsx b/src/plugins/embeddable/public/lib/embeddables/embeddable.tsx
index 9c544e86e189..fcecf117d7d5 100644
--- a/src/plugins/embeddable/public/lib/embeddables/embeddable.tsx
+++ b/src/plugins/embeddable/public/lib/embeddables/embeddable.tsx
@@ -51,8 +51,7 @@ export abstract class Embeddable<
   // to update input when the parent changes.
   private parentSubscription?: Rx.Subscription;
 
-  // TODO: Rename to destroyed.
-  private destoyed: boolean = false;
+  private destroyed: boolean = false;
 
   constructor(input: TEmbeddableInput, output: TEmbeddableOutput, parent?: IContainer) {
     this.id = input.id;
@@ -123,7 +122,7 @@ export abstract class Embeddable<
   }
 
   public updateInput(changes: Partial<TEmbeddableInput>): void {
-    if (this.destoyed) {
+    if (this.destroyed) {
       throw new Error('Embeddable has been destroyed');
     }
     if (this.parent) {
@@ -135,7 +134,7 @@ export abstract class Embeddable<
   }
 
   public render(domNode: HTMLElement | Element): void {
-    if (this.destoyed) {
+    if (this.destroyed) {
       throw new Error('Embeddable has been destroyed');
     }
     return;
@@ -155,7 +154,7 @@ export abstract class Embeddable<
    * implementors to add any additional clean up tasks, like unmounting and unsubscribing.
    */
   public destroy(): void {
-    this.destoyed = true;
+    this.destroyed = true;
 
     this.input$.complete();
     this.output$.complete();

From d511bb2c9b466f07467d85e9d2261d24d54381e2 Mon Sep 17 00:00:00 2001
From: Mikhail Shustov <restrry@gmail.com>
Date: Fri, 26 Jun 2020 14:39:46 +0300
Subject: [PATCH 40/78] move Metrics API to start (#69787)

* move metrics to start

* update plugins accordingly

* update docs

* update legacy code

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../kibana-plugin-core-server.coresetup.md    |  1 -
 ...na-plugin-core-server.coresetup.metrics.md | 13 ------
 .../kibana-plugin-core-server.corestart.md    |  1 +
 ...na-plugin-core-server.corestart.metrics.md | 12 ++++++
 .../core/server/kibana-plugin-core-server.md  |  2 +-
 ...rver.metricsservicesetup.getopsmetrics_.md | 24 -----------
 ...-plugin-core-server.metricsservicesetup.md |  9 ----
 src/core/server/index.ts                      |  6 +--
 src/core/server/internal_types.ts             |  4 +-
 src/core/server/legacy/legacy_service.test.ts |  2 -
 src/core/server/legacy/legacy_service.ts      |  6 +--
 .../server/metrics/metrics_service.mock.ts    | 41 +++++++++++++------
 .../server/metrics/metrics_service.test.ts    | 12 +++---
 src/core/server/metrics/metrics_service.ts    | 13 +++---
 src/core/server/metrics/types.ts              |  6 +--
 src/core/server/mocks.ts                      |  4 +-
 src/core/server/plugins/plugin_context.ts     |  6 +--
 src/core/server/server.api.md                 | 12 ++++--
 src/core/server/server.ts                     |  6 +--
 .../status/routes/api/register_stats.js       |  2 +-
 .../server/__snapshots__/index.test.ts.snap   |  2 +-
 .../server/index.test.ts                      | 26 +-----------
 .../kibana_usage_collection/server/plugin.ts  | 19 +++++----
 src/plugins/telemetry/server/plugin.ts        |  2 +-
 24 files changed, 98 insertions(+), 133 deletions(-)
 delete mode 100644 docs/development/core/server/kibana-plugin-core-server.coresetup.metrics.md
 create mode 100644 docs/development/core/server/kibana-plugin-core-server.corestart.metrics.md
 delete mode 100644 docs/development/core/server/kibana-plugin-core-server.metricsservicesetup.getopsmetrics_.md

diff --git a/docs/development/core/server/kibana-plugin-core-server.coresetup.md b/docs/development/core/server/kibana-plugin-core-server.coresetup.md
index e9ed5b830b69..32221a320d2a 100644
--- a/docs/development/core/server/kibana-plugin-core-server.coresetup.md
+++ b/docs/development/core/server/kibana-plugin-core-server.coresetup.md
@@ -22,7 +22,6 @@ export interface CoreSetup<TPluginsStart extends object = object, TStart = unkno
 |  [getStartServices](./kibana-plugin-core-server.coresetup.getstartservices.md) | <code>StartServicesAccessor&lt;TPluginsStart, TStart&gt;</code> | [StartServicesAccessor](./kibana-plugin-core-server.startservicesaccessor.md) |
 |  [http](./kibana-plugin-core-server.coresetup.http.md) | <code>HttpServiceSetup &amp; {</code><br/><code>        resources: HttpResources;</code><br/><code>    }</code> | [HttpServiceSetup](./kibana-plugin-core-server.httpservicesetup.md) |
 |  [logging](./kibana-plugin-core-server.coresetup.logging.md) | <code>LoggingServiceSetup</code> | [LoggingServiceSetup](./kibana-plugin-core-server.loggingservicesetup.md) |
-|  [metrics](./kibana-plugin-core-server.coresetup.metrics.md) | <code>MetricsServiceSetup</code> | [MetricsServiceSetup](./kibana-plugin-core-server.metricsservicesetup.md) |
 |  [savedObjects](./kibana-plugin-core-server.coresetup.savedobjects.md) | <code>SavedObjectsServiceSetup</code> | [SavedObjectsServiceSetup](./kibana-plugin-core-server.savedobjectsservicesetup.md) |
 |  [status](./kibana-plugin-core-server.coresetup.status.md) | <code>StatusServiceSetup</code> | [StatusServiceSetup](./kibana-plugin-core-server.statusservicesetup.md) |
 |  [uiSettings](./kibana-plugin-core-server.coresetup.uisettings.md) | <code>UiSettingsServiceSetup</code> | [UiSettingsServiceSetup](./kibana-plugin-core-server.uisettingsservicesetup.md) |
diff --git a/docs/development/core/server/kibana-plugin-core-server.coresetup.metrics.md b/docs/development/core/server/kibana-plugin-core-server.coresetup.metrics.md
deleted file mode 100644
index 77c9e867ef8e..000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.coresetup.metrics.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [CoreSetup](./kibana-plugin-core-server.coresetup.md) &gt; [metrics](./kibana-plugin-core-server.coresetup.metrics.md)
-
-## CoreSetup.metrics property
-
-[MetricsServiceSetup](./kibana-plugin-core-server.metricsservicesetup.md)
-
-<b>Signature:</b>
-
-```typescript
-metrics: MetricsServiceSetup;
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.corestart.md b/docs/development/core/server/kibana-plugin-core-server.corestart.md
index 6a6bacf1eef4..acd23f0f4738 100644
--- a/docs/development/core/server/kibana-plugin-core-server.corestart.md
+++ b/docs/development/core/server/kibana-plugin-core-server.corestart.md
@@ -19,6 +19,7 @@ export interface CoreStart
 |  [capabilities](./kibana-plugin-core-server.corestart.capabilities.md) | <code>CapabilitiesStart</code> | [CapabilitiesStart](./kibana-plugin-core-server.capabilitiesstart.md) |
 |  [elasticsearch](./kibana-plugin-core-server.corestart.elasticsearch.md) | <code>ElasticsearchServiceStart</code> | [ElasticsearchServiceStart](./kibana-plugin-core-server.elasticsearchservicestart.md) |
 |  [http](./kibana-plugin-core-server.corestart.http.md) | <code>HttpServiceStart</code> | [HttpServiceStart](./kibana-plugin-core-server.httpservicestart.md) |
+|  [metrics](./kibana-plugin-core-server.corestart.metrics.md) | <code>MetricsServiceStart</code> |  |
 |  [savedObjects](./kibana-plugin-core-server.corestart.savedobjects.md) | <code>SavedObjectsServiceStart</code> | [SavedObjectsServiceStart](./kibana-plugin-core-server.savedobjectsservicestart.md) |
 |  [uiSettings](./kibana-plugin-core-server.corestart.uisettings.md) | <code>UiSettingsServiceStart</code> | [UiSettingsServiceStart](./kibana-plugin-core-server.uisettingsservicestart.md) |
 
diff --git a/docs/development/core/server/kibana-plugin-core-server.corestart.metrics.md b/docs/development/core/server/kibana-plugin-core-server.corestart.metrics.md
new file mode 100644
index 000000000000..a51c2f842c34
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.corestart.metrics.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [CoreStart](./kibana-plugin-core-server.corestart.md) &gt; [metrics](./kibana-plugin-core-server.corestart.metrics.md)
+
+## CoreStart.metrics property
+
+
+<b>Signature:</b>
+
+```typescript
+metrics: MetricsServiceStart;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.md b/docs/development/core/server/kibana-plugin-core-server.md
index 29c340bc390f..74422c82fc9e 100644
--- a/docs/development/core/server/kibana-plugin-core-server.md
+++ b/docs/development/core/server/kibana-plugin-core-server.md
@@ -112,7 +112,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [LoggerFactory](./kibana-plugin-core-server.loggerfactory.md) | The single purpose of <code>LoggerFactory</code> interface is to define a way to retrieve a context-based logger instance. |
 |  [LoggingServiceSetup](./kibana-plugin-core-server.loggingservicesetup.md) | Provides APIs to plugins for customizing the plugin's logger. |
 |  [LogMeta](./kibana-plugin-core-server.logmeta.md) | Contextual metadata |
-|  [MetricsServiceSetup](./kibana-plugin-core-server.metricsservicesetup.md) | APIs to retrieves metrics gathered and exposed by the core platform. |
+|  [MetricsServiceSetup](./kibana-plugin-core-server.metricsservicesetup.md) |  |
 |  [NodesVersionCompatibility](./kibana-plugin-core-server.nodesversioncompatibility.md) |  |
 |  [OnPostAuthToolkit](./kibana-plugin-core-server.onpostauthtoolkit.md) | A tool set defining an outcome of OnPostAuth interceptor for incoming request. |
 |  [OnPreAuthToolkit](./kibana-plugin-core-server.onpreauthtoolkit.md) | A tool set defining an outcome of OnPreAuth interceptor for incoming request. |
diff --git a/docs/development/core/server/kibana-plugin-core-server.metricsservicesetup.getopsmetrics_.md b/docs/development/core/server/kibana-plugin-core-server.metricsservicesetup.getopsmetrics_.md
deleted file mode 100644
index 61107fbf20ad..000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.metricsservicesetup.getopsmetrics_.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [MetricsServiceSetup](./kibana-plugin-core-server.metricsservicesetup.md) &gt; [getOpsMetrics$](./kibana-plugin-core-server.metricsservicesetup.getopsmetrics_.md)
-
-## MetricsServiceSetup.getOpsMetrics$ property
-
-Retrieve an observable emitting the [OpsMetrics](./kibana-plugin-core-server.opsmetrics.md) gathered. The observable will emit an initial value during core's `start` phase, and a new value every fixed interval of time, based on the `opts.interval` configuration property.
-
-<b>Signature:</b>
-
-```typescript
-getOpsMetrics$: () => Observable<OpsMetrics>;
-```
-
-## Example
-
-
-```ts
-core.metrics.getOpsMetrics$().subscribe(metrics => {
-  // do something with the metrics
-})
-
-```
-
diff --git a/docs/development/core/server/kibana-plugin-core-server.metricsservicesetup.md b/docs/development/core/server/kibana-plugin-core-server.metricsservicesetup.md
index 00045aeac74b..0bec919797b6 100644
--- a/docs/development/core/server/kibana-plugin-core-server.metricsservicesetup.md
+++ b/docs/development/core/server/kibana-plugin-core-server.metricsservicesetup.md
@@ -4,17 +4,8 @@
 
 ## MetricsServiceSetup interface
 
-APIs to retrieves metrics gathered and exposed by the core platform.
-
 <b>Signature:</b>
 
 ```typescript
 export interface MetricsServiceSetup 
 ```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [getOpsMetrics$](./kibana-plugin-core-server.metricsservicesetup.getopsmetrics_.md) | <code>() =&gt; Observable&lt;OpsMetrics&gt;</code> | Retrieve an observable emitting the [OpsMetrics](./kibana-plugin-core-server.opsmetrics.md) gathered. The observable will emit an initial value during core's <code>start</code> phase, and a new value every fixed interval of time, based on the <code>opts.interval</code> configuration property. |
-
diff --git a/src/core/server/index.ts b/src/core/server/index.ts
index e0afd5e57f04..7520111bf33a 100644
--- a/src/core/server/index.ts
+++ b/src/core/server/index.ts
@@ -60,7 +60,7 @@ import {
 } from './saved_objects';
 import { CapabilitiesSetup, CapabilitiesStart } from './capabilities';
 import { UuidServiceSetup } from './uuid';
-import { MetricsServiceSetup } from './metrics';
+import { MetricsServiceStart } from './metrics';
 import { StatusServiceSetup } from './status';
 import {
   LoggingServiceSetup,
@@ -403,8 +403,6 @@ export interface CoreSetup<TPluginsStart extends object = object, TStart = unkno
   };
   /** {@link LoggingServiceSetup} */
   logging: LoggingServiceSetup;
-  /** {@link MetricsServiceSetup} */
-  metrics: MetricsServiceSetup;
   /** {@link SavedObjectsServiceSetup} */
   savedObjects: SavedObjectsServiceSetup;
   /** {@link StatusServiceSetup} */
@@ -442,6 +440,8 @@ export interface CoreStart {
   elasticsearch: ElasticsearchServiceStart;
   /** {@link HttpServiceStart} */
   http: HttpServiceStart;
+  /** {@link MetricsServiceStart} */
+  metrics: MetricsServiceStart;
   /** {@link SavedObjectsServiceStart} */
   savedObjects: SavedObjectsServiceStart;
   /** {@link UiSettingsServiceStart} */
diff --git a/src/core/server/internal_types.ts b/src/core/server/internal_types.ts
index 09f82ad06d45..f6c17c237986 100644
--- a/src/core/server/internal_types.ts
+++ b/src/core/server/internal_types.ts
@@ -30,7 +30,7 @@ import {
 } from './saved_objects';
 import { InternalUiSettingsServiceSetup, InternalUiSettingsServiceStart } from './ui_settings';
 import { UuidServiceSetup } from './uuid';
-import { InternalMetricsServiceSetup } from './metrics';
+import { InternalMetricsServiceStart } from './metrics';
 import { InternalRenderingServiceSetup } from './rendering';
 import { InternalHttpResourcesSetup } from './http_resources';
 import { InternalStatusServiceSetup } from './status';
@@ -42,7 +42,6 @@ export interface InternalCoreSetup {
   context: ContextSetup;
   http: InternalHttpServiceSetup;
   elasticsearch: InternalElasticsearchServiceSetup;
-  metrics: InternalMetricsServiceSetup;
   savedObjects: InternalSavedObjectsServiceSetup;
   status: InternalStatusServiceSetup;
   uiSettings: InternalUiSettingsServiceSetup;
@@ -59,6 +58,7 @@ export interface InternalCoreStart {
   capabilities: CapabilitiesStart;
   elasticsearch: ElasticsearchServiceStart;
   http: InternalHttpServiceStart;
+  metrics: InternalMetricsServiceStart;
   savedObjects: InternalSavedObjectsServiceStart;
   uiSettings: InternalUiSettingsServiceStart;
 }
diff --git a/src/core/server/legacy/legacy_service.test.ts b/src/core/server/legacy/legacy_service.test.ts
index c18617cada45..ccadae757fe5 100644
--- a/src/core/server/legacy/legacy_service.test.ts
+++ b/src/core/server/legacy/legacy_service.test.ts
@@ -47,7 +47,6 @@ import { capabilitiesServiceMock } from '../capabilities/capabilities_service.mo
 import { httpResourcesMock } from '../http_resources/http_resources_service.mock';
 import { setupMock as renderingServiceMock } from '../rendering/__mocks__/rendering_service';
 import { uuidServiceMock } from '../uuid/uuid_service.mock';
-import { metricsServiceMock } from '../metrics/metrics_service.mock';
 import { findLegacyPluginSpecs } from './plugins';
 import { LegacyVars, LegacyServiceSetupDeps, LegacyServiceStartDeps } from './types';
 import { LegacyService } from './legacy_service';
@@ -98,7 +97,6 @@ beforeEach(() => {
         contracts: new Map([['plugin-id', 'plugin-value']]),
       },
       rendering: renderingServiceMock,
-      metrics: metricsServiceMock.createInternalSetupContract(),
       uuid: uuidSetup,
       status: statusServiceMock.createInternalSetupContract(),
       logging: loggingServiceMock.createInternalSetupContract(),
diff --git a/src/core/server/legacy/legacy_service.ts b/src/core/server/legacy/legacy_service.ts
index be737f6593c0..a544bad6c0e4 100644
--- a/src/core/server/legacy/legacy_service.ts
+++ b/src/core/server/legacy/legacy_service.ts
@@ -276,6 +276,9 @@ export class LegacyService implements CoreService {
         createSerializer: startDeps.core.savedObjects.createSerializer,
         getTypeRegistry: startDeps.core.savedObjects.getTypeRegistry,
       },
+      metrics: {
+        getOpsMetrics$: startDeps.core.metrics.getOpsMetrics$,
+      },
       uiSettings: { asScopedToClient: startDeps.core.uiSettings.asScopedToClient },
     };
 
@@ -312,9 +315,6 @@ export class LegacyService implements CoreService {
       logging: {
         configure: (config$) => setupDeps.core.logging.configure([], config$),
       },
-      metrics: {
-        getOpsMetrics$: setupDeps.core.metrics.getOpsMetrics$,
-      },
       savedObjects: {
         setClientFactoryProvider: setupDeps.core.savedObjects.setClientFactoryProvider,
         addClientWrapper: setupDeps.core.savedObjects.addClientWrapper,
diff --git a/src/core/server/metrics/metrics_service.mock.ts b/src/core/server/metrics/metrics_service.mock.ts
index cc53a4e27d57..769f6ee2a549 100644
--- a/src/core/server/metrics/metrics_service.mock.ts
+++ b/src/core/server/metrics/metrics_service.mock.ts
@@ -16,29 +16,46 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-
+import { BehaviorSubject } from 'rxjs';
 import { MetricsService } from './metrics_service';
 import {
   InternalMetricsServiceSetup,
   InternalMetricsServiceStart,
-  MetricsServiceSetup,
   MetricsServiceStart,
 } from './types';
 
-const createSetupContractMock = () => {
-  const setupContract: jest.Mocked<MetricsServiceSetup> = {
-    getOpsMetrics$: jest.fn(),
-  };
-  return setupContract;
-};
-
 const createInternalSetupContractMock = () => {
-  const setupContract: jest.Mocked<InternalMetricsServiceSetup> = createSetupContractMock();
+  const setupContract: jest.Mocked<InternalMetricsServiceSetup> = {};
   return setupContract;
 };
 
 const createStartContractMock = () => {
-  const startContract: jest.Mocked<MetricsServiceStart> = {};
+  const startContract: jest.Mocked<MetricsServiceStart> = {
+    getOpsMetrics$: jest.fn(),
+  };
+  startContract.getOpsMetrics$.mockReturnValue(
+    new BehaviorSubject({
+      process: {
+        memory: {
+          heap: { total_in_bytes: 1, used_in_bytes: 1, size_limit: 1 },
+          resident_set_size_in_bytes: 1,
+        },
+        event_loop_delay: 1,
+        pid: 1,
+        uptime_in_millis: 1,
+      },
+      os: {
+        platform: 'darwin' as const,
+        platformRelease: 'test',
+        load: { '1m': 1, '5m': 1, '15m': 1 },
+        memory: { total_in_bytes: 1, free_in_bytes: 1, used_in_bytes: 1 },
+        uptime_in_millis: 1,
+      },
+      response_times: { avg_in_millis: 1, max_in_millis: 1 },
+      requests: { disconnects: 1, total: 1, statusCodes: { '200': 1 } },
+      concurrent_connections: 1,
+    })
+  );
   return startContract;
 };
 
@@ -60,7 +77,7 @@ const createMock = () => {
 
 export const metricsServiceMock = {
   create: createMock,
-  createSetupContract: createSetupContractMock,
+  createSetupContract: createStartContractMock,
   createStartContract: createStartContractMock,
   createInternalSetupContract: createInternalSetupContractMock,
   createInternalStartContract: createInternalStartContractMock,
diff --git a/src/core/server/metrics/metrics_service.test.ts b/src/core/server/metrics/metrics_service.test.ts
index b3cc06ffca1d..f2019de7b6ca 100644
--- a/src/core/server/metrics/metrics_service.test.ts
+++ b/src/core/server/metrics/metrics_service.test.ts
@@ -75,8 +75,8 @@ describe('MetricsService', () => {
     it('resets the collector after each collection', async () => {
       mockOpsCollector.collect.mockResolvedValue(dummyMetrics);
 
-      const { getOpsMetrics$ } = await metricsService.setup({ http: httpMock });
-      await metricsService.start();
+      await metricsService.setup({ http: httpMock });
+      const { getOpsMetrics$ } = await metricsService.start();
 
       // `advanceTimersByTime` only ensure the interval handler is executed
       // however the `reset` call is executed after the async call to `collect`
@@ -109,8 +109,8 @@ describe('MetricsService', () => {
 
   describe('#stop', () => {
     it('stops the metrics interval', async () => {
-      const { getOpsMetrics$ } = await metricsService.setup({ http: httpMock });
-      await metricsService.start();
+      await metricsService.setup({ http: httpMock });
+      const { getOpsMetrics$ } = await metricsService.start();
 
       expect(mockOpsCollector.collect).toHaveBeenCalledTimes(1);
 
@@ -125,8 +125,8 @@ describe('MetricsService', () => {
     });
 
     it('completes the metrics observable', async () => {
-      const { getOpsMetrics$ } = await metricsService.setup({ http: httpMock });
-      await metricsService.start();
+      await metricsService.setup({ http: httpMock });
+      const { getOpsMetrics$ } = await metricsService.start();
 
       let completed = false;
 
diff --git a/src/core/server/metrics/metrics_service.ts b/src/core/server/metrics/metrics_service.ts
index 0ea9d0079260..f28fb21aaac0 100644
--- a/src/core/server/metrics/metrics_service.ts
+++ b/src/core/server/metrics/metrics_service.ts
@@ -45,12 +45,7 @@ export class MetricsService
 
   public async setup({ http }: MetricsServiceSetupDeps): Promise<InternalMetricsServiceSetup> {
     this.metricsCollector = new OpsMetricsCollector(http.server);
-
-    const metricsObservable = this.metrics$.asObservable();
-
-    return {
-      getOpsMetrics$: () => metricsObservable,
-    };
+    return {};
   }
 
   public async start(): Promise<InternalMetricsServiceStart> {
@@ -68,7 +63,11 @@ export class MetricsService
       this.refreshMetrics();
     }, config.interval.asMilliseconds());
 
-    return {};
+    const metricsObservable = this.metrics$.asObservable();
+
+    return {
+      getOpsMetrics$: () => metricsObservable,
+    };
   }
 
   private async refreshMetrics() {
diff --git a/src/core/server/metrics/types.ts b/src/core/server/metrics/types.ts
index 5c8f18fff380..cbf0acacd6ba 100644
--- a/src/core/server/metrics/types.ts
+++ b/src/core/server/metrics/types.ts
@@ -20,12 +20,14 @@
 import { Observable } from 'rxjs';
 import { OpsProcessMetrics, OpsOsMetrics, OpsServerMetrics } from './collectors';
 
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface MetricsServiceSetup {}
 /**
  * APIs to retrieves metrics gathered and exposed by the core platform.
  *
  * @public
  */
-export interface MetricsServiceSetup {
+export interface MetricsServiceStart {
   /**
    * Retrieve an observable emitting the {@link OpsMetrics} gathered.
    * The observable will emit an initial value during core's `start` phase, and a new value every fixed interval of time,
@@ -40,8 +42,6 @@ export interface MetricsServiceSetup {
    */
   getOpsMetrics$: () => Observable<OpsMetrics>;
 }
-// eslint-disable-next-line @typescript-eslint/no-empty-interface
-export interface MetricsServiceStart {}
 
 export type InternalMetricsServiceSetup = MetricsServiceSetup;
 export type InternalMetricsServiceStart = MetricsServiceStart;
diff --git a/src/core/server/mocks.ts b/src/core/server/mocks.ts
index 2ac5bd98f7ed..4491942951c5 100644
--- a/src/core/server/mocks.ts
+++ b/src/core/server/mocks.ts
@@ -129,7 +129,6 @@ function createCoreSetupMock({
     http: httpMock,
     savedObjects: savedObjectsServiceMock.createInternalSetupContract(),
     status: statusServiceMock.createSetupContract(),
-    metrics: metricsServiceMock.createSetupContract(),
     uiSettings: uiSettingsMock,
     uuid: uuidServiceMock.createSetupContract(),
     logging: loggingServiceMock.createSetupContract(),
@@ -146,6 +145,7 @@ function createCoreStartMock() {
     capabilities: capabilitiesServiceMock.createStartContract(),
     elasticsearch: elasticsearchServiceMock.createStart(),
     http: httpServiceMock.createStartContract(),
+    metrics: metricsServiceMock.createStartContract(),
     savedObjects: savedObjectsServiceMock.createStartContract(),
     uiSettings: uiSettingsServiceMock.createStartContract(),
   };
@@ -159,7 +159,6 @@ function createInternalCoreSetupMock() {
     context: contextServiceMock.createSetupContract(),
     elasticsearch: elasticsearchServiceMock.createInternalSetup(),
     http: httpServiceMock.createInternalSetupContract(),
-    metrics: metricsServiceMock.createInternalSetupContract(),
     savedObjects: savedObjectsServiceMock.createInternalSetupContract(),
     status: statusServiceMock.createInternalSetupContract(),
     uuid: uuidServiceMock.createSetupContract(),
@@ -176,6 +175,7 @@ function createInternalCoreStartMock() {
     capabilities: capabilitiesServiceMock.createStartContract(),
     elasticsearch: elasticsearchServiceMock.createStart(),
     http: httpServiceMock.createInternalStartContract(),
+    metrics: metricsServiceMock.createStartContract(),
     savedObjects: savedObjectsServiceMock.createInternalStartContract(),
     uiSettings: uiSettingsServiceMock.createStartContract(),
   };
diff --git a/src/core/server/plugins/plugin_context.ts b/src/core/server/plugins/plugin_context.ts
index 32bc8dc088ca..4643789d99a8 100644
--- a/src/core/server/plugins/plugin_context.ts
+++ b/src/core/server/plugins/plugin_context.ts
@@ -169,9 +169,6 @@ export function createPluginSetupContext<TPlugin, TPluginDependencies>(
     logging: {
       configure: (config$) => deps.logging.configure(['plugins', plugin.name], config$),
     },
-    metrics: {
-      getOpsMetrics$: deps.metrics.getOpsMetrics$,
-    },
     savedObjects: {
       setClientFactoryProvider: deps.savedObjects.setClientFactoryProvider,
       addClientWrapper: deps.savedObjects.addClientWrapper,
@@ -225,6 +222,9 @@ export function createPluginStartContext<TPlugin, TPluginDependencies>(
       createSerializer: deps.savedObjects.createSerializer,
       getTypeRegistry: deps.savedObjects.getTypeRegistry,
     },
+    metrics: {
+      getOpsMetrics$: deps.metrics.getOpsMetrics$,
+    },
     uiSettings: {
       asScopedToClient: deps.uiSettings.asScopedToClient,
     },
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index 00ec217bc858..108826ad61aa 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -712,8 +712,6 @@ export interface CoreSetup<TPluginsStart extends object = object, TStart = unkno
     // (undocumented)
     logging: LoggingServiceSetup;
     // (undocumented)
-    metrics: MetricsServiceSetup;
-    // (undocumented)
     savedObjects: SavedObjectsServiceSetup;
     // (undocumented)
     status: StatusServiceSetup;
@@ -731,6 +729,11 @@ export interface CoreStart {
     elasticsearch: ElasticsearchServiceStart;
     // (undocumented)
     http: HttpServiceStart;
+    // Warning: (ae-forgotten-export) The symbol "MetricsServiceStart" needs to be exported by the entry point index.d.ts
+    // Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "MetricsServiceStart"
+    //
+    // (undocumented)
+    metrics: MetricsServiceStart;
     // (undocumented)
     savedObjects: SavedObjectsServiceStart;
     // (undocumented)
@@ -1420,9 +1423,10 @@ export interface LogRecord {
     timestamp: Date;
 }
 
-// @public
+// Warning: (ae-missing-release-tag) "MetricsServiceSetup" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
 export interface MetricsServiceSetup {
-    getOpsMetrics$: () => Observable<OpsMetrics>;
 }
 
 // @public (undocumented)
diff --git a/src/core/server/server.ts b/src/core/server/server.ts
index 3bbcd0e37e14..dc37b77c57c9 100644
--- a/src/core/server/server.ts
+++ b/src/core/server/server.ts
@@ -150,7 +150,7 @@ export class Server {
       savedObjects: savedObjectsSetup,
     });
 
-    const metricsSetup = await this.metrics.setup({ http: httpSetup });
+    await this.metrics.setup({ http: httpSetup });
 
     const renderingSetup = await this.rendering.setup({
       http: httpSetup,
@@ -181,7 +181,6 @@ export class Server {
       status: statusSetup,
       uiSettings: uiSettingsSetup,
       uuid: uuidSetup,
-      metrics: metricsSetup,
       rendering: renderingSetup,
       httpResources: httpResourcesSetup,
       logging: loggingSetup,
@@ -211,12 +210,14 @@ export class Server {
     });
     const capabilitiesStart = this.capabilities.start();
     const uiSettingsStart = await this.uiSettings.start();
+    const metricsStart = await this.metrics.start();
     const httpStart = this.http.getStartContract();
 
     this.coreStart = {
       capabilities: capabilitiesStart,
       elasticsearch: elasticsearchStart,
       http: httpStart,
+      metrics: metricsStart,
       savedObjects: savedObjectsStart,
       uiSettings: uiSettingsStart,
     };
@@ -236,7 +237,6 @@ export class Server {
     await this.rendering.start({
       legacy: this.legacy,
     });
-    await this.metrics.start();
 
     return this.coreStart;
   }
diff --git a/src/legacy/server/status/routes/api/register_stats.js b/src/legacy/server/status/routes/api/register_stats.js
index 09957e61f74d..0221c7e0ea08 100644
--- a/src/legacy/server/status/routes/api/register_stats.js
+++ b/src/legacy/server/status/routes/api/register_stats.js
@@ -54,7 +54,7 @@ export function registerStatsApi(usageCollection, server, config, kbnServer) {
   /* kibana_stats gets singled out from the collector set as it is used
    * for health-checking Kibana and fetch does not rely on fetching data
    * from ES */
-  server.newPlatform.setup.core.metrics.getOpsMetrics$().subscribe((metrics) => {
+  server.newPlatform.start.core.metrics.getOpsMetrics$().subscribe((metrics) => {
     lastMetrics = {
       ...metrics,
       timestamp: new Date().toISOString(),
diff --git a/src/plugins/kibana_usage_collection/server/__snapshots__/index.test.ts.snap b/src/plugins/kibana_usage_collection/server/__snapshots__/index.test.ts.snap
index 41c4c33b53c8..f07912eff02b 100644
--- a/src/plugins/kibana_usage_collection/server/__snapshots__/index.test.ts.snap
+++ b/src/plugins/kibana_usage_collection/server/__snapshots__/index.test.ts.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`kibana_usage_collection Runs the setup method without issues 1`] = `true`;
+exports[`kibana_usage_collection Runs the setup method without issues 1`] = `false`;
 
 exports[`kibana_usage_collection Runs the setup method without issues 2`] = `true`;
 
diff --git a/src/plugins/kibana_usage_collection/server/index.test.ts b/src/plugins/kibana_usage_collection/server/index.test.ts
index c2680fef01ca..d4b065896c88 100644
--- a/src/plugins/kibana_usage_collection/server/index.test.ts
+++ b/src/plugins/kibana_usage_collection/server/index.test.ts
@@ -17,7 +17,6 @@
  * under the License.
  */
 
-import { BehaviorSubject } from 'rxjs';
 import {
   coreMock,
   savedObjectsRepositoryMock,
@@ -47,30 +46,6 @@ describe('kibana_usage_collection', () => {
 
   test('Runs the setup method without issues', () => {
     const coreSetup = coreMock.createSetup();
-    coreSetup.metrics.getOpsMetrics$.mockImplementation(
-      () =>
-        new BehaviorSubject({
-          process: {
-            memory: {
-              heap: { total_in_bytes: 1, used_in_bytes: 1, size_limit: 1 },
-              resident_set_size_in_bytes: 1,
-            },
-            event_loop_delay: 1,
-            pid: 1,
-            uptime_in_millis: 1,
-          },
-          os: {
-            platform: 'darwin' as const,
-            platformRelease: 'test',
-            load: { '1m': 1, '5m': 1, '15m': 1 },
-            memory: { total_in_bytes: 1, free_in_bytes: 1, used_in_bytes: 1 },
-            uptime_in_millis: 1,
-          },
-          response_times: { avg_in_millis: 1, max_in_millis: 1 },
-          requests: { disconnects: 1, total: 1, statusCodes: { '200': 1 } },
-          concurrent_connections: 1,
-        })
-    );
 
     expect(pluginInstance.setup(coreSetup, { usageCollection })).toBe(undefined);
     usageCollectors.forEach(({ isReady }) => {
@@ -86,6 +61,7 @@ describe('kibana_usage_collection', () => {
     coreStart.uiSettings.asScopedToClient.mockImplementation(() =>
       uiSettingsServiceMock.createClient()
     );
+
     expect(pluginInstance.start(coreStart)).toBe(undefined);
     usageCollectors.forEach(({ isReady }) => {
       expect(isReady()).toBe(true); // All should return true at this point
diff --git a/src/plugins/kibana_usage_collection/server/plugin.ts b/src/plugins/kibana_usage_collection/server/plugin.ts
index 64d536710023..803a9146bd08 100644
--- a/src/plugins/kibana_usage_collection/server/plugin.ts
+++ b/src/plugins/kibana_usage_collection/server/plugin.ts
@@ -18,18 +18,18 @@
  */
 
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { Observable } from 'rxjs';
+import { Subject, Observable } from 'rxjs';
 import {
   PluginInitializerContext,
   CoreSetup,
   Plugin,
-  MetricsServiceSetup,
   ISavedObjectsRepository,
   IUiSettingsClient,
   SharedGlobalConfig,
   SavedObjectsClient,
   CoreStart,
   SavedObjectsServiceSetup,
+  OpsMetrics,
 } from '../../../core/server';
 import {
   registerApplicationUsageCollector,
@@ -49,16 +49,18 @@ export class KibanaUsageCollectionPlugin implements Plugin {
   private readonly legacyConfig$: Observable<SharedGlobalConfig>;
   private savedObjectsClient?: ISavedObjectsRepository;
   private uiSettingsClient?: IUiSettingsClient;
+  private metric$: Subject<OpsMetrics>;
 
   constructor(initializerContext: PluginInitializerContext) {
     this.legacyConfig$ = initializerContext.config.legacy.globalConfig$;
+    this.metric$ = new Subject<OpsMetrics>();
   }
 
   public setup(
-    { savedObjects, metrics, getStartServices }: CoreSetup,
+    { savedObjects }: CoreSetup,
     { usageCollection }: KibanaUsageCollectionPluginsDepsSetup
   ) {
-    this.registerUsageCollectors(usageCollection, metrics, (opts) =>
+    this.registerUsageCollectors(usageCollection, this.metric$, (opts) =>
       savedObjects.registerType(opts)
     );
   }
@@ -68,19 +70,22 @@ export class KibanaUsageCollectionPlugin implements Plugin {
     this.savedObjectsClient = savedObjects.createInternalRepository();
     const savedObjectsClient = new SavedObjectsClient(this.savedObjectsClient);
     this.uiSettingsClient = uiSettings.asScopedToClient(savedObjectsClient);
+    core.metrics.getOpsMetrics$().subscribe(this.metric$);
   }
 
-  public stop() {}
+  public stop() {
+    this.metric$.complete();
+  }
 
   private registerUsageCollectors(
     usageCollection: UsageCollectionSetup,
-    metrics: MetricsServiceSetup,
+    metric$: Subject<OpsMetrics>,
     registerType: SavedObjectsRegisterType
   ) {
     const getSavedObjectsClient = () => this.savedObjectsClient;
     const getUiSettingsClient = () => this.uiSettingsClient;
 
-    registerOpsStatsCollector(usageCollection, metrics.getOpsMetrics$());
+    registerOpsStatsCollector(usageCollection, metric$);
     registerKibanaUsageCollector(usageCollection, this.legacyConfig$);
     registerManagementUsageCollector(usageCollection, getUiSettingsClient);
     registerUiMetricUsageCollector(usageCollection, registerType, getSavedObjectsClient);
diff --git a/src/plugins/telemetry/server/plugin.ts b/src/plugins/telemetry/server/plugin.ts
index e555c40d2559..6c8888feafc1 100644
--- a/src/plugins/telemetry/server/plugin.ts
+++ b/src/plugins/telemetry/server/plugin.ts
@@ -75,7 +75,7 @@ export class TelemetryPlugin implements Plugin {
   }
 
   public async setup(
-    { elasticsearch, http, savedObjects, metrics }: CoreSetup,
+    { elasticsearch, http, savedObjects }: CoreSetup,
     { usageCollection, telemetryCollectionManager }: TelemetryPluginsSetup
   ) {
     const currentKibanaVersion = this.currentKibanaVersion;

From 52223da44fd91119b1d8bada483d4963ff771755 Mon Sep 17 00:00:00 2001
From: Devon Thomson <devon.thomson@hotmail.com>
Date: Fri, 26 Jun 2020 07:55:12 -0400
Subject: [PATCH 41/78] prep state transfer for passing embeddables by value to
 editor and back (#69991)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../application/dashboard_app_controller.tsx  | 14 ++++++--
 src/plugins/embeddable/public/index.ts        |  2 +-
 .../lib/actions/edit_panel_action.test.tsx    |  2 +-
 .../public/lib/actions/edit_panel_action.ts   |  6 ++--
 .../embeddable_state_transfer.test.ts         |  8 ++---
 .../embeddable_state_transfer.ts              | 20 ++++++------
 .../public/lib/state_transfer/index.ts        |  2 +-
 .../public/lib/state_transfer/types.ts        | 32 ++++++++++++++-----
 src/plugins/embeddable/public/mocks.tsx       |  4 +--
 .../public/wizard/new_vis_modal.test.tsx      |  2 +-
 .../public/wizard/new_vis_modal.tsx           |  2 +-
 .../public/application/editor/editor.js       |  2 +-
 .../lens/public/app_plugin/mounter.tsx        |  2 +-
 13 files changed, 61 insertions(+), 37 deletions(-)

diff --git a/src/plugins/dashboard/public/application/dashboard_app_controller.tsx b/src/plugins/dashboard/public/application/dashboard_app_controller.tsx
index 3c559a6cde21..b52bf5bf02b7 100644
--- a/src/plugins/dashboard/public/application/dashboard_app_controller.tsx
+++ b/src/plugins/dashboard/public/application/dashboard_app_controller.tsx
@@ -60,6 +60,7 @@ import {
   ViewMode,
   SavedObjectEmbeddableInput,
   ContainerOutput,
+  EmbeddableInput,
 } from '../../../embeddable/public';
 import { NavAction, SavedDashboardPanel } from '../types';
 
@@ -430,9 +431,16 @@ export class DashboardAppController {
               .getStateTransfer(scopedHistory())
               .getIncomingEmbeddablePackage();
             if (incomingState) {
-              container.addNewEmbeddable<SavedObjectEmbeddableInput>(incomingState.type, {
-                savedObjectId: incomingState.id,
-              });
+              if ('id' in incomingState) {
+                container.addNewEmbeddable<SavedObjectEmbeddableInput>(incomingState.type, {
+                  savedObjectId: incomingState.id,
+                });
+              } else if ('input' in incomingState) {
+                container.addNewEmbeddable<EmbeddableInput>(
+                  incomingState.type,
+                  incomingState.input
+                );
+              }
             }
           }
 
diff --git a/src/plugins/embeddable/public/index.ts b/src/plugins/embeddable/public/index.ts
index 1d1dc7912193..35fbfe2e0aa3 100644
--- a/src/plugins/embeddable/public/index.ts
+++ b/src/plugins/embeddable/public/index.ts
@@ -69,7 +69,7 @@ export {
   isRangeSelectTriggerContext,
   isValueClickTriggerContext,
   EmbeddableStateTransfer,
-  EmbeddableOriginatingAppState,
+  EmbeddableEditorState,
   EmbeddablePackageState,
   EmbeddableRenderer,
   EmbeddableRendererProps,
diff --git a/src/plugins/embeddable/public/lib/actions/edit_panel_action.test.tsx b/src/plugins/embeddable/public/lib/actions/edit_panel_action.test.tsx
index 4b602efb0271..594a7ad73c39 100644
--- a/src/plugins/embeddable/public/lib/actions/edit_panel_action.test.tsx
+++ b/src/plugins/embeddable/public/lib/actions/edit_panel_action.test.tsx
@@ -59,7 +59,7 @@ test('redirects to app using state transfer', async () => {
   const embeddable = new EditableEmbeddable({ id: '123', viewMode: ViewMode.EDIT }, true);
   embeddable.getOutput = jest.fn(() => ({ editApp: 'ultraVisualize', editPath: '/123' }));
   await action.execute({ embeddable });
-  expect(stateTransferMock.navigateToWithOriginatingApp).toHaveBeenCalledWith('ultraVisualize', {
+  expect(stateTransferMock.navigateToEditor).toHaveBeenCalledWith('ultraVisualize', {
     path: '/123',
     state: { originatingApp: 'superCoolCurrentApp' },
   });
diff --git a/src/plugins/embeddable/public/lib/actions/edit_panel_action.ts b/src/plugins/embeddable/public/lib/actions/edit_panel_action.ts
index d983dc9f4185..9177a77d547b 100644
--- a/src/plugins/embeddable/public/lib/actions/edit_panel_action.ts
+++ b/src/plugins/embeddable/public/lib/actions/edit_panel_action.ts
@@ -24,7 +24,7 @@ import { take } from 'rxjs/operators';
 import { ViewMode } from '../types';
 import { EmbeddableFactoryNotFoundError } from '../errors';
 import { EmbeddableStart } from '../../plugin';
-import { IEmbeddable, EmbeddableOriginatingAppState, EmbeddableStateTransfer } from '../..';
+import { IEmbeddable, EmbeddableEditorState, EmbeddableStateTransfer } from '../..';
 
 export const ACTION_EDIT_PANEL = 'editPanel';
 
@@ -35,7 +35,7 @@ interface ActionContext {
 interface NavigationContext {
   app: string;
   path: string;
-  state?: EmbeddableOriginatingAppState;
+  state?: EmbeddableEditorState;
 }
 
 export class EditPanelAction implements Action<ActionContext> {
@@ -88,7 +88,7 @@ export class EditPanelAction implements Action<ActionContext> {
     const appTarget = this.getAppTarget(context);
     if (appTarget) {
       if (this.stateTransfer && appTarget.state) {
-        await this.stateTransfer.navigateToWithOriginatingApp(appTarget.app, {
+        await this.stateTransfer.navigateToEditor(appTarget.app, {
           path: appTarget.path,
           state: appTarget.state,
         });
diff --git a/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.test.ts b/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.test.ts
index 0d5ae6be6818..b7dd95ccba32 100644
--- a/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.test.ts
+++ b/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.test.ts
@@ -38,7 +38,7 @@ describe('embeddable state transfer', () => {
   });
 
   it('can send an outgoing originating app state', async () => {
-    await stateTransfer.navigateToWithOriginatingApp(destinationApp, { state: { originatingApp } });
+    await stateTransfer.navigateToEditor(destinationApp, { state: { originatingApp } });
     expect(application.navigateToApp).toHaveBeenCalledWith('superUltraVisualize', {
       state: { originatingApp: 'superUltraTestDashboard' },
     });
@@ -50,7 +50,7 @@ describe('embeddable state transfer', () => {
       application.navigateToApp,
       (historyMock as unknown) as ScopedHistory
     );
-    await stateTransfer.navigateToWithOriginatingApp(destinationApp, {
+    await stateTransfer.navigateToEditor(destinationApp, {
       state: { originatingApp },
       appendToExistingState: true,
     });
@@ -94,7 +94,7 @@ describe('embeddable state transfer', () => {
       application.navigateToApp,
       (historyMock as unknown) as ScopedHistory
     );
-    const fetchedState = stateTransfer.getIncomingOriginatingApp();
+    const fetchedState = stateTransfer.getIncomingEditorState();
     expect(fetchedState).toEqual({ originatingApp: 'extremeSportsKibana' });
   });
 
@@ -104,7 +104,7 @@ describe('embeddable state transfer', () => {
       application.navigateToApp,
       (historyMock as unknown) as ScopedHistory
     );
-    const fetchedState = stateTransfer.getIncomingOriginatingApp();
+    const fetchedState = stateTransfer.getIncomingEditorState();
     expect(fetchedState).toBeUndefined();
   });
 
diff --git a/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.ts b/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.ts
index 57b425d2df45..8f70e5a66c47 100644
--- a/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.ts
+++ b/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.ts
@@ -20,8 +20,8 @@
 import { cloneDeep } from 'lodash';
 import { ScopedHistory, ApplicationStart } from '../../../../../core/public';
 import {
-  EmbeddableOriginatingAppState,
-  isEmbeddableOriginatingAppState,
+  EmbeddableEditorState,
+  isEmbeddableEditorState,
   EmbeddablePackageState,
   isEmbeddablePackageState,
 } from './types';
@@ -39,16 +39,16 @@ export class EmbeddableStateTransfer {
   ) {}
 
   /**
-   * Fetches an {@link EmbeddableOriginatingAppState | originating app} argument from the scoped
+   * Fetches an {@link EmbeddableEditorState | originating app} argument from the scoped
    * history's location state.
    *
    * @param history - the scoped history to fetch from
    * @param options.keysToRemoveAfterFetch - an array of keys to be removed from the state after they are retrieved
    */
-  public getIncomingOriginatingApp(options?: {
+  public getIncomingEditorState(options?: {
     keysToRemoveAfterFetch?: string[];
-  }): EmbeddableOriginatingAppState | undefined {
-    return this.getIncomingState<EmbeddableOriginatingAppState>(isEmbeddableOriginatingAppState, {
+  }): EmbeddableEditorState | undefined {
+    return this.getIncomingState<EmbeddableEditorState>(isEmbeddableEditorState, {
       keysToRemoveAfterFetch: options?.keysToRemoveAfterFetch,
     });
   }
@@ -70,17 +70,17 @@ export class EmbeddableStateTransfer {
 
   /**
    * A wrapper around the {@link ApplicationStart.navigateToApp} method which navigates to the specified appId
-   * with {@link EmbeddableOriginatingAppState | originating app state}
+   * with {@link EmbeddableEditorState | embeddable editor state}
    */
-  public async navigateToWithOriginatingApp(
+  public async navigateToEditor(
     appId: string,
     options?: {
       path?: string;
-      state: EmbeddableOriginatingAppState;
+      state: EmbeddableEditorState;
       appendToExistingState?: boolean;
     }
   ): Promise<void> {
-    await this.navigateToWithState<EmbeddableOriginatingAppState>(appId, options);
+    await this.navigateToWithState<EmbeddableEditorState>(appId, options);
   }
 
   /**
diff --git a/src/plugins/embeddable/public/lib/state_transfer/index.ts b/src/plugins/embeddable/public/lib/state_transfer/index.ts
index e51efc5dcca2..7daa7a0ea81d 100644
--- a/src/plugins/embeddable/public/lib/state_transfer/index.ts
+++ b/src/plugins/embeddable/public/lib/state_transfer/index.ts
@@ -18,4 +18,4 @@
  */
 
 export { EmbeddableStateTransfer } from './embeddable_state_transfer';
-export { EmbeddableOriginatingAppState, EmbeddablePackageState } from './types';
+export { EmbeddableEditorState, EmbeddablePackageState } from './types';
diff --git a/src/plugins/embeddable/public/lib/state_transfer/types.ts b/src/plugins/embeddable/public/lib/state_transfer/types.ts
index 8eae441d1be2..a6721784302a 100644
--- a/src/plugins/embeddable/public/lib/state_transfer/types.ts
+++ b/src/plugins/embeddable/public/lib/state_transfer/types.ts
@@ -17,33 +17,49 @@
  * under the License.
  */
 
+import { EmbeddableInput } from '..';
+
 /**
  * Represents a state package that contains the last active app id.
  * @public
  */
-export interface EmbeddableOriginatingAppState {
+export interface EmbeddableEditorState {
   originatingApp: string;
+  byValueMode?: boolean;
+  valueInput?: EmbeddableInput;
 }
 
-export function isEmbeddableOriginatingAppState(
-  state: unknown
-): state is EmbeddableOriginatingAppState {
+export function isEmbeddableEditorState(state: unknown): state is EmbeddableEditorState {
   return ensureFieldOfTypeExists('originatingApp', state, 'string');
 }
 
 /**
- * Represents a state package that contains all fields necessary to create an embeddable in a container.
+ * Represents a state package that contains all fields necessary to create an embeddable by reference in a container.
  * @public
  */
-export interface EmbeddablePackageState {
+export interface EmbeddablePackageByReferenceState {
   type: string;
   id: string;
 }
 
+/**
+ * Represents a state package that contains all fields necessary to create an embeddable by value in a container.
+ * @public
+ */
+export interface EmbeddablePackageByValueState {
+  type: string;
+  input: EmbeddableInput;
+}
+
+export type EmbeddablePackageState =
+  | EmbeddablePackageByReferenceState
+  | EmbeddablePackageByValueState;
+
 export function isEmbeddablePackageState(state: unknown): state is EmbeddablePackageState {
   return (
-    ensureFieldOfTypeExists('type', state, 'string') &&
-    ensureFieldOfTypeExists('id', state, 'string')
+    (ensureFieldOfTypeExists('type', state, 'string') &&
+      ensureFieldOfTypeExists('id', state, 'string')) ||
+    ensureFieldOfTypeExists('input', state, 'object')
   );
 }
 
diff --git a/src/plugins/embeddable/public/mocks.tsx b/src/plugins/embeddable/public/mocks.tsx
index 49910525c7ab..6d94af1f2282 100644
--- a/src/plugins/embeddable/public/mocks.tsx
+++ b/src/plugins/embeddable/public/mocks.tsx
@@ -78,9 +78,9 @@ export const createEmbeddablePanelMock = ({
 
 export const createEmbeddableStateTransferMock = (): Partial<EmbeddableStateTransfer> => {
   return {
-    getIncomingOriginatingApp: jest.fn(),
+    getIncomingEditorState: jest.fn(),
     getIncomingEmbeddablePackage: jest.fn(),
-    navigateToWithOriginatingApp: jest.fn(),
+    navigateToEditor: jest.fn(),
     navigateToWithEmbeddablePackage: jest.fn(),
   };
 };
diff --git a/src/plugins/visualizations/public/wizard/new_vis_modal.test.tsx b/src/plugins/visualizations/public/wizard/new_vis_modal.test.tsx
index dd89e98fb8fe..f48febfef5b4 100644
--- a/src/plugins/visualizations/public/wizard/new_vis_modal.test.tsx
+++ b/src/plugins/visualizations/public/wizard/new_vis_modal.test.tsx
@@ -165,7 +165,7 @@ describe('NewVisModal', () => {
       );
       const visButton = wrapper.find('button[data-test-subj="visType-visWithAliasUrl"]');
       visButton.simulate('click');
-      expect(stateTransfer.navigateToWithOriginatingApp).toBeCalledWith('otherApp', {
+      expect(stateTransfer.navigateToEditor).toBeCalledWith('otherApp', {
         path: '#/aliasUrl',
         state: { originatingApp: 'coolJestTestApp' },
       });
diff --git a/src/plugins/visualizations/public/wizard/new_vis_modal.tsx b/src/plugins/visualizations/public/wizard/new_vis_modal.tsx
index 84a5bca0ed0e..1d01900ceffc 100644
--- a/src/plugins/visualizations/public/wizard/new_vis_modal.tsx
+++ b/src/plugins/visualizations/public/wizard/new_vis_modal.tsx
@@ -172,7 +172,7 @@ class NewVisModal extends React.Component<TypeSelectionProps, TypeSelectionState
 
   private navigate(appId: string, params: string) {
     if (this.props.stateTransfer && this.props.originatingApp) {
-      this.props.stateTransfer.navigateToWithOriginatingApp(appId, {
+      this.props.stateTransfer.navigateToEditor(appId, {
         path: params,
         state: { originatingApp: this.props.originatingApp },
       });
diff --git a/src/plugins/visualize/public/application/editor/editor.js b/src/plugins/visualize/public/application/editor/editor.js
index 25e6bdd1c3e0..d7c7828c58f2 100644
--- a/src/plugins/visualize/public/application/editor/editor.js
+++ b/src/plugins/visualize/public/application/editor/editor.js
@@ -118,7 +118,7 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
   };
 
   const { originatingApp } =
-    embeddable.getStateTransfer(scopedHistory()).getIncomingOriginatingApp() || {};
+    embeddable.getStateTransfer(scopedHistory()).getIncomingEditorState() || {};
   $scope.getOriginatingApp = () => originatingApp;
 
   const visStateToEditorState = () => {
diff --git a/x-pack/plugins/lens/public/app_plugin/mounter.tsx b/x-pack/plugins/lens/public/app_plugin/mounter.tsx
index 7a33241792a5..1ee618a31a69 100644
--- a/x-pack/plugins/lens/public/app_plugin/mounter.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/mounter.tsx
@@ -38,7 +38,7 @@ export async function mountApp(
 
   const stateTransfer = embeddable?.getStateTransfer(params.history);
   const { originatingApp } =
-    stateTransfer?.getIncomingOriginatingApp({ keysToRemoveAfterFetch: ['originatingApp'] }) || {};
+    stateTransfer?.getIncomingEditorState({ keysToRemoveAfterFetch: ['originatingApp'] }) || {};
 
   const instance = await createEditorFrame();
 

From b3b5dab00d630872ccf4ac1a56c35150acc642b4 Mon Sep 17 00:00:00 2001
From: Anton Dosov <anton.dosov@elastic.co>
Date: Fri, 26 Jun 2020 14:05:17 +0200
Subject: [PATCH 42/78] Api reference docs for state_containers and state_sync
 (#67354)

Adds state_containers and state_sync to api_extractor
improves TSDoc definitions for those plugins
adds changes to api_extractor script to support common/ folder and runs docs generation sequentially to not get OOM.

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../common/state_containers/index.md          |  12 ++
 ...utils-common-state_containers.basestate.md |  13 ++
 ...state_containers.basestatecontainer.get.md |  13 ++
 ...mon-state_containers.basestatecontainer.md |  22 +++
 ...state_containers.basestatecontainer.set.md |  13 ++
 ...te_containers.basestatecontainer.state_.md |  13 ++
 ...tils-common-state_containers.comparator.md |  13 ++
 ...a_utils-common-state_containers.connect.md |  13 ++
 ...n-state_containers.createstatecontainer.md |  24 +++
 ...state_containers.createstatecontainer_1.md |  25 +++
 ...state_containers.createstatecontainer_2.md |  27 +++
 ...ners.createstatecontaineroptions.freeze.md |  25 +++
 ..._containers.createstatecontaineroptions.md |  20 +++
 ...ainers.createstatecontainerreacthelpers.md |  22 +++
 ..._utils-common-state_containers.dispatch.md |  13 ++
 ...mon-state_containers.ensurepureselector.md |  12 ++
 ...n-state_containers.ensurepuretransition.md |  12 ++
 ...common-state_containers.mapstatetoprops.md |  13 ++
 ...ns-kibana_utils-common-state_containers.md |  52 ++++++
 ...tils-common-state_containers.middleware.md |  13 ++
 ...ls-common-state_containers.pureselector.md |  12 ++
 ...ate_containers.pureselectorstoselectors.md |  14 ++
 ...state_containers.pureselectortoselector.md |  12 ++
 ...a_utils-common-state_containers.reducer.md |  13 ++
 ...s.reduxlikestatecontainer.addmiddleware.md |  11 ++
 ...ainers.reduxlikestatecontainer.dispatch.md |  11 ++
 ...ainers.reduxlikestatecontainer.getstate.md |  11 ++
 ...tate_containers.reduxlikestatecontainer.md |  25 +++
 ...tainers.reduxlikestatecontainer.reducer.md |  11 ++
 ....reduxlikestatecontainer.replacereducer.md |  11 ++
 ...iners.reduxlikestatecontainer.subscribe.md |  11 ++
 ..._utils-common-state_containers.selector.md |  12 ++
 ...-common-state_containers.statecontainer.md |  21 +++
 ...ate_containers.statecontainer.selectors.md |  11 ++
 ...e_containers.statecontainer.transitions.md |  11 ++
 ...tils-common-state_containers.unboxstate.md |  13 ++
 ...n-state_containers.usecontainerselector.md |  13 ++
 ...mmon-state_containers.usecontainerstate.md |  13 ++
 .../kibana_utils/public/state_sync/index.md   |  12 ++
 ...lic-state_sync.createkbnurlstatestorage.md |  16 ++
 ...e_sync.createsessionstoragestatestorage.md |  13 ++
 ...c-state_sync.ikbnurlstatestorage.cancel.md |  13 ++
 ...-state_sync.ikbnurlstatestorage.change_.md |  11 ++
 ...ic-state_sync.ikbnurlstatestorage.flush.md |  15 ++
 ...blic-state_sync.ikbnurlstatestorage.get.md |  11 ++
 ...s-public-state_sync.ikbnurlstatestorage.md |  24 +++
 ...blic-state_sync.ikbnurlstatestorage.set.md |  13 ++
 ...-state_sync.inullablebasestatecontainer.md |  24 +++
 ...te_sync.inullablebasestatecontainer.set.md |  11 ++
 ...te_sync.isessionstoragestatestorage.get.md |  11 ++
 ...-state_sync.isessionstoragestatestorage.md |  21 +++
 ...te_sync.isessionstoragestatestorage.set.md |  11 ++
 ...-public-state_sync.istatestorage.cancel.md |  13 ++
 ...public-state_sync.istatestorage.change_.md |  13 ++
 ...ils-public-state_sync.istatestorage.get.md |  13 ++
 ...a_utils-public-state_sync.istatestorage.md |  25 +++
 ...ils-public-state_sync.istatestorage.set.md |  13 ++
 ...tils-public-state_sync.istatesyncconfig.md |  22 +++
 ...te_sync.istatesyncconfig.statecontainer.md |  13 ++
 ...tate_sync.istatesyncconfig.statestorage.md |  15 ++
 ...-state_sync.istatesyncconfig.storagekey.md |  13 ++
 ...a_utils-public-state_sync.isyncstateref.md |  20 +++
 ...s-public-state_sync.isyncstateref.start.md |  13 ++
 ...ls-public-state_sync.isyncstateref.stop.md |  13 ++
 ...-plugins-kibana_utils-public-state_sync.md |  48 ++++++
 ...-public-state_sync.startsyncstatefntype.md |  12 ++
 ...s-public-state_sync.stopsyncstatefntype.md |  12 ++
 ...ibana_utils-public-state_sync.syncstate.md |  93 +++++++++++
 ...bana_utils-public-state_sync.syncstates.md |  42 +++++
 src/dev/run_check_published_api_changes.ts    |  56 +++++--
 .../common/state_containers/common.api.md     | 156 ++++++++++++++++++
 .../create_state_container.ts                 |  43 ++++-
 .../create_state_container_react_helpers.ts   |  23 ++-
 .../common/state_containers/index.ts          |  40 ++++-
 .../common/state_containers/types.ts          | 106 +++++++++++-
 .../kibana_utils/public/state_sync/index.ts   |  21 +++
 .../public/state_sync/public.api.md           |  97 +++++++++++
 .../public/state_sync/state_sync.ts           |  68 +++++---
 .../create_kbn_url_state_storage.ts           |  30 +++-
 .../create_session_storage_state_storage.ts   |  12 ++
 .../state_sync_state_storage/types.ts         |   5 +-
 .../kibana_utils/public/state_sync/types.ts   |  25 ++-
 82 files changed, 1816 insertions(+), 71 deletions(-)
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/index.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestate.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.get.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.set.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.state_.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.comparator.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.connect.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_1.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_2.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.freeze.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainerreacthelpers.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.dispatch.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepureselector.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepuretransition.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.mapstatetoprops.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.middleware.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselector.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectorstoselectors.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectortoselector.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reducer.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.addmiddleware.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.dispatch.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.getstate.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.reducer.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.replacereducer.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.subscribe.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.selector.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.selectors.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.transitions.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.unboxstate.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerselector.md
 create mode 100644 docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerstate.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/index.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.createkbnurlstatestorage.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.createsessionstoragestatestorage.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.cancel.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.change_.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.flush.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.get.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.set.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.set.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.get.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.set.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.cancel.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.change_.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.get.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.set.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statecontainer.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statestorage.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.storagekey.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.start.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.stop.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.startsyncstatefntype.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.stopsyncstatefntype.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.syncstate.md
 create mode 100644 docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.syncstates.md
 create mode 100644 src/plugins/kibana_utils/common/state_containers/common.api.md
 create mode 100644 src/plugins/kibana_utils/public/state_sync/public.api.md

diff --git a/docs/development/plugins/kibana_utils/common/state_containers/index.md b/docs/development/plugins/kibana_utils/common/state_containers/index.md
new file mode 100644
index 000000000000..b4e1071ceb73
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/index.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md)
+
+## API Reference
+
+## Packages
+
+|  Package | Description |
+|  --- | --- |
+|  [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) | State containers are Redux-store-like objects meant to help you manage state in your services or apps. Refer to [guides and examples](https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_containers) for more info |
+
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestate.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestate.md
new file mode 100644
index 000000000000..92893afc02be
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestate.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [BaseState](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestate.md)
+
+## BaseState type
+
+Base [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md) state shape
+
+<b>Signature:</b>
+
+```typescript
+export declare type BaseState = object;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.get.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.get.md
new file mode 100644
index 000000000000..b939954d92aa
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.get.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [BaseStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md) &gt; [get](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.get.md)
+
+## BaseStateContainer.get property
+
+Retrieves current state from the container
+
+<b>Signature:</b>
+
+```typescript
+get: () => State;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md
new file mode 100644
index 000000000000..66c25c87f5e3
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [BaseStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md)
+
+## BaseStateContainer interface
+
+Base state container shape without transitions or selectors
+
+<b>Signature:</b>
+
+```typescript
+export interface BaseStateContainer<State extends BaseState> 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [get](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.get.md) | <code>() =&gt; State</code> | Retrieves current state from the container |
+|  [set](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.set.md) | <code>(state: State) =&gt; void</code> | Sets state into container |
+|  [state$](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.state_.md) | <code>Observable&lt;State&gt;</code> |  of state |
+
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.set.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.set.md
new file mode 100644
index 000000000000..ed4ff365adfb
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.set.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [BaseStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md) &gt; [set](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.set.md)
+
+## BaseStateContainer.set property
+
+Sets state into container
+
+<b>Signature:</b>
+
+```typescript
+set: (state: State) => void;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.state_.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.state_.md
new file mode 100644
index 000000000000..35838fa53d53
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.state_.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [BaseStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md) &gt; [state$](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.state_.md)
+
+## BaseStateContainer.state$ property
+
+ of state
+
+<b>Signature:</b>
+
+```typescript
+state$: Observable<State>;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.comparator.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.comparator.md
new file mode 100644
index 000000000000..12af33756fb1
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.comparator.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [Comparator](./kibana-plugin-plugins-kibana_utils-common-state_containers.comparator.md)
+
+## Comparator type
+
+Used to compare state. see [useContainerSelector](./kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerselector.md)
+
+<b>Signature:</b>
+
+```typescript
+export declare type Comparator<Result> = (previous: Result, current: Result) => boolean;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.connect.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.connect.md
new file mode 100644
index 000000000000..e05f1fb392fe
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.connect.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [Connect](./kibana-plugin-plugins-kibana_utils-common-state_containers.connect.md)
+
+## Connect type
+
+Similar to `connect` from react-redux, allows to map state from state container to component's props
+
+<b>Signature:</b>
+
+```typescript
+export declare type Connect<State extends BaseState> = <Props extends object, StatePropKeys extends keyof Props>(mapStateToProp: MapStateToProps<State, Pick<Props, StatePropKeys>>) => (component: ComponentType<Props>) => FC<Omit<Props, StatePropKeys>>;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer.md
new file mode 100644
index 000000000000..cc43b59676dc
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [createStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer.md)
+
+## createStateContainer() function
+
+Creates a state container without transitions and without selectors.
+
+<b>Signature:</b>
+
+```typescript
+export declare function createStateContainer<State extends BaseState>(defaultState: State): ReduxLikeStateContainer<State>;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  defaultState | <code>State</code> | initial state |
+
+<b>Returns:</b>
+
+`ReduxLikeStateContainer<State>`
+
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_1.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_1.md
new file mode 100644
index 000000000000..794bf6358831
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_1.md
@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [createStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_1.md)
+
+## createStateContainer() function
+
+Creates a state container with transitions, but without selectors
+
+<b>Signature:</b>
+
+```typescript
+export declare function createStateContainer<State extends BaseState, PureTransitions extends object>(defaultState: State, pureTransitions: PureTransitions): ReduxLikeStateContainer<State, PureTransitions>;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  defaultState | <code>State</code> | initial state |
+|  pureTransitions | <code>PureTransitions</code> | state transitions configuration object. Map of . |
+
+<b>Returns:</b>
+
+`ReduxLikeStateContainer<State, PureTransitions>`
+
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_2.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_2.md
new file mode 100644
index 000000000000..1946baae202f
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_2.md
@@ -0,0 +1,27 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [createStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_2.md)
+
+## createStateContainer() function
+
+Creates a state container with transitions and selectors
+
+<b>Signature:</b>
+
+```typescript
+export declare function createStateContainer<State extends BaseState, PureTransitions extends object, PureSelectors extends object>(defaultState: State, pureTransitions: PureTransitions, pureSelectors: PureSelectors, options?: CreateStateContainerOptions): ReduxLikeStateContainer<State, PureTransitions, PureSelectors>;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  defaultState | <code>State</code> | initial state |
+|  pureTransitions | <code>PureTransitions</code> | state transitions configuration object. Map of . |
+|  pureSelectors | <code>PureSelectors</code> | state selectors configuration object. Map of . |
+|  options | <code>CreateStateContainerOptions</code> | state container options [CreateStateContainerOptions](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.md) |
+
+<b>Returns:</b>
+
+`ReduxLikeStateContainer<State, PureTransitions, PureSelectors>`
+
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.freeze.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.freeze.md
new file mode 100644
index 000000000000..4f772c7c54d0
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.freeze.md
@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [CreateStateContainerOptions](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.md) &gt; [freeze](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.freeze.md)
+
+## CreateStateContainerOptions.freeze property
+
+Function to use when freezing state. Supply identity function. If not provided, default deepFreeze is use.
+
+<b>Signature:</b>
+
+```typescript
+freeze?: <T>(state: T) => T;
+```
+
+## Example
+
+If you expect that your state will be mutated externally an you cannot prevent that
+
+```ts
+{
+  freeze: state => state,
+}
+
+```
+
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.md
new file mode 100644
index 000000000000..d328d306e93e
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.md
@@ -0,0 +1,20 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [CreateStateContainerOptions](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.md)
+
+## CreateStateContainerOptions interface
+
+State container options
+
+<b>Signature:</b>
+
+```typescript
+export interface CreateStateContainerOptions 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [freeze](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.freeze.md) | <code>&lt;T&gt;(state: T) =&gt; T</code> | Function to use when freezing state. Supply identity function. If not provided, default deepFreeze is use. |
+
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainerreacthelpers.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainerreacthelpers.md
new file mode 100644
index 000000000000..a6076490c274
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainerreacthelpers.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [createStateContainerReactHelpers](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainerreacthelpers.md)
+
+## createStateContainerReactHelpers variable
+
+Creates helpers for using [State Containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md) with react Refer to [guide](https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_containers/react.md) for details
+
+<b>Signature:</b>
+
+```typescript
+createStateContainerReactHelpers: <Container extends StateContainer<any, any, {}>>() => {
+    Provider: React.Provider<Container>;
+    Consumer: React.Consumer<Container>;
+    context: React.Context<Container>;
+    useContainer: () => Container;
+    useState: () => UnboxState<Container>;
+    useTransitions: () => Container["transitions"];
+    useSelector: <Result>(selector: (state: UnboxState<Container>) => Result, comparator?: Comparator<Result>) => Result;
+    connect: Connect<UnboxState<Container>>;
+}
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.dispatch.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.dispatch.md
new file mode 100644
index 000000000000..d4057a549bb0
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.dispatch.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [Dispatch](./kibana-plugin-plugins-kibana_utils-common-state_containers.dispatch.md)
+
+## Dispatch type
+
+Redux like dispatch
+
+<b>Signature:</b>
+
+```typescript
+export declare type Dispatch<T> = (action: T) => void;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepureselector.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepureselector.md
new file mode 100644
index 000000000000..5e4e86ad82d5
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepureselector.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [EnsurePureSelector](./kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepureselector.md)
+
+## EnsurePureSelector type
+
+
+<b>Signature:</b>
+
+```typescript
+export declare type EnsurePureSelector<T> = Ensure<T, PureSelector<any, any, any>>;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepuretransition.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepuretransition.md
new file mode 100644
index 000000000000..0e621e989346
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepuretransition.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [EnsurePureTransition](./kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepuretransition.md)
+
+## EnsurePureTransition type
+
+
+<b>Signature:</b>
+
+```typescript
+export declare type EnsurePureTransition<T> = Ensure<T, PureTransition<any, any>>;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.mapstatetoprops.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.mapstatetoprops.md
new file mode 100644
index 000000000000..8e6a49ac7274
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.mapstatetoprops.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [MapStateToProps](./kibana-plugin-plugins-kibana_utils-common-state_containers.mapstatetoprops.md)
+
+## MapStateToProps type
+
+State container state to component props mapper. See [Connect](./kibana-plugin-plugins-kibana_utils-common-state_containers.connect.md)
+
+<b>Signature:</b>
+
+```typescript
+export declare type MapStateToProps<State extends BaseState, StateProps extends object> = (state: State) => StateProps;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.md
new file mode 100644
index 000000000000..e74ff2c6885b
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.md
@@ -0,0 +1,52 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md)
+
+## kibana-plugin-plugins-kibana\_utils-common-state\_containers package
+
+State containers are Redux-store-like objects meant to help you manage state in your services or apps. Refer to [guides and examples](https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_containers) for more info
+
+## Functions
+
+|  Function | Description |
+|  --- | --- |
+|  [createStateContainer(defaultState)](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer.md) | Creates a state container without transitions and without selectors. |
+|  [createStateContainer(defaultState, pureTransitions)](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_1.md) | Creates a state container with transitions, but without selectors |
+|  [createStateContainer(defaultState, pureTransitions, pureSelectors, options)](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainer_2.md) | Creates a state container with transitions and selectors |
+
+## Interfaces
+
+|  Interface | Description |
+|  --- | --- |
+|  [BaseStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md) | Base state container shape without transitions or selectors |
+|  [CreateStateContainerOptions](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontaineroptions.md) | State container options |
+|  [ReduxLikeStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md) | Fully featured state container which matches Redux store interface. Extends [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md) Allows to use state container with redux libraries |
+|  [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md) | Fully featured state container with [Selectors](./kibana-plugin-plugins-kibana_utils-common-state_containers.selector.md) and . Extends [BaseStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md) |
+
+## Variables
+
+|  Variable | Description |
+|  --- | --- |
+|  [createStateContainerReactHelpers](./kibana-plugin-plugins-kibana_utils-common-state_containers.createstatecontainerreacthelpers.md) | Creates helpers for using [State Containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md) with react Refer to [guide](https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_containers/react.md) for details |
+|  [useContainerSelector](./kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerselector.md) | React hook to apply selector to state container to extract only needed information. Will re-render your component only when the section changes. |
+|  [useContainerState](./kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerstate.md) | React hooks that returns the latest state of a [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md)<!-- -->. |
+
+## Type Aliases
+
+|  Type Alias | Description |
+|  --- | --- |
+|  [BaseState](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestate.md) | Base [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md) state shape |
+|  [Comparator](./kibana-plugin-plugins-kibana_utils-common-state_containers.comparator.md) | Used to compare state. see [useContainerSelector](./kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerselector.md) |
+|  [Connect](./kibana-plugin-plugins-kibana_utils-common-state_containers.connect.md) | Similar to <code>connect</code> from react-redux, allows to map state from state container to component's props |
+|  [Dispatch](./kibana-plugin-plugins-kibana_utils-common-state_containers.dispatch.md) | Redux like dispatch |
+|  [EnsurePureSelector](./kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepureselector.md) |  |
+|  [EnsurePureTransition](./kibana-plugin-plugins-kibana_utils-common-state_containers.ensurepuretransition.md) |  |
+|  [MapStateToProps](./kibana-plugin-plugins-kibana_utils-common-state_containers.mapstatetoprops.md) | State container state to component props mapper. See [Connect](./kibana-plugin-plugins-kibana_utils-common-state_containers.connect.md) |
+|  [Middleware](./kibana-plugin-plugins-kibana_utils-common-state_containers.middleware.md) | Redux like Middleware |
+|  [PureSelector](./kibana-plugin-plugins-kibana_utils-common-state_containers.pureselector.md) |  |
+|  [PureSelectorsToSelectors](./kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectorstoselectors.md) |  |
+|  [PureSelectorToSelector](./kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectortoselector.md) |  |
+|  [Reducer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reducer.md) | Redux like Reducer |
+|  [Selector](./kibana-plugin-plugins-kibana_utils-common-state_containers.selector.md) |  |
+|  [UnboxState](./kibana-plugin-plugins-kibana_utils-common-state_containers.unboxstate.md) | Utility type for inferring state shape from [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md) |
+
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.middleware.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.middleware.md
new file mode 100644
index 000000000000..574b83306dc9
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.middleware.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [Middleware](./kibana-plugin-plugins-kibana_utils-common-state_containers.middleware.md)
+
+## Middleware type
+
+Redux like Middleware
+
+<b>Signature:</b>
+
+```typescript
+export declare type Middleware<State extends BaseState = BaseState> = (store: Pick<ReduxLikeStateContainer<State, any>, 'getState' | 'dispatch'>) => (next: (action: TransitionDescription) => TransitionDescription | any) => Dispatch<TransitionDescription>;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselector.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselector.md
new file mode 100644
index 000000000000..6ac07cba446f
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselector.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [PureSelector](./kibana-plugin-plugins-kibana_utils-common-state_containers.pureselector.md)
+
+## PureSelector type
+
+
+<b>Signature:</b>
+
+```typescript
+export declare type PureSelector<State extends BaseState, Result, Args extends any[] = []> = (state: State) => Selector<Result, Args>;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectorstoselectors.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectorstoselectors.md
new file mode 100644
index 000000000000..82a91f7c87e1
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectorstoselectors.md
@@ -0,0 +1,14 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [PureSelectorsToSelectors](./kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectorstoselectors.md)
+
+## PureSelectorsToSelectors type
+
+
+<b>Signature:</b>
+
+```typescript
+export declare type PureSelectorsToSelectors<T extends object> = {
+    [K in keyof T]: PureSelectorToSelector<EnsurePureSelector<T[K]>>;
+};
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectortoselector.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectortoselector.md
new file mode 100644
index 000000000000..5c12afd1cd97
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectortoselector.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [PureSelectorToSelector](./kibana-plugin-plugins-kibana_utils-common-state_containers.pureselectortoselector.md)
+
+## PureSelectorToSelector type
+
+
+<b>Signature:</b>
+
+```typescript
+export declare type PureSelectorToSelector<T extends PureSelector<any, any, any>> = ReturnType<EnsurePureSelector<T>>;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reducer.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reducer.md
new file mode 100644
index 000000000000..519e6ce7d7cf
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reducer.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [Reducer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reducer.md)
+
+## Reducer type
+
+Redux like Reducer
+
+<b>Signature:</b>
+
+```typescript
+export declare type Reducer<State extends BaseState> = (state: State, action: TransitionDescription) => State;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.addmiddleware.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.addmiddleware.md
new file mode 100644
index 000000000000..e90da05e30d8
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.addmiddleware.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [ReduxLikeStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md) &gt; [addMiddleware](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.addmiddleware.md)
+
+## ReduxLikeStateContainer.addMiddleware property
+
+<b>Signature:</b>
+
+```typescript
+addMiddleware: (middleware: Middleware<State>) => void;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.dispatch.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.dispatch.md
new file mode 100644
index 000000000000..7a9755ee3b65
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.dispatch.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [ReduxLikeStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md) &gt; [dispatch](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.dispatch.md)
+
+## ReduxLikeStateContainer.dispatch property
+
+<b>Signature:</b>
+
+```typescript
+dispatch: (action: TransitionDescription) => void;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.getstate.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.getstate.md
new file mode 100644
index 000000000000..86e1c6dd34cd
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.getstate.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [ReduxLikeStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md) &gt; [getState](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.getstate.md)
+
+## ReduxLikeStateContainer.getState property
+
+<b>Signature:</b>
+
+```typescript
+getState: () => State;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md
new file mode 100644
index 000000000000..0e08119c1eae
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md
@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [ReduxLikeStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md)
+
+## ReduxLikeStateContainer interface
+
+Fully featured state container which matches Redux store interface. Extends [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md) Allows to use state container with redux libraries
+
+<b>Signature:</b>
+
+```typescript
+export interface ReduxLikeStateContainer<State extends BaseState, PureTransitions extends object = {}, PureSelectors extends object = {}> extends StateContainer<State, PureTransitions, PureSelectors> 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [addMiddleware](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.addmiddleware.md) | <code>(middleware: Middleware&lt;State&gt;) =&gt; void</code> |  |
+|  [dispatch](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.dispatch.md) | <code>(action: TransitionDescription) =&gt; void</code> |  |
+|  [getState](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.getstate.md) | <code>() =&gt; State</code> |  |
+|  [reducer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.reducer.md) | <code>Reducer&lt;State&gt;</code> |  |
+|  [replaceReducer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.replacereducer.md) | <code>(nextReducer: Reducer&lt;State&gt;) =&gt; void</code> |  |
+|  [subscribe](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.subscribe.md) | <code>(listener: (state: State) =&gt; void) =&gt; () =&gt; void</code> |  |
+
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.reducer.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.reducer.md
new file mode 100644
index 000000000000..49eabf19340f
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.reducer.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [ReduxLikeStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md) &gt; [reducer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.reducer.md)
+
+## ReduxLikeStateContainer.reducer property
+
+<b>Signature:</b>
+
+```typescript
+reducer: Reducer<State>;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.replacereducer.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.replacereducer.md
new file mode 100644
index 000000000000..2582d31d9adc
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.replacereducer.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [ReduxLikeStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md) &gt; [replaceReducer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.replacereducer.md)
+
+## ReduxLikeStateContainer.replaceReducer property
+
+<b>Signature:</b>
+
+```typescript
+replaceReducer: (nextReducer: Reducer<State>) => void;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.subscribe.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.subscribe.md
new file mode 100644
index 000000000000..15139a7bd9f3
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.subscribe.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [ReduxLikeStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.md) &gt; [subscribe](./kibana-plugin-plugins-kibana_utils-common-state_containers.reduxlikestatecontainer.subscribe.md)
+
+## ReduxLikeStateContainer.subscribe property
+
+<b>Signature:</b>
+
+```typescript
+subscribe: (listener: (state: State) => void) => () => void;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.selector.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.selector.md
new file mode 100644
index 000000000000..5c143551d130
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.selector.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [Selector](./kibana-plugin-plugins-kibana_utils-common-state_containers.selector.md)
+
+## Selector type
+
+
+<b>Signature:</b>
+
+```typescript
+export declare type Selector<Result, Args extends any[] = []> = (...args: Args) => Result;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md
new file mode 100644
index 000000000000..23ec1c8e5be0
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md
@@ -0,0 +1,21 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md)
+
+## StateContainer interface
+
+Fully featured state container with [Selectors](./kibana-plugin-plugins-kibana_utils-common-state_containers.selector.md) and . Extends [BaseStateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.basestatecontainer.md)
+
+<b>Signature:</b>
+
+```typescript
+export interface StateContainer<State extends BaseState, PureTransitions extends object = object, PureSelectors extends object = {}> extends BaseStateContainer<State> 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [selectors](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.selectors.md) | <code>Readonly&lt;PureSelectorsToSelectors&lt;PureSelectors&gt;&gt;</code> |  |
+|  [transitions](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.transitions.md) | <code>Readonly&lt;PureTransitionsToTransitions&lt;PureTransitions&gt;&gt;</code> |  |
+
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.selectors.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.selectors.md
new file mode 100644
index 000000000000..2afac07b59e3
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.selectors.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md) &gt; [selectors](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.selectors.md)
+
+## StateContainer.selectors property
+
+<b>Signature:</b>
+
+```typescript
+selectors: Readonly<PureSelectorsToSelectors<PureSelectors>>;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.transitions.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.transitions.md
new file mode 100644
index 000000000000..4712d3287bee
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.transitions.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md) &gt; [transitions](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.transitions.md)
+
+## StateContainer.transitions property
+
+<b>Signature:</b>
+
+```typescript
+transitions: Readonly<PureTransitionsToTransitions<PureTransitions>>;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.unboxstate.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.unboxstate.md
new file mode 100644
index 000000000000..d4f99841456d
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.unboxstate.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [UnboxState](./kibana-plugin-plugins-kibana_utils-common-state_containers.unboxstate.md)
+
+## UnboxState type
+
+Utility type for inferring state shape from [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md)
+
+<b>Signature:</b>
+
+```typescript
+export declare type UnboxState<Container extends StateContainer<any, any>> = Container extends StateContainer<infer T, any> ? T : never;
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerselector.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerselector.md
new file mode 100644
index 000000000000..fe5f30a9c847
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerselector.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [useContainerSelector](./kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerselector.md)
+
+## useContainerSelector variable
+
+React hook to apply selector to state container to extract only needed information. Will re-render your component only when the section changes.
+
+<b>Signature:</b>
+
+```typescript
+useContainerSelector: <Container extends StateContainer<any, any, {}>, Result>(container: Container, selector: (state: UnboxState<Container>) => Result, comparator?: Comparator<Result>) => Result
+```
diff --git a/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerstate.md b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerstate.md
new file mode 100644
index 000000000000..7cef47c58f9d
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/common/state_containers/kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerstate.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-common-state\_containers](./kibana-plugin-plugins-kibana_utils-common-state_containers.md) &gt; [useContainerState](./kibana-plugin-plugins-kibana_utils-common-state_containers.usecontainerstate.md)
+
+## useContainerState variable
+
+React hooks that returns the latest state of a [StateContainer](./kibana-plugin-plugins-kibana_utils-common-state_containers.statecontainer.md)<!-- -->.
+
+<b>Signature:</b>
+
+```typescript
+useContainerState: <Container extends StateContainer<any, any, {}>>(container: Container) => UnboxState<Container>
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/index.md b/docs/development/plugins/kibana_utils/public/state_sync/index.md
new file mode 100644
index 000000000000..4b345d9130bd
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/index.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md)
+
+## API Reference
+
+## Packages
+
+|  Package | Description |
+|  --- | --- |
+|  [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) | State syncing utilities are a set of helpers for syncing your application state with URL or browser storage.<!-- -->They are designed to work together with state containers (<!-- -->). But state containers are not required.<!-- -->State syncing utilities include:<!-- -->-  util which: - Subscribes to state changes and pushes them to state storage. - Optionally subscribes to state storage changes and pushes them to state. - Two types of storage compatible with <code>syncState</code>: -  - Serializes state and persists it to URL's query param in rison or hashed format. Listens for state updates in the URL and pushes them back to state. -  - Serializes state and persists it to browser storage.<!-- -->Refer [here](https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_sync) for a complete guide and examples |
+
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.createkbnurlstatestorage.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.createkbnurlstatestorage.md
new file mode 100644
index 000000000000..22f70ce22b57
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.createkbnurlstatestorage.md
@@ -0,0 +1,16 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [createKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.createkbnurlstatestorage.md)
+
+## createKbnUrlStateStorage variable
+
+Creates [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) state storage
+
+<b>Signature:</b>
+
+```typescript
+createKbnUrlStateStorage: ({ useHash, history }?: {
+    useHash: boolean;
+    history?: History<any> | undefined;
+}) => IKbnUrlStateStorage
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.createsessionstoragestatestorage.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.createsessionstoragestatestorage.md
new file mode 100644
index 000000000000..dccff93ad172
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.createsessionstoragestatestorage.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [createSessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.createsessionstoragestatestorage.md)
+
+## createSessionStorageStateStorage variable
+
+Creates [ISessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md) [guide](https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_sync/storages/session_storage.md)
+
+<b>Signature:</b>
+
+```typescript
+createSessionStorageStateStorage: (storage?: Storage) => ISessionStorageStateStorage
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.cancel.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.cancel.md
new file mode 100644
index 000000000000..29a511d57d7b
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.cancel.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) &gt; [cancel](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.cancel.md)
+
+## IKbnUrlStateStorage.cancel property
+
+cancels any pending url updates
+
+<b>Signature:</b>
+
+```typescript
+cancel: () => void;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.change_.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.change_.md
new file mode 100644
index 000000000000..2b55f2aca70c
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.change_.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) &gt; [change$](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.change_.md)
+
+## IKbnUrlStateStorage.change$ property
+
+<b>Signature:</b>
+
+```typescript
+change$: <State = unknown>(key: string) => Observable<State | null>;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.flush.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.flush.md
new file mode 100644
index 000000000000..e0e6aa9be436
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.flush.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) &gt; [flush](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.flush.md)
+
+## IKbnUrlStateStorage.flush property
+
+synchronously runs any pending url updates returned boolean indicates if change occurred
+
+<b>Signature:</b>
+
+```typescript
+flush: (opts?: {
+        replace?: boolean;
+    }) => boolean;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.get.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.get.md
new file mode 100644
index 000000000000..0eb60c21fbbb
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.get.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) &gt; [get](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.get.md)
+
+## IKbnUrlStateStorage.get property
+
+<b>Signature:</b>
+
+```typescript
+get: <State = unknown>(key: string) => State | null;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md
new file mode 100644
index 000000000000..56cefebd2acf
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md)
+
+## IKbnUrlStateStorage interface
+
+KbnUrlStateStorage is a state storage for [syncState()](./kibana-plugin-plugins-kibana_utils-public-state_sync.syncstate.md) utility which: 1. Keeps state in sync with the URL. 2. Serializes data and stores it in the URL in one of the supported formats: \* Rison encoded. \* Hashed URL: In URL we store only the hash from the serialized state, but the state itself is stored in sessionStorage. See kibana's advanced option for more context state:storeInSessionStorage 3. Takes care of listening to the URL updates and notifies state about the updates. 4. Takes care of batching URL updates to prevent redundant browser history records. [GUIDE](https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_sync/storages/kbn_url_storage.md)
+
+<b>Signature:</b>
+
+```typescript
+export interface IKbnUrlStateStorage extends IStateStorage 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [cancel](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.cancel.md) | <code>() =&gt; void</code> | cancels any pending url updates |
+|  [change$](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.change_.md) | <code>&lt;State = unknown&gt;(key: string) =&gt; Observable&lt;State &#124; null&gt;</code> |  |
+|  [flush](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.flush.md) | <code>(opts?: {</code><br/><code>        replace?: boolean;</code><br/><code>    }) =&gt; boolean</code> | synchronously runs any pending url updates returned boolean indicates if change occurred |
+|  [get](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.get.md) | <code>&lt;State = unknown&gt;(key: string) =&gt; State &#124; null</code> |  |
+|  [set](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.set.md) | <code>&lt;State&gt;(key: string, state: State, opts?: {</code><br/><code>        replace: boolean;</code><br/><code>    }) =&gt; Promise&lt;string &#124; undefined&gt;</code> |  |
+
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.set.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.set.md
new file mode 100644
index 000000000000..2eab44d34441
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.set.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) &gt; [set](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.set.md)
+
+## IKbnUrlStateStorage.set property
+
+<b>Signature:</b>
+
+```typescript
+set: <State>(key: string, state: State, opts?: {
+        replace: boolean;
+    }) => Promise<string | undefined>;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.md
new file mode 100644
index 000000000000..ca6960993640
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [INullableBaseStateContainer](./kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.md)
+
+## INullableBaseStateContainer interface
+
+Extension of  with one constraint: set state should handle `null` as incoming state
+
+<b>Signature:</b>
+
+```typescript
+export interface INullableBaseStateContainer<State extends BaseState> extends BaseStateContainer<State> 
+```
+
+## Remarks
+
+State container for stateSync() have to accept "null" for example, set() implementation could handle null and fallback to some default state this is required to handle edge case, when state in storage becomes empty and syncing is in progress. state container will be notified about about storage becoming empty with null passed in
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [set](./kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.set.md) | <code>(state: State &#124; null) =&gt; void</code> |  |
+
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.set.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.set.md
new file mode 100644
index 000000000000..dd2978f59484
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.set.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [INullableBaseStateContainer](./kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.md) &gt; [set](./kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.set.md)
+
+## INullableBaseStateContainer.set property
+
+<b>Signature:</b>
+
+```typescript
+set: (state: State | null) => void;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.get.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.get.md
new file mode 100644
index 000000000000..83131c77132c
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.get.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [ISessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md) &gt; [get](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.get.md)
+
+## ISessionStorageStateStorage.get property
+
+<b>Signature:</b>
+
+```typescript
+get: <State = unknown>(key: string) => State | null;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md
new file mode 100644
index 000000000000..7792bc3932f9
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md
@@ -0,0 +1,21 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [ISessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md)
+
+## ISessionStorageStateStorage interface
+
+[IStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md) for storing state in browser  [guide](https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_sync/storages/session_storage.md)
+
+<b>Signature:</b>
+
+```typescript
+export interface ISessionStorageStateStorage extends IStateStorage 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [get](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.get.md) | <code>&lt;State = unknown&gt;(key: string) =&gt; State &#124; null</code> |  |
+|  [set](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.set.md) | <code>&lt;State&gt;(key: string, state: State) =&gt; void</code> |  |
+
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.set.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.set.md
new file mode 100644
index 000000000000..04b0ab01f0d1
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.set.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [ISessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md) &gt; [set](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.set.md)
+
+## ISessionStorageStateStorage.set property
+
+<b>Signature:</b>
+
+```typescript
+set: <State>(key: string, state: State) => void;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.cancel.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.cancel.md
new file mode 100644
index 000000000000..ce771d52a6e6
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.cancel.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md) &gt; [cancel](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.cancel.md)
+
+## IStateStorage.cancel property
+
+Optional method to cancel any pending activity syncState() will call it, if it is provided by IStateStorage
+
+<b>Signature:</b>
+
+```typescript
+cancel?: () => void;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.change_.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.change_.md
new file mode 100644
index 000000000000..ed6672a3d83c
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.change_.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md) &gt; [change$](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.change_.md)
+
+## IStateStorage.change$ property
+
+Should notify when the stored state has changed
+
+<b>Signature:</b>
+
+```typescript
+change$?: <State = unknown>(key: string) => Observable<State | null>;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.get.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.get.md
new file mode 100644
index 000000000000..2c0b2ee970cc
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.get.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md) &gt; [get](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.get.md)
+
+## IStateStorage.get property
+
+Should retrieve state from the storage and deserialize it
+
+<b>Signature:</b>
+
+```typescript
+get: <State = unknown>(key: string) => State | null;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md
new file mode 100644
index 000000000000..2c34a185fb7b
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md
@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md)
+
+## IStateStorage interface
+
+Any StateStorage have to implement IStateStorage interface StateStorage is responsible for: \* state serialisation / deserialization \* persisting to and retrieving from storage
+
+For an example take a look at already implemented [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) and [ISessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md) state storages
+
+<b>Signature:</b>
+
+```typescript
+export interface IStateStorage 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [cancel](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.cancel.md) | <code>() =&gt; void</code> | Optional method to cancel any pending activity syncState() will call it, if it is provided by IStateStorage |
+|  [change$](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.change_.md) | <code>&lt;State = unknown&gt;(key: string) =&gt; Observable&lt;State &#124; null&gt;</code> | Should notify when the stored state has changed |
+|  [get](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.get.md) | <code>&lt;State = unknown&gt;(key: string) =&gt; State &#124; null</code> | Should retrieve state from the storage and deserialize it |
+|  [set](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.set.md) | <code>&lt;State&gt;(key: string, state: State) =&gt; any</code> | Take in a state object, should serialise and persist |
+
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.set.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.set.md
new file mode 100644
index 000000000000..3f286994ed4a
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.set.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md) &gt; [set](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.set.md)
+
+## IStateStorage.set property
+
+Take in a state object, should serialise and persist
+
+<b>Signature:</b>
+
+```typescript
+set: <State>(key: string, state: State) => any;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.md
new file mode 100644
index 000000000000..f9368de4240a
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IStateSyncConfig](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.md)
+
+## IStateSyncConfig interface
+
+Config for setting up state syncing with 
+
+<b>Signature:</b>
+
+```typescript
+export interface IStateSyncConfig<State extends BaseState, StateStorage extends IStateStorage = IStateStorage> 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [stateContainer](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statecontainer.md) | <code>INullableBaseStateContainer&lt;State&gt;</code> | State container to keep in sync with storage, have to implement [INullableBaseStateContainer](./kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.md) interface We encourage to use  as a state container, but it is also possible to implement own custom container for advanced use cases |
+|  [stateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statestorage.md) | <code>StateStorage</code> | State storage to use, State storage is responsible for serialising / deserialising and persisting / retrieving stored state<!-- -->There are common strategies already implemented: see [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) which replicate what State (AppState, GlobalState) in legacy world did |
+|  [storageKey](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.storagekey.md) | <code>string</code> | Storage key to use for syncing, e.g. storageKey '\_a' should sync state to ?\_a query param |
+
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statecontainer.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statecontainer.md
new file mode 100644
index 000000000000..0098dd5c99ae
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statecontainer.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IStateSyncConfig](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.md) &gt; [stateContainer](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statecontainer.md)
+
+## IStateSyncConfig.stateContainer property
+
+State container to keep in sync with storage, have to implement [INullableBaseStateContainer](./kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.md) interface We encourage to use  as a state container, but it is also possible to implement own custom container for advanced use cases
+
+<b>Signature:</b>
+
+```typescript
+stateContainer: INullableBaseStateContainer<State>;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statestorage.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statestorage.md
new file mode 100644
index 000000000000..ef872ba0ba9b
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statestorage.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IStateSyncConfig](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.md) &gt; [stateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.statestorage.md)
+
+## IStateSyncConfig.stateStorage property
+
+State storage to use, State storage is responsible for serialising / deserialising and persisting / retrieving stored state
+
+There are common strategies already implemented: see [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) which replicate what State (AppState, GlobalState) in legacy world did
+
+<b>Signature:</b>
+
+```typescript
+stateStorage: StateStorage;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.storagekey.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.storagekey.md
new file mode 100644
index 000000000000..d3887c23df1e
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.storagekey.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [IStateSyncConfig](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.md) &gt; [storageKey](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.storagekey.md)
+
+## IStateSyncConfig.storageKey property
+
+Storage key to use for syncing, e.g. storageKey '\_a' should sync state to ?\_a query param
+
+<b>Signature:</b>
+
+```typescript
+storageKey: string;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.md
new file mode 100644
index 000000000000..137db68cd6b4
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.md
@@ -0,0 +1,20 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [ISyncStateRef](./kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.md)
+
+## ISyncStateRef interface
+
+
+<b>Signature:</b>
+
+```typescript
+export interface ISyncStateRef<stateStorage extends IStateStorage = IStateStorage> 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [start](./kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.start.md) | <code>StartSyncStateFnType</code> | start state syncing |
+|  [stop](./kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.stop.md) | <code>StopSyncStateFnType</code> | stop state syncing |
+
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.start.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.start.md
new file mode 100644
index 000000000000..d8df808ba215
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.start.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [ISyncStateRef](./kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.md) &gt; [start](./kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.start.md)
+
+## ISyncStateRef.start property
+
+start state syncing
+
+<b>Signature:</b>
+
+```typescript
+start: StartSyncStateFnType;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.stop.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.stop.md
new file mode 100644
index 000000000000..70356dd9d6c7
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.stop.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [ISyncStateRef](./kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.md) &gt; [stop](./kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.stop.md)
+
+## ISyncStateRef.stop property
+
+stop state syncing
+
+<b>Signature:</b>
+
+```typescript
+stop: StopSyncStateFnType;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.md
new file mode 100644
index 000000000000..2b02c98e0d60
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.md
@@ -0,0 +1,48 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md)
+
+## kibana-plugin-plugins-kibana\_utils-public-state\_sync package
+
+State syncing utilities are a set of helpers for syncing your application state with URL or browser storage.
+
+They are designed to work together with state containers (<!-- -->). But state containers are not required.
+
+State syncing utilities include:
+
+- [syncState()](./kibana-plugin-plugins-kibana_utils-public-state_sync.syncstate.md) util which: - Subscribes to state changes and pushes them to state storage. - Optionally subscribes to state storage changes and pushes them to state. - Two types of storage compatible with `syncState`<!-- -->: - [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) - Serializes state and persists it to URL's query param in rison or hashed format. Listens for state updates in the URL and pushes them back to state. - [ISessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md) - Serializes state and persists it to browser storage.
+
+Refer [here](https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_sync) for a complete guide and examples
+
+## Functions
+
+|  Function | Description |
+|  --- | --- |
+|  [syncState({ storageKey, stateStorage, stateContainer, })](./kibana-plugin-plugins-kibana_utils-public-state_sync.syncstate.md) | Utility for syncing application state wrapped in state container with some kind of storage (e.g. URL) Refer [here](https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_sync) for a complete guide and examples |
+|  [syncStates(stateSyncConfigs)](./kibana-plugin-plugins-kibana_utils-public-state_sync.syncstates.md) |  |
+
+## Interfaces
+
+|  Interface | Description |
+|  --- | --- |
+|  [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) | KbnUrlStateStorage is a state storage for [syncState()](./kibana-plugin-plugins-kibana_utils-public-state_sync.syncstate.md) utility which: 1. Keeps state in sync with the URL. 2. Serializes data and stores it in the URL in one of the supported formats: \* Rison encoded. \* Hashed URL: In URL we store only the hash from the serialized state, but the state itself is stored in sessionStorage. See kibana's advanced option for more context state:storeInSessionStorage 3. Takes care of listening to the URL updates and notifies state about the updates. 4. Takes care of batching URL updates to prevent redundant browser history records. [GUIDE](https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_sync/storages/kbn_url_storage.md) |
+|  [INullableBaseStateContainer](./kibana-plugin-plugins-kibana_utils-public-state_sync.inullablebasestatecontainer.md) | Extension of  with one constraint: set state should handle <code>null</code> as incoming state |
+|  [ISessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md) | [IStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md) for storing state in browser  [guide](https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_sync/storages/session_storage.md) |
+|  [IStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatestorage.md) | Any StateStorage have to implement IStateStorage interface StateStorage is responsible for: \* state serialisation / deserialization \* persisting to and retrieving from storage<!-- -->For an example take a look at already implemented [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) and [ISessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md) state storages |
+|  [IStateSyncConfig](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.md) | Config for setting up state syncing with  |
+|  [ISyncStateRef](./kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.md) |  |
+
+## Variables
+
+|  Variable | Description |
+|  --- | --- |
+|  [createKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.createkbnurlstatestorage.md) | Creates [IKbnUrlStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.ikbnurlstatestorage.md) state storage |
+|  [createSessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.createsessionstoragestatestorage.md) | Creates [ISessionStorageStateStorage](./kibana-plugin-plugins-kibana_utils-public-state_sync.isessionstoragestatestorage.md) [guide](https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_sync/storages/session_storage.md) |
+
+## Type Aliases
+
+|  Type Alias | Description |
+|  --- | --- |
+|  [StartSyncStateFnType](./kibana-plugin-plugins-kibana_utils-public-state_sync.startsyncstatefntype.md) |  |
+|  [StopSyncStateFnType](./kibana-plugin-plugins-kibana_utils-public-state_sync.stopsyncstatefntype.md) |  |
+
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.startsyncstatefntype.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.startsyncstatefntype.md
new file mode 100644
index 000000000000..23f71ba330d4
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.startsyncstatefntype.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [StartSyncStateFnType](./kibana-plugin-plugins-kibana_utils-public-state_sync.startsyncstatefntype.md)
+
+## StartSyncStateFnType type
+
+
+<b>Signature:</b>
+
+```typescript
+export declare type StartSyncStateFnType = () => void;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.stopsyncstatefntype.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.stopsyncstatefntype.md
new file mode 100644
index 000000000000..69ff6e899e86
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.stopsyncstatefntype.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [StopSyncStateFnType](./kibana-plugin-plugins-kibana_utils-public-state_sync.stopsyncstatefntype.md)
+
+## StopSyncStateFnType type
+
+
+<b>Signature:</b>
+
+```typescript
+export declare type StopSyncStateFnType = () => void;
+```
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.syncstate.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.syncstate.md
new file mode 100644
index 000000000000..d095c3fffc51
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.syncstate.md
@@ -0,0 +1,93 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [syncState](./kibana-plugin-plugins-kibana_utils-public-state_sync.syncstate.md)
+
+## syncState() function
+
+Utility for syncing application state wrapped in state container with some kind of storage (e.g. URL) Refer [here](https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_sync) for a complete guide and examples
+
+<b>Signature:</b>
+
+```typescript
+export declare function syncState<State extends BaseState, StateStorage extends IStateStorage = IStateStorage>({ storageKey, stateStorage, stateContainer, }: IStateSyncConfig<State, IStateStorage>): ISyncStateRef;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  { storageKey, stateStorage, stateContainer, } | <code>IStateSyncConfig&lt;State, IStateStorage&gt;</code> |  |
+
+<b>Returns:</b>
+
+`ISyncStateRef`
+
+- [ISyncStateRef](./kibana-plugin-plugins-kibana_utils-public-state_sync.isyncstateref.md)
+
+## Remarks
+
+1. It is responsibility of consumer to make sure that initial app state and storage are in sync before starting syncing No initial sync happens when syncState() is called
+
+## Example 1
+
+1. the simplest use case
+
+```ts
+const stateStorage = createKbnUrlStateStorage();
+syncState({
+  storageKey: '_s',
+  stateContainer,
+  stateStorage
+});
+
+```
+
+## Example 2
+
+2. conditionally configuring sync strategy
+
+```ts
+const stateStorage = createKbnUrlStateStorage({useHash: config.get('state:stateContainerInSessionStorage')})
+syncState({
+  storageKey: '_s',
+  stateContainer,
+  stateStorage
+});
+
+```
+
+## Example 3
+
+3. implementing custom sync strategy
+
+```ts
+const localStorageStateStorage = {
+  set: (storageKey, state) => localStorage.setItem(storageKey, JSON.stringify(state)),
+  get: (storageKey) => localStorage.getItem(storageKey) ? JSON.parse(localStorage.getItem(storageKey)) : null
+};
+syncState({
+  storageKey: '_s',
+  stateContainer,
+  stateStorage: localStorageStateStorage
+});
+
+```
+
+## Example 4
+
+4. Transform state before serialising Useful for: \* Migration / backward compatibility \* Syncing part of state \* Providing default values
+
+```ts
+const stateToStorage = (s) => ({ tab: s.tab });
+syncState({
+  storageKey: '_s',
+  stateContainer: {
+    get: () => stateToStorage(stateContainer.get()),
+    set: stateContainer.set(({ tab }) => ({ ...stateContainer.get(), tab }),
+    state$: stateContainer.state$.pipe(map(stateToStorage))
+  },
+  stateStorage
+});
+
+```
+
diff --git a/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.syncstates.md b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.syncstates.md
new file mode 100644
index 000000000000..87a2449a384d
--- /dev/null
+++ b/docs/development/plugins/kibana_utils/public/state_sync/kibana-plugin-plugins-kibana_utils-public-state_sync.syncstates.md
@@ -0,0 +1,42 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-kibana\_utils-public-state\_sync](./kibana-plugin-plugins-kibana_utils-public-state_sync.md) &gt; [syncStates](./kibana-plugin-plugins-kibana_utils-public-state_sync.syncstates.md)
+
+## syncStates() function
+
+<b>Signature:</b>
+
+```typescript
+export declare function syncStates(stateSyncConfigs: Array<IStateSyncConfig<any>>): ISyncStateRef;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  stateSyncConfigs | <code>Array&lt;IStateSyncConfig&lt;any&gt;&gt;</code> | Array of [IStateSyncConfig](./kibana-plugin-plugins-kibana_utils-public-state_sync.istatesyncconfig.md) to sync |
+
+<b>Returns:</b>
+
+`ISyncStateRef`
+
+## Example
+
+sync multiple different sync configs
+
+```ts
+syncStates([
+  {
+    storageKey: '_s1',
+    stateStorage: stateStorage1,
+    stateContainer: stateContainer1,
+  },
+  {
+    storageKey: '_s2',
+    stateStorage: stateStorage2,
+    stateContainer: stateContainer2,
+  },
+]);
+
+```
+
diff --git a/src/dev/run_check_published_api_changes.ts b/src/dev/run_check_published_api_changes.ts
index 45dafe1b415e..0aa450c8b002 100644
--- a/src/dev/run_check_published_api_changes.ts
+++ b/src/dev/run_check_published_api_changes.ts
@@ -43,7 +43,18 @@ import getopts from 'getopts';
  */
 
 const getReportFileName = (folder: string) => {
-  return folder.indexOf('public') > -1 ? 'public' : 'server';
+  switch (true) {
+    case folder.includes('public'):
+      return 'public';
+    case folder.includes('server'):
+      return 'server';
+    case folder.includes('common'):
+      return 'common';
+    default:
+      throw new Error(
+        `folder "${folder}" expected to include one of ["public", "server", "common"]`
+      );
+  }
 };
 
 const apiExtractorConfig = (folder: string): ExtractorConfig => {
@@ -131,7 +142,7 @@ const runApiExtractor = (
     messageCallback: (message: ExtractorMessage) => {
       if (message.messageId === 'console-api-report-not-copied') {
         // ConsoleMessageId.ApiReportNotCopied
-        log.warning(`You have changed the signature of the ${folder} Core API`);
+        log.warning(`You have changed the signature of the ${folder} public API`);
         log.warning(
           'To accept these changes run `node scripts/check_published_api_changes.js --accept` and then:\n' +
             "\t 1. Commit the updated documentation and API review file '" +
@@ -142,7 +153,7 @@ const runApiExtractor = (
         message.handled = true;
       } else if (message.messageId === 'console-api-report-copied') {
         // ConsoleMessageId.ApiReportCopied
-        log.warning(`You have changed the signature of the ${folder} Core API`);
+        log.warning(`You have changed the signature of the ${folder} public API`);
         log.warning(
           "Please commit the updated API documentation and the API review file: '" +
             config.reportFilePath
@@ -150,7 +161,7 @@ const runApiExtractor = (
         message.handled = true;
       } else if (message.messageId === 'console-api-report-unchanged') {
         // ConsoleMessageId.ApiReportUnchanged
-        log.info(`Core ${folder} API: no changes detected ✔`);
+        log.info(`${folder} API: no changes detected ✔`);
         message.handled = true;
       }
     },
@@ -170,7 +181,7 @@ async function run(
   folder: string,
   { log, opts }: { log: ToolingLog; opts: Options }
 ): Promise<boolean> {
-  log.info(`Core ${folder} API: checking for changes in API signature...`);
+  log.info(`${folder} API: checking for changes in API signature...`);
 
   const { apiReportChanged, succeeded } = runApiExtractor(log, folder, opts.accept);
 
@@ -188,7 +199,7 @@ async function run(
       log.error(e);
       return false;
     }
-    log.info(`Core ${folder} API: updated documentation ✔`);
+    log.info(`${folder} API: updated documentation ✔`);
   }
 
   // If the api signature changed or any errors or warnings occured, exit with an error
@@ -224,24 +235,31 @@ async function run(
     opts.help = true;
   }
 
-  const folders = ['core/public', 'core/server', 'plugins/data/server', 'plugins/data/public'];
+  const core = ['core/public', 'core/server'];
+  const plugins = [
+    'plugins/data/server',
+    'plugins/data/public',
+    'plugins/kibana_utils/common/state_containers',
+    'plugins/kibana_utils/public/state_sync',
+  ];
+  const folders = [...core, ...plugins];
 
   if (opts.help) {
     process.stdout.write(
       dedent(chalk`
         {dim usage:} node scripts/check_published_api_changes [...options]
 
-        Checks for any changes to the Kibana Core API
+        Checks for any changes to the Kibana shared API
 
         Examples:
 
-          {dim # Checks for any changes to the Kibana Core API}
+          {dim # Checks for any changes to the Kibana shared API}
           {dim $} node scripts/check_published_api_changes
 
-          {dim # Checks for any changes to the Kibana Core API and updates the documentation}
+          {dim # Checks for any changes to the Kibana shared API and updates the documentation}
           {dim $} node scripts/check_published_api_changes --docs
 
-          {dim # Checks for and automatically accepts and updates documentation for any changes to the Kibana Core API}
+          {dim # Checks for and automatically accepts and updates documentation for any changes to the Kibana shared API}
           {dim $} node scripts/check_published_api_changes --accept
 
           {dim # Only checks the core/public directory}
@@ -249,7 +267,7 @@ async function run(
 
         Options:
           --accept    {dim Accepts all changes by updating the API Review files and documentation}
-          --docs      {dim Updates the Core API documentation}
+          --docs      {dim Updates the API documentation}
           --filter    {dim RegExp that folder names must match, folders: [${folders.join(', ')}]}
           --help      {dim Show this message}
       `)
@@ -259,20 +277,22 @@ async function run(
   }
 
   try {
-    log.info(`Core: Building types...`);
+    log.info(`Building types for api extractor...`);
     await runBuildTypes();
   } catch (e) {
     log.error(e);
     return false;
   }
 
-  const results = await Promise.all(
-    folders
-      .filter((folder) => (opts.filter.length ? folder.match(opts.filter) : true))
-      .map((folder) => run(folder, { log, opts }))
+  const filteredFolders = folders.filter((folder) =>
+    opts.filter.length ? folder.match(opts.filter) : true
   );
+  const results = [];
+  for (const folder of filteredFolders) {
+    results.push(await run(folder, { log, opts }));
+  }
 
-  if (results.find((r) => r === false) !== undefined) {
+  if (results.includes(false)) {
     process.exitCode = 1;
   }
 })().catch((e) => {
diff --git a/src/plugins/kibana_utils/common/state_containers/common.api.md b/src/plugins/kibana_utils/common/state_containers/common.api.md
new file mode 100644
index 000000000000..f85458499b71
--- /dev/null
+++ b/src/plugins/kibana_utils/common/state_containers/common.api.md
@@ -0,0 +1,156 @@
+## API Report File for "kibana"
+
+> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
+
+```ts
+
+import { ComponentType } from 'react';
+import { Ensure } from '@kbn/utility-types';
+import { FC } from 'react';
+import { Observable } from 'rxjs';
+import React from 'react';
+
+// @public
+export type BaseState = object;
+
+// @public
+export interface BaseStateContainer<State extends BaseState> {
+    get: () => State;
+    set: (state: State) => void;
+    // Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "Observable"
+    state$: Observable<State>;
+}
+
+// @public
+export type Comparator<Result> = (previous: Result, current: Result) => boolean;
+
+// @public
+export type Connect<State extends BaseState> = <Props extends object, StatePropKeys extends keyof Props>(mapStateToProp: MapStateToProps<State, Pick<Props, StatePropKeys>>) => (component: ComponentType<Props>) => FC<Omit<Props, StatePropKeys>>;
+
+// @public
+export function createStateContainer<State extends BaseState>(defaultState: State): ReduxLikeStateContainer<State>;
+
+// @public
+export function createStateContainer<State extends BaseState, PureTransitions extends object>(defaultState: State, pureTransitions: PureTransitions): ReduxLikeStateContainer<State, PureTransitions>;
+
+// Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "PureSelectors"
+//
+// @public
+export function createStateContainer<State extends BaseState, PureTransitions extends object, PureSelectors extends object>(defaultState: State, pureTransitions: PureTransitions, pureSelectors: PureSelectors, options?: CreateStateContainerOptions): ReduxLikeStateContainer<State, PureTransitions, PureSelectors>;
+
+// @public
+export interface CreateStateContainerOptions {
+    freeze?: <T>(state: T) => T;
+}
+
+// @public
+export const createStateContainerReactHelpers: <Container extends StateContainer<any, any, {}>>() => {
+    Provider: React.Provider<Container>;
+    Consumer: React.Consumer<Container>;
+    context: React.Context<Container>;
+    useContainer: () => Container;
+    useState: () => UnboxState<Container>;
+    useTransitions: () => Container["transitions"];
+    useSelector: <Result>(selector: (state: UnboxState<Container>) => Result, comparator?: Comparator<Result>) => Result;
+    connect: Connect<UnboxState<Container>>;
+};
+
+// @public
+export type Dispatch<T> = (action: T) => void;
+
+// @public (undocumented)
+export type EnsurePureSelector<T> = Ensure<T, PureSelector<any, any, any>>;
+
+// Warning: (ae-incompatible-release-tags) The symbol "EnsurePureTransition" is marked as @public, but its signature references "PureTransition" which is marked as @internal
+//
+// @public (undocumented)
+export type EnsurePureTransition<T> = Ensure<T, PureTransition<any, any>>;
+
+// @public
+export type MapStateToProps<State extends BaseState, StateProps extends object> = (state: State) => StateProps;
+
+// Warning: (ae-incompatible-release-tags) The symbol "Middleware" is marked as @public, but its signature references "TransitionDescription" which is marked as @internal
+//
+// @public
+export type Middleware<State extends BaseState = BaseState> = (store: Pick<ReduxLikeStateContainer<State, any>, 'getState' | 'dispatch'>) => (next: (action: TransitionDescription) => TransitionDescription | any) => Dispatch<TransitionDescription>;
+
+// @public (undocumented)
+export type PureSelector<State extends BaseState, Result, Args extends any[] = []> = (state: State) => Selector<Result, Args>;
+
+// @public (undocumented)
+export type PureSelectorsToSelectors<T extends object> = {
+    [K in keyof T]: PureSelectorToSelector<EnsurePureSelector<T[K]>>;
+};
+
+// @public (undocumented)
+export type PureSelectorToSelector<T extends PureSelector<any, any, any>> = ReturnType<EnsurePureSelector<T>>;
+
+// @internal (undocumented)
+export type PureTransition<State extends BaseState, Args extends any[]> = (state: State) => Transition<State, Args>;
+
+// @internal (undocumented)
+export type PureTransitionsToTransitions<T extends object> = {
+    [K in keyof T]: PureTransitionToTransition<EnsurePureTransition<T[K]>>;
+};
+
+// @internal (undocumented)
+export type PureTransitionToTransition<T extends PureTransition<any, any>> = ReturnType<T>;
+
+// Warning: (ae-incompatible-release-tags) The symbol "Reducer" is marked as @public, but its signature references "TransitionDescription" which is marked as @internal
+//
+// @public
+export type Reducer<State extends BaseState> = (state: State, action: TransitionDescription) => State;
+
+// @public
+export interface ReduxLikeStateContainer<State extends BaseState, PureTransitions extends object = {}, PureSelectors extends object = {}> extends StateContainer<State, PureTransitions, PureSelectors> {
+    // (undocumented)
+    addMiddleware: (middleware: Middleware<State>) => void;
+    // Warning: (ae-incompatible-release-tags) The symbol "dispatch" is marked as @public, but its signature references "TransitionDescription" which is marked as @internal
+    //
+    // (undocumented)
+    dispatch: (action: TransitionDescription) => void;
+    // (undocumented)
+    getState: () => State;
+    // (undocumented)
+    reducer: Reducer<State>;
+    // (undocumented)
+    replaceReducer: (nextReducer: Reducer<State>) => void;
+    // (undocumented)
+    subscribe: (listener: (state: State) => void) => () => void;
+}
+
+// @public (undocumented)
+export type Selector<Result, Args extends any[] = []> = (...args: Args) => Result;
+
+// @public
+export interface StateContainer<State extends BaseState, PureTransitions extends object = object, PureSelectors extends object = {}> extends BaseStateContainer<State> {
+    // (undocumented)
+    selectors: Readonly<PureSelectorsToSelectors<PureSelectors>>;
+    // Warning: (ae-incompatible-release-tags) The symbol "transitions" is marked as @public, but its signature references "PureTransitionsToTransitions" which is marked as @internal
+    //
+    // (undocumented)
+    transitions: Readonly<PureTransitionsToTransitions<PureTransitions>>;
+}
+
+// @internal (undocumented)
+export type Transition<State extends BaseState, Args extends any[]> = (...args: Args) => State;
+
+// @internal (undocumented)
+export interface TransitionDescription<Type extends string = string, Args extends any[] = any[]> {
+    // (undocumented)
+    args: Args;
+    // (undocumented)
+    type: Type;
+}
+
+// @public
+export type UnboxState<Container extends StateContainer<any, any>> = Container extends StateContainer<infer T, any> ? T : never;
+
+// @public
+export const useContainerSelector: <Container extends StateContainer<any, any, {}>, Result>(container: Container, selector: (state: UnboxState<Container>) => Result, comparator?: Comparator<Result>) => Result;
+
+// @public
+export const useContainerState: <Container extends StateContainer<any, any, {}>>(container: Container) => UnboxState<Container>;
+
+
+```
diff --git a/src/plugins/kibana_utils/common/state_containers/create_state_container.ts b/src/plugins/kibana_utils/common/state_containers/create_state_container.ts
index 69e204a642f9..6bb6e66616c9 100644
--- a/src/plugins/kibana_utils/common/state_containers/create_state_container.ts
+++ b/src/plugins/kibana_utils/common/state_containers/create_state_container.ts
@@ -44,29 +44,57 @@ const defaultFreeze: <T>(value: T) => T = isProduction
       return value as T;
     };
 
+/**
+ * State container options
+ * @public
+ */
 export interface CreateStateContainerOptions {
   /**
-   * Function to use when freezing state. Supply identity function
+   * Function to use when freezing state. Supply identity function.
+   * If not provided, default `deepFreeze` is used.
    *
+   * @example
+   * If you expect that your state will be mutated externally an you cannot
+   * prevent that
    * ```ts
    * {
    *   freeze: state => state,
    * }
    * ```
-   *
-   * if you expect that your state will be mutated externally an you cannot
-   * prevent that.
    */
   freeze?: <T>(state: T) => T;
 }
 
+/**
+ * Creates a state container without transitions and without selectors.
+ * @param defaultState - initial state
+ * @typeParam State - shape of state
+ * @public
+ */
 export function createStateContainer<State extends BaseState>(
   defaultState: State
 ): ReduxLikeStateContainer<State>;
+/**
+ * Creates a state container with transitions, but without selectors.
+ * @param defaultState - initial state
+ * @param pureTransitions - state transitions configuration object. Map of {@link PureTransition}.
+ * @typeParam State - shape of state
+ * @public
+ */
 export function createStateContainer<State extends BaseState, PureTransitions extends object>(
   defaultState: State,
   pureTransitions: PureTransitions
 ): ReduxLikeStateContainer<State, PureTransitions>;
+
+/**
+ * Creates a state container with transitions and selectors.
+ * @param defaultState - initial state
+ * @param pureTransitions - state transitions configuration object. Map of {@link PureTransition}.
+ * @param pureSelectors - state selectors configuration object. Map of {@link PureSelectors}.
+ * @param options - state container options {@link CreateStateContainerOptions}
+ * @typeParam State - shape of state
+ * @public
+ */
 export function createStateContainer<
   State extends BaseState,
   PureTransitions extends object,
@@ -77,14 +105,17 @@ export function createStateContainer<
   pureSelectors: PureSelectors,
   options?: CreateStateContainerOptions
 ): ReduxLikeStateContainer<State, PureTransitions, PureSelectors>;
+/**
+ * @internal
+ */
 export function createStateContainer<
   State extends BaseState,
   PureTransitions extends object,
   PureSelectors extends object
 >(
   defaultState: State,
-  pureTransitions: PureTransitions = {} as PureTransitions,
-  pureSelectors: PureSelectors = {} as PureSelectors,
+  pureTransitions: PureTransitions = {} as PureTransitions, // TODO: https://github.com/elastic/kibana/issues/54439
+  pureSelectors: PureSelectors = {} as PureSelectors, // TODO: https://github.com/elastic/kibana/issues/54439
   options: CreateStateContainerOptions = {}
 ): ReduxLikeStateContainer<State, PureTransitions, PureSelectors> {
   const { freeze = defaultFreeze } = options;
diff --git a/src/plugins/kibana_utils/common/state_containers/create_state_container_react_helpers.ts b/src/plugins/kibana_utils/common/state_containers/create_state_container_react_helpers.ts
index 8536f97e00ed..4712c2fc233f 100644
--- a/src/plugins/kibana_utils/common/state_containers/create_state_container_react_helpers.ts
+++ b/src/plugins/kibana_utils/common/state_containers/create_state_container_react_helpers.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import * as React from 'react';
+import React from 'react';
 import useObservable from 'react-use/lib/useObservable';
 import defaultComparator from 'fast-deep-equal';
 import { Comparator, Connect, StateContainer, UnboxState } from './types';
@@ -25,23 +25,27 @@ import { Comparator, Connect, StateContainer, UnboxState } from './types';
 const { useContext, useLayoutEffect, useRef, createElement: h } = React;
 
 /**
- * Returns the latest state of a state container.
+ * React hooks that returns the latest state of a {@link StateContainer}.
  *
- * @param container State container which state to track.
+ * @param container - {@link StateContainer} which state to track.
+ * @returns - latest {@link StateContainer} state
+ * @public
  */
 export const useContainerState = <Container extends StateContainer<any, any>>(
   container: Container
 ): UnboxState<Container> => useObservable(container.state$, container.get());
 
 /**
- * Apply selector to state container to extract only needed information. Will
+ * React hook to apply selector to state container to extract only needed information. Will
  * re-render your component only when the section changes.
  *
- * @param container State container which state to track.
- * @param selector Function used to pick parts of state.
- * @param comparator Comparator function used to memoize previous result, to not
+ * @param container - {@link StateContainer} which state to track.
+ * @param selector - Function used to pick parts of state.
+ * @param comparator - {@link Comparator} function used to memoize previous result, to not
  *    re-render React component if state did not change. By default uses
  *    `fast-deep-equal` package.
+ * @returns - result of a selector(state)
+ * @public
  */
 export const useContainerSelector = <Container extends StateContainer<any, any>, Result>(
   container: Container,
@@ -68,6 +72,11 @@ export const useContainerSelector = <Container extends StateContainer<any, any>,
   return value;
 };
 
+/**
+ * Creates helpers for using {@link StateContainer | State Containers} with react
+ * Refer to {@link https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_containers/react.md | guide} for details
+ * @public
+ */
 export const createStateContainerReactHelpers = <Container extends StateContainer<any, any>>() => {
   const context = React.createContext<Container>(null as any);
 
diff --git a/src/plugins/kibana_utils/common/state_containers/index.ts b/src/plugins/kibana_utils/common/state_containers/index.ts
index 43e204ecb79f..e2e056bd67da 100644
--- a/src/plugins/kibana_utils/common/state_containers/index.ts
+++ b/src/plugins/kibana_utils/common/state_containers/index.ts
@@ -17,6 +17,40 @@
  * under the License.
  */
 
-export * from './types';
-export * from './create_state_container';
-export * from './create_state_container_react_helpers';
+/**
+ * State containers are Redux-store-like objects meant to help you manage state in your services or apps.
+ * Refer to {@link https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_containers | guides and examples} for more info
+ *
+ * @packageDocumentation
+ */
+
+export {
+  BaseState,
+  BaseStateContainer,
+  TransitionDescription,
+  StateContainer,
+  ReduxLikeStateContainer,
+  Dispatch,
+  Middleware,
+  Selector,
+  Comparator,
+  MapStateToProps,
+  Connect,
+  Reducer,
+  UnboxState,
+  PureSelectorToSelector,
+  PureSelectorsToSelectors,
+  EnsurePureSelector,
+  PureTransitionsToTransitions,
+  PureTransitionToTransition,
+  EnsurePureTransition,
+  PureSelector,
+  PureTransition,
+  Transition,
+} from './types';
+export { createStateContainer, CreateStateContainerOptions } from './create_state_container';
+export {
+  createStateContainerReactHelpers,
+  useContainerSelector,
+  useContainerState,
+} from './create_state_container_react_helpers';
diff --git a/src/plugins/kibana_utils/common/state_containers/types.ts b/src/plugins/kibana_utils/common/state_containers/types.ts
index 29ffa4cd486b..b6adb89d9be7 100644
--- a/src/plugins/kibana_utils/common/state_containers/types.ts
+++ b/src/plugins/kibana_utils/common/state_containers/types.ts
@@ -19,28 +19,76 @@
 
 import { Observable } from 'rxjs';
 import { Ensure } from '@kbn/utility-types';
+import { FC, ComponentType } from 'react';
 
+/**
+ * Base {@link StateContainer} state shape
+ * @public
+ */
 export type BaseState = object;
+
+/**
+ * @internal
+ */
 export interface TransitionDescription<Type extends string = string, Args extends any[] = any[]> {
   type: Type;
   args: Args;
 }
+/**
+ * @internal
+ */
 export type Transition<State extends BaseState, Args extends any[]> = (...args: Args) => State;
+/**
+ * @internal
+ */
 export type PureTransition<State extends BaseState, Args extends any[]> = (
   state: State
 ) => Transition<State, Args>;
+/**
+ * @public
+ */
 export type EnsurePureTransition<T> = Ensure<T, PureTransition<any, any>>;
+/**
+ * @internal
+ */
 export type PureTransitionToTransition<T extends PureTransition<any, any>> = ReturnType<T>;
+/**
+ * @internal
+ */
 export type PureTransitionsToTransitions<T extends object> = {
   [K in keyof T]: PureTransitionToTransition<EnsurePureTransition<T[K]>>;
 };
 
+/**
+ * Base state container shape without transitions or selectors
+ * @typeParam State - Shape of state in the container. Have to match {@link BaseState} constraint
+ * @public
+ */
 export interface BaseStateContainer<State extends BaseState> {
+  /**
+   * Retrieves current state from the container
+   * @returns current state
+   * @public
+   */
   get: () => State;
+  /**
+   * Sets state into container
+   * @param state - new state to set
+   */
   set: (state: State) => void;
+  /**
+   * {@link Observable} of state
+   */
   state$: Observable<State>;
 }
 
+/**
+ * Fully featured state container with {@link Selector | Selectors} and {@link Transition | Transitions}. Extends {@link BaseStateContainer}.
+ * @typeParam State - Shape of state in the container. Has to match {@link BaseState} constraint
+ * @typeParam PureTransitions - map of {@link PureTransition | transitions} to provide on state container
+ * @typeParam PureSelectors - map of {@link PureSelector | selectors} to provide on state container
+ * @public
+ */
 export interface StateContainer<
   State extends BaseState,
   PureTransitions extends object = object,
@@ -50,6 +98,11 @@ export interface StateContainer<
   selectors: Readonly<PureSelectorsToSelectors<PureSelectors>>;
 }
 
+/**
+ * Fully featured state container which matches Redux store interface. Extends {@link StateContainer}.
+ * Allows to use state container with redux libraries.
+ * @public
+ */
 export interface ReduxLikeStateContainer<
   State extends BaseState,
   PureTransitions extends object = {},
@@ -63,45 +116,92 @@ export interface ReduxLikeStateContainer<
   subscribe: (listener: (state: State) => void) => () => void;
 }
 
+/**
+ * Redux like dispatch
+ * @public
+ */
 export type Dispatch<T> = (action: T) => void;
+/**
+ * Redux like Middleware
+ * @public
+ */
 export type Middleware<State extends BaseState = BaseState> = (
   store: Pick<ReduxLikeStateContainer<State, any>, 'getState' | 'dispatch'>
 ) => (
   next: (action: TransitionDescription) => TransitionDescription | any
 ) => Dispatch<TransitionDescription>;
-
+/**
+ * Redux like Reducer
+ * @public
+ */
 export type Reducer<State extends BaseState> = (
   state: State,
   action: TransitionDescription
 ) => State;
 
+/**
+ * Utility type for inferring state shape from {@link StateContainer}
+ * @public
+ */
 export type UnboxState<
   Container extends StateContainer<any, any>
 > = Container extends StateContainer<infer T, any> ? T : never;
+/**
+ * Utility type for inferring transitions type from {@link StateContainer}
+ * @public
+ */
 export type UnboxTransitions<
   Container extends StateContainer<any, any>
 > = Container extends StateContainer<any, infer T> ? T : never;
 
+/**
+ * @public
+ */
 export type Selector<Result, Args extends any[] = []> = (...args: Args) => Result;
+/**
+ * @public
+ */
 export type PureSelector<State extends BaseState, Result, Args extends any[] = []> = (
   state: State
 ) => Selector<Result, Args>;
+/**
+ * @public
+ */
 export type EnsurePureSelector<T> = Ensure<T, PureSelector<any, any, any>>;
+/**
+ * @public
+ */
 export type PureSelectorToSelector<T extends PureSelector<any, any, any>> = ReturnType<
   EnsurePureSelector<T>
 >;
+/**
+ * @public
+ */
 export type PureSelectorsToSelectors<T extends object> = {
   [K in keyof T]: PureSelectorToSelector<EnsurePureSelector<T[K]>>;
 };
 
+/**
+ * Used to compare state, see {@link useContainerSelector}.
+ * @public
+ */
 export type Comparator<Result> = (previous: Result, current: Result) => boolean;
-
+/**
+ * State container state to component props mapper.
+ * See {@link Connect}
+ * @public
+ */
 export type MapStateToProps<State extends BaseState, StateProps extends object> = (
   state: State
 ) => StateProps;
+/**
+ * Similar to `connect` from react-redux,
+ * allows to map state from state container to component's props.
+ * @public
+ */
 export type Connect<State extends BaseState> = <
   Props extends object,
   StatePropKeys extends keyof Props
 >(
   mapStateToProp: MapStateToProps<State, Pick<Props, StatePropKeys>>
-) => (component: React.ComponentType<Props>) => React.FC<Omit<Props, StatePropKeys>>;
+) => (component: ComponentType<Props>) => FC<Omit<Props, StatePropKeys>>;
diff --git a/src/plugins/kibana_utils/public/state_sync/index.ts b/src/plugins/kibana_utils/public/state_sync/index.ts
index 1dfa998c5bb9..da60b3625536 100644
--- a/src/plugins/kibana_utils/public/state_sync/index.ts
+++ b/src/plugins/kibana_utils/public/state_sync/index.ts
@@ -17,11 +17,32 @@
  * under the License.
  */
 
+/**
+ * State syncing utilities are a set of helpers for syncing your application state
+ * with browser URL or browser storage.
+ *
+ * They are designed to work together with {@link https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_containers | state containers}. But state containers are not required.
+ *
+ * State syncing utilities include:
+ *
+ * *{@link syncState} util which:
+ *   * Subscribes to state changes and pushes them to state storage.
+ *   * Optionally subscribes to state storage changes and pushes them to state.
+ *   * Two types of storages compatible with `syncState`:
+ *   * {@link IKbnUrlStateStorage} - Serializes state and persists it to URL's query param in rison or hashed format.
+ * Listens for state updates in the URL and pushes them back to state.
+ *   * {@link ISessionStorageStateStorage} - Serializes state and persists it to browser storage.
+ *
+ * Refer {@link https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_sync | here} for a complete guide and examples.
+ * @packageDocumentation
+ */
+
 export {
   createSessionStorageStateStorage,
   createKbnUrlStateStorage,
   IKbnUrlStateStorage,
   ISessionStorageStateStorage,
+  IStateStorage,
 } from './state_sync_state_storage';
 export { IStateSyncConfig, INullableBaseStateContainer } from './types';
 export {
diff --git a/src/plugins/kibana_utils/public/state_sync/public.api.md b/src/plugins/kibana_utils/public/state_sync/public.api.md
new file mode 100644
index 000000000000..c174ba798d01
--- /dev/null
+++ b/src/plugins/kibana_utils/public/state_sync/public.api.md
@@ -0,0 +1,97 @@
+## API Report File for "kibana"
+
+> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
+
+```ts
+
+import { History } from 'history';
+import { Observable } from 'rxjs';
+
+// @public
+export const createKbnUrlStateStorage: ({ useHash, history }?: {
+    useHash: boolean;
+    history?: History<any> | undefined;
+}) => IKbnUrlStateStorage;
+
+// Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "Storage"
+//
+// @public
+export const createSessionStorageStateStorage: (storage?: Storage) => ISessionStorageStateStorage;
+
+// @public
+export interface IKbnUrlStateStorage extends IStateStorage {
+    cancel: () => void;
+    // (undocumented)
+    change$: <State = unknown>(key: string) => Observable<State | null>;
+    flush: (opts?: {
+        replace?: boolean;
+    }) => boolean;
+    // (undocumented)
+    get: <State = unknown>(key: string) => State | null;
+    // (undocumented)
+    set: <State>(key: string, state: State, opts?: {
+        replace: boolean;
+    }) => Promise<string | undefined>;
+}
+
+// Warning: (ae-forgotten-export) The symbol "BaseState" needs to be exported by the entry point index.d.ts
+// Warning: (ae-forgotten-export) The symbol "BaseStateContainer" needs to be exported by the entry point index.d.ts
+// Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "BaseStateContainer"
+//
+// @public
+export interface INullableBaseStateContainer<State extends BaseState> extends BaseStateContainer<State> {
+    // (undocumented)
+    set: (state: State | null) => void;
+}
+
+// Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "Storage"
+//
+// @public
+export interface ISessionStorageStateStorage extends IStateStorage {
+    // (undocumented)
+    get: <State = unknown>(key: string) => State | null;
+    // (undocumented)
+    set: <State>(key: string, state: State) => void;
+}
+
+// @public
+export interface IStateStorage {
+    cancel?: () => void;
+    change$?: <State = unknown>(key: string) => Observable<State | null>;
+    get: <State = unknown>(key: string) => State | null;
+    set: <State>(key: string, state: State) => any;
+}
+
+// Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "stateSync"
+// Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "BaseState"
+//
+// @public
+export interface IStateSyncConfig<State extends BaseState, StateStorage extends IStateStorage = IStateStorage> {
+    // Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "BaseStateContainer"
+    stateContainer: INullableBaseStateContainer<State>;
+    stateStorage: StateStorage;
+    storageKey: string;
+}
+
+// @public (undocumented)
+export interface ISyncStateRef<stateStorage extends IStateStorage = IStateStorage> {
+    start: StartSyncStateFnType;
+    stop: StopSyncStateFnType;
+}
+
+// @public (undocumented)
+export type StartSyncStateFnType = () => void;
+
+// @public (undocumented)
+export type StopSyncStateFnType = () => void;
+
+// @public
+export function syncState<State extends BaseState, StateStorage extends IStateStorage = IStateStorage>({ storageKey, stateStorage, stateContainer, }: IStateSyncConfig<State, IStateStorage>): ISyncStateRef;
+
+// Warning: (ae-missing-release-tag) "syncStates" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export function syncStates(stateSyncConfigs: Array<IStateSyncConfig<any>>): ISyncStateRef;
+
+
+```
diff --git a/src/plugins/kibana_utils/public/state_sync/state_sync.ts b/src/plugins/kibana_utils/public/state_sync/state_sync.ts
index 4c400d47b8e7..bbcaaedd0d8b 100644
--- a/src/plugins/kibana_utils/public/state_sync/state_sync.ts
+++ b/src/plugins/kibana_utils/public/state_sync/state_sync.ts
@@ -26,29 +26,61 @@ import { distinctUntilChangedWithInitialValue } from '../../common';
 import { BaseState } from '../../common/state_containers';
 import { applyDiff } from '../state_management/utils/diff_object';
 
+/**
+ * @public
+ */
+export type StopSyncStateFnType = () => void;
+/**
+ * @public
+ */
+export type StartSyncStateFnType = () => void;
+
+/**
+ * @public
+ */
+export interface ISyncStateRef<stateStorage extends IStateStorage = IStateStorage> {
+  /**
+   * stop state syncing
+   */
+  stop: StopSyncStateFnType;
+  /**
+   * start state syncing
+   */
+  start: StartSyncStateFnType;
+}
+
 /**
  * Utility for syncing application state wrapped in state container
  * with some kind of storage (e.g. URL)
  *
- * Examples:
+ * Go {@link https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_sync | here} for a complete guide and examples.
  *
- * 1. the simplest use case
+ * @example
+ *
+ * the simplest use case
+ * ```ts
  * const stateStorage = createKbnUrlStateStorage();
  * syncState({
  *   storageKey: '_s',
  *   stateContainer,
  *   stateStorage
  * });
+ * ```
  *
- * 2. conditionally configuring sync strategy
+ * @example
+ * conditionally configuring sync strategy
+ * ```ts
  * const stateStorage = createKbnUrlStateStorage({useHash: config.get('state:stateContainerInSessionStorage')})
  * syncState({
  *   storageKey: '_s',
  *   stateContainer,
  *   stateStorage
  * });
+ * ```
  *
- * 3. implementing custom sync strategy
+ * @example
+ * implementing custom sync strategy
+ * ```ts
  * const localStorageStateStorage = {
  *   set: (storageKey, state) => localStorage.setItem(storageKey, JSON.stringify(state)),
  *   get: (storageKey) => localStorage.getItem(storageKey) ? JSON.parse(localStorage.getItem(storageKey)) : null
@@ -58,12 +90,15 @@ import { applyDiff } from '../state_management/utils/diff_object';
  *   stateContainer,
  *   stateStorage: localStorageStateStorage
  * });
+ * ```
  *
- * 4. Transform state before serialising
+ * @example
+ * transforming state before serialising
  *  Useful for:
  *  * Migration / backward compatibility
  *  * Syncing part of state
  *  * Providing default values
+ * ```ts
  * const stateToStorage = (s) => ({ tab: s.tab });
  * syncState({
  *   storageKey: '_s',
@@ -74,20 +109,12 @@ import { applyDiff } from '../state_management/utils/diff_object';
  *   },
  *   stateStorage
  * });
+ * ```
  *
- * Caveats:
- *
- * 1. It is responsibility of consumer to make sure that initial app state and storage are in sync before starting syncing
- *    No initial sync happens when syncState() is called
+ * @param - syncing config {@link IStateSyncConfig}
+ * @returns - {@link ISyncStateRef}
+ * @public
  */
-export type StopSyncStateFnType = () => void;
-export type StartSyncStateFnType = () => void;
-export interface ISyncStateRef<stateStorage extends IStateStorage = IStateStorage> {
-  // stop syncing state with storage
-  stop: StopSyncStateFnType;
-  // start syncing state with storage
-  start: StartSyncStateFnType;
-}
 export function syncState<
   State extends BaseState,
   StateStorage extends IStateStorage = IStateStorage
@@ -159,7 +186,9 @@ export function syncState<
 }
 
 /**
- * multiple different sync configs
+ * @example
+ * sync multiple different sync configs
+ * ```ts
  * syncStates([
  *   {
  *     storageKey: '_s1',
@@ -172,7 +201,8 @@ export function syncState<
  *     stateContainer: stateContainer2,
  *   },
  * ]);
- * @param stateSyncConfigs - Array of IStateSyncConfig to sync
+ * ```
+ * @param stateSyncConfigs - Array of {@link IStateSyncConfig} to sync
  */
 export function syncStates(stateSyncConfigs: Array<IStateSyncConfig<any>>): ISyncStateRef {
   const syncRefs = stateSyncConfigs.map((config) => syncState(config));
diff --git a/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/create_kbn_url_state_storage.ts b/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/create_kbn_url_state_storage.ts
index 67c1bf26aa25..0c74e1eb9f42 100644
--- a/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/create_kbn_url_state_storage.ts
+++ b/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/create_kbn_url_state_storage.ts
@@ -27,6 +27,19 @@ import {
   setStateToKbnUrl,
 } from '../../state_management/url';
 
+/**
+ * KbnUrlStateStorage is a state storage for {@link syncState} utility which:
+ *
+ * 1. Keeps state in sync with the URL.
+ * 2. Serializes data and stores it in the URL in one of the supported formats:
+ *   * Rison encoded.
+ *   * Hashed URL: In URL we store only the hash from the serialized state, but the state itself is stored in sessionStorage. See Kibana's `state:storeInSessionStorage` advanced option for more context.
+ * 3. Takes care of listening to the URL updates and notifies state about the updates.
+ * 4. Takes care of batching URL updates to prevent redundant browser history records.
+ *
+ * {@link https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_sync/storages/kbn_url_storage.md | Refer to this guide for more info}
+ * @public
+ */
 export interface IKbnUrlStateStorage extends IStateStorage {
   set: <State>(
     key: string,
@@ -36,18 +49,23 @@ export interface IKbnUrlStateStorage extends IStateStorage {
   get: <State = unknown>(key: string) => State | null;
   change$: <State = unknown>(key: string) => Observable<State | null>;
 
-  // cancels any pending url updates
+  /**
+   * cancels any pending url updates
+   */
   cancel: () => void;
 
-  // synchronously runs any pending url updates
-  // returned boolean indicates if change occurred
+  /**
+   * Synchronously runs any pending url updates, returned boolean indicates if change occurred.
+   * @param opts: {replace? boolean} - allows to specify if push or replace should be used for flushing update
+   * @returns boolean - indicates if there was an update to flush
+   */
   flush: (opts?: { replace?: boolean }) => boolean;
 }
 
 /**
- * Implements syncing to/from url strategies.
- * Replicates what was implemented in state (AppState, GlobalState)
- * Both expanded and hashed use cases
+ * Creates {@link IKbnUrlStateStorage} state storage
+ * @returns - {@link IKbnUrlStateStorage}
+ * @public
  */
 export const createKbnUrlStateStorage = (
   { useHash = false, history }: { useHash: boolean; history?: History } = { useHash: false }
diff --git a/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/create_session_storage_state_storage.ts b/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/create_session_storage_state_storage.ts
index 00edfdfd1ed6..60ff211cd590 100644
--- a/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/create_session_storage_state_storage.ts
+++ b/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/create_session_storage_state_storage.ts
@@ -19,11 +19,23 @@
 
 import { IStateStorage } from './types';
 
+/**
+ * {@link IStateStorage} for storing state in browser {@link Storage}
+ * {@link https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_sync/storages/session_storage.md | guide}
+ * @public
+ */
 export interface ISessionStorageStateStorage extends IStateStorage {
   set: <State>(key: string, state: State) => void;
   get: <State = unknown>(key: string) => State | null;
 }
 
+/**
+ * Creates {@link ISessionStorageStateStorage}
+ * {@link https://github.com/elastic/kibana/blob/master/src/plugins/kibana_utils/docs/state_sync/storages/session_storage.md | guide}
+ * @param storage - Option {@link Storage} to use for storing state. By default window.sessionStorage.
+ * @returns - {@link ISessionStorageStateStorage}
+ * @public
+ */
 export const createSessionStorageStateStorage = (
   storage: Storage = window.sessionStorage
 ): ISessionStorageStateStorage => {
diff --git a/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/types.ts b/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/types.ts
index add1dc259be4..bae5dc206718 100644
--- a/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/types.ts
+++ b/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/types.ts
@@ -25,7 +25,8 @@ import { Observable } from 'rxjs';
  * * state serialisation / deserialization
  * * persisting to and retrieving from storage
  *
- * For an example take a look at already implemented KbnUrl state storage
+ * For an example take a look at already implemented {@link IKbnUrlStateStorage} and {@link ISessionStorageStateStorage} state storages
+ * @public
  */
 export interface IStateStorage {
   /**
@@ -45,7 +46,7 @@ export interface IStateStorage {
 
   /**
    * Optional method to cancel any pending activity
-   * syncState() will call it, if it is provided by IStateStorage
+   * {@link syncState} will call it during destroy, if it is provided by IStateStorage
    */
   cancel?: () => void;
 }
diff --git a/src/plugins/kibana_utils/public/state_sync/types.ts b/src/plugins/kibana_utils/public/state_sync/types.ts
index 2acb466d92e9..e879ab7c55b2 100644
--- a/src/plugins/kibana_utils/public/state_sync/types.ts
+++ b/src/plugins/kibana_utils/public/state_sync/types.ts
@@ -20,15 +20,26 @@
 import { BaseState, BaseStateContainer } from '../../common/state_containers/types';
 import { IStateStorage } from './state_sync_state_storage';
 
+/**
+ * Extension of {@link BaseStateContainer} with one constraint: set state should handle `null` as incoming state
+ * @remarks
+ * State container for `stateSync()` have to accept `null`
+ * for example, `set()` implementation could handle null and fallback to some default state
+ * this is required to handle edge case, when state in storage becomes empty and syncing is in progress.
+ * State container will be notified about about storage becoming empty with null passed in.
+ * @public
+ */
 export interface INullableBaseStateContainer<State extends BaseState>
   extends BaseStateContainer<State> {
-  // State container for stateSync() have to accept "null"
-  // for example, set() implementation could handle null and fallback to some default state
-  // this is required to handle edge case, when state in storage becomes empty and syncing is in progress.
-  // state container will be notified about about storage becoming empty with null passed in
   set: (state: State | null) => void;
 }
 
+/**
+ * Config for setting up state syncing with {@link stateSync}
+ * @typeParam State - State shape to sync to storage, has to extend {@link BaseState}
+ * @typeParam StateStorage - used state storage to sync state with
+ * @public
+ */
 export interface IStateSyncConfig<
   State extends BaseState,
   StateStorage extends IStateStorage = IStateStorage
@@ -39,8 +50,8 @@ export interface IStateSyncConfig<
    */
   storageKey: string;
   /**
-   * State container to keep in sync with storage, have to implement INullableBaseStateContainer<State> interface
-   * The idea is that ./state_containers/ should be used as a state container,
+   * State container to keep in sync with storage, have to implement {@link INullableBaseStateContainer} interface
+   * We encourage to use {@link BaseStateContainer} as a state container,
    * but it is also possible to implement own custom container for advanced use cases
    */
   stateContainer: INullableBaseStateContainer<State>;
@@ -49,7 +60,7 @@ export interface IStateSyncConfig<
    * State storage is responsible for serialising / deserialising and persisting / retrieving stored state
    *
    * There are common strategies already implemented:
-   * './state_sync_state_storage/'
+   * see {@link IKbnUrlStateStorage}
    * which replicate what State (AppState, GlobalState) in legacy world did
    *
    */

From 684aa68f17ce9722c8441166b025c4f96dd2a4ad Mon Sep 17 00:00:00 2001
From: Vadim Dalecky <streamich@gmail.com>
Date: Fri, 26 Jun 2020 14:26:35 +0200
Subject: [PATCH 43/78] "Explore underlying data" in-chart action (#69494)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* refactor: 💡 rename folder to "explore_data"

* style: 💄 check for "share" plugin in more semantic way

"explore data" actions use Discover URL generator, which is registered
in "share" plugin, which is optional plugin, so we check for its
existance, because otherwise URL generator is not available.

* refactor: 💡 move KibanaURL to a separate file

* feat: 🎸 add "Explore underlying data" in-chart action

* fix: 🐛 fix imports after refactor

* feat: 🎸 add start.filtersFromContext to embeddable plugin

* feat: 🎸 add type checkers to data plugin

* feat: 🎸 better handle empty filters in Discover URL generator

* feat: 🎸 implement .getUrl() method of explore data in-chart act

* feat: 🎸 add embeddable.filtersAndTimeRangeFromContext()

* feat: 🎸 improve getUrl() method of explore data action

* test: 💍 update test mock

* fix possible stale hashHistory.location in discover

* style: 💄 ensureHashHistoryLocation -> syncHistoryLocations

* docs: ✏️ update autogenerated docs

* test: 💍 add in-chart "Explore underlying data" unit tests

* test: 💍 add in-chart "Explore underlying data" functional tests

* test: 💍 clean-up custom time range after panel action tests

* chore: 🤖 fix embeddable plugin mocks

* chore: 🤖 fix another mock

* test: 💍 add support for new action to pie chart service

Co-authored-by: Anton Dosov <anton.dosov@elastic.co>
---
 ...ana-plugin-plugins-data-public.isfilter.md |  11 +
 ...na-plugin-plugins-data-public.isfilters.md |  11 +
 ...bana-plugin-plugins-data-public.isquery.md |  11 +
 ...-plugin-plugins-data-public.istimerange.md |  11 +
 .../kibana-plugin-plugins-data-public.md      |   4 +
 .../common/es_query/filters/meta_filter.ts    |  10 +
 src/plugins/data/common/index.ts              |   3 +-
 src/plugins/data/common/query/index.ts        |   1 +
 src/plugins/data/common/query/is_query.ts     |  27 ++
 src/plugins/data/common/timefilter/index.ts   |  20 ++
 .../data/common/timefilter/is_time_range.ts   |  26 ++
 src/plugins/data/public/index.ts              |   2 +
 src/plugins/data/public/public.api.md         |  20 ++
 src/plugins/discover/public/index.ts          |   2 +-
 .../discover/public/kibana_services.ts        |  15 +-
 src/plugins/discover/public/plugin.ts         |   2 +
 src/plugins/discover/public/url_generator.ts  |   6 +-
 src/plugins/embeddable/kibana.json            |   1 +
 src/plugins/embeddable/public/index.ts        |   1 +
 .../public/lib/triggers/triggers.ts           |  14 +-
 src/plugins/embeddable/public/mocks.tsx       |   5 +
 src/plugins/embeddable/public/plugin.tsx      |  64 +++-
 .../embeddable/public/tests/test_plugin.ts    |   9 +-
 .../services/dashboard/panel_actions.ts       |  14 +
 .../services/visualizations/pie_chart.ts      |  17 +-
 .../abstract_explore_data_action.ts           |  74 +++++
 .../explore_data_chart_action.test.ts         | 274 ++++++++++++++++++
 .../explore_data/explore_data_chart_action.ts |  65 +++++
 .../explore_data_context_menu_action.test.ts  |  28 +-
 .../explore_data_context_menu_action.ts       |  54 ++++
 .../index.ts                                  |   1 +
 .../public/actions/explore_data/kibana_url.ts |  31 ++
 .../public/actions/explore_data/shared.ts     |  37 +++
 .../discover_enhanced/public/actions/index.ts |   2 +-
 .../explore_data_context_menu_action.ts       | 156 ----------
 .../discover_enhanced/public/plugin.ts        |  27 +-
 .../drilldowns/dashboard_drilldowns.ts        |   2 +-
 .../drilldowns/explore_data_chart_action.ts   |  98 +++++++
 .../drilldowns/explore_data_panel_action.ts   |  31 +-
 .../apps/dashboard/drilldowns/index.ts        |   1 +
 .../services/dashboard/panel_time_range.ts    |   6 +
 41 files changed, 997 insertions(+), 197 deletions(-)
 create mode 100644 docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilter.md
 create mode 100644 docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilters.md
 create mode 100644 docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isquery.md
 create mode 100644 docs/development/plugins/data/public/kibana-plugin-plugins-data-public.istimerange.md
 create mode 100644 src/plugins/data/common/query/is_query.ts
 create mode 100644 src/plugins/data/common/timefilter/index.ts
 create mode 100644 src/plugins/data/common/timefilter/is_time_range.ts
 create mode 100644 x-pack/plugins/discover_enhanced/public/actions/explore_data/abstract_explore_data_action.ts
 create mode 100644 x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_chart_action.test.ts
 create mode 100644 x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_chart_action.ts
 rename x-pack/plugins/discover_enhanced/public/actions/{view_in_discover => explore_data}/explore_data_context_menu_action.test.ts (88%)
 create mode 100644 x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_context_menu_action.ts
 rename x-pack/plugins/discover_enhanced/public/actions/{view_in_discover => explore_data}/index.ts (86%)
 create mode 100644 x-pack/plugins/discover_enhanced/public/actions/explore_data/kibana_url.ts
 create mode 100644 x-pack/plugins/discover_enhanced/public/actions/explore_data/shared.ts
 delete mode 100644 x-pack/plugins/discover_enhanced/public/actions/view_in_discover/explore_data_context_menu_action.ts
 create mode 100644 x-pack/test/functional/apps/dashboard/drilldowns/explore_data_chart_action.ts

diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilter.md
new file mode 100644
index 000000000000..f1916e89c2c9
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilter.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [isFilter](./kibana-plugin-plugins-data-public.isfilter.md)
+
+## isFilter variable
+
+<b>Signature:</b>
+
+```typescript
+isFilter: (x: unknown) => x is Filter
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilters.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilters.md
new file mode 100644
index 000000000000..558da72cc26b
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilters.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [isFilters](./kibana-plugin-plugins-data-public.isfilters.md)
+
+## isFilters variable
+
+<b>Signature:</b>
+
+```typescript
+isFilters: (x: unknown) => x is Filter[]
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isquery.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isquery.md
new file mode 100644
index 000000000000..0884566333aa
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isquery.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [isQuery](./kibana-plugin-plugins-data-public.isquery.md)
+
+## isQuery variable
+
+<b>Signature:</b>
+
+```typescript
+isQuery: (x: unknown) => x is Query
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.istimerange.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.istimerange.md
new file mode 100644
index 000000000000..e9420493c82f
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.istimerange.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [isTimeRange](./kibana-plugin-plugins-data-public.istimerange.md)
+
+## isTimeRange variable
+
+<b>Signature:</b>
+
+```typescript
+isTimeRange: (x: unknown) => x is TimeRange
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
index f62479f02926..feeb686a1f5e 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
@@ -110,6 +110,10 @@
 |  [getKbnTypeNames](./kibana-plugin-plugins-data-public.getkbntypenames.md) | Get the esTypes known by all kbnFieldTypes {<!-- -->Array<string>} |
 |  [indexPatterns](./kibana-plugin-plugins-data-public.indexpatterns.md) |  |
 |  [injectSearchSourceReferences](./kibana-plugin-plugins-data-public.injectsearchsourcereferences.md) |  |
+|  [isFilter](./kibana-plugin-plugins-data-public.isfilter.md) |  |
+|  [isFilters](./kibana-plugin-plugins-data-public.isfilters.md) |  |
+|  [isQuery](./kibana-plugin-plugins-data-public.isquery.md) |  |
+|  [isTimeRange](./kibana-plugin-plugins-data-public.istimerange.md) |  |
 |  [parseSearchSourceJSON](./kibana-plugin-plugins-data-public.parsesearchsourcejson.md) |  |
 |  [QueryStringInput](./kibana-plugin-plugins-data-public.querystringinput.md) |  |
 |  [search](./kibana-plugin-plugins-data-public.search.md) |  |
diff --git a/src/plugins/data/common/es_query/filters/meta_filter.ts b/src/plugins/data/common/es_query/filters/meta_filter.ts
index ff6dff9d8b74..e3099ae6a402 100644
--- a/src/plugins/data/common/es_query/filters/meta_filter.ts
+++ b/src/plugins/data/common/es_query/filters/meta_filter.ts
@@ -107,3 +107,13 @@ export const pinFilter = (filter: Filter) =>
 
 export const unpinFilter = (filter: Filter) =>
   !isFilterPinned(filter) ? filter : toggleFilterPinned(filter);
+
+export const isFilter = (x: unknown): x is Filter =>
+  !!x &&
+  typeof x === 'object' &&
+  !!(x as Filter).meta &&
+  typeof (x as Filter).meta === 'object' &&
+  typeof (x as Filter).meta.disabled === 'boolean';
+
+export const isFilters = (x: unknown): x is Filter[] =>
+  Array.isArray(x) && !x.find((y) => !isFilter(y));
diff --git a/src/plugins/data/common/index.ts b/src/plugins/data/common/index.ts
index adbd93d518fc..b40e02b709d3 100644
--- a/src/plugins/data/common/index.ts
+++ b/src/plugins/data/common/index.ts
@@ -20,11 +20,12 @@
 export * from './constants';
 export * from './es_query';
 export * from './field_formats';
+export * from './field_mapping';
 export * from './index_patterns';
 export * from './kbn_field_types';
 export * from './query';
 export * from './search';
 export * from './search/aggs';
+export * from './timefilter';
 export * from './types';
 export * from './utils';
-export * from './field_mapping';
diff --git a/src/plugins/data/common/query/index.ts b/src/plugins/data/common/query/index.ts
index 421cc4f63e4e..4e90f6f8bb83 100644
--- a/src/plugins/data/common/query/index.ts
+++ b/src/plugins/data/common/query/index.ts
@@ -19,3 +19,4 @@
 
 export * from './filter_manager';
 export * from './types';
+export * from './is_query';
diff --git a/src/plugins/data/common/query/is_query.ts b/src/plugins/data/common/query/is_query.ts
new file mode 100644
index 000000000000..08a99a39b1ac
--- /dev/null
+++ b/src/plugins/data/common/query/is_query.ts
@@ -0,0 +1,27 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Query } from './types';
+
+export const isQuery = (x: unknown): x is Query =>
+  !!x &&
+  typeof x === 'object' &&
+  typeof (x as Query).language === 'string' &&
+  (typeof (x as Query).query === 'string' ||
+    (typeof (x as Query).query === 'object' && !!(x as Query).query));
diff --git a/src/plugins/data/common/timefilter/index.ts b/src/plugins/data/common/timefilter/index.ts
new file mode 100644
index 000000000000..e0c509e119fd
--- /dev/null
+++ b/src/plugins/data/common/timefilter/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { isTimeRange } from './is_time_range';
diff --git a/src/plugins/data/common/timefilter/is_time_range.ts b/src/plugins/data/common/timefilter/is_time_range.ts
new file mode 100644
index 000000000000..f206cd04dde3
--- /dev/null
+++ b/src/plugins/data/common/timefilter/is_time_range.ts
@@ -0,0 +1,26 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { TimeRange } from './types';
+
+export const isTimeRange = (x: unknown): x is TimeRange =>
+  !!x &&
+  typeof x === 'object' &&
+  typeof (x as TimeRange).from === 'string' &&
+  typeof (x as TimeRange).to === 'string';
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index 3665d9dc2b46..efce8d2c021c 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -440,6 +440,8 @@ export {
   getKbnTypeNames,
 } from '../common';
 
+export { isTimeRange, isQuery, isFilter, isFilters } from '../common';
+
 export * from '../common/field_mapping';
 
 /*
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index 25c9b0718050..b12ad94017fb 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -1291,6 +1291,26 @@ export interface ISearchStrategy<T extends TStrategyTypes> {
     search: ISearch<T>;
 }
 
+// Warning: (ae-missing-release-tag) "isFilter" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export const isFilter: (x: unknown) => x is Filter;
+
+// Warning: (ae-missing-release-tag) "isFilters" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export const isFilters: (x: unknown) => x is Filter[];
+
+// Warning: (ae-missing-release-tag) "isQuery" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export const isQuery: (x: unknown) => x is Query;
+
+// Warning: (ae-missing-release-tag) "isTimeRange" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export const isTimeRange: (x: unknown) => x is TimeRange;
+
 // Warning: (ae-missing-release-tag) "ISyncSearchRequest" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
diff --git a/src/plugins/discover/public/index.ts b/src/plugins/discover/public/index.ts
index 4154fdfeb3ff..6ac8f674b615 100644
--- a/src/plugins/discover/public/index.ts
+++ b/src/plugins/discover/public/index.ts
@@ -27,4 +27,4 @@ export function plugin(initializerContext: PluginInitializerContext) {
 
 export { SavedSearch, SavedSearchLoader, createSavedSearchesLoader } from './saved_searches';
 export { ISearchEmbeddable, SEARCH_EMBEDDABLE_TYPE, SearchInput } from './application/embeddable';
-export { DISCOVER_APP_URL_GENERATOR } from './url_generator';
+export { DISCOVER_APP_URL_GENERATOR, DiscoverUrlGeneratorState } from './url_generator';
diff --git a/src/plugins/discover/public/kibana_services.ts b/src/plugins/discover/public/kibana_services.ts
index cca63cd880b6..2c6bbcc3ecce 100644
--- a/src/plugins/discover/public/kibana_services.ts
+++ b/src/plugins/discover/public/kibana_services.ts
@@ -60,10 +60,23 @@ export const [getDocViewsRegistry, setDocViewsRegistry] = createGetterSetter<Doc
   'DocViewsRegistry'
 );
 /**
- * Makes sure discover and context are using one instance of history
+ * Makes sure discover and context are using one instance of history.
  */
 export const getHistory = _.once(() => createHashHistory());
 
+/**
+ * Discover currently uses two `history` instances: one from Kibana Platform and
+ * another from `history` package. Below function is used every time Discover
+ * app is loaded to synchronize both instances.
+ *
+ * This helper is temporary until https://github.com/elastic/kibana/issues/65161 is resolved.
+ */
+export const syncHistoryLocations = () => {
+  const h = getHistory();
+  Object.assign(h.location, createHashHistory().location);
+  return h;
+};
+
 export const [getScopedHistory, setScopedHistory] = createGetterSetter<ScopedHistory>(
   'scopedHistory'
 );
diff --git a/src/plugins/discover/public/plugin.ts b/src/plugins/discover/public/plugin.ts
index ba97efa55068..e97ac783c616 100644
--- a/src/plugins/discover/public/plugin.ts
+++ b/src/plugins/discover/public/plugin.ts
@@ -55,6 +55,7 @@ import {
   setServices,
   setScopedHistory,
   getScopedHistory,
+  syncHistoryLocations,
   getServices,
 } from './kibana_services';
 import { createSavedSearchesLoader } from './saved_searches';
@@ -245,6 +246,7 @@ export class DiscoverPlugin
           throw Error('Discover plugin method initializeInnerAngular is undefined');
         }
         setScopedHistory(params.history);
+        syncHistoryLocations();
         appMounted();
         const {
           plugins: { data: dataStart },
diff --git a/src/plugins/discover/public/url_generator.ts b/src/plugins/discover/public/url_generator.ts
index 42d689050d5a..c7f2e2147e81 100644
--- a/src/plugins/discover/public/url_generator.ts
+++ b/src/plugins/discover/public/url_generator.ts
@@ -98,11 +98,13 @@ export class DiscoverUrlGenerator
     const queryState: QueryState = {};
 
     if (query) appState.query = query;
-    if (filters) appState.filters = filters?.filter((f) => !esFilters.isFilterPinned(f));
+    if (filters && filters.length)
+      appState.filters = filters?.filter((f) => !esFilters.isFilterPinned(f));
     if (indexPatternId) appState.index = indexPatternId;
 
     if (timeRange) queryState.time = timeRange;
-    if (filters) queryState.filters = filters?.filter((f) => esFilters.isFilterPinned(f));
+    if (filters && filters.length)
+      queryState.filters = filters?.filter((f) => esFilters.isFilterPinned(f));
     if (refreshInterval) queryState.refreshInterval = refreshInterval;
 
     let url = `${this.params.appBasePath}#/${savedSearchPath}`;
diff --git a/src/plugins/embeddable/kibana.json b/src/plugins/embeddable/kibana.json
index 06b0e88da334..332237d19e21 100644
--- a/src/plugins/embeddable/kibana.json
+++ b/src/plugins/embeddable/kibana.json
@@ -4,6 +4,7 @@
   "server": false,
   "ui": true,
   "requiredPlugins": [
+    "data",
     "inspector",
     "uiActions"
   ],
diff --git a/src/plugins/embeddable/public/index.ts b/src/plugins/embeddable/public/index.ts
index 35fbfe2e0aa3..f19974942c43 100644
--- a/src/plugins/embeddable/public/index.ts
+++ b/src/plugins/embeddable/public/index.ts
@@ -28,6 +28,7 @@ export {
   ACTION_EDIT_PANEL,
   Adapters,
   AddPanelAction,
+  ChartActionContext,
   Container,
   ContainerInput,
   ContainerOutput,
diff --git a/src/plugins/embeddable/public/lib/triggers/triggers.ts b/src/plugins/embeddable/public/lib/triggers/triggers.ts
index 2b447c89e285..5bb96a708b7a 100644
--- a/src/plugins/embeddable/public/lib/triggers/triggers.ts
+++ b/src/plugins/embeddable/public/lib/triggers/triggers.ts
@@ -39,10 +39,6 @@ export interface ValueClickTriggerContext<T extends IEmbeddable = IEmbeddable> {
   };
 }
 
-export const isValueClickTriggerContext = (
-  context: ValueClickTriggerContext | RangeSelectTriggerContext
-): context is ValueClickTriggerContext => context.data && 'data' in context.data;
-
 export interface RangeSelectTriggerContext<T extends IEmbeddable = IEmbeddable> {
   embeddable?: T;
   data: {
@@ -53,8 +49,16 @@ export interface RangeSelectTriggerContext<T extends IEmbeddable = IEmbeddable>
   };
 }
 
+export type ChartActionContext<T extends IEmbeddable = IEmbeddable> =
+  | ValueClickTriggerContext<T>
+  | RangeSelectTriggerContext<T>;
+
+export const isValueClickTriggerContext = (
+  context: ChartActionContext
+): context is ValueClickTriggerContext => context.data && 'data' in context.data;
+
 export const isRangeSelectTriggerContext = (
-  context: ValueClickTriggerContext | RangeSelectTriggerContext
+  context: ChartActionContext
 ): context is RangeSelectTriggerContext => context.data && 'range' in context.data;
 
 export const CONTEXT_MENU_TRIGGER = 'CONTEXT_MENU_TRIGGER';
diff --git a/src/plugins/embeddable/public/mocks.tsx b/src/plugins/embeddable/public/mocks.tsx
index 6d94af1f2282..efd0ccdc4553 100644
--- a/src/plugins/embeddable/public/mocks.tsx
+++ b/src/plugins/embeddable/public/mocks.tsx
@@ -31,6 +31,7 @@ import { coreMock } from '../../../core/public/mocks';
 import { UiActionsService } from './lib/ui_actions';
 import { CoreStart } from '../../../core/public';
 import { Start as InspectorStart } from '../../inspector/public';
+import { dataPluginMock } from '../../data/public/mocks';
 
 // eslint-disable-next-line
 import { inspectorPluginMock } from '../../inspector/public/mocks';
@@ -100,6 +101,8 @@ const createStartContract = (): Start => {
     EmbeddablePanel: jest.fn(),
     getEmbeddablePanel: jest.fn(),
     getStateTransfer: jest.fn(() => createEmbeddableStateTransferMock() as EmbeddableStateTransfer),
+    filtersAndTimeRangeFromContext: jest.fn(),
+    filtersFromContext: jest.fn(),
   };
   return startContract;
 };
@@ -108,11 +111,13 @@ const createInstance = (setupPlugins: Partial<EmbeddableSetupDependencies> = {})
   const plugin = new EmbeddablePublicPlugin({} as any);
   const setup = plugin.setup(coreMock.createSetup(), {
     uiActions: setupPlugins.uiActions || uiActionsPluginMock.createSetupContract(),
+    data: dataPluginMock.createSetupContract(),
   });
   const doStart = (startPlugins: Partial<EmbeddableStartDependencies> = {}) =>
     plugin.start(coreMock.createStart(), {
       uiActions: startPlugins.uiActions || uiActionsPluginMock.createStartContract(),
       inspector: inspectorPluginMock.createStartContract(),
+      data: dataPluginMock.createStartContract(),
     });
   return {
     plugin,
diff --git a/src/plugins/embeddable/public/plugin.tsx b/src/plugins/embeddable/public/plugin.tsx
index c4e0ca44a4e7..03bb4a477926 100644
--- a/src/plugins/embeddable/public/plugin.tsx
+++ b/src/plugins/embeddable/public/plugin.tsx
@@ -17,6 +17,13 @@
  * under the License.
  */
 import React from 'react';
+import {
+  DataPublicPluginSetup,
+  DataPublicPluginStart,
+  Filter,
+  TimeRange,
+  esFilters,
+} from '../../data/public';
 import { getSavedObjectFinder } from '../../saved_objects/public';
 import { UiActionsSetup, UiActionsStart } from '../../ui_actions/public';
 import { Start as InspectorStart } from '../../inspector/public';
@@ -36,15 +43,20 @@ import {
   defaultEmbeddableFactoryProvider,
   IEmbeddable,
   EmbeddablePanel,
+  ChartActionContext,
+  isRangeSelectTriggerContext,
+  isValueClickTriggerContext,
 } from './lib';
 import { EmbeddableFactoryDefinition } from './lib/embeddables/embeddable_factory_definition';
 import { EmbeddableStateTransfer } from './lib/state_transfer';
 
 export interface EmbeddableSetupDependencies {
+  data: DataPublicPluginSetup;
   uiActions: UiActionsSetup;
 }
 
 export interface EmbeddableStartDependencies {
+  data: DataPublicPluginStart;
   uiActions: UiActionsStart;
   inspector: InspectorStart;
 }
@@ -70,6 +82,19 @@ export interface EmbeddableStart {
     embeddableFactoryId: string
   ) => EmbeddableFactory<I, O, E> | undefined;
   getEmbeddableFactories: () => IterableIterator<EmbeddableFactory>;
+
+  /**
+   * Given {@link ChartActionContext} returns a list of `data` plugin {@link Filter} entries.
+   */
+  filtersFromContext: (context: ChartActionContext) => Promise<Filter[]>;
+
+  /**
+   * Returns possible time range and filters that can be constructed from {@link ChartActionContext} object.
+   */
+  filtersAndTimeRangeFromContext: (
+    context: ChartActionContext
+  ) => Promise<{ filters: Filter[]; timeRange?: TimeRange }>;
+
   EmbeddablePanel: EmbeddablePanelHOC;
   getEmbeddablePanel: (stateTransfer?: EmbeddableStateTransfer) => EmbeddablePanelHOC;
   getStateTransfer: (history?: ScopedHistory) => EmbeddableStateTransfer;
@@ -107,7 +132,7 @@ export class EmbeddablePublicPlugin implements Plugin<EmbeddableSetup, Embeddabl
 
   public start(
     core: CoreStart,
-    { uiActions, inspector }: EmbeddableStartDependencies
+    { data, uiActions, inspector }: EmbeddableStartDependencies
   ): EmbeddableStart {
     this.embeddableFactoryDefinitions.forEach((def) => {
       this.embeddableFactories.set(
@@ -121,6 +146,41 @@ export class EmbeddablePublicPlugin implements Plugin<EmbeddableSetup, Embeddabl
     this.outgoingOnlyStateTransfer = new EmbeddableStateTransfer(core.application.navigateToApp);
     this.isRegistryReady = true;
 
+    const filtersFromContext: EmbeddableStart['filtersFromContext'] = async (context) => {
+      try {
+        if (isRangeSelectTriggerContext(context))
+          return await data.actions.createFiltersFromRangeSelectAction(context.data);
+        if (isValueClickTriggerContext(context))
+          return await data.actions.createFiltersFromValueClickAction(context.data);
+        // eslint-disable-next-line no-console
+        console.warn("Can't extract filters from action.", context);
+      } catch (error) {
+        // eslint-disable-next-line no-console
+        console.warn('Error extracting filters from action. Returning empty filter list.', error);
+      }
+      return [];
+    };
+
+    const filtersAndTimeRangeFromContext: EmbeddableStart['filtersAndTimeRangeFromContext'] = async (
+      context
+    ) => {
+      const filters = await filtersFromContext(context);
+
+      if (!context.data.timeFieldName) return { filters };
+
+      const { timeRangeFilter, restOfFilters } = esFilters.extractTimeFilter(
+        context.data.timeFieldName,
+        filters
+      );
+
+      return {
+        filters: restOfFilters,
+        timeRange: timeRangeFilter
+          ? esFilters.convertRangeFilterToTimeRangeString(timeRangeFilter)
+          : undefined,
+      };
+    };
+
     const getEmbeddablePanelHoc = (stateTransfer?: EmbeddableStateTransfer) => ({
       embeddable,
       hideHeader,
@@ -146,6 +206,8 @@ export class EmbeddablePublicPlugin implements Plugin<EmbeddableSetup, Embeddabl
     return {
       getEmbeddableFactory: this.getEmbeddableFactory,
       getEmbeddableFactories: this.getEmbeddableFactories,
+      filtersFromContext,
+      filtersAndTimeRangeFromContext,
       getStateTransfer: (history?: ScopedHistory) => {
         return history
           ? new EmbeddableStateTransfer(core.application.navigateToApp, history)
diff --git a/src/plugins/embeddable/public/tests/test_plugin.ts b/src/plugins/embeddable/public/tests/test_plugin.ts
index e13a906e3033..bb12e3d7b901 100644
--- a/src/plugins/embeddable/public/tests/test_plugin.ts
+++ b/src/plugins/embeddable/public/tests/test_plugin.ts
@@ -23,6 +23,7 @@ import { UiActionsStart } from '../../../ui_actions/public';
 import { uiActionsPluginMock } from '../../../ui_actions/public/mocks';
 // eslint-disable-next-line
 import { inspectorPluginMock } from '../../../inspector/public/mocks';
+import { dataPluginMock } from '../../../data/public/mocks';
 import { coreMock } from '../../../../core/public/mocks';
 import { EmbeddablePublicPlugin, EmbeddableSetup, EmbeddableStart } from '../plugin';
 
@@ -42,7 +43,10 @@ export const testPlugin = (
   const uiActions = uiActionsPluginMock.createPlugin(coreSetup, coreStart);
   const initializerContext = {} as any;
   const plugin = new EmbeddablePublicPlugin(initializerContext);
-  const setup = plugin.setup(coreSetup, { uiActions: uiActions.setup });
+  const setup = plugin.setup(coreSetup, {
+    data: dataPluginMock.createSetupContract(),
+    uiActions: uiActions.setup,
+  });
 
   return {
     plugin,
@@ -51,8 +55,9 @@ export const testPlugin = (
     setup,
     doStart: (anotherCoreStart: CoreStart = coreStart) => {
       const start = plugin.start(anotherCoreStart, {
-        uiActions: uiActionsPluginMock.createStartContract(),
+        data: dataPluginMock.createStartContract(),
         inspector: inspectorPluginMock.createStartContract(),
+        uiActions: uiActionsPluginMock.createStartContract(),
       });
       return start;
     },
diff --git a/test/functional/services/dashboard/panel_actions.ts b/test/functional/services/dashboard/panel_actions.ts
index c9a5dcfba32b..0f5d6ea74a6b 100644
--- a/test/functional/services/dashboard/panel_actions.ts
+++ b/test/functional/services/dashboard/panel_actions.ts
@@ -213,5 +213,19 @@ export function DashboardPanelActionsProvider({ getService, getPageObjects }: Ft
       await testSubjects.click('saveNewTitleButton');
       await this.toggleContextMenu(panel);
     }
+
+    async getActionWebElementByText(text: string): Promise<WebElementWrapper> {
+      log.debug(`getActionWebElement: "${text}"`);
+      const menu = await testSubjects.find('multipleActionsContextMenu');
+      const items = await menu.findAllByCssSelector('[data-test-subj*="embeddablePanelAction-"]');
+      for (const item of items) {
+        const currentText = await item.getVisibleText();
+        if (currentText === text) {
+          return item;
+        }
+      }
+
+      throw new Error(`No action matching text "${text}"`);
+    }
   })();
 }
diff --git a/test/functional/services/visualizations/pie_chart.ts b/test/functional/services/visualizations/pie_chart.ts
index 66f32d246b31..a25695a5bfcb 100644
--- a/test/functional/services/visualizations/pie_chart.ts
+++ b/test/functional/services/visualizations/pie_chart.ts
@@ -28,10 +28,13 @@ export function PieChartProvider({ getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const find = getService('find');
   const defaultFindTimeout = config.get('timeouts.find');
+  const panelActions = getService('dashboardPanelActions');
 
   return new (class PieChart {
-    async filterOnPieSlice(name?: string) {
-      log.debug(`PieChart.filterOnPieSlice(${name})`);
+    private readonly filterActionText = 'Apply filter to current view';
+
+    async clickOnPieSlice(name?: string) {
+      log.debug(`PieChart.clickOnPieSlice(${name})`);
       if (name) {
         await testSubjects.click(`pieSlice-${name.split(' ').join('-')}`);
       } else {
@@ -44,6 +47,16 @@ export function PieChartProvider({ getService }: FtrProviderContext) {
       }
     }
 
+    async filterOnPieSlice(name?: string) {
+      log.debug(`PieChart.filterOnPieSlice(${name})`);
+      await this.clickOnPieSlice(name);
+      const hasUiActionsPopup = await testSubjects.exists('multipleActionsContextMenu');
+      if (hasUiActionsPopup) {
+        const actionElement = await panelActions.getActionWebElementByText(this.filterActionText);
+        await actionElement.click();
+      }
+    }
+
     async filterByLegendItem(label: string) {
       log.debug(`PieChart.filterByLegendItem(${label})`);
       await testSubjects.click(`legend-${label}`);
diff --git a/x-pack/plugins/discover_enhanced/public/actions/explore_data/abstract_explore_data_action.ts b/x-pack/plugins/discover_enhanced/public/actions/explore_data/abstract_explore_data_action.ts
new file mode 100644
index 000000000000..620cabe65277
--- /dev/null
+++ b/x-pack/plugins/discover_enhanced/public/actions/explore_data/abstract_explore_data_action.ts
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { DiscoverStart } from '../../../../../../src/plugins/discover/public';
+import { EmbeddableStart } from '../../../../../../src/plugins/embeddable/public';
+import { ViewMode, IEmbeddable } from '../../../../../../src/plugins/embeddable/public';
+import { StartServicesGetter } from '../../../../../../src/plugins/kibana_utils/public';
+import { CoreStart } from '../../../../../../src/core/public';
+import { KibanaURL } from './kibana_url';
+import * as shared from './shared';
+
+export const ACTION_EXPLORE_DATA = 'ACTION_EXPLORE_DATA';
+
+export interface PluginDeps {
+  discover: Pick<DiscoverStart, 'urlGenerator'>;
+  embeddable: Pick<EmbeddableStart, 'filtersAndTimeRangeFromContext'>;
+}
+
+export interface CoreDeps {
+  application: Pick<CoreStart['application'], 'navigateToApp'>;
+}
+
+export interface Params {
+  start: StartServicesGetter<PluginDeps, unknown, CoreDeps>;
+}
+
+export abstract class AbstractExploreDataAction<Context extends { embeddable?: IEmbeddable }> {
+  public readonly getIconType = (context: Context): string => 'discoverApp';
+
+  public readonly getDisplayName = (context: Context): string =>
+    i18n.translate('xpack.discover.FlyoutCreateDrilldownAction.displayName', {
+      defaultMessage: 'Explore underlying data',
+    });
+
+  constructor(protected readonly params: Params) {}
+
+  protected abstract async getUrl(context: Context): Promise<KibanaURL>;
+
+  public async isCompatible({ embeddable }: Context): Promise<boolean> {
+    if (!embeddable) return false;
+    if (!this.params.start().plugins.discover.urlGenerator) return false;
+    if (!shared.isVisualizeEmbeddable(embeddable)) return false;
+    if (!shared.getIndexPattern(embeddable)) return false;
+    if (embeddable.getInput().viewMode !== ViewMode.VIEW) return false;
+    return true;
+  }
+
+  public async execute(context: Context): Promise<void> {
+    if (!shared.isVisualizeEmbeddable(context.embeddable)) return;
+
+    const { core } = this.params.start();
+    const { appName, appPath } = await this.getUrl(context);
+
+    await core.application.navigateToApp(appName, {
+      path: appPath,
+    });
+  }
+
+  public async getHref(context: Context): Promise<string> {
+    const { embeddable } = context;
+
+    if (!shared.isVisualizeEmbeddable(embeddable)) {
+      throw new Error(`Embeddable not supported for "${this.getDisplayName(context)}" action.`);
+    }
+
+    const { path } = await this.getUrl(context);
+
+    return path;
+  }
+}
diff --git a/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_chart_action.test.ts b/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_chart_action.test.ts
new file mode 100644
index 000000000000..a273f0d50e45
--- /dev/null
+++ b/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_chart_action.test.ts
@@ -0,0 +1,274 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ExploreDataChartAction } from './explore_data_chart_action';
+import { Params, PluginDeps } from './abstract_explore_data_action';
+import { coreMock } from '../../../../../../src/core/public/mocks';
+import { UrlGeneratorContract } from '../../../../../../src/plugins/share/public';
+import {
+  EmbeddableStart,
+  RangeSelectTriggerContext,
+  ValueClickTriggerContext,
+  ChartActionContext,
+} from '../../../../../../src/plugins/embeddable/public';
+import { i18n } from '@kbn/i18n';
+import {
+  VisualizeEmbeddableContract,
+  VISUALIZE_EMBEDDABLE_TYPE,
+} from '../../../../../../src/plugins/visualizations/public';
+import { ViewMode } from '../../../../../../src/plugins/embeddable/public';
+import { Filter, TimeRange } from '../../../../../../src/plugins/data/public';
+
+const i18nTranslateSpy = (i18n.translate as unknown) as jest.SpyInstance;
+
+jest.mock('@kbn/i18n', () => ({
+  i18n: {
+    translate: jest.fn((key, options) => options.defaultMessage),
+  },
+}));
+
+afterEach(() => {
+  i18nTranslateSpy.mockClear();
+});
+
+const setup = ({ useRangeEvent = false }: { useRangeEvent?: boolean } = {}) => {
+  type UrlGenerator = UrlGeneratorContract<'DISCOVER_APP_URL_GENERATOR'>;
+
+  const core = coreMock.createStart();
+
+  const urlGenerator: UrlGenerator = ({
+    createUrl: jest.fn(() => Promise.resolve('/xyz/app/discover/foo#bar')),
+  } as unknown) as UrlGenerator;
+
+  const filtersAndTimeRangeFromContext = jest.fn((async () => ({
+    filters: [],
+  })) as EmbeddableStart['filtersAndTimeRangeFromContext']);
+
+  const plugins: PluginDeps = {
+    discover: {
+      urlGenerator,
+    },
+    embeddable: {
+      filtersAndTimeRangeFromContext,
+    },
+  };
+
+  const params: Params = {
+    start: () => ({
+      plugins,
+      self: {},
+      core,
+    }),
+  };
+  const action = new ExploreDataChartAction(params);
+
+  const input = {
+    viewMode: ViewMode.VIEW,
+  };
+
+  const output = {
+    indexPatterns: [
+      {
+        id: 'index-ptr-foo',
+      },
+    ],
+  };
+
+  const embeddable: VisualizeEmbeddableContract = ({
+    type: VISUALIZE_EMBEDDABLE_TYPE,
+    getInput: () => input,
+    getOutput: () => output,
+  } as unknown) as VisualizeEmbeddableContract;
+
+  const data: ChartActionContext<typeof embeddable>['data'] = {
+    ...(useRangeEvent
+      ? ({ range: {} } as RangeSelectTriggerContext['data'])
+      : ({ data: [] } as ValueClickTriggerContext['data'])),
+    timeFieldName: 'order_date',
+  };
+
+  const context = {
+    embeddable,
+    data,
+  } as ChartActionContext<typeof embeddable>;
+
+  return { core, plugins, urlGenerator, params, action, input, output, embeddable, data, context };
+};
+
+describe('"Explore underlying data" panel action', () => {
+  test('action has Discover icon', () => {
+    const { action, context } = setup();
+    expect(action.getIconType(context)).toBe('discoverApp');
+  });
+
+  test('title is "Explore underlying data"', () => {
+    const { action, context } = setup();
+    expect(action.getDisplayName(context)).toBe('Explore underlying data');
+  });
+
+  test('translates title', () => {
+    expect(i18nTranslateSpy).toHaveBeenCalledTimes(0);
+
+    const { action, context } = setup();
+    action.getDisplayName(context);
+
+    expect(i18nTranslateSpy).toHaveBeenCalledTimes(1);
+    expect(i18nTranslateSpy.mock.calls[0][0]).toBe(
+      'xpack.discover.FlyoutCreateDrilldownAction.displayName'
+    );
+  });
+
+  describe('isCompatible()', () => {
+    test('returns true when all conditions are met', async () => {
+      const { action, context } = setup();
+
+      const isCompatible = await action.isCompatible(context);
+
+      expect(isCompatible).toBe(true);
+    });
+
+    test('returns false when URL generator is not present', async () => {
+      const { action, plugins, context } = setup();
+      (plugins.discover as any).urlGenerator = undefined;
+
+      const isCompatible = await action.isCompatible(context);
+
+      expect(isCompatible).toBe(false);
+    });
+
+    test('returns false if embeddable is not Visualize embeddable', async () => {
+      const { action, embeddable, context } = setup();
+      (embeddable as any).type = 'NOT_VISUALIZE_EMBEDDABLE';
+
+      const isCompatible = await action.isCompatible(context);
+
+      expect(isCompatible).toBe(false);
+    });
+
+    test('returns false if embeddable does not have index patterns', async () => {
+      const { action, output, context } = setup();
+      delete output.indexPatterns;
+
+      const isCompatible = await action.isCompatible(context);
+
+      expect(isCompatible).toBe(false);
+    });
+
+    test('returns false if embeddable index patterns are empty', async () => {
+      const { action, output, context } = setup();
+      output.indexPatterns = [];
+
+      const isCompatible = await action.isCompatible(context);
+
+      expect(isCompatible).toBe(false);
+    });
+
+    test('returns false if dashboard is in edit mode', async () => {
+      const { action, input, context } = setup();
+      input.viewMode = ViewMode.EDIT;
+
+      const isCompatible = await action.isCompatible(context);
+
+      expect(isCompatible).toBe(false);
+    });
+  });
+
+  describe('getHref()', () => {
+    test('returns URL path generated by URL generator', async () => {
+      const { action, context } = setup();
+
+      const href = await action.getHref(context);
+
+      expect(href).toBe('/xyz/app/discover/foo#bar');
+    });
+
+    test('calls URL generator with right arguments', async () => {
+      const { action, urlGenerator, context } = setup();
+
+      expect(urlGenerator.createUrl).toHaveBeenCalledTimes(0);
+
+      await action.getHref(context);
+
+      expect(urlGenerator.createUrl).toHaveBeenCalledTimes(1);
+      expect(urlGenerator.createUrl).toHaveBeenCalledWith({
+        filters: [],
+        indexPatternId: 'index-ptr-foo',
+        timeRange: undefined,
+      });
+    });
+
+    test('applies chart event filters', async () => {
+      const { action, context, urlGenerator, plugins } = setup();
+
+      ((plugins.embeddable
+        .filtersAndTimeRangeFromContext as unknown) as jest.SpyInstance).mockImplementation(() => {
+        const filters: Filter[] = [
+          {
+            meta: {
+              alias: 'alias',
+              disabled: false,
+              negate: false,
+            },
+          },
+        ];
+        const timeRange: TimeRange = {
+          from: 'from',
+          to: 'to',
+        };
+        return { filters, timeRange };
+      });
+
+      expect(plugins.embeddable.filtersAndTimeRangeFromContext).toHaveBeenCalledTimes(0);
+
+      await action.getHref(context);
+
+      expect(plugins.embeddable.filtersAndTimeRangeFromContext).toHaveBeenCalledTimes(1);
+      expect(plugins.embeddable.filtersAndTimeRangeFromContext).toHaveBeenCalledWith(context);
+      expect(urlGenerator.createUrl).toHaveBeenCalledWith({
+        filters: [
+          {
+            meta: {
+              alias: 'alias',
+              disabled: false,
+              negate: false,
+            },
+          },
+        ],
+        indexPatternId: 'index-ptr-foo',
+        timeRange: {
+          from: 'from',
+          to: 'to',
+        },
+      });
+    });
+  });
+
+  describe('execute()', () => {
+    test('calls platform SPA navigation method', async () => {
+      const { action, context, core } = setup();
+
+      expect(core.application.navigateToApp).toHaveBeenCalledTimes(0);
+
+      await action.execute(context);
+
+      expect(core.application.navigateToApp).toHaveBeenCalledTimes(1);
+    });
+
+    test('calls platform SPA navigation method with right arguments', async () => {
+      const { action, context, core } = setup();
+
+      await action.execute(context);
+
+      expect(core.application.navigateToApp).toHaveBeenCalledTimes(1);
+      expect(core.application.navigateToApp.mock.calls[0]).toEqual([
+        'discover',
+        {
+          path: '/foo#bar',
+        },
+      ]);
+    });
+  });
+});
diff --git a/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_chart_action.ts b/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_chart_action.ts
new file mode 100644
index 000000000000..359f14959c6a
--- /dev/null
+++ b/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_chart_action.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Action } from '../../../../../../src/plugins/ui_actions/public';
+import {
+  ValueClickTriggerContext,
+  RangeSelectTriggerContext,
+} from '../../../../../../src/plugins/embeddable/public';
+import { DiscoverUrlGeneratorState } from '../../../../../../src/plugins/discover/public';
+import { isTimeRange, isQuery, isFilters } from '../../../../../../src/plugins/data/public';
+import { KibanaURL } from './kibana_url';
+import * as shared from './shared';
+import { AbstractExploreDataAction } from './abstract_explore_data_action';
+
+export type ExploreDataChartActionContext = ValueClickTriggerContext | RangeSelectTriggerContext;
+
+export const ACTION_EXPLORE_DATA_CHART = 'ACTION_EXPLORE_DATA_CHART';
+
+/**
+ * This is "Explore underlying data" action which appears in popup context
+ * menu when user clicks a value in visualization or brushes a time range.
+ */
+export class ExploreDataChartAction extends AbstractExploreDataAction<ExploreDataChartActionContext>
+  implements Action<ExploreDataChartActionContext> {
+  public readonly id = ACTION_EXPLORE_DATA_CHART;
+
+  public readonly type = ACTION_EXPLORE_DATA_CHART;
+
+  public readonly order = 200;
+
+  protected readonly getUrl = async (
+    context: ExploreDataChartActionContext
+  ): Promise<KibanaURL> => {
+    const { plugins } = this.params.start();
+    const { urlGenerator } = plugins.discover;
+
+    if (!urlGenerator) {
+      throw new Error('Discover URL generator not available.');
+    }
+
+    const { embeddable } = context;
+    const { filters, timeRange } = await plugins.embeddable.filtersAndTimeRangeFromContext(context);
+    const state: DiscoverUrlGeneratorState = {
+      filters,
+      timeRange,
+    };
+
+    if (embeddable) {
+      state.indexPatternId = shared.getIndexPattern(embeddable) || undefined;
+
+      const input = embeddable.getInput();
+
+      if (isTimeRange(input.timeRange) && !state.timeRange) state.timeRange = input.timeRange;
+      if (isQuery(input.query)) state.query = input.query;
+      if (isFilters(input.filters)) state.filters = [...input.filters, ...(state.filters || [])];
+    }
+
+    const path = await urlGenerator.createUrl(state);
+
+    return new KibanaURL(path);
+  };
+}
diff --git a/x-pack/plugins/discover_enhanced/public/actions/view_in_discover/explore_data_context_menu_action.test.ts b/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_context_menu_action.test.ts
similarity index 88%
rename from x-pack/plugins/discover_enhanced/public/actions/view_in_discover/explore_data_context_menu_action.test.ts
rename to x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_context_menu_action.test.ts
index a7167d2e2e69..e742b6938097 100644
--- a/x-pack/plugins/discover_enhanced/public/actions/view_in_discover/explore_data_context_menu_action.test.ts
+++ b/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_context_menu_action.test.ts
@@ -4,14 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  ExploreDataContextMenuAction,
-  ACTION_EXPLORE_DATA,
-  Params,
-  PluginDeps,
-} from './explore_data_context_menu_action';
+import { ExploreDataContextMenuAction } from './explore_data_context_menu_action';
+import { Params, PluginDeps } from './abstract_explore_data_action';
 import { coreMock } from '../../../../../../src/core/public/mocks';
 import { UrlGeneratorContract } from '../../../../../../src/plugins/share/public';
+import { EmbeddableStart } from '../../../../../../src/plugins/embeddable/public';
 import { i18n } from '@kbn/i18n';
 import {
   VisualizeEmbeddableContract,
@@ -37,14 +34,20 @@ const setup = () => {
   const core = coreMock.createStart();
 
   const urlGenerator: UrlGenerator = ({
-    id: ACTION_EXPLORE_DATA,
     createUrl: jest.fn(() => Promise.resolve('/xyz/app/discover/foo#bar')),
   } as unknown) as UrlGenerator;
 
+  const filtersAndTimeRangeFromContext = jest.fn((async () => ({
+    filters: [],
+  })) as EmbeddableStart['filtersAndTimeRangeFromContext']);
+
   const plugins: PluginDeps = {
     discover: {
       urlGenerator,
     },
+    embeddable: {
+      filtersAndTimeRangeFromContext,
+    },
   };
 
   const params: Params = {
@@ -83,19 +86,20 @@ const setup = () => {
 
 describe('"Explore underlying data" panel action', () => {
   test('action has Discover icon', () => {
-    const { action } = setup();
-    expect(action.getIconType()).toBe('discoverApp');
+    const { action, context } = setup();
+    expect(action.getIconType(context)).toBe('discoverApp');
   });
 
   test('title is "Explore underlying data"', () => {
-    const { action } = setup();
-    expect(action.getDisplayName()).toBe('Explore underlying data');
+    const { action, context } = setup();
+    expect(action.getDisplayName(context)).toBe('Explore underlying data');
   });
 
   test('translates title', () => {
     expect(i18nTranslateSpy).toHaveBeenCalledTimes(0);
 
-    setup().action.getDisplayName();
+    const { action, context } = setup();
+    action.getDisplayName(context);
 
     expect(i18nTranslateSpy).toHaveBeenCalledTimes(1);
     expect(i18nTranslateSpy.mock.calls[0][0]).toBe(
diff --git a/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_context_menu_action.ts b/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_context_menu_action.ts
new file mode 100644
index 000000000000..6691089f875d
--- /dev/null
+++ b/x-pack/plugins/discover_enhanced/public/actions/explore_data/explore_data_context_menu_action.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Action } from '../../../../../../src/plugins/ui_actions/public';
+import { EmbeddableContext } from '../../../../../../src/plugins/embeddable/public';
+import { DiscoverUrlGeneratorState } from '../../../../../../src/plugins/discover/public';
+import { isTimeRange, isQuery, isFilters } from '../../../../../../src/plugins/data/public';
+import { KibanaURL } from './kibana_url';
+import * as shared from './shared';
+import { AbstractExploreDataAction } from './abstract_explore_data_action';
+
+export const ACTION_EXPLORE_DATA = 'ACTION_EXPLORE_DATA';
+
+/**
+ * This is "Explore underlying data" action which appears in the context
+ * menu of a dashboard panel.
+ */
+export class ExploreDataContextMenuAction extends AbstractExploreDataAction<EmbeddableContext>
+  implements Action<EmbeddableContext> {
+  public readonly id = ACTION_EXPLORE_DATA;
+
+  public readonly type = ACTION_EXPLORE_DATA;
+
+  public readonly order = 200;
+
+  protected readonly getUrl = async (context: EmbeddableContext): Promise<KibanaURL> => {
+    const { plugins } = this.params.start();
+    const { urlGenerator } = plugins.discover;
+
+    if (!urlGenerator) {
+      throw new Error('Discover URL generator not available.');
+    }
+
+    const { embeddable } = context;
+    const state: DiscoverUrlGeneratorState = {};
+
+    if (embeddable) {
+      state.indexPatternId = shared.getIndexPattern(embeddable) || undefined;
+
+      const input = embeddable.getInput();
+
+      if (isTimeRange(input.timeRange) && !state.timeRange) state.timeRange = input.timeRange;
+      if (isQuery(input.query)) state.query = input.query;
+      if (isFilters(input.filters)) state.filters = [...input.filters, ...(state.filters || [])];
+    }
+
+    const path = await urlGenerator.createUrl(state);
+
+    return new KibanaURL(path);
+  };
+}
diff --git a/x-pack/plugins/discover_enhanced/public/actions/view_in_discover/index.ts b/x-pack/plugins/discover_enhanced/public/actions/explore_data/index.ts
similarity index 86%
rename from x-pack/plugins/discover_enhanced/public/actions/view_in_discover/index.ts
rename to x-pack/plugins/discover_enhanced/public/actions/explore_data/index.ts
index 878862136538..e6d7d4b59149 100644
--- a/x-pack/plugins/discover_enhanced/public/actions/view_in_discover/index.ts
+++ b/x-pack/plugins/discover_enhanced/public/actions/explore_data/index.ts
@@ -5,3 +5,4 @@
  */
 
 export * from './explore_data_context_menu_action';
+export * from './explore_data_chart_action';
diff --git a/x-pack/plugins/discover_enhanced/public/actions/explore_data/kibana_url.ts b/x-pack/plugins/discover_enhanced/public/actions/explore_data/kibana_url.ts
new file mode 100644
index 000000000000..3c25fc2b3c3d
--- /dev/null
+++ b/x-pack/plugins/discover_enhanced/public/actions/explore_data/kibana_url.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+// TODO: Replace this logic with KibanaURL once it is available.
+// https://github.com/elastic/kibana/issues/64497
+export class KibanaURL {
+  public readonly path: string;
+  public readonly appName: string;
+  public readonly appPath: string;
+
+  constructor(path: string) {
+    const match = path.match(/^.*\/app\/([^\/#]+)(.+)$/);
+
+    if (!match) {
+      throw new Error('Unexpected Discover URL path.');
+    }
+
+    const [, appName, appPath] = match;
+
+    if (!appName || !appPath) {
+      throw new Error('Could not parse Discover URL path.');
+    }
+
+    this.path = path;
+    this.appName = appName;
+    this.appPath = appPath;
+  }
+}
diff --git a/x-pack/plugins/discover_enhanced/public/actions/explore_data/shared.ts b/x-pack/plugins/discover_enhanced/public/actions/explore_data/shared.ts
new file mode 100644
index 000000000000..fa2168df944b
--- /dev/null
+++ b/x-pack/plugins/discover_enhanced/public/actions/explore_data/shared.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEmbeddable } from '../../../../../../src/plugins/embeddable/public';
+import {
+  VISUALIZE_EMBEDDABLE_TYPE,
+  VisualizeEmbeddableContract,
+} from '../../../../../../src/plugins/visualizations/public';
+
+export const isOutputWithIndexPatterns = (
+  output: unknown
+): output is { indexPatterns: Array<{ id: string }> } => {
+  if (!output || typeof output !== 'object') return false;
+  return Array.isArray((output as any).indexPatterns);
+};
+
+export const isVisualizeEmbeddable = (
+  embeddable?: IEmbeddable
+): embeddable is VisualizeEmbeddableContract =>
+  embeddable && embeddable?.type === VISUALIZE_EMBEDDABLE_TYPE ? true : false;
+
+/**
+ * @returns Returns empty string if no index pattern ID found.
+ */
+export const getIndexPattern = (embeddable?: IEmbeddable): string => {
+  if (!embeddable) return '';
+  const output = embeddable.getOutput();
+
+  if (isOutputWithIndexPatterns(output) && output.indexPatterns.length > 0) {
+    return output.indexPatterns[0].id;
+  }
+
+  return '';
+};
diff --git a/x-pack/plugins/discover_enhanced/public/actions/index.ts b/x-pack/plugins/discover_enhanced/public/actions/index.ts
index cbb955fa4634..209ae6bee09b 100644
--- a/x-pack/plugins/discover_enhanced/public/actions/index.ts
+++ b/x-pack/plugins/discover_enhanced/public/actions/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export * from './view_in_discover';
+export * from './explore_data';
diff --git a/x-pack/plugins/discover_enhanced/public/actions/view_in_discover/explore_data_context_menu_action.ts b/x-pack/plugins/discover_enhanced/public/actions/view_in_discover/explore_data_context_menu_action.ts
deleted file mode 100644
index d66ca129934a..000000000000
--- a/x-pack/plugins/discover_enhanced/public/actions/view_in_discover/explore_data_context_menu_action.ts
+++ /dev/null
@@ -1,156 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-/* eslint-disable max-classes-per-file */
-
-import { i18n } from '@kbn/i18n';
-import { Action } from '../../../../../../src/plugins/ui_actions/public';
-import { DiscoverStart } from '../../../../../../src/plugins/discover/public';
-import {
-  EmbeddableContext,
-  IEmbeddable,
-  ViewMode,
-} from '../../../../../../src/plugins/embeddable/public';
-import { StartServicesGetter } from '../../../../../../src/plugins/kibana_utils/public';
-import { CoreStart } from '../../../../../../src/core/public';
-import {
-  VisualizeEmbeddableContract,
-  VISUALIZE_EMBEDDABLE_TYPE,
-} from '../../../../../../src/plugins/visualizations/public';
-
-// TODO: Replace this logic with KibanaURL once it is available.
-// https://github.com/elastic/kibana/issues/64497
-class KibanaURL {
-  public readonly path: string;
-  public readonly appName: string;
-  public readonly appPath: string;
-
-  constructor(path: string) {
-    const match = path.match(/^.*\/app\/([^\/#]+)(.+)$/);
-
-    if (!match) {
-      throw new Error('Unexpected Discover URL path.');
-    }
-
-    const [, appName, appPath] = match;
-
-    if (!appName || !appPath) {
-      throw new Error('Could not parse Discover URL path.');
-    }
-
-    this.path = path;
-    this.appName = appName;
-    this.appPath = appPath;
-  }
-}
-
-export const ACTION_EXPLORE_DATA = 'ACTION_EXPLORE_DATA';
-
-const isOutputWithIndexPatterns = (
-  output: unknown
-): output is { indexPatterns: Array<{ id: string }> } => {
-  if (!output || typeof output !== 'object') return false;
-  return Array.isArray((output as any).indexPatterns);
-};
-
-const isVisualizeEmbeddable = (
-  embeddable: IEmbeddable
-): embeddable is VisualizeEmbeddableContract => embeddable?.type === VISUALIZE_EMBEDDABLE_TYPE;
-
-export interface PluginDeps {
-  discover: Pick<DiscoverStart, 'urlGenerator'>;
-}
-
-export interface CoreDeps {
-  application: Pick<CoreStart['application'], 'navigateToApp'>;
-}
-
-export interface Params {
-  start: StartServicesGetter<PluginDeps, unknown, CoreDeps>;
-}
-
-export class ExploreDataContextMenuAction implements Action<EmbeddableContext> {
-  public readonly id = ACTION_EXPLORE_DATA;
-
-  public readonly type = ACTION_EXPLORE_DATA;
-
-  public readonly order = 200;
-
-  constructor(private readonly params: Params) {}
-
-  public getDisplayName() {
-    return i18n.translate('xpack.discover.FlyoutCreateDrilldownAction.displayName', {
-      defaultMessage: 'Explore underlying data',
-    });
-  }
-
-  public getIconType() {
-    return 'discoverApp';
-  }
-
-  public async isCompatible({ embeddable }: EmbeddableContext) {
-    if (!this.params.start().plugins.discover.urlGenerator) return false;
-    if (!isVisualizeEmbeddable(embeddable)) return false;
-    if (!this.getIndexPattern(embeddable)) return false;
-    if (embeddable.getInput().viewMode !== ViewMode.VIEW) return false;
-    return true;
-  }
-
-  public async execute({ embeddable }: EmbeddableContext) {
-    if (!isVisualizeEmbeddable(embeddable)) return;
-
-    const { core } = this.params.start();
-    const { appName, appPath } = await this.getUrl(embeddable);
-
-    await core.application.navigateToApp(appName, {
-      path: appPath,
-    });
-  }
-
-  public async getHref({ embeddable }: EmbeddableContext): Promise<string> {
-    if (!isVisualizeEmbeddable(embeddable)) {
-      throw new Error(`Embeddable not supported for "${this.getDisplayName()}" action.`);
-    }
-
-    const { path } = await this.getUrl(embeddable);
-
-    return path;
-  }
-
-  private async getUrl(embeddable: VisualizeEmbeddableContract): Promise<KibanaURL> {
-    const { plugins } = this.params.start();
-    const { urlGenerator } = plugins.discover;
-
-    if (!urlGenerator) {
-      throw new Error('Discover URL generator not available.');
-    }
-
-    const { timeRange, query, filters } = embeddable.getInput();
-    const indexPatternId = this.getIndexPattern(embeddable);
-
-    const path = await urlGenerator.createUrl({
-      indexPatternId,
-      filters,
-      query,
-      timeRange,
-    });
-
-    return new KibanaURL(path);
-  }
-
-  /**
-   * @returns Returns empty string if no index pattern ID found.
-   */
-  private getIndexPattern(embeddable: VisualizeEmbeddableContract): string {
-    const output = embeddable!.getOutput();
-
-    if (isOutputWithIndexPatterns(output) && output.indexPatterns.length > 0) {
-      return output.indexPatterns[0].id;
-    }
-
-    return '';
-  }
-}
diff --git a/x-pack/plugins/discover_enhanced/public/plugin.ts b/x-pack/plugins/discover_enhanced/public/plugin.ts
index f55c5dab3449..ea3c1222eb36 100644
--- a/x-pack/plugins/discover_enhanced/public/plugin.ts
+++ b/x-pack/plugins/discover_enhanced/public/plugin.ts
@@ -6,7 +6,12 @@
 
 import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
 import { PluginInitializerContext } from 'kibana/public';
-import { UiActionsSetup, UiActionsStart } from '../../../../src/plugins/ui_actions/public';
+import {
+  UiActionsSetup,
+  UiActionsStart,
+  SELECT_RANGE_TRIGGER,
+  VALUE_CLICK_TRIGGER,
+} from '../../../../src/plugins/ui_actions/public';
 import { createStartServicesGetter } from '../../../../src/plugins/kibana_utils/public';
 import { DiscoverSetup, DiscoverStart } from '../../../../src/plugins/discover/public';
 import { SharePluginSetup, SharePluginStart } from '../../../../src/plugins/share/public';
@@ -16,11 +21,18 @@ import {
   EmbeddableContext,
   CONTEXT_MENU_TRIGGER,
 } from '../../../../src/plugins/embeddable/public';
-import { ExploreDataContextMenuAction, ACTION_EXPLORE_DATA } from './actions';
+import {
+  ExploreDataContextMenuAction,
+  ExploreDataChartAction,
+  ACTION_EXPLORE_DATA,
+  ACTION_EXPLORE_DATA_CHART,
+  ExploreDataChartActionContext,
+} from './actions';
 
 declare module '../../../../src/plugins/ui_actions/public' {
   export interface ActionContextMapping {
     [ACTION_EXPLORE_DATA]: EmbeddableContext;
+    [ACTION_EXPLORE_DATA_CHART]: ExploreDataChartActionContext;
   }
 }
 
@@ -48,10 +60,17 @@ export class DiscoverEnhancedPlugin
     { uiActions, share }: DiscoverEnhancedSetupDependencies
   ) {
     const start = createStartServicesGetter(core.getStartServices);
+    const isSharePluginInstalled = !!share;
 
-    if (!!share) {
-      const exploreDataAction = new ExploreDataContextMenuAction({ start });
+    if (isSharePluginInstalled) {
+      const params = { start };
+
+      const exploreDataAction = new ExploreDataContextMenuAction(params);
       uiActions.addTriggerAction(CONTEXT_MENU_TRIGGER, exploreDataAction);
+
+      const exploreDataChartAction = new ExploreDataChartAction(params);
+      uiActions.addTriggerAction(SELECT_RANGE_TRIGGER, exploreDataChartAction);
+      uiActions.addTriggerAction(VALUE_CLICK_TRIGGER, exploreDataChartAction);
     }
   }
 
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_drilldowns.ts b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_drilldowns.ts
index bcdd3d1f82e7..29ead0db1c63 100644
--- a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_drilldowns.ts
+++ b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_drilldowns.ts
@@ -59,7 +59,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       );
 
       // trigger drilldown action by clicking on a pie and picking drilldown action by it's name
-      await pieChart.filterOnPieSlice('40,000');
+      await pieChart.clickOnPieSlice('40,000');
       await dashboardDrilldownPanelActions.expectMultipleActionsMenuOpened();
 
       const href = await dashboardDrilldownPanelActions.getActionHrefByText(
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/explore_data_chart_action.ts b/x-pack/test/functional/apps/dashboard/drilldowns/explore_data_chart_action.ts
new file mode 100644
index 000000000000..12363f8800c2
--- /dev/null
+++ b/x-pack/test/functional/apps/dashboard/drilldowns/explore_data_chart_action.ts
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+const ACTION_ID = 'ACTION_EXPLORE_DATA_CHART';
+const ACTION_TEST_SUBJ = `embeddablePanelAction-${ACTION_ID}`;
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const drilldowns = getService('dashboardDrilldownsManage');
+  const { dashboard, discover, common, timePicker } = getPageObjects([
+    'dashboard',
+    'discover',
+    'common',
+    'timePicker',
+  ]);
+  const testSubjects = getService('testSubjects');
+  const pieChart = getService('pieChart');
+  const dashboardDrilldownPanelActions = getService('dashboardDrilldownPanelActions');
+  const filterBar = getService('filterBar');
+  const browser = getService('browser');
+
+  describe('Explore underlying data - chart action', () => {
+    describe('value click action', () => {
+      it('action exists in chart click popup menu', async () => {
+        await common.navigateToApp('dashboard');
+        await dashboard.preserveCrossAppState();
+        await dashboard.loadSavedDashboard(drilldowns.DASHBOARD_WITH_PIE_CHART_NAME);
+        await pieChart.clickOnPieSlice('160,000');
+        await dashboardDrilldownPanelActions.expectMultipleActionsMenuOpened();
+        await testSubjects.existOrFail(ACTION_TEST_SUBJ);
+      });
+
+      it('action is a link <a> element', async () => {
+        const actionElement = await testSubjects.find(ACTION_TEST_SUBJ);
+        const tag = await actionElement.getTagName();
+        const href = await actionElement.getAttribute('href');
+
+        expect(tag.toLowerCase()).to.be('a');
+        expect(typeof href).to.be('string');
+        expect(href.length > 5).to.be(true);
+      });
+
+      it('navigates to Discover app on action click carrying over pie slice filter', async () => {
+        await testSubjects.clickWhenNotDisabled(ACTION_TEST_SUBJ);
+        await discover.waitForDiscoverAppOnScreen();
+        await filterBar.hasFilter('memory', '160,000 to 200,000');
+        const filterCount = await filterBar.getFilterCount();
+
+        expect(filterCount).to.be(1);
+      });
+    });
+
+    describe('brush action', () => {
+      let originalTimeRangeDurationHours: number | undefined;
+
+      it('action exists in chart brush popup menu', async () => {
+        await common.navigateToApp('dashboard');
+        await dashboard.preserveCrossAppState();
+        await dashboard.loadSavedDashboard(drilldowns.DASHBOARD_WITH_AREA_CHART_NAME);
+
+        originalTimeRangeDurationHours = await timePicker.getTimeDurationInHours();
+        const areaChart = await testSubjects.find('visualizationLoader');
+        await browser.dragAndDrop(
+          {
+            location: areaChart,
+            offset: {
+              x: -100,
+              y: 0,
+            },
+          },
+          {
+            location: areaChart,
+            offset: {
+              x: 100,
+              y: 0,
+            },
+          }
+        );
+
+        await dashboardDrilldownPanelActions.expectMultipleActionsMenuOpened();
+        await testSubjects.existOrFail(ACTION_TEST_SUBJ);
+      });
+
+      it('navigates to Discover on click carrying over brushed time range', async () => {
+        await testSubjects.clickWhenNotDisabled(ACTION_TEST_SUBJ);
+        await discover.waitForDiscoverAppOnScreen();
+        const newTimeRangeDurationHours = await timePicker.getTimeDurationInHours();
+
+        expect(newTimeRangeDurationHours).to.be.lessThan(originalTimeRangeDurationHours as number);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/explore_data_panel_action.ts b/x-pack/test/functional/apps/dashboard/drilldowns/explore_data_panel_action.ts
index 24d6e820ac0e..fedc83a2f81c 100644
--- a/x-pack/test/functional/apps/dashboard/drilldowns/explore_data_panel_action.ts
+++ b/x-pack/test/functional/apps/dashboard/drilldowns/explore_data_panel_action.ts
@@ -8,7 +8,7 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
 const ACTION_ID = 'ACTION_EXPLORE_DATA';
-const EXPLORE_RAW_DATA_ACTION_TEST_SUBJ = `embeddablePanelAction-${ACTION_ID}`;
+const ACTION_TEST_SUBJ = `embeddablePanelAction-${ACTION_ID}`;
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const drilldowns = getService('dashboardDrilldownsManage');
@@ -24,31 +24,46 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const kibanaServer = getService('kibanaServer');
 
   describe('Explore underlying data - panel action', function () {
-    before(async () => {
-      await kibanaServer.uiSettings.replace({ defaultIndex: 'logstash*' });
+    before(
+      'change default index pattern to verify action navigates to correct index pattern',
+      async () => {
+        await kibanaServer.uiSettings.replace({ defaultIndex: 'logstash*' });
+      }
+    );
+
+    before('start on Dashboard landing page', async () => {
       await common.navigateToApp('dashboard');
       await dashboard.preserveCrossAppState();
     });
 
-    after(async () => {
+    after('set back default index pattern', async () => {
       await kibanaServer.uiSettings.replace({ defaultIndex: 'logstash-*' });
     });
 
+    after('clean-up custom time range on panel', async () => {
+      await common.navigateToApp('dashboard');
+      await dashboard.gotoDashboardEditMode(drilldowns.DASHBOARD_WITH_PIE_CHART_NAME);
+      await panelActions.openContextMenu();
+      await panelActionsTimeRange.clickTimeRangeActionInContextMenu();
+      await panelActionsTimeRange.clickRemovePerPanelTimeRangeButton();
+      await dashboard.saveDashboard('Dashboard with Pie Chart');
+    });
+
     it('action exists in panel context menu', async () => {
       await dashboard.loadSavedDashboard(drilldowns.DASHBOARD_WITH_PIE_CHART_NAME);
       await panelActions.openContextMenu();
-      await testSubjects.existOrFail(EXPLORE_RAW_DATA_ACTION_TEST_SUBJ);
+      await testSubjects.existOrFail(ACTION_TEST_SUBJ);
     });
 
     it('is a link <a> element', async () => {
-      const actionElement = await testSubjects.find(EXPLORE_RAW_DATA_ACTION_TEST_SUBJ);
+      const actionElement = await testSubjects.find(ACTION_TEST_SUBJ);
       const tag = await actionElement.getTagName();
 
       expect(tag.toLowerCase()).to.be('a');
     });
 
     it('navigates to Discover app to index pattern of the panel on action click', async () => {
-      await testSubjects.clickWhenNotDisabled(EXPLORE_RAW_DATA_ACTION_TEST_SUBJ);
+      await testSubjects.clickWhenNotDisabled(ACTION_TEST_SUBJ);
       await discover.waitForDiscoverAppOnScreen();
 
       const el = await testSubjects.find('indexPattern-switch-link');
@@ -71,7 +86,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await dashboard.saveDashboard('Dashboard with Pie Chart');
 
       await panelActions.openContextMenu();
-      await testSubjects.clickWhenNotDisabled(EXPLORE_RAW_DATA_ACTION_TEST_SUBJ);
+      await testSubjects.clickWhenNotDisabled(ACTION_TEST_SUBJ);
       await discover.waitForDiscoverAppOnScreen();
 
       const text = await timePicker.getShowDatesButtonText();
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/index.ts b/x-pack/test/functional/apps/dashboard/drilldowns/index.ts
index 19d85ad0e448..4cdb33c06947 100644
--- a/x-pack/test/functional/apps/dashboard/drilldowns/index.ts
+++ b/x-pack/test/functional/apps/dashboard/drilldowns/index.ts
@@ -24,5 +24,6 @@ export default function ({ loadTestFile, getService }: FtrProviderContext) {
 
     loadTestFile(require.resolve('./dashboard_drilldowns'));
     loadTestFile(require.resolve('./explore_data_panel_action'));
+    loadTestFile(require.resolve('./explore_data_chart_action'));
   });
 }
diff --git a/x-pack/test/functional/services/dashboard/panel_time_range.ts b/x-pack/test/functional/services/dashboard/panel_time_range.ts
index 6a91a6ff0584..f71e8284c30d 100644
--- a/x-pack/test/functional/services/dashboard/panel_time_range.ts
+++ b/x-pack/test/functional/services/dashboard/panel_time_range.ts
@@ -52,5 +52,11 @@ export function DashboardPanelTimeRangeProvider({ getService }: FtrProviderConte
       const button = await this.findModalTestSubject('addPerPanelTimeRangeButton');
       await button.click();
     }
+
+    public async clickRemovePerPanelTimeRangeButton() {
+      log.debug('clickRemovePerPanelTimeRangeButton');
+      const button = await this.findModalTestSubject('removePerPanelTimeRangeButton');
+      await button.click();
+    }
   })();
 }

From 09e3f75bc3951b317973dd1f67f7b4e6c9a6ba42 Mon Sep 17 00:00:00 2001
From: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>
Date: Fri, 26 Jun 2020 08:56:09 -0400
Subject: [PATCH 44/78] [SECURITY] Redirect app/security to
 app/security/overview (#70005)

* redirect app/security to app/security/overview

* missing re-naming initialization

* add unit test for intialization value of indicesExists

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../common/containers/source/index.test.tsx   | 18 +++++++++++++
 .../public/common/containers/source/index.tsx |  2 +-
 .../public/common/translations.ts             |  4 +--
 .../security_solution/public/plugin.tsx       | 26 ++++++++++---------
 4 files changed, 35 insertions(+), 15 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx b/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
index c30c3668638a..69e4ac615ebf 100644
--- a/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
@@ -17,6 +17,24 @@ jest.mock('../../utils/apollo_context', () => ({
 }));
 
 describe('Index Fields & Browser Fields', () => {
+  test('At initialization the value of indicesExists should be true', async () => {
+    const { result, waitForNextUpdate } = renderHook(() => useWithSource());
+    const initialResult = result.current;
+
+    await waitForNextUpdate();
+
+    return expect(initialResult).toEqual({
+      browserFields: {},
+      errorMessage: null,
+      indexPattern: {
+        fields: [],
+        title: 'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,packetbeat-*,winlogbeat-*',
+      },
+      indicesExist: true,
+      loading: true,
+    });
+  });
+
   test('returns memoized value', async () => {
     const { result, waitForNextUpdate, rerender } = renderHook(() => useWithSource());
     await waitForNextUpdate();
diff --git a/x-pack/plugins/security_solution/public/common/containers/source/index.tsx b/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
index 34ac5f8f5d94..5e80953914c9 100644
--- a/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
@@ -102,7 +102,7 @@ export const useWithSource = (sourceId = 'default', indexToAdd?: string[] | null
     browserFields: EMPTY_BROWSER_FIELDS,
     errorMessage: null,
     indexPattern: getIndexFields(defaultIndex.join(), []),
-    indicesExist: undefined,
+    indicesExist: indicesExistOrDataTemporarilyUnavailable(undefined),
     loading: false,
   });
 
diff --git a/x-pack/plugins/security_solution/public/common/translations.ts b/x-pack/plugins/security_solution/public/common/translations.ts
index b5a400d187f8..677543ec0dba 100644
--- a/x-pack/plugins/security_solution/public/common/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/translations.ts
@@ -7,12 +7,12 @@
 import { i18n } from '@kbn/i18n';
 
 export const EMPTY_TITLE = i18n.translate('xpack.securitySolution.pages.common.emptyTitle', {
-  defaultMessage: 'Welcome to SIEM. Let’s get you started.',
+  defaultMessage: 'Welcome to Security Solution. Let’s get you started.',
 });
 
 export const EMPTY_MESSAGE = i18n.translate('xpack.securitySolution.pages.common.emptyMessage', {
   defaultMessage:
-    'To begin using security information and event management (SIEM), you’ll need to add SIEM-related data, in Elastic Common Schema (ECS) format, to the Elastic Stack. An easy way to get started is by installing and configuring our data shippers, called Beats. Let’s do that now!',
+    'To begin using security information and event management (Security Solution), you’ll need to add security solution related data, in Elastic Common Schema (ECS) format, to the Elastic Stack. An easy way to get started is by installing and configuring our data shippers, called Beats. Let’s do that now!',
 });
 
 export const EMPTY_ACTION_PRIMARY = i18n.translate(
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index 360c81abadc8..b247170a4a5d 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -16,6 +16,7 @@ import {
   PluginInitializerContext,
   Plugin as IPlugin,
   DEFAULT_APP_CATEGORIES,
+  AppNavLinkStatus,
 } from '../../../../src/core/public';
 import { Storage } from '../../../../src/plugins/kibana_utils/public';
 import { FeatureCatalogueCategory } from '../../../../src/plugins/home/public';
@@ -35,6 +36,7 @@ import {
   APP_CASES_PATH,
   SHOW_ENDPOINT_ALERTS_NAV,
   APP_ENDPOINT_ALERTS_PATH,
+  APP_PATH,
 } from '../common/constants';
 import { ConfigureEndpointDatasource } from './management/pages/policy/view/ingest_manager_integration/configure_datasource';
 
@@ -86,18 +88,18 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       return { coreStart, startPlugins, services, store: this.store, storage };
     };
 
-    // Waiting for https://github.com/elastic/kibana/issues/69110
-    // core.application.register({
-    //   id: APP_ID,
-    //   title: 'Security',
-    //   appRoute: APP_PATH,
-    //   navLinkStatus: AppNavLinkStatus.hidden,
-    //   mount: async (params: AppMountParameters) => {
-    //     const [{ application }] = await core.getStartServices();
-    //     application.navigateToApp(`${APP_ID}:${SecurityPageName.overview}`, { replace: true });
-    //     return () => true;
-    //   },
-    // });
+    core.application.register({
+      exactRoute: true,
+      id: APP_ID,
+      title: 'Security',
+      appRoute: APP_PATH,
+      navLinkStatus: AppNavLinkStatus.hidden,
+      mount: async (params: AppMountParameters) => {
+        const [{ application }] = await core.getStartServices();
+        application.navigateToApp(`${APP_ID}:${SecurityPageName.overview}`, { replace: true });
+        return () => true;
+      },
+    });
 
     core.application.register({
       id: `${APP_ID}:${SecurityPageName.overview}`,

From ae7e9d9ad5748f73786f660d36f081e400b3a777 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20Haro?=
 <alejandro.haro@elastic.co>
Date: Fri, 26 Jun 2020 13:57:17 +0100
Subject: [PATCH 45/78] [License Management] Do not break when
 `telemetry.enabled:false` (#69711)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../public/application/app_context.tsx        |  4 +-
 .../opt_in_example_flyout.tsx                 | 11 ++++++
 .../telemetry_opt_in/telemetry_opt_in.tsx     | 37 +++++++++++++------
 .../public/application/lib/telemetry.ts       | 11 +++---
 .../start_trial/start_trial.tsx               |  4 +-
 .../license_management/public/plugin.ts       | 18 ++++++---
 6 files changed, 57 insertions(+), 28 deletions(-)
 create mode 100644 x-pack/plugins/license_management/public/application/components/telemetry_opt_in/opt_in_example_flyout.tsx

diff --git a/x-pack/plugins/license_management/public/application/app_context.tsx b/x-pack/plugins/license_management/public/application/app_context.tsx
index 39e7ef5f16e7..62f019682fba 100644
--- a/x-pack/plugins/license_management/public/application/app_context.tsx
+++ b/x-pack/plugins/license_management/public/application/app_context.tsx
@@ -9,7 +9,7 @@ import { ScopedHistory } from 'kibana/public';
 
 import { CoreStart } from '../../../../../src/core/public';
 import { LicensingPluginSetup, ILicense } from '../../../licensing/public';
-import { TelemetryPluginSetup } from '../../../../../src/plugins/telemetry/public';
+import { TelemetryPluginStart } from '../../../../../src/plugins/telemetry/public';
 import { ClientConfigType } from '../types';
 import { BreadcrumbService } from './breadcrumbs';
 
@@ -23,7 +23,7 @@ export interface AppDependencies {
   };
   plugins: {
     licensing: LicensingPluginSetup;
-    telemetry?: TelemetryPluginSetup;
+    telemetry?: TelemetryPluginStart;
   };
   docLinks: {
     security: string;
diff --git a/x-pack/plugins/license_management/public/application/components/telemetry_opt_in/opt_in_example_flyout.tsx b/x-pack/plugins/license_management/public/application/components/telemetry_opt_in/opt_in_example_flyout.tsx
new file mode 100644
index 000000000000..a13443ad8a0d
--- /dev/null
+++ b/x-pack/plugins/license_management/public/application/components/telemetry_opt_in/opt_in_example_flyout.tsx
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { OptInExampleFlyout } from '../../../../../../../src/plugins/telemetry_management_section/public';
+
+// required for lazy loading
+// eslint-disable-next-line import/no-default-export
+export default OptInExampleFlyout;
diff --git a/x-pack/plugins/license_management/public/application/components/telemetry_opt_in/telemetry_opt_in.tsx b/x-pack/plugins/license_management/public/application/components/telemetry_opt_in/telemetry_opt_in.tsx
index eff5c6cc21c4..92e241a375ce 100644
--- a/x-pack/plugins/license_management/public/application/components/telemetry_opt_in/telemetry_opt_in.tsx
+++ b/x-pack/plugins/license_management/public/application/components/telemetry_opt_in/telemetry_opt_in.tsx
@@ -5,13 +5,19 @@
  */
 
 import React, { Fragment } from 'react';
-import { EuiLink, EuiCheckbox, EuiSpacer, EuiText, EuiTitle, EuiPopover } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
 import {
-  OptInExampleFlyout,
-  PRIVACY_STATEMENT_URL,
-  TelemetryPluginSetup,
-} from '../../lib/telemetry';
+  EuiLink,
+  EuiCheckbox,
+  EuiSpacer,
+  EuiText,
+  EuiTitle,
+  EuiPopover,
+  EuiLoadingSpinner,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { TelemetryPluginStart } from '../../lib/telemetry';
+
+const OptInExampleFlyout = React.lazy(() => import('./opt_in_example_flyout'));
 
 interface State {
   showMoreTelemetryInfo: boolean;
@@ -22,7 +28,7 @@ interface Props {
   onOptInChange: (isOptingInToTelemetry: boolean) => void;
   isOptingInToTelemetry: boolean;
   isStartTrial: boolean;
-  telemetry: TelemetryPluginSetup;
+  telemetry: TelemetryPluginStart;
 }
 
 export class TelemetryOptIn extends React.Component<Props, State> {
@@ -54,11 +60,15 @@ export class TelemetryOptIn extends React.Component<Props, State> {
 
     let example = null;
     if (showExample) {
+      // Using React.Suspense and lazy loading here to avoid crashing the plugin when importing
+      // OptInExampleFlyout but telemetryManagementSection is disabled
       example = (
-        <OptInExampleFlyout
-          onClose={() => this.setState({ showExample: false })}
-          fetchExample={telemetry.telemetryService.fetchExample}
-        />
+        <React.Suspense fallback={<EuiLoadingSpinner />}>
+          <OptInExampleFlyout
+            onClose={() => this.setState({ showExample: false })}
+            fetchExample={telemetry.telemetryService.fetchExample}
+          />
+        </React.Suspense>
       );
     }
 
@@ -116,7 +126,10 @@ export class TelemetryOptIn extends React.Component<Props, State> {
                   </EuiLink>
                 ),
                 telemetryPrivacyStatementLink: (
-                  <EuiLink href={PRIVACY_STATEMENT_URL} target="_blank">
+                  <EuiLink
+                    href={telemetry.telemetryConstants.getPrivacyStatementUrl()}
+                    target="_blank"
+                  >
                     <FormattedMessage
                       id="xpack.licenseMgmt.telemetryOptIn.telemetryPrivacyStatementLinkText"
                       defaultMessage="telemetry privacy statement"
diff --git a/x-pack/plugins/license_management/public/application/lib/telemetry.ts b/x-pack/plugins/license_management/public/application/lib/telemetry.ts
index 421f0887a14c..2185e48acbbb 100644
--- a/x-pack/plugins/license_management/public/application/lib/telemetry.ts
+++ b/x-pack/plugins/license_management/public/application/lib/telemetry.ts
@@ -4,15 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { TelemetryPluginSetup } from '../../../../../../src/plugins/telemetry/public';
+import type { TelemetryPluginStart } from '../../../../../../src/plugins/telemetry/public';
 
-export { OptInExampleFlyout } from '../../../../../../src/plugins/telemetry_management_section/public/';
-export { PRIVACY_STATEMENT_URL } from '../../../../../../src/plugins/telemetry/common/constants';
-export { TelemetryPluginSetup, shouldShowTelemetryOptIn };
+export type { TelemetryPluginStart } from '../../../../../../src/plugins/telemetry/public';
+export { shouldShowTelemetryOptIn };
 
 function shouldShowTelemetryOptIn(
-  telemetry?: TelemetryPluginSetup
-): telemetry is TelemetryPluginSetup {
+  telemetry?: TelemetryPluginStart
+): telemetry is TelemetryPluginStart {
   if (telemetry) {
     const { telemetryService } = telemetry;
     const isOptedIn = telemetryService.getIsOptedIn();
diff --git a/x-pack/plugins/license_management/public/application/sections/license_dashboard/start_trial/start_trial.tsx b/x-pack/plugins/license_management/public/application/sections/license_dashboard/start_trial/start_trial.tsx
index 627eb0425c6d..65d40f1de200 100644
--- a/x-pack/plugins/license_management/public/application/sections/license_dashboard/start_trial/start_trial.tsx
+++ b/x-pack/plugins/license_management/public/application/sections/license_dashboard/start_trial/start_trial.tsx
@@ -26,12 +26,12 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { TelemetryOptIn } from '../../../components/telemetry_opt_in';
 import { EXTERNAL_LINKS } from '../../../../../common/constants';
 import { AppContextConsumer, AppDependencies } from '../../../app_context';
-import { TelemetryPluginSetup, shouldShowTelemetryOptIn } from '../../../lib/telemetry';
+import { TelemetryPluginStart, shouldShowTelemetryOptIn } from '../../../lib/telemetry';
 
 interface Props {
   loadTrialStatus: () => void;
   startLicenseTrial: () => void;
-  telemetry?: TelemetryPluginSetup;
+  telemetry?: TelemetryPluginStart;
   shouldShowStartTrial: boolean;
 }
 
diff --git a/x-pack/plugins/license_management/public/plugin.ts b/x-pack/plugins/license_management/public/plugin.ts
index e2e6437d12d2..2511337793fe 100644
--- a/x-pack/plugins/license_management/public/plugin.ts
+++ b/x-pack/plugins/license_management/public/plugin.ts
@@ -6,7 +6,7 @@
 import { first } from 'rxjs/operators';
 import { CoreSetup, Plugin, PluginInitializerContext } from 'src/core/public';
 
-import { TelemetryPluginSetup } from '../../../../src/plugins/telemetry/public';
+import { TelemetryPluginStart } from '../../../../src/plugins/telemetry/public';
 import { ManagementSetup, ManagementSectionId } from '../../../../src/plugins/management/public';
 import { LicensingPluginSetup } from '../../../plugins/licensing/public';
 import { PLUGIN } from '../common/constants';
@@ -14,10 +14,13 @@ import { ClientConfigType } from './types';
 import { AppDependencies } from './application';
 import { BreadcrumbService } from './application/breadcrumbs';
 
-interface PluginsDependencies {
+interface PluginsDependenciesSetup {
   management: ManagementSetup;
   licensing: LicensingPluginSetup;
-  telemetry?: TelemetryPluginSetup;
+}
+
+interface PluginsDependenciesStart {
+  telemetry?: TelemetryPluginStart;
 }
 
 export interface LicenseManagementUIPluginSetup {
@@ -31,7 +34,10 @@ export class LicenseManagementUIPlugin
 
   constructor(private readonly initializerContext: PluginInitializerContext) {}
 
-  setup(coreSetup: CoreSetup, plugins: PluginsDependencies): LicenseManagementUIPluginSetup {
+  setup(
+    coreSetup: CoreSetup<PluginsDependenciesStart>,
+    plugins: PluginsDependenciesSetup
+  ): LicenseManagementUIPluginSetup {
     const config = this.initializerContext.config.get<ClientConfigType>();
 
     if (!config.ui.enabled) {
@@ -42,14 +48,14 @@ export class LicenseManagementUIPlugin
     }
 
     const { getStartServices } = coreSetup;
-    const { management, telemetry, licensing } = plugins;
+    const { management, licensing } = plugins;
 
     management.sections.getSection(ManagementSectionId.Stack).registerApp({
       id: PLUGIN.id,
       title: PLUGIN.title,
       order: 0,
       mount: async ({ element, setBreadcrumbs, history }) => {
-        const [core] = await getStartServices();
+        const [core, { telemetry }] = await getStartServices();
         const initialLicense = await plugins.licensing.license$.pipe(first()).toPromise();
 
         // Setup documentation links

From f1a1178328617c7b687ae30da9cc1a76e4805326 Mon Sep 17 00:00:00 2001
From: Aleh Zasypkin <aleh.zasypkin@gmail.com>
Date: Fri, 26 Jun 2020 15:15:02 +0200
Subject: [PATCH 46/78] =?UTF-8?q?Upgrade=20`elliptic`=20dependency=20(`6.5?=
 =?UTF-8?q?.2`=20=E2=86=92=20`6.5.3`).=20(#70054)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/yarn.lock b/yarn.lock
index 93db6de88775..60122f8b8cde 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -12958,9 +12958,9 @@ element-resize-detector@^1.1.15:
     batch-processor "^1.0.0"
 
 elliptic@^6.0.0:
-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/elliptic/-/elliptic-6.5.2.tgz#05c5678d7173c049d8ca433552224a495d0e3762"
-  integrity sha512-f4x70okzZbIQl/NSRLkI/+tteV/9WqL98zx+SQ69KbXxmVrmjwsNUPn/gYJJ0sHvEak24cZgHIPegRePAtA/xw==
+  version "6.5.3"
+  resolved "https://registry.yarnpkg.com/elliptic/-/elliptic-6.5.3.tgz#cb59eb2efdaf73a0bd78ccd7015a62ad6e0f93d6"
+  integrity sha512-IMqzv5wNQf+E6aHeIqATs0tOLeOTwj1QKbRcS3jBbYkl5oLAserA8yJTT7/VyHUYG91PRmPyeQDObKLPpeS4dw==
   dependencies:
     bn.js "^4.4.0"
     brorand "^1.0.1"

From 9ebf41c77c9e84205df987751864d31c5a4f53df Mon Sep 17 00:00:00 2001
From: Kevin Qualters <56408403+kqualters-elastic@users.noreply.github.com>
Date: Fri, 26 Jun 2020 09:42:10 -0400
Subject: [PATCH 47/78] [Endpoint] use rbush to only render to DOM resolver
 nodes that are in view (#68957)

* [Endpoint] use rbush to only render resolver nodes that are in view in the DOM

* Add related events code back

* Change processNodePositionsAndEdgeLineSegments selector to return a function that takes optional bounding box

* Refactor selectors to not break original, and not run as often

* Memoize rtree search selector, fix tests

* Update node styles to use style hook, update jest tests

* Fix type change issue in jest test
---
 x-pack/plugins/security_solution/package.json |   6 +-
 .../public/resolver/lib/aabb.ts               |  14 ++
 .../public/resolver/lib/vector2.ts            |   7 +
 .../public/resolver/models/process_event.ts   |   4 +
 .../data/__snapshots__/graphing.test.ts.snap  |  50 +++++-
 .../public/resolver/store/data/selectors.ts   | 135 +++++++++++++-
 .../store/data/visible_entities.test.ts       | 165 ++++++++++++++++++
 .../public/resolver/store/middleware.ts       |   1 -
 .../public/resolver/store/selectors.ts        |  30 ++++
 .../public/resolver/types.ts                  |  36 +++-
 .../public/resolver/view/assets.tsx           |  32 +---
 .../public/resolver/view/index.tsx            |  25 ++-
 .../public/resolver/view/panel.tsx            |  22 ++-
 .../panels/panel_content_process_detail.tsx   |  15 +-
 .../panels/panel_content_process_list.tsx     |  13 +-
 .../panels/panel_content_related_counts.tsx   |   2 +-
 .../panels/panel_content_related_detail.tsx   |   2 +-
 .../view/panels/process_cube_icon.tsx         |   9 +-
 .../resolver/view/process_event_dot.tsx       |  19 +-
 yarn.lock                                     |  12 ++
 20 files changed, 527 insertions(+), 72 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/resolver/lib/aabb.ts
 create mode 100644 x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts

diff --git a/x-pack/plugins/security_solution/package.json b/x-pack/plugins/security_solution/package.json
index 73347e00e6b3..108ed6695885 100644
--- a/x-pack/plugins/security_solution/package.json
+++ b/x-pack/plugins/security_solution/package.json
@@ -16,9 +16,11 @@
     "@types/lodash": "^4.14.110"
   },
   "dependencies": {
+    "@types/rbush": "^3.0.0",
+    "@types/seedrandom": ">=2.0.0 <4.0.0",
     "lodash": "^4.17.15",
     "querystring": "^0.2.0",
-    "redux-devtools-extension": "^2.13.8",
-    "@types/seedrandom": ">=2.0.0 <4.0.0"
+    "rbush": "^3.0.1",
+    "redux-devtools-extension": "^2.13.8"
   }
 }
diff --git a/x-pack/plugins/security_solution/public/resolver/lib/aabb.ts b/x-pack/plugins/security_solution/public/resolver/lib/aabb.ts
new file mode 100644
index 000000000000..0937d10c24d8
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/lib/aabb.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as vector2 from './vector2';
+import { AABB } from '../types';
+
+/**
+ * Return a boolean indicating if 2 vector objects are equal.
+ */
+export function isEqual(a: AABB, b: AABB): boolean {
+  return vector2.isEqual(a.minimum, b.minimum) && vector2.isEqual(a.maximum, b.maximum);
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/lib/vector2.ts b/x-pack/plugins/security_solution/public/resolver/lib/vector2.ts
index 898ce6f6bacd..35f17c9460f8 100644
--- a/x-pack/plugins/security_solution/public/resolver/lib/vector2.ts
+++ b/x-pack/plugins/security_solution/public/resolver/lib/vector2.ts
@@ -40,6 +40,13 @@ export function applyMatrix3([x, y]: Vector2, [m11, m12, m13, m21, m22, m23]: Ma
   return [x * m11 + y * m12 + m13, x * m21 + y * m22 + m23];
 }
 
+/**
+ * Returns a boolean indicating equality of two vectors.
+ */
+export function isEqual([x1, y1]: Vector2, [x2, y2]: Vector2): boolean {
+  return x1 === x2 && y1 === y2;
+}
+
 /**
  * Returns the distance between two vectors
  */
diff --git a/x-pack/plugins/security_solution/public/resolver/models/process_event.ts b/x-pack/plugins/security_solution/public/resolver/models/process_event.ts
index 1094fee6da24..0286cca93b43 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/process_event.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/process_event.ts
@@ -24,6 +24,10 @@ function isValue(field: string | string[], value: string) {
   }
 }
 
+export function isTerminatedProcess(passedEvent: ResolverEvent) {
+  return eventType(passedEvent) === 'processTerminated';
+}
+
 /**
  * Returns a custom event type for a process event based on the event's metadata.
  */
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/__snapshots__/graphing.test.ts.snap b/x-pack/plugins/security_solution/public/resolver/store/data/__snapshots__/graphing.test.ts.snap
index f21d3b210681..8525ccd7b154 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/__snapshots__/graphing.test.ts.snap
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/__snapshots__/graphing.test.ts.snap
@@ -36,6 +36,9 @@ exports[`resolver graph layout when rendering two forks, and one fork has an ext
 Object {
   "edgeLineSegments": Array [
     Object {
+      "metadata": Object {
+        "uniqueId": "parentToMid",
+      },
       "points": Array [
         Array [
           0,
@@ -48,6 +51,9 @@ Object {
       ],
     },
     Object {
+      "metadata": Object {
+        "uniqueId": "midway",
+      },
       "points": Array [
         Array [
           0,
@@ -60,7 +66,9 @@ Object {
       ],
     },
     Object {
-      "metadata": Object {},
+      "metadata": Object {
+        "uniqueId": "",
+      },
       "points": Array [
         Array [
           0,
@@ -73,7 +81,9 @@ Object {
       ],
     },
     Object {
-      "metadata": Object {},
+      "metadata": Object {
+        "uniqueId": "",
+      },
       "points": Array [
         Array [
           395.9797974644666,
@@ -86,6 +96,9 @@ Object {
       ],
     },
     Object {
+      "metadata": Object {
+        "uniqueId": "parentToMid13",
+      },
       "points": Array [
         Array [
           197.9898987322333,
@@ -98,6 +111,9 @@ Object {
       ],
     },
     Object {
+      "metadata": Object {
+        "uniqueId": "midway13",
+      },
       "points": Array [
         Array [
           296.98484809834997,
@@ -110,7 +126,9 @@ Object {
       ],
     },
     Object {
-      "metadata": Object {},
+      "metadata": Object {
+        "uniqueId": "13",
+      },
       "points": Array [
         Array [
           296.98484809834997,
@@ -123,7 +141,9 @@ Object {
       ],
     },
     Object {
-      "metadata": Object {},
+      "metadata": Object {
+        "uniqueId": "14",
+      },
       "points": Array [
         Array [
           494.9747468305833,
@@ -136,6 +156,9 @@ Object {
       ],
     },
     Object {
+      "metadata": Object {
+        "uniqueId": "parentToMid25",
+      },
       "points": Array [
         Array [
           593.9696961966999,
@@ -148,6 +171,9 @@ Object {
       ],
     },
     Object {
+      "metadata": Object {
+        "uniqueId": "midway25",
+      },
       "points": Array [
         Array [
           692.9646455628166,
@@ -160,7 +186,9 @@ Object {
       ],
     },
     Object {
-      "metadata": Object {},
+      "metadata": Object {
+        "uniqueId": "25",
+      },
       "points": Array [
         Array [
           692.9646455628166,
@@ -173,7 +201,9 @@ Object {
       ],
     },
     Object {
-      "metadata": Object {},
+      "metadata": Object {
+        "uniqueId": "26",
+      },
       "points": Array [
         Array [
           890.9545442950499,
@@ -186,7 +216,9 @@ Object {
       ],
     },
     Object {
-      "metadata": Object {},
+      "metadata": Object {
+        "uniqueId": "67",
+      },
       "points": Array [
         Array [
           1088.9444430272833,
@@ -344,7 +376,9 @@ exports[`resolver graph layout when rendering two nodes, one being the parent of
 Object {
   "edgeLineSegments": Array [
     Object {
-      "metadata": Object {},
+      "metadata": Object {
+        "uniqueId": "",
+      },
       "points": Array [
         Array [
           0,
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
index ba415e6d83c8..5654f1ca423f 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import rbush from 'rbush';
 import { createSelector } from 'reselect';
 import {
   DataState,
@@ -16,11 +17,20 @@ import {
   AdjacentProcessMap,
   Vector2,
   EdgeLineMetadata,
+  IndexedEntity,
+  IndexedEdgeLineSegment,
+  IndexedProcessNode,
+  AABB,
+  VisibleEntites,
 } from '../../types';
 import { ResolverEvent } from '../../../../common/endpoint/types';
-import { eventTimestamp } from '../../../../common/endpoint/models/event';
+import * as event from '../../../../common/endpoint/models/event';
 import { add as vector2Add, applyMatrix3 } from '../../lib/vector2';
-import { isGraphableProcess, uniquePidForProcess } from '../../models/process_event';
+import {
+  isGraphableProcess,
+  isTerminatedProcess,
+  uniquePidForProcess,
+} from '../../models/process_event';
 import {
   factory as indexedProcessTreeFactory,
   children as indexedProcessTreeChildren,
@@ -29,6 +39,7 @@ import {
   levelOrder,
 } from '../../models/indexed_process_tree';
 import { getFriendlyElapsedTime } from '../../lib/date';
+import { isEqual } from '../../lib/aabb';
 
 const unit = 140;
 const distanceBetweenNodesInUnits = 2;
@@ -81,6 +92,20 @@ export const graphableProcesses = createSelector(
   }
 );
 
+/**
+ * Process events that will be displayed as terminated.
+ */
+export const terminatedProcesses = createSelector(
+  ({ results }: DataState) => results,
+  function (results: DataState['results']) {
+    return new Set(
+      results.filter(isTerminatedProcess).map((terminatedEvent) => {
+        return uniquePidForProcess(terminatedEvent);
+      })
+    );
+  }
+);
+
 /**
  * In laying out the graph, we precalculate the 'width' of each subtree. The 'width' of the subtree is determined by its
  * descedants and the rule that each process node must be at least 1 unit apart. Enforcing that all nodes are at least
@@ -157,7 +182,7 @@ function processEdgeLineSegments(
 ): EdgeLineSegment[] {
   const edgeLineSegments: EdgeLineSegment[] = [];
   for (const metadata of levelOrderWithWidths(indexedProcessTree, widths)) {
-    const edgeLineMetadata: EdgeLineMetadata = {};
+    const edgeLineMetadata: EdgeLineMetadata = { uniqueId: '' };
     /**
      * We only handle children, drawing lines back to their parents. The root has no parent, so we skip it
      */
@@ -168,6 +193,9 @@ function processEdgeLineSegments(
     const { process, parent, parentWidth } = metadata;
     const position = positions.get(process);
     const parentPosition = positions.get(parent);
+    const parentId = event.entityId(parent);
+    const processEntityId = event.entityId(process);
+    const edgeLineId = parentId ? parentId + processEntityId : parentId;
 
     if (position === undefined || parentPosition === undefined) {
       /**
@@ -176,12 +204,13 @@ function processEdgeLineSegments(
       throw new Error();
     }
 
-    const parentTime = eventTimestamp(parent);
-    const processTime = eventTimestamp(process);
+    const parentTime = event.eventTimestamp(parent);
+    const processTime = event.eventTimestamp(process);
     if (parentTime && processTime) {
       const elapsedTime = getFriendlyElapsedTime(parentTime, processTime);
       if (elapsedTime) edgeLineMetadata.elapsedTime = elapsedTime;
     }
+    edgeLineMetadata.uniqueId = edgeLineId;
 
     /**
      * The point halfway between the parent and child on the y axis, we sometimes have a hard angle here in the edge line
@@ -226,6 +255,7 @@ function processEdgeLineSegments(
 
       const lineFromParentToMidwayLine: EdgeLineSegment = {
         points: [parentPosition, [parentPosition[0], midwayY]],
+        metadata: { uniqueId: `parentToMid${edgeLineId}` },
       };
 
       const widthOfMidline = parentWidth - firstChildWidth / 2 - lastChildWidth / 2;
@@ -246,6 +276,7 @@ function processEdgeLineSegments(
             midwayY,
           ],
         ],
+        metadata: { uniqueId: `midway${edgeLineId}` },
       };
 
       edgeLineSegments.push(
@@ -508,18 +539,16 @@ export const processNodePositionsAndEdgeLineSegments = createSelector(
     for (const edgeLineSegment of edgeLineSegments) {
       const {
         points: [startPoint, endPoint],
-        metadata,
       } = edgeLineSegment;
 
       const transformedSegment: EdgeLineSegment = {
+        ...edgeLineSegment,
         points: [
           applyMatrix3(startPoint, isometricTransformMatrix),
           applyMatrix3(endPoint, isometricTransformMatrix),
         ],
       };
 
-      if (metadata) transformedSegment.metadata = metadata;
-
       transformedEdgeLineSegments.push(transformedSegment);
     }
 
@@ -530,6 +559,96 @@ export const processNodePositionsAndEdgeLineSegments = createSelector(
   }
 );
 
+const indexedProcessNodePositionsAndEdgeLineSegments = createSelector(
+  processNodePositionsAndEdgeLineSegments,
+  function visibleProcessNodePositionsAndEdgeLineSegments({
+    /* eslint-disable no-shadow */
+    processNodePositions,
+    edgeLineSegments,
+    /* eslint-enable no-shadow */
+  }) {
+    const tree: rbush<IndexedEntity> = new rbush();
+    const processesToIndex: IndexedProcessNode[] = [];
+    const edgeLineSegmentsToIndex: IndexedEdgeLineSegment[] = [];
+
+    // Make sure these numbers are big enough to cover the process nodes at all zoom levels.
+    // The process nodes don't extend equally in all directions from their center point.
+    const processNodeViewWidth = 720;
+    const processNodeViewHeight = 240;
+    const lineSegmentPadding = 30;
+    for (const [processEvent, position] of processNodePositions) {
+      const [nodeX, nodeY] = position;
+      const indexedEvent: IndexedProcessNode = {
+        minX: nodeX - 0.5 * processNodeViewWidth,
+        minY: nodeY - 0.5 * processNodeViewHeight,
+        maxX: nodeX + 0.5 * processNodeViewWidth,
+        maxY: nodeY + 0.5 * processNodeViewHeight,
+        position,
+        entity: processEvent,
+        type: 'processNode',
+      };
+      processesToIndex.push(indexedEvent);
+    }
+    for (const edgeLineSegment of edgeLineSegments) {
+      const {
+        points: [[x1, y1], [x2, y2]],
+      } = edgeLineSegment;
+      const indexedLineSegment: IndexedEdgeLineSegment = {
+        minX: Math.min(x1, x2) - lineSegmentPadding,
+        minY: Math.min(y1, y2) - lineSegmentPadding,
+        maxX: Math.max(x1, x2) + lineSegmentPadding,
+        maxY: Math.max(y1, y2) + lineSegmentPadding,
+        entity: edgeLineSegment,
+        type: 'edgeLine',
+      };
+      edgeLineSegmentsToIndex.push(indexedLineSegment);
+    }
+    tree.load([...processesToIndex, ...edgeLineSegmentsToIndex]);
+    return tree;
+  }
+);
+
+export const visibleProcessNodePositionsAndEdgeLineSegments = createSelector(
+  indexedProcessNodePositionsAndEdgeLineSegments,
+  function visibleProcessNodePositionsAndEdgeLineSegments(tree) {
+    // memoize the results of this call to avoid unnecessarily rerunning
+    let lastBoundingBox: AABB | null = null;
+    let currentlyVisible: VisibleEntites = {
+      processNodePositions: new Map<ResolverEvent, Vector2>(),
+      connectingEdgeLineSegments: [],
+    };
+    return (boundingBox: AABB) => {
+      if (lastBoundingBox !== null && isEqual(lastBoundingBox, boundingBox)) {
+        return currentlyVisible;
+      } else {
+        const {
+          minimum: [minX, minY],
+          maximum: [maxX, maxY],
+        } = boundingBox;
+        const entities = tree.search({
+          minX,
+          minY,
+          maxX,
+          maxY,
+        });
+        const visibleProcessNodePositions = new Map<ResolverEvent, Vector2>(
+          entities
+            .filter((entity): entity is IndexedProcessNode => entity.type === 'processNode')
+            .map((node) => [node.entity, node.position])
+        );
+        const connectingEdgeLineSegments = entities
+          .filter((entity): entity is IndexedEdgeLineSegment => entity.type === 'edgeLine')
+          .map((node) => node.entity);
+        currentlyVisible = {
+          processNodePositions: visibleProcessNodePositions,
+          connectingEdgeLineSegments,
+        };
+        lastBoundingBox = boundingBox;
+        return currentlyVisible;
+      }
+    };
+  }
+);
 /**
  * Returns the `children` and `ancestors` limits for the current graph, if any.
  *
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts b/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
new file mode 100644
index 000000000000..f10cfe0ba466
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
@@ -0,0 +1,165 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Store, createStore } from 'redux';
+import { ResolverAction } from '../actions';
+import { resolverReducer } from '../reducer';
+import { ResolverState } from '../../types';
+import { LegacyEndpointEvent, ResolverEvent } from '../../../../common/endpoint/types';
+import { visibleProcessNodePositionsAndEdgeLineSegments } from '../selectors';
+import { mockProcessEvent } from '../../models/process_event_test_helpers';
+
+describe('resolver visible entities', () => {
+  let processA: LegacyEndpointEvent;
+  let processB: LegacyEndpointEvent;
+  let processC: LegacyEndpointEvent;
+  let processD: LegacyEndpointEvent;
+  let processE: LegacyEndpointEvent;
+  let processF: LegacyEndpointEvent;
+  let processG: LegacyEndpointEvent;
+  let store: Store<ResolverState, ResolverAction>;
+
+  beforeEach(() => {
+    /*
+     *          A
+     *          |
+     *          B
+     *          |
+     *          C
+     *          |
+     *          D etc
+     */
+    processA = mockProcessEvent({
+      endgame: {
+        process_name: '',
+        event_type_full: 'process_event',
+        event_subtype_full: 'creation_event',
+        unique_pid: 0,
+      },
+    });
+    processB = mockProcessEvent({
+      endgame: {
+        event_type_full: 'process_event',
+        event_subtype_full: 'already_running',
+        unique_pid: 1,
+        unique_ppid: 0,
+      },
+    });
+    processC = mockProcessEvent({
+      endgame: {
+        event_type_full: 'process_event',
+        event_subtype_full: 'creation_event',
+        unique_pid: 2,
+        unique_ppid: 1,
+      },
+    });
+    processD = mockProcessEvent({
+      endgame: {
+        event_type_full: 'process_event',
+        event_subtype_full: 'creation_event',
+        unique_pid: 3,
+        unique_ppid: 2,
+      },
+    });
+    processE = mockProcessEvent({
+      endgame: {
+        event_type_full: 'process_event',
+        event_subtype_full: 'creation_event',
+        unique_pid: 4,
+        unique_ppid: 3,
+      },
+    });
+    processF = mockProcessEvent({
+      endgame: {
+        event_type_full: 'process_event',
+        event_subtype_full: 'creation_event',
+        unique_pid: 5,
+        unique_ppid: 4,
+      },
+    });
+    processF = mockProcessEvent({
+      endgame: {
+        event_type_full: 'process_event',
+        event_subtype_full: 'creation_event',
+        unique_pid: 6,
+        unique_ppid: 5,
+      },
+    });
+    processG = mockProcessEvent({
+      endgame: {
+        event_type_full: 'process_event',
+        event_subtype_full: 'creation_event',
+        unique_pid: 7,
+        unique_ppid: 6,
+      },
+    });
+    store = createStore(resolverReducer, undefined);
+  });
+  describe('when rendering a large tree with a small viewport', () => {
+    beforeEach(() => {
+      const events: ResolverEvent[] = [
+        processA,
+        processB,
+        processC,
+        processD,
+        processE,
+        processF,
+        processG,
+      ];
+      const action: ResolverAction = {
+        type: 'serverReturnedResolverData',
+        payload: { events, stats: new Map(), lineageLimits: { children: '', ancestors: '' } },
+      };
+      const cameraAction: ResolverAction = { type: 'userSetRasterSize', payload: [300, 200] };
+      store.dispatch(action);
+      store.dispatch(cameraAction);
+    });
+    it('the visibleProcessNodePositions list should only include 2 nodes', () => {
+      const { processNodePositions } = visibleProcessNodePositionsAndEdgeLineSegments(
+        store.getState()
+      )(0);
+      expect([...processNodePositions.keys()].length).toEqual(2);
+    });
+    it('the visibleEdgeLineSegments list should only include one edge line', () => {
+      const { connectingEdgeLineSegments } = visibleProcessNodePositionsAndEdgeLineSegments(
+        store.getState()
+      )(0);
+      expect(connectingEdgeLineSegments.length).toEqual(1);
+    });
+  });
+  describe('when rendering a large tree with a large viewport', () => {
+    beforeEach(() => {
+      const events: ResolverEvent[] = [
+        processA,
+        processB,
+        processC,
+        processD,
+        processE,
+        processF,
+        processG,
+      ];
+      const action: ResolverAction = {
+        type: 'serverReturnedResolverData',
+        payload: { events, stats: new Map(), lineageLimits: { children: '', ancestors: '' } },
+      };
+      const cameraAction: ResolverAction = { type: 'userSetRasterSize', payload: [2000, 2000] };
+      store.dispatch(action);
+      store.dispatch(cameraAction);
+    });
+    it('the visibleProcessNodePositions list should include all process nodes', () => {
+      const { processNodePositions } = visibleProcessNodePositionsAndEdgeLineSegments(
+        store.getState()
+      )(0);
+      expect([...processNodePositions.keys()].length).toEqual(5);
+    });
+    it('the visibleEdgeLineSegments list include all lines', () => {
+      const { connectingEdgeLineSegments } = visibleProcessNodePositionsAndEdgeLineSegments(
+        store.getState()
+      )(0);
+      expect(connectingEdgeLineSegments.length).toEqual(4);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/resolver/store/middleware.ts b/x-pack/plugins/security_solution/public/resolver/store/middleware.ts
index 343b4e1a1447..a1807255b5ea 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/middleware.ts
@@ -112,7 +112,6 @@ export const resolverMiddlewareFactory: MiddlewareFactory = (context) => {
             query: { events: 100 },
           }
         );
-
         api.dispatch({
           type: 'serverReturnedRelatedEventData',
           payload: result,
diff --git a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
index 3a5c48009e5b..5599b7e8ab61 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { createSelector } from 'reselect';
 import * as cameraSelectors from './camera/selectors';
 import * as dataSelectors from './data/selectors';
 import * as uiSelectors from './ui/selectors';
@@ -60,6 +61,11 @@ export const processAdjacencies = composeSelectors(
   dataSelectors.processAdjacencies
 );
 
+export const terminatedProcesses = composeSelectors(
+  dataStateSelector,
+  dataSelectors.terminatedProcesses
+);
+
 /**
  * Returns a map of `ResolverEvent` entity_id to their related event and alert statistics
  */
@@ -171,3 +177,27 @@ function composeSelectors<OuterState, InnerState, ReturnValue>(
 ): (state: OuterState) => ReturnValue {
   return (state) => secondSelector(selector(state));
 }
+
+const boundingBox = composeSelectors(cameraStateSelector, cameraSelectors.viewableBoundingBox);
+const indexedProcessNodesAndEdgeLineSegments = composeSelectors(
+  dataStateSelector,
+  dataSelectors.visibleProcessNodePositionsAndEdgeLineSegments
+);
+
+/**
+ * Return the visible edge lines and process nodes based on the camera position at `time`.
+ * The bounding box represents what the camera can see. The camera position is a function of time because it can be
+ * animated. So in order to get the currently visible entities, we need to pass in time.
+ */
+export const visibleProcessNodePositionsAndEdgeLineSegments = createSelector(
+  indexedProcessNodesAndEdgeLineSegments,
+  boundingBox,
+  function (
+    /* eslint-disable no-shadow */
+    indexedProcessNodesAndEdgeLineSegments,
+    boundingBox
+    /* eslint-enable no-shadow */
+  ) {
+    return (time: number) => indexedProcessNodesAndEdgeLineSegments(boundingBox(time));
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/resolver/types.ts b/x-pack/plugins/security_solution/public/resolver/types.ts
index f0e401dd2e89..0742fa2e3056 100644
--- a/x-pack/plugins/security_solution/public/resolver/types.ts
+++ b/x-pack/plugins/security_solution/public/resolver/types.ts
@@ -5,7 +5,7 @@
  */
 
 import { Store } from 'redux';
-
+import { BBox } from 'rbush';
 import { ResolverAction } from './store/actions';
 export { ResolverAction } from './store/actions';
 import {
@@ -142,6 +142,36 @@ export type CameraState = {
     }
 );
 
+/**
+ * Wrappers around our internal types that make them compatible with `rbush`.
+ */
+export type IndexedEntity = IndexedEdgeLineSegment | IndexedProcessNode;
+
+/**
+ * The entity stored in rbush for resolver edge lines.
+ */
+export interface IndexedEdgeLineSegment extends BBox {
+  type: 'edgeLine';
+  entity: EdgeLineSegment;
+}
+
+/**
+ * The entity store in rbush for resolver process nodes.
+ */
+export interface IndexedProcessNode extends BBox {
+  type: 'processNode';
+  entity: ResolverEvent;
+  position: Vector2;
+}
+
+/**
+ * A type containing all things to actually be rendered to the DOM.
+ */
+export interface VisibleEntites {
+  processNodePositions: ProcessPositions;
+  connectingEdgeLineSegments: EdgeLineSegment[];
+}
+
 /**
  * State for `data` reducer which handles receiving Resolver data from the backend.
  */
@@ -287,6 +317,8 @@ export interface DurationDetails {
  */
 export interface EdgeLineMetadata {
   elapsedTime?: DurationDetails;
+  // A string of the two joined process nodes concatted together.
+  uniqueId: string;
 }
 /**
  * A tuple of 2 vector2 points forming a polyline. Used to connect process nodes in the graph.
@@ -298,7 +330,7 @@ export type EdgeLinePoints = Vector2[];
  */
 export interface EdgeLineSegment {
   points: EdgeLinePoints;
-  metadata?: EdgeLineMetadata;
+  metadata: EdgeLineMetadata;
 }
 
 /**
diff --git a/x-pack/plugins/security_solution/public/resolver/view/assets.tsx b/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
index 82f969b755b2..442a90f0a575 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
@@ -12,8 +12,6 @@ import styled from 'styled-components';
 import { i18n } from '@kbn/i18n';
 import { useUiSetting } from '../../common/lib/kibana';
 import { DEFAULT_DARK_MODE } from '../../../common/constants';
-import { ResolverEvent } from '../../../common/endpoint/types';
-import * as processModel from '../models/process_event';
 import { ResolverProcessType } from '../types';
 
 type ResolverColorNames =
@@ -417,27 +415,13 @@ const processTypeToCube: Record<ResolverProcessType, keyof NodeStyleMap> = {
   unknownEvent: 'runningProcessCube',
 };
 
-/**
- * This will return which type the ResolverEvent will display as in the Node component
- * it will be something like 'runningProcessCube' or 'terminatedProcessCube'
- *
- * @param processEvent {ResolverEvent} the event to get the Resolver Component Node type of
- */
-export function nodeType(processEvent: ResolverEvent): keyof NodeStyleMap {
-  const processType = processModel.eventType(processEvent);
-  if (processType in processTypeToCube) {
-    return processTypeToCube[processType];
-  }
-  return 'runningProcessCube';
-}
-
 /**
  * A hook to bring Resolver theming information into components.
  */
 export const useResolverTheme = (): {
   colorMap: ColorMap;
   nodeAssets: NodeStyleMap;
-  cubeAssetsForNode: (arg0: ResolverEvent) => NodeStyleConfig;
+  cubeAssetsForNode: (isProcessTerimnated: boolean, isProcessOrigin: boolean) => NodeStyleConfig;
 } => {
   const isDarkMode = useUiSetting<boolean>(DEFAULT_DARK_MODE);
   const theme = isDarkMode ? euiThemeAmsterdamDark : euiThemeAmsterdamLight;
@@ -511,12 +495,14 @@ export const useResolverTheme = (): {
     },
   };
 
-  /**
-   * Export assets to reuse symbols/icons in other places in the app (e.g. tables, etc.)
-   * @param processEvent : The process event to fetch node assets for
-   */
-  function cubeAssetsForNode(processEvent: ResolverEvent) {
-    return nodeAssets[nodeType(processEvent)];
+  function cubeAssetsForNode(isProcessTerminated: boolean, isProcessOrigin: boolean) {
+    if (isProcessTerminated) {
+      return nodeAssets[processTypeToCube.processTerminated];
+    } else if (isProcessOrigin) {
+      return nodeAssets[processTypeToCube.processCausedAlert];
+    } else {
+      return nodeAssets[processTypeToCube.processRan];
+    }
   }
 
   return { colorMap, nodeAssets, cubeAssetsForNode };
diff --git a/x-pack/plugins/security_solution/public/resolver/view/index.tsx b/x-pack/plugins/security_solution/public/resolver/view/index.tsx
index 9dfc9a45fafe..9b7114b56495 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/index.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/index.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useLayoutEffect } from 'react';
+import React, { useLayoutEffect, useContext } from 'react';
 import { useSelector, useDispatch } from 'react-redux';
 import styled from 'styled-components';
 import { EuiLoadingSpinner } from '@elastic/eui';
@@ -16,9 +16,10 @@ import { GraphControls } from './graph_controls';
 import { ProcessEventDot } from './process_event_dot';
 import { useCamera } from './use_camera';
 import { SymbolDefinitions, useResolverTheme } from './assets';
+import { entityId } from '../../../common/endpoint/models/event';
 import { ResolverAction } from '../types';
 import { ResolverEvent } from '../../../common/endpoint/types';
-import * as eventModel from '../../../common/endpoint/models/event';
+import { SideEffectContext } from './side_effect_context';
 
 interface StyledResolver {
   backgroundColor: string;
@@ -74,17 +75,20 @@ export const Resolver = React.memo(function Resolver({
   className?: string;
   selectedEvent?: ResolverEvent;
 }) {
-  const { processNodePositions, edgeLineSegments } = useSelector(
-    selectors.processNodePositionsAndEdgeLineSegments
-  );
+  const { timestamp } = useContext(SideEffectContext);
+
+  const { processNodePositions, connectingEdgeLineSegments } = useSelector(
+    selectors.visibleProcessNodePositionsAndEdgeLineSegments
+  )(timestamp());
 
   const dispatch: (action: ResolverAction) => unknown = useDispatch();
   const { processToAdjacencyMap } = useSelector(selectors.processAdjacencies);
-  const relatedEventsStats = useSelector(selectors.relatedEventsStats);
   const { projectionMatrix, ref, onMouseDown } = useCamera();
   const isLoading = useSelector(selectors.isLoading);
   const hasError = useSelector(selectors.hasError);
+  const relatedEventsStats = useSelector(selectors.relatedEventsStats);
   const activeDescendantId = useSelector(selectors.uiActiveDescendantId);
+  const terminatedProcesses = useSelector(selectors.terminatedProcesses);
   const { colorMap } = useResolverTheme();
 
   useLayoutEffect(() => {
@@ -123,10 +127,10 @@ export const Resolver = React.memo(function Resolver({
           tabIndex={0}
           aria-activedescendant={activeDescendantId || undefined}
         >
-          {edgeLineSegments.map(({ points: [startPosition, endPosition], metadata }, index) => (
+          {connectingEdgeLineSegments.map(({ points: [startPosition, endPosition], metadata }) => (
             <EdgeLine
               edgeLineMetadata={metadata}
-              key={index}
+              key={metadata.uniqueId}
               startPosition={startPosition}
               endPosition={endPosition}
               projectionMatrix={projectionMatrix}
@@ -134,6 +138,7 @@ export const Resolver = React.memo(function Resolver({
           ))}
           {[...processNodePositions].map(([processEvent, position], index) => {
             const adjacentNodeMap = processToAdjacencyMap.get(processEvent);
+            const processEntityId = entityId(processEvent);
             if (!adjacentNodeMap) {
               // This should never happen
               throw new Error('Issue calculating adjacency node map.');
@@ -145,7 +150,9 @@ export const Resolver = React.memo(function Resolver({
                 projectionMatrix={projectionMatrix}
                 event={processEvent}
                 adjacentNodeMap={adjacentNodeMap}
-                relatedEventsStats={relatedEventsStats.get(eventModel.entityId(processEvent))}
+                relatedEventsStats={relatedEventsStats.get(entityId(processEvent))}
+                isProcessTerminated={terminatedProcesses.has(processEntityId)}
+                isProcessOrigin={false}
               />
             );
           })}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panel.tsx b/x-pack/plugins/security_solution/public/resolver/view/panel.tsx
index 4bef2f4d2a10..c8f6512077a6 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panel.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panel.tsx
@@ -51,6 +51,7 @@ const PanelContent = memo(function PanelContent() {
   const urlSearch = history.location.search;
   const dispatch = useResolverDispatch();
 
+  const { timestamp } = useContext(SideEffectContext);
   const queryParams: CrumbInfo = useMemo(() => {
     return { crumbId: '', crumbEvent: '', ...querystring.parse(urlSearch.slice(1)) };
   }, [urlSearch]);
@@ -84,7 +85,7 @@ const PanelContent = memo(function PanelContent() {
   const paramsSelectedEvent = useMemo(() => {
     return graphableProcesses.find((evt) => event.entityId(evt) === idFromParams);
   }, [graphableProcesses, idFromParams]);
-  const { timestamp } = useContext(SideEffectContext);
+
   const [lastUpdatedProcess, setLastUpdatedProcess] = useState<null | ResolverEvent>(null);
 
   /**
@@ -218,11 +219,19 @@ const PanelContent = memo(function PanelContent() {
   }, [panelToShow, dispatch]);
 
   const currentPanelView = useSelector(selectors.currentPanelView);
+  const terminatedProcesses = useSelector(selectors.terminatedProcesses);
+  const processEntityId = uiSelectedEvent ? event.entityId(uiSelectedEvent) : undefined;
+  const isProcessTerminated = processEntityId ? terminatedProcesses.has(processEntityId) : false;
 
   const panelInstance = useMemo(() => {
     if (currentPanelView === 'processDetails') {
       return (
-        <ProcessDetails processEvent={uiSelectedEvent!} pushToQueryParams={pushToQueryParams} />
+        <ProcessDetails
+          processEvent={uiSelectedEvent!}
+          pushToQueryParams={pushToQueryParams}
+          isProcessTerminated={isProcessTerminated}
+          isProcessOrigin={false}
+        />
       );
     }
 
@@ -261,7 +270,13 @@ const PanelContent = memo(function PanelContent() {
       );
     }
     // The default 'Event List' / 'List of all processes' view
-    return <ProcessListWithCounts pushToQueryParams={pushToQueryParams} />;
+    return (
+      <ProcessListWithCounts
+        pushToQueryParams={pushToQueryParams}
+        isProcessTerminated={isProcessTerminated}
+        isProcessOrigin={false}
+      />
+    );
   }, [
     uiSelectedEvent,
     crumbEvent,
@@ -269,6 +284,7 @@ const PanelContent = memo(function PanelContent() {
     pushToQueryParams,
     relatedStatsForIdFromParams,
     currentPanelView,
+    isProcessTerminated,
   ]);
 
   return <>{panelInstance}</>;
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_detail.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_detail.tsx
index fcb7bf1d12e1..3127c7132df3 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_detail.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_detail.tsx
@@ -41,10 +41,14 @@ const StyledDescriptionList = styled(EuiDescriptionList)`
  */
 export const ProcessDetails = memo(function ProcessDetails({
   processEvent,
+  isProcessTerminated,
+  isProcessOrigin,
   pushToQueryParams,
 }: {
   processEvent: ResolverEvent;
-  pushToQueryParams: (arg0: CrumbInfo) => unknown;
+  isProcessTerminated: boolean;
+  isProcessOrigin: boolean;
+  pushToQueryParams: (queryStringKeyValuePair: CrumbInfo) => unknown;
 }) {
   const processName = event.eventName(processEvent);
   const processInfoEntry = useMemo(() => {
@@ -178,8 +182,8 @@ export const ProcessDetails = memo(function ProcessDetails({
     if (!processEvent) {
       return { descriptionText: '' };
     }
-    return cubeAssetsForNode(processEvent);
-  }, [processEvent, cubeAssetsForNode]);
+    return cubeAssetsForNode(isProcessTerminated, isProcessOrigin);
+  }, [processEvent, cubeAssetsForNode, isProcessTerminated, isProcessOrigin]);
 
   const titleId = useMemo(() => htmlIdGenerator('resolverTable')(), []);
   return (
@@ -188,7 +192,10 @@ export const ProcessDetails = memo(function ProcessDetails({
       <EuiSpacer size="l" />
       <EuiTitle size="xs">
         <h4 aria-describedby={titleId}>
-          <CubeForProcess processEvent={processEvent} />
+          <CubeForProcess
+            isProcessTerminated={isProcessTerminated}
+            isProcessOrigin={isProcessOrigin}
+          />
           {processName}
         </h4>
       </EuiTitle>
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx
index 86ae10b3b38c..9152649c07ab 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx
@@ -28,8 +28,12 @@ import { ResolverEvent } from '../../../../common/endpoint/types';
  */
 export const ProcessListWithCounts = memo(function ProcessListWithCounts({
   pushToQueryParams,
+  isProcessTerminated,
+  isProcessOrigin,
 }: {
-  pushToQueryParams: (arg0: CrumbInfo) => unknown;
+  pushToQueryParams: (queryStringKeyValuePair: CrumbInfo) => unknown;
+  isProcessTerminated: boolean;
+  isProcessOrigin: boolean;
 }) {
   interface ProcessTableView {
     name: string;
@@ -82,7 +86,10 @@ export const ProcessListWithCounts = memo(function ProcessListWithCounts({
                 pushToQueryParams({ crumbId: event.entityId(item.event), crumbEvent: '' });
               }}
             >
-              <CubeForProcess processEvent={item.event} />
+              <CubeForProcess
+                isProcessTerminated={isProcessTerminated}
+                isProcessOrigin={isProcessOrigin}
+              />
               {name}
             </EuiButtonEmpty>
           );
@@ -114,7 +121,7 @@ export const ProcessListWithCounts = memo(function ProcessListWithCounts({
         },
       },
     ],
-    [pushToQueryParams, handleBringIntoViewClick]
+    [pushToQueryParams, handleBringIntoViewClick, isProcessOrigin, isProcessTerminated]
   );
 
   const { processNodePositions } = useSelector(selectors.processNodePositionsAndEdgeLineSegments);
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_counts.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_counts.tsx
index 2e4211f568ff..880ee1dc7a10 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_counts.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_counts.tsx
@@ -30,7 +30,7 @@ export const EventCountsForProcess = memo(function EventCountsForProcess({
   relatedStats,
 }: {
   processEvent: ResolverEvent;
-  pushToQueryParams: (arg0: CrumbInfo) => unknown;
+  pushToQueryParams: (queryStringKeyValuePair: CrumbInfo) => unknown;
   relatedStats: ResolverNodeStats;
 }) {
   interface EventCountsTableView {
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_detail.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_detail.tsx
index 1fe6599e0829..f27ec56fef69 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_detail.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_detail.tsx
@@ -96,7 +96,7 @@ export const RelatedEventDetail = memo(function RelatedEventDetail({
 }: {
   relatedEventId: string;
   parentEvent: ResolverEvent;
-  pushToQueryParams: (arg0: CrumbInfo) => unknown;
+  pushToQueryParams: (queryStringKeyValuePair: CrumbInfo) => unknown;
   countForParent: number | undefined;
 }) {
   const processName = (parentEvent && event.eventName(parentEvent)) || '*';
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/process_cube_icon.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/process_cube_icon.tsx
index 29ffe154d571..98eea51a011b 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/process_cube_icon.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/process_cube_icon.tsx
@@ -5,7 +5,6 @@
  */
 
 import React, { memo } from 'react';
-import { ResolverEvent } from '../../../../common/endpoint/types';
 import { useResolverTheme } from '../assets';
 
 /**
@@ -13,12 +12,14 @@ import { useResolverTheme } from '../assets';
  * Nodes on the graph and what's in the table. Using the same symbol in both places (as below) could help with that.
  */
 export const CubeForProcess = memo(function CubeForProcess({
-  processEvent,
+  isProcessTerminated,
+  isProcessOrigin,
 }: {
-  processEvent: ResolverEvent;
+  isProcessTerminated: boolean;
+  isProcessOrigin: boolean;
 }) {
   const { cubeAssetsForNode } = useResolverTheme();
-  const { cubeSymbol, descriptionText } = cubeAssetsForNode(processEvent);
+  const { cubeSymbol, descriptionText } = cubeAssetsForNode(isProcessTerminated, isProcessOrigin);
 
   return (
     <>
diff --git a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
index 78b70611a697..e7c9960f7805 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
@@ -15,7 +15,7 @@ import querystring from 'querystring';
 import { NodeSubMenu, subMenuAssets } from './submenu';
 import { applyMatrix3 } from '../lib/vector2';
 import { Vector2, Matrix3, AdjacentProcessMap } from '../types';
-import { SymbolIds, useResolverTheme, calculateResolverFontSize, nodeType } from './assets';
+import { SymbolIds, useResolverTheme, calculateResolverFontSize } from './assets';
 import { ResolverEvent, ResolverNodeStats } from '../../../common/endpoint/types';
 import { useResolverDispatch } from './use_resolver_dispatch';
 import * as eventModel from '../../../common/endpoint/models/event';
@@ -239,6 +239,8 @@ const ProcessEventDotComponents = React.memo(
     event,
     projectionMatrix,
     adjacentNodeMap,
+    isProcessTerminated,
+    isProcessOrigin,
     relatedEventsStats,
   }: {
     /**
@@ -262,6 +264,16 @@ const ProcessEventDotComponents = React.memo(
      */
     adjacentNodeMap: AdjacentProcessMap;
     /**
+     * Whether or not to show the process as terminated.
+     */
+    isProcessTerminated: boolean;
+    /**
+     * Whether or not to show the process as the originating event.
+     */
+    isProcessOrigin: boolean;
+    /**
+     * A collection of events related to the current node and statistics (e.g. counts indexed by event type)
+     * to provide the user some visibility regarding the contents thereof.
      * Statistics for the number of related events and alerts for this process node
      */
     relatedEventsStats?: ResolverNodeStats;
@@ -363,7 +375,7 @@ const ProcessEventDotComponents = React.memo(
           })
         | null;
     } = React.createRef();
-    const { colorMap, nodeAssets } = useResolverTheme();
+    const { colorMap, cubeAssetsForNode } = useResolverTheme();
     const {
       backingFill,
       cubeSymbol,
@@ -371,7 +383,8 @@ const ProcessEventDotComponents = React.memo(
       isLabelFilled,
       labelButtonFill,
       strokeColor,
-    } = nodeAssets[nodeType(event)];
+    } = cubeAssetsForNode(isProcessTerminated, isProcessOrigin);
+
     const resolverNodeIdGenerator = useMemo(() => htmlIdGenerator('resolverNode'), []);
 
     const nodeId = useMemo(() => resolverNodeIdGenerator(selfId), [
diff --git a/yarn.lock b/yarn.lock
index 60122f8b8cde..53fef40b44c9 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5616,6 +5616,11 @@
   resolved "https://registry.yarnpkg.com/@types/q/-/q-1.5.2.tgz#690a1475b84f2a884fd07cd797c00f5f31356ea8"
   integrity sha512-ce5d3q03Ex0sy4R14722Rmt6MT07Ua+k4FwDfdcToYJcMKNtRVQvJ6JCAPdAmAnbRb6CsX6aYb9m96NGod9uTw==
 
+"@types/rbush@^3.0.0":
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/@types/rbush/-/rbush-3.0.0.tgz#b6887d99b159e87ae23cd14eceff34f139842aa6"
+  integrity sha512-W3ue/GYWXBOpkRm0VSoifrP3HV0Ni47aVJWvXyWMcbtpBy/l/K/smBRiJ+fI8f7shXRjZBiux+iJzYbh7VmcZg==
+
 "@types/reach__router@^1.2.3", "@types/reach__router@^1.2.6":
   version "1.2.6"
   resolved "https://registry.yarnpkg.com/@types/reach__router/-/reach__router-1.2.6.tgz#b14cf1adbd1a365d204bbf6605cd9dd7b8816c87"
@@ -25291,6 +25296,13 @@ raw-loader@~0.5.1:
   resolved "https://registry.yarnpkg.com/raw-loader/-/raw-loader-0.5.1.tgz#0c3d0beaed8a01c966d9787bf778281252a979aa"
   integrity sha1-DD0L6u2KAclm2Xh793goElKpeao=
 
+rbush@^3.0.1:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/rbush/-/rbush-3.0.1.tgz#5fafa8a79b3b9afdfe5008403a720cc1de882ecf"
+  integrity sha512-XRaVO0YecOpEuIvbhbpTrZgoiI6xBlz6hnlr6EHhd+0x9ase6EmeN+hdwwUaJvLcsFFQ8iWVF1GAK1yB0BWi0w==
+  dependencies:
+    quickselect "^2.0.0"
+
 rc@^1.0.1, rc@^1.1.6, rc@^1.2.7, rc@^1.2.8:
   version "1.2.8"
   resolved "https://registry.yarnpkg.com/rc/-/rc-1.2.8.tgz#cd924bf5200a075b83c188cd6b9e211b7fc0d3ed"

From c8089a5aa2ff21c5c56dbefc2f24ced67a78992f Mon Sep 17 00:00:00 2001
From: Jean-Louis Leysens <jloleysens@gmail.com>
Date: Fri, 26 Jun 2020 16:25:50 +0200
Subject: [PATCH 48/78] [Ingest Pipelines Editor] First round of UX
 improvements (#69381)

* First round of UX tweaks

- Fixed potential text overflow issue on descriptions
- Removed border around text input when editing description

* Updated the on-failure pipeline description copy

* Properly encode URI component pipeline names

* use xjson editor in flyout

* also hide the test flyout if we are editing a component

* add much stronger dimming effect when in edit mode

* also added dimming effect to moving state

* remove box shadow if dimmed

* add tooltips to dropzones

* fix CITs after master merge

* fix nested rendering of processors tree

* only show the tooltip when the dropzone is unavaiable and visible

* keep white background on dim

* hide controls when moving

* fix on blur bug

* Rename variables and prefix booleans with "is"

* Remove box shadow on all nested tree items

* use classNames as it is intended to be used

* Refactor SCSS values to variables

* Added cancel move button

- also hide the description in move mode when it is empty
- update and refactor some shared sass variables
- some number of sass changes to make labels play nice in move
  mode
- changed the logic to not render the buttons when in move mode
  instead of display: none on them. The issue is with the tooltip
  not hiding when when we change to move mode and the mouse event
  "leave" does get through the tooltip element causing tooltips
  to hang even though the mouse has left them.

* Fixes for monaco XJSON grammar parser and update form copy

- Monaco XJSON worker was not handling trailing whitespace
- Update copy in the processor configuration form

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 packages/kbn-monaco/src/xjson/grammar.ts      |   3 +-
 packages/kbn-monaco/src/xjson/language.ts     |   5 +-
 .../pipeline_form/pipeline_form.tsx           |   1 +
 .../pipeline_processors_editor.helpers.tsx    |  28 +-
 .../components/_shared.scss                   |   2 +
 .../on_failure_processors_title.tsx           |   2 +-
 .../context_menu.tsx                          |  46 +--
 .../inline_text_input.tsx                     |  60 ++--
 .../messages.ts                               |  11 +-
 .../pipeline_processors_editor_item.scss      |  50 +++-
 .../pipeline_processors_editor_item.tsx       | 265 +++++++++++-------
 .../field_components/index.ts                 |   7 +
 .../field_components/xjson_editor.tsx         |  66 +++++
 .../processor_settings_form.tsx               |  21 +-
 .../processors/custom.tsx                     |  15 +-
 .../components/drop_zone_button.tsx           |  52 +++-
 .../components/private_tree.tsx               |  60 ++--
 .../processors_tree/components/tree_node.tsx  |  50 +---
 .../processors_tree/processors_tree.scss      |  64 ++---
 .../components/processors_tree/utils.ts       |   4 +-
 .../pipeline_processors_editor.scss           |   2 +-
 .../pipeline_processors_editor.tsx            |   2 +-
 .../public/application/index.tsx              |   3 +-
 .../application/mount_management_section.ts   |   1 +
 .../ingest_pipelines/public/shared_imports.ts |   7 +-
 25 files changed, 511 insertions(+), 316 deletions(-)
 create mode 100644 x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/_shared.scss
 create mode 100644 x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/field_components/index.ts
 create mode 100644 x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/field_components/xjson_editor.tsx

diff --git a/packages/kbn-monaco/src/xjson/grammar.ts b/packages/kbn-monaco/src/xjson/grammar.ts
index e95059f9ece2..fbd7b3d319c1 100644
--- a/packages/kbn-monaco/src/xjson/grammar.ts
+++ b/packages/kbn-monaco/src/xjson/grammar.ts
@@ -200,12 +200,13 @@ export const createParser = () => {
 
       try {
         value();
+        white();
       } catch (e) {
         errored = true;
         annos.push({ type: AnnoTypes.error, at: e.at - 1, text: e.message });
       }
       if (!errored && ch) {
-        error('Syntax error');
+        annos.push({ type: AnnoTypes.error, at: at, text: 'Syntax Error' });
       }
       return { annotations: annos };
     }
diff --git a/packages/kbn-monaco/src/xjson/language.ts b/packages/kbn-monaco/src/xjson/language.ts
index fe505818d3c9..54b7004fecd8 100644
--- a/packages/kbn-monaco/src/xjson/language.ts
+++ b/packages/kbn-monaco/src/xjson/language.ts
@@ -52,7 +52,10 @@ export const registerGrammarChecker = (editor: monaco.editor.IEditor) => {
 
   const updateAnnos = async () => {
     const { annotations } = await wps.getAnnos();
-    const model = editor.getModel() as monaco.editor.ITextModel;
+    const model = editor.getModel() as monaco.editor.ITextModel | null;
+    if (!model) {
+      return;
+    }
     monaco.editor.setModelMarkers(
       model,
       OWNER,
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_form/pipeline_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_form/pipeline_form.tsx
index ec065a74abca..05c9f0a08b0c 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_form/pipeline_form.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_form/pipeline_form.tsx
@@ -81,6 +81,7 @@ export const PipelineForm: React.FunctionComponent<PipelineFormProps> = ({
   });
 
   const onEditorFlyoutOpen = useCallback(() => {
+    setIsTestingPipeline(false);
     setIsRequestVisible(false);
   }, [setIsRequestVisible]);
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.helpers.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.helpers.tsx
index 320ccd0cbe8c..7ad9aed3c44a 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.helpers.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.helpers.tsx
@@ -24,8 +24,15 @@ jest.mock('@elastic/eui', () => {
         }}
       />
     ),
-    // Mocking EuiCodeEditor, which uses React Ace under the hood
-    EuiCodeEditor: (props: any) => (
+  };
+});
+
+jest.mock('../../../../../../../../src/plugins/kibana_react/public', () => {
+  const original = jest.requireActual('../../../../../../../../src/plugins/kibana_react/public');
+  return {
+    ...original,
+    // Mocking CodeEditor, which uses React Monaco under the hood
+    CodeEditor: (props: any) => (
       <input
         data-test-subj={props['data-test-subj'] || 'mockCodeEditor'}
         data-currentvalue={props.value}
@@ -95,8 +102,9 @@ const createActions = (testBed: TestBed<TestSubject>) => {
       act(() => {
         find(`${processorSelector}.moveItemButton`).simulate('click');
       });
+      component.update();
       act(() => {
-        find(dropZoneSelector).last().simulate('click');
+        find(dropZoneSelector).simulate('click');
       });
       component.update();
     },
@@ -122,13 +130,6 @@ const createActions = (testBed: TestBed<TestSubject>) => {
       });
     },
 
-    duplicateProcessor(processorSelector: string) {
-      find(`${processorSelector}.moreMenu.button`).simulate('click');
-      act(() => {
-        find(`${processorSelector}.moreMenu.duplicateButton`).simulate('click');
-      });
-    },
-
     startAndCancelMove(processorSelector: string) {
       act(() => {
         find(`${processorSelector}.moveItemButton`).simulate('click');
@@ -139,6 +140,13 @@ const createActions = (testBed: TestBed<TestSubject>) => {
       });
     },
 
+    duplicateProcessor(processorSelector: string) {
+      find(`${processorSelector}.moreMenu.button`).simulate('click');
+      act(() => {
+        find(`${processorSelector}.moreMenu.duplicateButton`).simulate('click');
+      });
+    },
+
     toggleOnFailure() {
       find('pipelineEditorOnFailureToggle').simulate('click');
     },
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/_shared.scss b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/_shared.scss
new file mode 100644
index 000000000000..8d17a3970d94
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/_shared.scss
@@ -0,0 +1,2 @@
+$dropZoneZIndex: 1;  /* Prevent the next item down from obscuring the button */
+$cancelButtonZIndex: 2;
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/on_failure_processors_title.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/on_failure_processors_title.tsx
index 6451096c897d..251a2ffe9521 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/on_failure_processors_title.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/on_failure_processors_title.tsx
@@ -31,7 +31,7 @@ export const OnFailureProcessorsTitle: FunctionComponent = () => {
         <EuiText size="s" color="subdued">
           <FormattedMessage
             id="xpack.ingestPipelines.pipelineEditor.onFailureTreeDescription"
-            defaultMessage="The processors used to pre-process documents before indexing. {learnMoreLink}"
+            defaultMessage="The processors used to handle exceptions in this pipeline. {learnMoreLink}"
             values={{
               learnMoreLink: (
                 <EuiLink
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/context_menu.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/context_menu.tsx
index 64364e921a3a..5bbea4b89b05 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/context_menu.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/context_menu.tsx
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import classNames from 'classnames';
 import React, { FunctionComponent, useState } from 'react';
 
 import { EuiContextMenuItem, EuiContextMenuPanel, EuiPopover, EuiButtonIcon } from '@elastic/eui';
@@ -12,6 +13,7 @@ import { editorItemMessages } from './messages';
 
 interface Props {
   disabled: boolean;
+  hidden: boolean;
   showAddOnFailure: boolean;
   onDuplicate: () => void;
   onDelete: () => void;
@@ -20,9 +22,13 @@ interface Props {
 }
 
 export const ContextMenu: FunctionComponent<Props> = (props) => {
-  const { showAddOnFailure, onDuplicate, onAddOnFailure, onDelete, disabled } = props;
+  const { showAddOnFailure, onDuplicate, onAddOnFailure, onDelete, disabled, hidden } = props;
   const [isOpen, setIsOpen] = useState<boolean>(false);
 
+  const containerClasses = classNames({
+    'pipelineProcessorsEditor__item--displayNone': hidden,
+  });
+
   const contextMenuItems = [
     <EuiContextMenuItem
       data-test-subj="duplicateButton"
@@ -63,23 +69,25 @@ export const ContextMenu: FunctionComponent<Props> = (props) => {
   ].filter(Boolean) as JSX.Element[];
 
   return (
-    <EuiPopover
-      data-test-subj={props['data-test-subj']}
-      anchorPosition="leftCenter"
-      panelPaddingSize="none"
-      isOpen={isOpen}
-      closePopover={() => setIsOpen(false)}
-      button={
-        <EuiButtonIcon
-          data-test-subj="button"
-          disabled={disabled}
-          onClick={() => setIsOpen((v) => !v)}
-          iconType="boxesHorizontal"
-          aria-label={editorItemMessages.moreButtonAriaLabel}
-        />
-      }
-    >
-      <EuiContextMenuPanel items={contextMenuItems} />
-    </EuiPopover>
+    <div className={containerClasses}>
+      <EuiPopover
+        data-test-subj={props['data-test-subj']}
+        anchorPosition="leftCenter"
+        panelPaddingSize="none"
+        isOpen={isOpen}
+        closePopover={() => setIsOpen(false)}
+        button={
+          <EuiButtonIcon
+            data-test-subj="button"
+            disabled={disabled}
+            onClick={() => setIsOpen((v) => !v)}
+            iconType="boxesHorizontal"
+            aria-label={editorItemMessages.moreButtonAriaLabel}
+          />
+        }
+      >
+        <EuiContextMenuPanel items={contextMenuItems} />
+      </EuiPopover>
+    </div>
   );
 };
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/inline_text_input.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/inline_text_input.tsx
index e0b67bc907ca..00ac8d4f6d72 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/inline_text_input.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/inline_text_input.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
+import classNames from 'classnames';
 import React, { FunctionComponent, useState, useEffect, useCallback } from 'react';
 import { EuiFieldText, EuiText, keyCodes } from '@elastic/eui';
 
@@ -11,10 +11,12 @@ export interface Props {
   placeholder: string;
   ariaLabel: string;
   onChange: (value: string) => void;
+  disabled: boolean;
   text?: string;
 }
 
 export const InlineTextInput: FunctionComponent<Props> = ({
+  disabled,
   placeholder,
   text,
   ariaLabel,
@@ -23,26 +25,17 @@ export const InlineTextInput: FunctionComponent<Props> = ({
   const [isShowingTextInput, setIsShowingTextInput] = useState<boolean>(false);
   const [textValue, setTextValue] = useState<string>(text ?? '');
 
-  const content = isShowingTextInput ? (
-    <EuiFieldText
-      controlOnly
-      fullWidth
-      compressed
-      value={textValue}
-      aria-label={ariaLabel}
-      className="pipelineProcessorsEditor__item__textInput"
-      inputRef={(el) => el?.focus()}
-      onChange={(event) => setTextValue(event.target.value)}
-    />
-  ) : (
-    <EuiText size="s" color="subdued">
-      {text || <em>{placeholder}</em>}
-    </EuiText>
-  );
+  const containerClasses = classNames('pipelineProcessorsEditor__item__textContainer', {
+    'pipelineProcessorsEditor__item__textContainer--notEditing': !isShowingTextInput && !disabled,
+  });
 
   const submitChange = useCallback(() => {
-    setIsShowingTextInput(false);
-    onChange(textValue);
+    // Give any on blur handlers the chance to complete if the user is
+    // tabbing over this component.
+    setTimeout(() => {
+      setIsShowingTextInput(false);
+      onChange(textValue);
+    });
   }, [setIsShowingTextInput, onChange, textValue]);
 
   useEffect(() => {
@@ -62,14 +55,27 @@ export const InlineTextInput: FunctionComponent<Props> = ({
     };
   }, [isShowingTextInput, submitChange, setIsShowingTextInput]);
 
-  return (
-    <div
-      className="pipelineProcessorsEditor__item__textContainer"
-      tabIndex={0}
-      onFocus={() => setIsShowingTextInput(true)}
-      onBlur={submitChange}
-    >
-      {content}
+  return isShowingTextInput && !disabled ? (
+    <div className={`pipelineProcessorsEditor__item__textContainer ${containerClasses}`}>
+      <EuiFieldText
+        controlOnly
+        onBlur={submitChange}
+        fullWidth
+        compressed
+        value={textValue}
+        aria-label={ariaLabel}
+        className="pipelineProcessorsEditor__item__textInput"
+        inputRef={(el) => el?.focus()}
+        onChange={(event) => setTextValue(event.target.value)}
+      />
+    </div>
+  ) : (
+    <div className={containerClasses} tabIndex={0} onFocus={() => setIsShowingTextInput(true)}>
+      <EuiText size="s" color="subdued">
+        <div className="pipelineProcessorsEditor__item__description">
+          {text || <em>{placeholder}</em>}
+        </div>
+      </EuiText>
     </div>
   );
 };
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/messages.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/messages.ts
index 67dbf2708d66..913902d29550 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/messages.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/messages.ts
@@ -10,12 +10,9 @@ export const editorItemMessages = {
   moveButtonLabel: i18n.translate('xpack.ingestPipelines.pipelineEditor.item.moveButtonLabel', {
     defaultMessage: 'Move this processor',
   }),
-  editorButtonLabel: i18n.translate(
-    'xpack.ingestPipelines.pipelineEditor.item.editButtonAriaLabel',
-    {
-      defaultMessage: 'Edit this processor',
-    }
-  ),
+  editButtonLabel: i18n.translate('xpack.ingestPipelines.pipelineEditor.item.editButtonAriaLabel', {
+    defaultMessage: 'Edit this processor',
+  }),
   duplicateButtonLabel: i18n.translate(
     'xpack.ingestPipelines.pipelineEditor.item.moreMenu.duplicateButtonLabel',
     {
@@ -31,7 +28,7 @@ export const editorItemMessages = {
   cancelMoveButtonLabel: i18n.translate(
     'xpack.ingestPipelines.pipelineEditor.item.cancelMoveButtonAriaLabel',
     {
-      defaultMessage: 'Cancel moving this processor',
+      defaultMessage: 'Cancel move',
     }
   ),
   deleteButtonLabel: i18n.translate(
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.scss b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.scss
index a17e64485384..6b5e11808460 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.scss
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.scss
@@ -1,17 +1,57 @@
+@import '../shared';
+
 .pipelineProcessorsEditor__item {
+  transition: border-color 1s;
+  min-height: 50px;
+  &--selected {
+    border: 1px solid $euiColorPrimary;
+  }
+
+  &--displayNone {
+    display: none;
+  }
+
+  &--dimmed {
+    box-shadow: none;
+  }
+
+  // Remove the box-shadow on all nested items
+  .pipelineProcessorsEditor__item {
+    box-shadow: none !important;
+  }
+
+  &__processorTypeLabel {
+    line-height: $euiButtonHeightSmall;
+  }
+
   &__textContainer {
     padding: 4px;
     border-radius: 2px;
 
-    transition: border-color .3s;
-    border: 2px solid #FFF;
+    transition: border-color 0.3s;
+    border: 2px solid transparent;
 
-    &:hover {
-      border: 2px solid $euiColorLightShade;
+    &--notEditing {
+      &:hover {
+        border: 2px solid $euiColorLightShade;
+      }
     }
   }
+
+  &__description {
+    overflow-x: hidden;
+    white-space: nowrap;
+    text-overflow: ellipsis;
+    max-width: 600px;
+  }
+
   &__textInput {
     height: 21px;
-    min-width: 100px;
+    min-width: 150px;
+  }
+
+  &__cancelMoveButton {
+    // Ensure that the cancel button is above the drop zones
+    z-index: $cancelButtonZIndex;
   }
 }
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.tsx
index 0eb259db75f4..0fe804adaeb4 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.tsx
@@ -4,8 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import classNames from 'classnames';
 import React, { FunctionComponent, memo } from 'react';
-import { EuiButtonIcon, EuiFlexGroup, EuiFlexItem, EuiText, EuiToolTip } from '@elastic/eui';
+import {
+  EuiButtonIcon,
+  EuiButton,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiPanel,
+  EuiText,
+  EuiToolTip,
+} from '@elastic/eui';
 
 import { ProcessorInternal, ProcessorSelector } from '../../types';
 import { selectorToDataTestSubject } from '../../utils';
@@ -17,6 +26,7 @@ import './pipeline_processors_editor_item.scss';
 import { InlineTextInput } from './inline_text_input';
 import { ContextMenu } from './context_menu';
 import { editorItemMessages } from './messages';
+import { ProcessorInfo } from '../processors_tree';
 
 export interface Handlers {
   onMove: () => void;
@@ -25,127 +35,166 @@ export interface Handlers {
 
 export interface Props {
   processor: ProcessorInternal;
-  selected: boolean;
   handlers: Handlers;
   selector: ProcessorSelector;
   description?: string;
+  movingProcessor?: ProcessorInfo;
+  renderOnFailureHandlers?: () => React.ReactNode;
 }
 
 export const PipelineProcessorsEditorItem: FunctionComponent<Props> = memo(
-  ({ processor, description, handlers: { onCancelMove, onMove }, selector, selected }) => {
+  ({
+    processor,
+    description,
+    handlers: { onCancelMove, onMove },
+    selector,
+    movingProcessor,
+    renderOnFailureHandlers,
+  }) => {
     const {
       state: { editor, processorsDispatch },
     } = usePipelineProcessorsContext();
 
-    const disabled = editor.mode.id !== 'idle';
-    const isDarkBold =
-      editor.mode.id !== 'editingProcessor' || processor.id === editor.mode.arg.processor.id;
+    const isDisabled = editor.mode.id !== 'idle';
+    const isInMoveMode = Boolean(movingProcessor);
+    const isMovingThisProcessor = processor.id === movingProcessor?.id;
+    const isEditingThisProcessor =
+      editor.mode.id === 'editingProcessor' && processor.id === editor.mode.arg.processor.id;
+    const isEditingOtherProcessor =
+      editor.mode.id === 'editingProcessor' && !isEditingThisProcessor;
+    const isMovingOtherProcessor = editor.mode.id === 'movingProcessor' && !isMovingThisProcessor;
+    const isDimmed = isEditingOtherProcessor || isMovingOtherProcessor;
+
+    const panelClasses = classNames('pipelineProcessorsEditor__item', {
+      'pipelineProcessorsEditor__item--selected': isMovingThisProcessor || isEditingThisProcessor,
+      'pipelineProcessorsEditor__item--dimmed': isDimmed,
+    });
+
+    const actionElementClasses = classNames({
+      'pipelineProcessorsEditor__item--displayNone': isInMoveMode,
+    });
+
+    const inlineTextInputContainerClasses = classNames({
+      'pipelineProcessorsEditor__item--displayNone': isInMoveMode && !processor.options.description,
+    });
+
+    const cancelMoveButtonClasses = classNames('pipelineProcessorsEditor__item__cancelMoveButton', {
+      'pipelineProcessorsEditor__item--displayNone': !isMovingThisProcessor,
+    });
 
     return (
-      <EuiFlexGroup
-        gutterSize="none"
-        responsive={false}
-        alignItems="center"
-        justifyContent="spaceBetween"
-        data-test-subj={selectorToDataTestSubject(selector)}
-      >
-        <EuiFlexItem>
-          <EuiFlexGroup gutterSize="m" alignItems="center" responsive={false}>
-            <EuiFlexItem grow={false}>
-              <EuiText color={isDarkBold ? undefined : 'subdued'}>
-                <b>{processor.type}</b>
-              </EuiText>
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <InlineTextInput
-                onChange={(nextDescription) => {
-                  let nextOptions: Record<string, any>;
-                  if (!nextDescription) {
-                    const { description: __, ...restOptions } = processor.options;
-                    nextOptions = restOptions;
-                  } else {
-                    nextOptions = {
-                      ...processor.options,
-                      description: nextDescription,
-                    };
-                  }
-                  processorsDispatch({
-                    type: 'updateProcessor',
-                    payload: {
-                      processor: {
-                        ...processor,
-                        options: nextOptions,
+      <EuiPanel className={panelClasses} paddingSize="s">
+        <EuiFlexGroup
+          gutterSize="none"
+          responsive={false}
+          alignItems="center"
+          justifyContent="spaceBetween"
+          data-test-subj={selectorToDataTestSubject(selector)}
+        >
+          <EuiFlexItem>
+            <EuiFlexGroup gutterSize="m" alignItems="center" responsive={false}>
+              <EuiFlexItem grow={false}>
+                <EuiText
+                  className="pipelineProcessorsEditor__item__processorTypeLabel"
+                  color={isDimmed ? 'subdued' : undefined}
+                >
+                  <b>{processor.type}</b>
+                </EuiText>
+              </EuiFlexItem>
+              <EuiFlexItem className={inlineTextInputContainerClasses} grow={false}>
+                <InlineTextInput
+                  disabled={isDisabled}
+                  onChange={(nextDescription) => {
+                    let nextOptions: Record<string, any>;
+                    if (!nextDescription) {
+                      const { description: __, ...restOptions } = processor.options;
+                      nextOptions = restOptions;
+                    } else {
+                      nextOptions = {
+                        ...processor.options,
+                        description: nextDescription,
+                      };
+                    }
+                    processorsDispatch({
+                      type: 'updateProcessor',
+                      payload: {
+                        processor: {
+                          ...processor,
+                          options: nextOptions,
+                        },
+                        selector,
                       },
-                      selector,
-                    },
-                  });
-                }}
-                ariaLabel={editorItemMessages.processorTypeLabel({ type: processor.type })}
-                text={description}
-                placeholder={editorItemMessages.descriptionPlaceholder}
-              />
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <EuiButtonIcon
-                data-test-subj="editItemButton"
-                disabled={disabled}
-                aria-label={editorItemMessages.editorButtonLabel}
-                iconType="pencil"
-                size="s"
-                onClick={() => {
-                  editor.setMode({
-                    id: 'editingProcessor',
-                    arg: { processor, selector },
-                  });
-                }}
-              />
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              {selected ? (
-                <EuiButtonIcon
-                  data-test-subj="cancelMoveItemButton"
-                  aria-label={editorItemMessages.cancelMoveButtonLabel}
-                  size="s"
-                  onClick={onCancelMove}
-                  iconType="crossInACircleFilled"
+                    });
+                  }}
+                  ariaLabel={editorItemMessages.processorTypeLabel({ type: processor.type })}
+                  text={description}
+                  placeholder={editorItemMessages.descriptionPlaceholder}
                 />
-              ) : (
-                <EuiToolTip content={editorItemMessages.moveButtonLabel}>
-                  <EuiButtonIcon
-                    data-test-subj="moveItemButton"
-                    disabled={disabled}
-                    aria-label={editorItemMessages.moveButtonLabel}
-                    size="s"
-                    onClick={onMove}
-                    iconType="sortable"
-                  />
-                </EuiToolTip>
-              )}
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <ContextMenu
-            data-test-subj="moreMenu"
-            disabled={disabled}
-            showAddOnFailure={!processor.onFailure?.length}
-            onAddOnFailure={() => {
-              editor.setMode({ id: 'creatingProcessor', arg: { selector } });
-            }}
-            onDelete={() => {
-              editor.setMode({ id: 'removingProcessor', arg: { selector } });
-            }}
-            onDuplicate={() => {
-              processorsDispatch({
-                type: 'duplicateProcessor',
-                payload: {
-                  source: selector,
-                },
-              });
-            }}
-          />
-        </EuiFlexItem>
-      </EuiFlexGroup>
+              </EuiFlexItem>
+              <EuiFlexItem className={actionElementClasses} grow={false}>
+                {!isInMoveMode && (
+                  <EuiToolTip content={editorItemMessages.editButtonLabel}>
+                    <EuiButtonIcon
+                      disabled={isDisabled}
+                      aria-label={editorItemMessages.editButtonLabel}
+                      iconType="pencil"
+                      size="s"
+                      onClick={() => {
+                        editor.setMode({
+                          id: 'editingProcessor',
+                          arg: { processor, selector },
+                        });
+                      }}
+                    />
+                  </EuiToolTip>
+                )}
+              </EuiFlexItem>
+              <EuiFlexItem className={actionElementClasses} grow={false}>
+                {!isInMoveMode && (
+                  <EuiToolTip content={editorItemMessages.moveButtonLabel}>
+                    <EuiButtonIcon
+                      data-test-subj="moveItemButton"
+                      size="s"
+                      disabled={isDisabled}
+                      aria-label={editorItemMessages.moveButtonLabel}
+                      onClick={onMove}
+                      iconType="sortable"
+                    />
+                  </EuiToolTip>
+                )}
+              </EuiFlexItem>
+              <EuiFlexItem grow={false} className={cancelMoveButtonClasses}>
+                <EuiButton data-test-subj="cancelMoveItemButton" size="s" onClick={onCancelMove}>
+                  {editorItemMessages.cancelMoveButtonLabel}
+                </EuiButton>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <ContextMenu
+              data-test-subj="moreMenu"
+              disabled={isDisabled}
+              hidden={isInMoveMode}
+              showAddOnFailure={!processor.onFailure?.length}
+              onAddOnFailure={() => {
+                editor.setMode({ id: 'creatingProcessor', arg: { selector } });
+              }}
+              onDelete={() => {
+                editor.setMode({ id: 'removingProcessor', arg: { selector } });
+              }}
+              onDuplicate={() => {
+                processorsDispatch({
+                  type: 'duplicateProcessor',
+                  payload: {
+                    source: selector,
+                  },
+                });
+              }}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+        {renderOnFailureHandlers && renderOnFailureHandlers()}
+      </EuiPanel>
     );
   }
 );
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/field_components/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/field_components/index.ts
new file mode 100644
index 000000000000..6f7b55a3ea4b
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/field_components/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { OnXJsonEditorUpdateHandler, XJsonEditor } from './xjson_editor';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/field_components/xjson_editor.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/field_components/xjson_editor.tsx
new file mode 100644
index 000000000000..a8456ad0ffd7
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/field_components/xjson_editor.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiPanel } from '@elastic/eui';
+import { XJsonLang } from '@kbn/monaco';
+import React, { FunctionComponent, useCallback } from 'react';
+import { EuiFormRow } from '@elastic/eui';
+import {
+  CodeEditor,
+  FieldHook,
+  getFieldValidityAndErrorMessage,
+  Monaco,
+} from '../../../../../../shared_imports';
+
+export type OnXJsonEditorUpdateHandler<T = { [key: string]: any }> = (arg: {
+  data: {
+    raw: string;
+    format(): T;
+  };
+  validate(): boolean;
+  isValid: boolean | undefined;
+}) => void;
+
+interface Props {
+  field: FieldHook<string>;
+  editorProps: { [key: string]: any };
+}
+
+export const XJsonEditor: FunctionComponent<Props> = ({ field, editorProps }) => {
+  const { value, helpText, setValue, label } = field;
+  const { xJson, setXJson, convertToJson } = Monaco.useXJsonMode(value);
+  const { errorMessage } = getFieldValidityAndErrorMessage(field);
+
+  const onChange = useCallback(
+    (s) => {
+      setXJson(s);
+      setValue(convertToJson(s));
+    },
+    [setValue, setXJson, convertToJson]
+  );
+  return (
+    <EuiFormRow
+      label={label}
+      helpText={helpText}
+      isInvalid={typeof errorMessage === 'string'}
+      error={errorMessage}
+      fullWidth
+    >
+      <EuiPanel paddingSize="s" hasShadow={false}>
+        <CodeEditor
+          value={xJson}
+          languageId={XJsonLang.ID}
+          editorDidMount={(m) => {
+            XJsonLang.registerGrammarChecker(m);
+          }}
+          options={{ minimap: { enabled: false } }}
+          onChange={onChange}
+          {...(editorProps as any)}
+        />
+      </EuiPanel>
+    </EuiFormRow>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.tsx
index 84dfce64f602..9d284748a3d1 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.tsx
@@ -18,26 +18,32 @@ import {
   EuiFlexItem,
 } from '@elastic/eui';
 
-import { Form, useForm, FormDataProvider } from '../../../../../shared_imports';
+import { Form, FormDataProvider, FormHook } from '../../../../../shared_imports';
 import { usePipelineProcessorsContext } from '../../context';
 import { ProcessorInternal } from '../../types';
 
 import { DocumentationButton } from './documentation_button';
-import { ProcessorSettingsFromOnSubmitArg } from './processor_settings_form.container';
 import { getProcessorFormDescriptor } from './map_processor_type_to_form';
 import { CommonProcessorFields, ProcessorTypeField } from './processors/common_fields';
 import { Custom } from './processors/custom';
 
-export type OnSubmitHandler = (processor: ProcessorSettingsFromOnSubmitArg) => void;
-
 export interface Props {
   isOnFailure: boolean;
   processor?: ProcessorInternal;
-  form: ReturnType<typeof useForm>['form'];
+  form: FormHook;
   onClose: () => void;
   onOpen: () => void;
 }
 
+const updateButtonLabel = i18n.translate(
+  'xpack.ingestPipelines.settingsFormOnFailureFlyout.updateButtonLabel',
+  { defaultMessage: 'Update' }
+);
+const addButtonLabel = i18n.translate(
+  'xpack.ingestPipelines.settingsFormOnFailureFlyout.addButtonLabel',
+  { defaultMessage: 'Add' }
+);
+
 export const ProcessorSettingsForm: FunctionComponent<Props> = memo(
   ({ processor, form, isOnFailure, onClose, onOpen }) => {
     const {
@@ -123,10 +129,7 @@ export const ProcessorSettingsForm: FunctionComponent<Props> = memo(
                     <>
                       {formContent}
                       <EuiButton data-test-subj="submitButton" onClick={form.submit}>
-                        {i18n.translate(
-                          'xpack.ingestPipelines.pipelineEditor.settingsForm.submitButtonLabel',
-                          { defaultMessage: 'Submit' }
-                        )}
+                        {processor ? updateButtonLabel : addButtonLabel}
                       </EuiButton>
                     </>
                   );
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processors/custom.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processors/custom.tsx
index 4d8634e6f285..82fdc81e0a84 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processors/custom.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processors/custom.tsx
@@ -12,15 +12,16 @@ import {
   FIELD_TYPES,
   fieldValidators,
   UseField,
-  JsonEditorField,
 } from '../../../../../../shared_imports';
 
 const { emptyField, isJsonField } = fieldValidators;
 
+import { XJsonEditor } from '../field_components';
+
 const customConfig: FieldConfig = {
   type: FIELD_TYPES.TEXT,
   label: i18n.translate('xpack.ingestPipelines.pipelineEditor.customForm.optionsFieldLabel', {
-    defaultMessage: 'Configuration options',
+    defaultMessage: 'Configuration',
   }),
   serializer: (value: string) => {
     try {
@@ -42,7 +43,7 @@ const customConfig: FieldConfig = {
         i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.customForm.configurationRequiredError',
           {
-            defaultMessage: 'Configuration options are required.',
+            defaultMessage: 'Configuration is required.',
           }
         )
       ),
@@ -71,17 +72,17 @@ export const Custom: FunctionComponent<Props> = ({ defaultOptions }) => {
   return (
     <UseField
       path="customOptions"
-      component={JsonEditorField}
+      component={XJsonEditor}
       config={customConfig}
       defaultValue={defaultOptions}
       componentProps={{
-        euiCodeEditorProps: {
+        editorProps: {
           'data-test-subj': 'processorOptionsEditor',
-          height: '300px',
+          height: 300,
           'aria-label': i18n.translate(
             'xpack.ingestPipelines.pipelineEditor.customForm.optionsFieldAriaLabel',
             {
-              defaultMessage: 'Configuration options JSON editor',
+              defaultMessage: 'Configuration JSON editor',
             }
           ),
         },
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/drop_zone_button.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/drop_zone_button.tsx
index b64de4f61391..4cd734f8a819 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/drop_zone_button.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/drop_zone_button.tsx
@@ -7,39 +7,61 @@
 import { i18n } from '@kbn/i18n';
 import React, { FunctionComponent } from 'react';
 import classNames from 'classnames';
-import { EuiButtonIcon, EuiFlexItem } from '@elastic/eui';
+import { EuiButtonIcon, EuiToolTip } from '@elastic/eui';
 
 export interface Props {
+  isVisible: boolean;
   isDisabled: boolean;
   onClick: (event: React.MouseEvent<HTMLButtonElement, MouseEvent>) => void;
   'data-test-subj'?: string;
 }
 
-const MOVE_HERE_LABEL = i18n.translate('xpack.ingestPipelines.pipelineEditor.moveTargetLabel', {
-  defaultMessage: 'Move here',
-});
+const moveHereLabel = i18n.translate(
+  'xpack.ingestPipelines.pipelineEditor.dropZoneButton.moveHereToolTip',
+  {
+    defaultMessage: 'Move here',
+  }
+);
+
+const cannotMoveHereLabel = i18n.translate(
+  'xpack.ingestPipelines.pipelineEditor.dropZoneButton.unavailableToolTip',
+  { defaultMessage: 'Cannot move here' }
+);
 
 export const DropZoneButton: FunctionComponent<Props> = (props) => {
-  const { onClick, isDisabled } = props;
+  const { onClick, isDisabled, isVisible } = props;
+  const isUnavailable = isVisible && isDisabled;
   const containerClasses = classNames({
-    'pipelineProcessorsEditor__tree__dropZoneContainer--active': !isDisabled,
+    'pipelineProcessorsEditor__tree__dropZoneContainer--visible': isVisible,
+    'pipelineProcessorsEditor__tree__dropZoneContainer--unavailable': isUnavailable,
   });
   const buttonClasses = classNames({
-    'pipelineProcessorsEditor__tree__dropZoneButton--active': !isDisabled,
+    'pipelineProcessorsEditor__tree__dropZoneButton--visible': isVisible,
+    'pipelineProcessorsEditor__tree__dropZoneButton--unavailable': isUnavailable,
   });
 
-  return (
-    <EuiFlexItem
-      className={`pipelineProcessorsEditor__tree__dropZoneContainer ${containerClasses}`}
-    >
+  const content = (
+    <div className={`pipelineProcessorsEditor__tree__dropZoneContainer ${containerClasses}`}>
       <EuiButtonIcon
         data-test-subj={props['data-test-subj']}
         className={`pipelineProcessorsEditor__tree__dropZoneButton ${buttonClasses}`}
-        aria-label={MOVE_HERE_LABEL}
-        disabled={isDisabled}
-        onClick={onClick}
+        aria-label={moveHereLabel}
+        // We artificially disable the button so that hover and pointer events are
+        // still enabled
+        onClick={isDisabled ? () => {} : onClick}
         iconType="empty"
       />
-    </EuiFlexItem>
+    </div>
+  );
+
+  return isUnavailable ? (
+    <EuiToolTip
+      className="pipelineProcessorsEditor__tree__dropZoneContainer__toolTip"
+      content={cannotMoveHereLabel}
+    >
+      {content}
+    </EuiToolTip>
+  ) : (
+    content
   );
 };
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/private_tree.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/private_tree.tsx
index 661bde1aa8b3..89407fd4366d 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/private_tree.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/private_tree.tsx
@@ -78,46 +78,50 @@ export const PrivateTree: FunctionComponent<PrivateProps> = ({
     return (
       <>
         {idx === 0 ? (
+          <EuiFlexItem>
+            <DropZoneButton
+              data-test-subj={`dropButtonAbove-${stringifiedSelector}`}
+              onClick={(event) => {
+                event.preventDefault();
+                onAction({
+                  type: 'move',
+                  payload: {
+                    destination: selector.concat(DropSpecialLocations.top),
+                    source: movingProcessor!.selector,
+                  },
+                });
+              }}
+              isVisible={Boolean(movingProcessor)}
+              isDisabled={!movingProcessor || isDropZoneAboveDisabled(info, movingProcessor)}
+            />
+          </EuiFlexItem>
+        ) : undefined}
+        <EuiFlexItem>
+          <TreeNode
+            level={level}
+            processor={processor}
+            processorInfo={info}
+            onAction={onAction}
+            movingProcessor={movingProcessor}
+          />
+        </EuiFlexItem>
+        <EuiFlexItem>
           <DropZoneButton
-            data-test-subj={`dropButtonAbove-${stringifiedSelector}`}
+            data-test-subj={`dropButtonBelow-${stringifiedSelector}`}
+            isVisible={Boolean(movingProcessor)}
+            isDisabled={!movingProcessor || isDropZoneBelowDisabled(info, movingProcessor)}
             onClick={(event) => {
               event.preventDefault();
               onAction({
                 type: 'move',
                 payload: {
-                  destination: selector.concat(DropSpecialLocations.top),
+                  destination: selector.concat(String(idx + 1)),
                   source: movingProcessor!.selector,
                 },
               });
             }}
-            isDisabled={Boolean(
-              !movingProcessor || isDropZoneAboveDisabled(info, movingProcessor!)
-            )}
-          />
-        ) : undefined}
-        <EuiFlexItem>
-          <TreeNode
-            level={level}
-            processor={processor}
-            processorInfo={info}
-            onAction={onAction}
-            movingProcessor={movingProcessor}
           />
         </EuiFlexItem>
-        <DropZoneButton
-          data-test-subj={`dropButtonBelow-${stringifiedSelector}`}
-          isDisabled={Boolean(!movingProcessor || isDropZoneBelowDisabled(info, movingProcessor!))}
-          onClick={(event) => {
-            event.preventDefault();
-            onAction({
-              type: 'move',
-              payload: {
-                destination: selector.concat(String(idx + 1)),
-                source: movingProcessor!.selector,
-              },
-            });
-          }}
-        />
       </>
     );
   };
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/tree_node.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/tree_node.tsx
index a396a7f4d5ec..2e3f39ef1d3a 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/tree_node.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/components/tree_node.tsx
@@ -5,9 +5,8 @@
  */
 
 import React, { FunctionComponent, useMemo } from 'react';
-import classNames from 'classnames';
 import { i18n } from '@kbn/i18n';
-import { EuiPanel, EuiText } from '@elastic/eui';
+import { EuiText } from '@elastic/eui';
 
 import { ProcessorInternal } from '../../../types';
 
@@ -47,40 +46,21 @@ export const TreeNode: FunctionComponent<Props> = ({
     };
   }, [onAction, stringSelector, processor]); // eslint-disable-line react-hooks/exhaustive-deps
 
-  const selected = movingProcessor?.id === processor.id;
-
-  const panelClasses = classNames({
-    'pipelineProcessorsEditor__tree__item--selected': selected,
-  });
-
   const renderOnFailureHandlersTree = () => {
     if (!processor.onFailure?.length) {
       return;
     }
 
-    const onFailureHandlerLabelClasses = classNames({
-      'pipelineProcessorsEditor__tree__onFailureHandlerLabel--withDropZone':
-        movingProcessor != null &&
-        movingProcessor.id !== processor.onFailure[0].id &&
-        movingProcessor.id !== processor.id,
-    });
-
     return (
       <div
         className="pipelineProcessorsEditor__tree__onFailureHandlerContainer"
         style={{ marginLeft: `${level * INDENTATION_PX}px` }}
       >
-        <div className="pipelineProcessorsEditor__tree__onFailureHandlerLabelContainer">
-          <EuiText
-            size="m"
-            className={`pipelineProcessorsEditor__tree__onFailureHandlerLabel ${onFailureHandlerLabelClasses}`}
-            color="subdued"
-          >
-            {i18n.translate('xpack.ingestPipelines.pipelineEditor.onFailureProcessorsLabel', {
-              defaultMessage: 'Failure handlers',
-            })}
-          </EuiText>
-        </div>
+        <EuiText size="m" color="subdued">
+          {i18n.translate('xpack.ingestPipelines.pipelineEditor.onFailureProcessorsLabel', {
+            defaultMessage: 'Failure handlers',
+          })}
+        </EuiText>
         <PrivateTree
           level={level + 1}
           movingProcessor={movingProcessor}
@@ -102,15 +82,13 @@ export const TreeNode: FunctionComponent<Props> = ({
   };
 
   return (
-    <EuiPanel className={`pipelineProcessorsEditor__tree__item ${panelClasses}`} paddingSize="s">
-      <PipelineProcessorsEditorItem
-        selector={processorInfo.selector}
-        processor={processor}
-        handlers={handlers}
-        description={processor.options.description}
-        selected={Boolean(movingProcessor?.id === processor.id)}
-      />
-      {renderOnFailureHandlersTree()}
-    </EuiPanel>
+    <PipelineProcessorsEditorItem
+      movingProcessor={movingProcessor}
+      selector={processorInfo.selector}
+      processor={processor}
+      handlers={handlers}
+      description={processor.options.description}
+      renderOnFailureHandlers={renderOnFailureHandlersTree}
+    />
   );
 };
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/processors_tree.scss b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/processors_tree.scss
index ad9058cea5e1..2feb71f21a4f 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/processors_tree.scss
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/processors_tree.scss
@@ -1,61 +1,61 @@
 @import '@elastic/eui/src/global_styling/variables/size';
+@import '../shared';
 
 .pipelineProcessorsEditor__tree {
-
   &__container {
     background-color: $euiColorLightestShade;
     padding: $euiSizeS;
   }
 
   &__dropZoneContainer {
+    position: relative;
     margin: 2px;
     visibility: hidden;
-    border: 2px dashed $euiColorLightShade;
-    height: 12px;
-    border-radius: 2px;
-
-    transition: border .5s;
+    background-color: transparent;
+    height: 2px;
 
-    &--active {
+    &--visible {
       &:hover {
-        border: 2px dashed $euiColorPrimary;
+        background-color: $euiColorPrimary;
       }
       visibility: visible;
     }
+
+    &--unavailable {
+      &:hover {
+        background-color: $euiColorMediumShade;
+      }
+    }
+
+    &__toolTip {
+      pointer-events: none;
+    }
   }
+  $dropZoneButtonHeight: 60px;
+  $dropZoneButtonOffsetY: $dropZoneButtonHeight * -0.5;
 
   &__dropZoneButton {
-    height: 8px;
+    position: absolute;
+    padding: 0;
+    height: $dropZoneButtonHeight;
+    margin-top: $dropZoneButtonOffsetY;
+    width: 100%;
     opacity: 0;
     text-decoration: none !important;
+    z-index: $dropZoneZIndex;
 
-    &--active {
+    &--visible {
+      pointer-events: visible !important;
       &:hover {
         transform: none !important;
       }
     }
 
-    &:disabled {
-      cursor: default !important;
-      & > * {
-        cursor: default !important;
-      }
+    &--unavailable {
+      cursor: not-allowed !important;
     }
   }
 
-  &__onFailureHandlerLabelContainer {
-    position: relative;
-    height: 14px;
-  }
-  &__onFailureHandlerLabel {
-    position: absolute;
-    bottom: -16px;
-    &--withDropZone {
-      bottom: -4px;
-    }
-  }
-
-
   &__onFailureHandlerContainer {
     margin-top: $euiSizeS;
     margin-bottom: $euiSizeS;
@@ -63,12 +63,4 @@
       overflow: visible;
     }
   }
-
-  &__item {
-    transition: border-color 1s;
-    min-height: 50px;
-    &--selected {
-      border: 1px solid $euiColorPrimary;
-    }
-  }
 }
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/utils.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/utils.ts
index 457e335602b9..6f8681b38fc7 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/utils.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_tree/utils.ts
@@ -13,9 +13,9 @@ import { ProcessorInternal } from '../../types';
 // - ./components/drop_zone_button.tsx
 // - ./components/pipeline_processors_editor_item.tsx
 const itemHeightsPx = {
-  WITHOUT_NESTED_ITEMS: 67,
+  WITHOUT_NESTED_ITEMS: 57,
   WITH_NESTED_ITEMS: 137,
-  TOP_PADDING: 16,
+  TOP_PADDING: 6,
 };
 
 export const calculateItemHeight = ({
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.scss b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.scss
index ee7421d7dbfa..73eb54827e04 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.scss
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.scss
@@ -1,3 +1,3 @@
 .pipelineProcessorsEditor {
-  margin-bottom: $euiSize;
+  margin-bottom: $euiSizeXL;
 }
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.tsx
index b64f77f582b3..09e77c510775 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.tsx
@@ -175,7 +175,7 @@ export const PipelineProcessorsEditor: FunctionComponent<Props> = memo(
             />
           </EuiFlexItem>
           <EuiFlexItem>
-            <EuiSpacer size="m" />
+            <EuiSpacer size="s" />
           </EuiFlexItem>
           <EuiFlexItem grow={false}>
             <OnFailureProcessorsTitle />
diff --git a/x-pack/plugins/ingest_pipelines/public/application/index.tsx b/x-pack/plugins/ingest_pipelines/public/application/index.tsx
index a8e6febeb2e5..6ffebd1854b7 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/index.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/index.tsx
@@ -7,7 +7,7 @@
 import { HttpSetup } from 'kibana/public';
 import React, { ReactNode } from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
-import { NotificationsSetup } from 'kibana/public';
+import { NotificationsSetup, IUiSettingsClient } from 'kibana/public';
 import { ManagementAppMountParams } from 'src/plugins/management/public';
 import { KibanaContextProvider } from '../../../../../src/plugins/kibana_react/public';
 
@@ -25,6 +25,7 @@ export interface AppServices {
   api: ApiService;
   notifications: NotificationsSetup;
   history: ManagementAppMountParams['history'];
+  uiSettings: IUiSettingsClient;
 }
 
 export interface CoreServices {
diff --git a/x-pack/plugins/ingest_pipelines/public/application/mount_management_section.ts b/x-pack/plugins/ingest_pipelines/public/application/mount_management_section.ts
index 49c8f5a7b2e1..16ba9f9cd7a1 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/mount_management_section.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/mount_management_section.ts
@@ -30,6 +30,7 @@ export async function mountManagementSection(
     api: apiService,
     notifications,
     history,
+    uiSettings: coreStart.uiSettings,
   };
 
   return renderApp(element, I18nContext, services, { http });
diff --git a/x-pack/plugins/ingest_pipelines/public/shared_imports.ts b/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
index 9ddb953c7197..05e7d1e41c5f 100644
--- a/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
+++ b/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
@@ -3,9 +3,11 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { useKibana as _useKibana } from '../../../../src/plugins/kibana_react/public';
+import { useKibana as _useKibana, CodeEditor } from '../../../../src/plugins/kibana_react/public';
 import { AppServices } from './application';
 
+export { CodeEditor };
+
 export {
   AuthorizationProvider,
   Error,
@@ -19,6 +21,7 @@ export {
   useRequest,
   UseRequestConfig,
   WithPrivileges,
+  Monaco,
 } from '../../../../src/plugins/es_ui_shared/public/';
 
 export {
@@ -36,6 +39,8 @@ export {
   FormDataProvider,
   OnFormUpdateArg,
   FieldConfig,
+  FieldHook,
+  getFieldValidityAndErrorMessage,
 } from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 
 export {

From 2a68dc7c6b8cb2fe8f77579241e70a204d6a26af Mon Sep 17 00:00:00 2001
From: Marta Bondyra <marta.bondyra@elastic.co>
Date: Fri, 26 Jun 2020 16:33:09 +0200
Subject: [PATCH 49/78] [Lens] Last used Index pattern is saved to and
 retrieved from local storage (#69511)

---
 .../indexpattern_datasource/indexpattern.tsx  |  3 +
 .../indexpattern_datasource/loader.test.ts    | 88 +++++++++++++++++++
 .../public/indexpattern_datasource/loader.ts  | 29 +++++-
 .../plugins/lens/public/settings_storage.tsx  | 17 ++++
 4 files changed, 135 insertions(+), 2 deletions(-)
 create mode 100644 x-pack/plugins/lens/public/settings_storage.tsx

diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx
index 9c4f6c9b590c..a98f63cf9b36 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx
@@ -125,6 +125,7 @@ export function getIndexPatternDatasource({
         state,
         savedObjectsClient: await savedObjectsClient,
         defaultIndexPatternId: core.uiSettings.get('defaultIndex'),
+        storage,
       });
     },
 
@@ -207,6 +208,7 @@ export function getIndexPatternDatasource({
                 setState,
                 savedObjectsClient,
                 onError: onIndexPatternLoadError,
+                storage,
               });
             }}
             data={data}
@@ -290,6 +292,7 @@ export function getIndexPatternDatasource({
               layerId: props.layerId,
               onError: onIndexPatternLoadError,
               replaceIfPossible: true,
+              storage,
             });
           }}
           {...props}
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
index b54ad3651471..55fd8a6d936d 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
@@ -18,6 +18,15 @@ import { documentField } from './document_field';
 
 jest.mock('./operations');
 
+const createMockStorage = (lastData?: Record<string, string>) => {
+  return {
+    get: jest.fn().mockImplementation(() => lastData),
+    set: jest.fn(),
+    remove: jest.fn(),
+    clear: jest.fn(),
+  };
+};
+
 const sampleIndexPatterns = {
   a: {
     id: 'a',
@@ -269,8 +278,10 @@ describe('loader', () => {
 
   describe('loadInitialState', () => {
     it('should load a default state', async () => {
+      const storage = createMockStorage();
       const state = await loadInitialState({
         savedObjectsClient: mockClient(),
+        storage,
       });
 
       expect(state).toMatchObject({
@@ -285,12 +296,61 @@ describe('loader', () => {
         layers: {},
         showEmptyFields: false,
       });
+      expect(storage.set).toHaveBeenCalledWith('lens-settings', {
+        indexPatternId: 'a',
+      });
+    });
+
+    it('should load a default state when lastUsedIndexPatternId is not found in indexPatternRefs', async () => {
+      const storage = createMockStorage({ indexPatternId: 'c' });
+      const state = await loadInitialState({
+        savedObjectsClient: mockClient(),
+        storage,
+      });
+
+      expect(state).toMatchObject({
+        currentIndexPatternId: 'a',
+        indexPatternRefs: [
+          { id: 'a', title: sampleIndexPatterns.a.title },
+          { id: 'b', title: sampleIndexPatterns.b.title },
+        ],
+        indexPatterns: {
+          a: sampleIndexPatterns.a,
+        },
+        layers: {},
+        showEmptyFields: false,
+      });
+      expect(storage.set).toHaveBeenCalledWith('lens-settings', {
+        indexPatternId: 'a',
+      });
+    });
+
+    it('should load lastUsedIndexPatternId if in localStorage', async () => {
+      const state = await loadInitialState({
+        savedObjectsClient: mockClient(),
+        storage: createMockStorage({ indexPatternId: 'b' }),
+      });
+
+      expect(state).toMatchObject({
+        currentIndexPatternId: 'b',
+        indexPatternRefs: [
+          { id: 'a', title: sampleIndexPatterns.a.title },
+          { id: 'b', title: sampleIndexPatterns.b.title },
+        ],
+        indexPatterns: {
+          b: sampleIndexPatterns.b,
+        },
+        layers: {},
+        showEmptyFields: false,
+      });
     });
 
     it('should use the default index pattern id, if provided', async () => {
+      const storage = createMockStorage();
       const state = await loadInitialState({
         defaultIndexPatternId: 'b',
         savedObjectsClient: mockClient(),
+        storage,
       });
 
       expect(state).toMatchObject({
@@ -305,6 +365,9 @@ describe('loader', () => {
         layers: {},
         showEmptyFields: false,
       });
+      expect(storage.set).toHaveBeenCalledWith('lens-settings', {
+        indexPatternId: 'b',
+      });
     });
 
     it('should initialize from saved state', async () => {
@@ -336,9 +399,11 @@ describe('loader', () => {
           },
         },
       };
+      const storage = createMockStorage({ indexPatternId: 'a' });
       const state = await loadInitialState({
         state: savedState,
         savedObjectsClient: mockClient(),
+        storage,
       });
 
       expect(state).toMatchObject({
@@ -353,6 +418,10 @@ describe('loader', () => {
         layers: savedState.layers,
         showEmptyFields: false,
       });
+
+      expect(storage.set).toHaveBeenCalledWith('lens-settings', {
+        indexPatternId: 'b',
+      });
     });
   });
 
@@ -367,6 +436,7 @@ describe('loader', () => {
         layers: {},
         showEmptyFields: true,
       };
+      const storage = createMockStorage({ indexPatternId: 'b' });
 
       await changeIndexPattern({
         state,
@@ -374,6 +444,7 @@ describe('loader', () => {
         id: 'a',
         savedObjectsClient: mockClient(),
         onError: jest.fn(),
+        storage,
       });
 
       expect(setState).toHaveBeenCalledTimes(1);
@@ -383,6 +454,9 @@ describe('loader', () => {
           a: sampleIndexPatterns.a,
         },
       });
+      expect(storage.set).toHaveBeenCalledWith('lens-settings', {
+        indexPatternId: 'a',
+      });
     });
 
     it('handles errors', async () => {
@@ -398,6 +472,8 @@ describe('loader', () => {
         showEmptyFields: true,
       };
 
+      const storage = createMockStorage({ indexPatternId: 'b' });
+
       await changeIndexPattern({
         state,
         setState,
@@ -409,9 +485,11 @@ describe('loader', () => {
           }),
         },
         onError,
+        storage,
       });
 
       expect(setState).not.toHaveBeenCalled();
+      expect(storage.set).not.toHaveBeenCalled();
       expect(onError).toHaveBeenCalledWith(err);
     });
   });
@@ -452,6 +530,8 @@ describe('loader', () => {
         showEmptyFields: true,
       };
 
+      const storage = createMockStorage({ indexPatternId: 'a' });
+
       await changeLayerIndexPattern({
         state,
         setState,
@@ -459,6 +539,7 @@ describe('loader', () => {
         layerId: 'l1',
         savedObjectsClient: mockClient(),
         onError: jest.fn(),
+        storage,
       });
 
       expect(setState).toHaveBeenCalledTimes(1);
@@ -492,6 +573,9 @@ describe('loader', () => {
           },
         },
       });
+      expect(storage.set).toHaveBeenCalledWith('lens-settings', {
+        indexPatternId: 'b',
+      });
     });
 
     it('handles errors', async () => {
@@ -515,6 +599,8 @@ describe('loader', () => {
         showEmptyFields: true,
       };
 
+      const storage = createMockStorage({ indexPatternId: 'b' });
+
       await changeLayerIndexPattern({
         state,
         setState,
@@ -527,9 +613,11 @@ describe('loader', () => {
           }),
         },
         onError,
+        storage,
       });
 
       expect(setState).not.toHaveBeenCalled();
+      expect(storage.set).not.toHaveBeenCalled();
       expect(onError).toHaveBeenCalledWith(err);
     });
   });
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
index c34f4c1d2314..ca52ffe73a87 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
@@ -5,6 +5,7 @@
  */
 
 import _ from 'lodash';
+import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
 import { SavedObjectsClientContract, SavedObjectAttributes, HttpSetup } from 'kibana/public';
 import { SimpleSavedObject } from 'kibana/public';
 import { StateSetter } from '../types';
@@ -24,6 +25,7 @@ import {
   IFieldType,
   IndexPatternTypeMeta,
 } from '../../../../../src/plugins/data/public';
+import { readFromStorage, writeToStorage } from '../settings_storage';
 
 interface SavedIndexPatternAttributes extends SavedObjectAttributes {
   title: string;
@@ -68,31 +70,48 @@ export async function loadIndexPatterns({
   );
 }
 
+const getLastUsedIndexPatternId = (
+  storage: IStorageWrapper,
+  indexPatternRefs: IndexPatternRef[]
+) => {
+  const indexPattern = readFromStorage(storage, 'indexPatternId');
+  return indexPattern && indexPatternRefs.find((i) => i.id === indexPattern)?.id;
+};
+
+const setLastUsedIndexPatternId = (storage: IStorageWrapper, value: string) => {
+  writeToStorage(storage, 'indexPatternId', value);
+};
+
 export async function loadInitialState({
   state,
   savedObjectsClient,
   defaultIndexPatternId,
+  storage,
 }: {
   state?: IndexPatternPersistedState;
   savedObjectsClient: SavedObjectsClient;
   defaultIndexPatternId?: string;
+  storage: IStorageWrapper;
 }): Promise<IndexPatternPrivateState> {
   const indexPatternRefs = await loadIndexPatternRefs(savedObjectsClient);
+  const lastUsedIndexPatternId = getLastUsedIndexPatternId(storage, indexPatternRefs);
+
   const requiredPatterns = _.unique(
     state
       ? Object.values(state.layers)
           .map((l) => l.indexPatternId)
           .concat(state.currentIndexPatternId)
-      : [defaultIndexPatternId || indexPatternRefs[0].id]
+      : [lastUsedIndexPatternId || defaultIndexPatternId || indexPatternRefs[0].id]
   );
 
   const currentIndexPatternId = requiredPatterns[0];
+  setLastUsedIndexPatternId(storage, currentIndexPatternId);
+
   const indexPatterns = await loadIndexPatterns({
     savedObjectsClient,
     cache: {},
     patterns: requiredPatterns,
   });
-
   if (state) {
     return {
       ...state,
@@ -120,12 +139,14 @@ export async function changeIndexPattern({
   state,
   setState,
   onError,
+  storage,
 }: {
   id: string;
   savedObjectsClient: SavedObjectsClient;
   state: IndexPatternPrivateState;
   setState: SetState;
   onError: ErrorHandler;
+  storage: IStorageWrapper;
 }) {
   try {
     const indexPatterns = await loadIndexPatterns({
@@ -145,6 +166,7 @@ export async function changeIndexPattern({
       },
       currentIndexPatternId: id,
     }));
+    setLastUsedIndexPatternId(storage, id);
   } catch (err) {
     onError(err);
   }
@@ -158,6 +180,7 @@ export async function changeLayerIndexPattern({
   setState,
   onError,
   replaceIfPossible,
+  storage,
 }: {
   indexPatternId: string;
   layerId: string;
@@ -166,6 +189,7 @@ export async function changeLayerIndexPattern({
   setState: SetState;
   onError: ErrorHandler;
   replaceIfPossible?: boolean;
+  storage: IStorageWrapper;
 }) {
   try {
     const indexPatterns = await loadIndexPatterns({
@@ -186,6 +210,7 @@ export async function changeLayerIndexPattern({
       },
       currentIndexPatternId: replaceIfPossible ? indexPatternId : s.currentIndexPatternId,
     }));
+    setLastUsedIndexPatternId(storage, indexPatternId);
   } catch (err) {
     onError(err);
   }
diff --git a/x-pack/plugins/lens/public/settings_storage.tsx b/x-pack/plugins/lens/public/settings_storage.tsx
new file mode 100644
index 000000000000..58e014512eda
--- /dev/null
+++ b/x-pack/plugins/lens/public/settings_storage.tsx
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
+
+const STORAGE_KEY = 'lens-settings';
+
+export const readFromStorage = (storage: IStorageWrapper, key: string) => {
+  const data = storage.get(STORAGE_KEY);
+  return data && data[key];
+};
+export const writeToStorage = (storage: IStorageWrapper, key: string, value: string) => {
+  storage.set(STORAGE_KEY, { [key]: value });
+};

From eea33a0db208ae3895228ebe60349e143e858acf Mon Sep 17 00:00:00 2001
From: Walter Rafelsberger <walter@elastic.co>
Date: Fri, 26 Jun 2020 17:03:00 +0200
Subject: [PATCH 50/78] [ML] Transforms: Adds functional tests for transform
 cloning and editing. (#69933)

Adds functional tests for transform cloning and editing.
---
 .../edit_transform_flyout.tsx                 |  16 +-
 .../edit_transform_flyout_form.tsx            |   3 +
 .../edit_transform_flyout_form_text_input.tsx |   3 +
 .../__snapshots__/action_delete.test.tsx.snap |   1 +
 .../__snapshots__/action_start.test.tsx.snap  |   1 +
 .../__snapshots__/action_stop.test.tsx.snap   |   1 +
 .../transform_list/action_clone.tsx           |   1 +
 .../transform_list/action_delete.tsx          |   1 +
 .../components/transform_list/action_edit.tsx |   1 +
 .../transform_list/action_start.tsx           |   1 +
 .../components/transform_list/action_stop.tsx |   1 +
 .../test/functional/apps/transform/cloning.ts | 171 +++++++++++++++++-
 .../apps/transform/creation_index_pattern.ts  |   2 +-
 .../apps/transform/creation_saved_search.ts   |   2 +-
 .../test/functional/apps/transform/editing.ts | 149 +++++++++++++++
 .../test/functional/apps/transform/index.ts   |   1 +
 .../services/transform/edit_flyout.ts         |  52 ++++++
 .../functional/services/transform/index.ts    |   3 +
 .../services/transform/transform_table.ts     |  42 ++++-
 19 files changed, 442 insertions(+), 10 deletions(-)
 create mode 100644 x-pack/test/functional/apps/transform/editing.ts
 create mode 100644 x-pack/test/functional/services/transform/edit_flyout.ts

diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout.tsx
index d3dae0a8c8b6..77a7ae25ce88 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout.tsx
@@ -77,10 +77,15 @@ export const EditTransformFlyout: FC<EditTransformFlyoutProps> = ({ closeFlyout,
 
   return (
     <EuiOverlayMask>
-      <EuiFlyout onClose={closeFlyout} hideCloseButton aria-labelledby="flyoutComplicatedTitle">
+      <EuiFlyout
+        onClose={closeFlyout}
+        hideCloseButton
+        aria-labelledby="transformEditFlyoutTitle"
+        data-test-subj="transformEditFlyout"
+      >
         <EuiFlyoutHeader hasBorder>
           <EuiTitle size="m">
-            <h2 id="flyoutComplicatedTitle">
+            <h2 id="transformEditFlyoutTitle">
               {i18n.translate('xpack.transform.transformList.editFlyoutTitle', {
                 defaultMessage: 'Edit {transformId}',
                 values: {
@@ -121,7 +126,12 @@ export const EditTransformFlyout: FC<EditTransformFlyoutProps> = ({ closeFlyout,
               </EuiButtonEmpty>
             </EuiFlexItem>
             <EuiFlexItem grow={false}>
-              <EuiButton onClick={submitFormHandler} fill isDisabled={isUpdateButtonDisabled}>
+              <EuiButton
+                data-test-subj="transformEditFlyoutUpdateButton"
+                onClick={submitFormHandler}
+                fill
+                isDisabled={isUpdateButtonDisabled}
+              >
                 {i18n.translate('xpack.transform.transformList.editFlyoutUpdateButtonText', {
                   defaultMessage: 'Update',
                 })}
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout_form.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout_form.tsx
index a9c230870bfc..583689875522 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout_form.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout_form.tsx
@@ -25,6 +25,7 @@ export const EditTransformFlyoutForm: FC<EditTransformFlyoutFormProps> = ({
   return (
     <EuiForm>
       <EditTransformFlyoutFormTextInput
+        dataTestSubj="transformEditFlyoutDescriptionInput"
         errorMessages={formFields.description.errorMessages}
         label={i18n.translate('xpack.transform.transformList.editFlyoutFormDescriptionLabel', {
           defaultMessage: 'Description',
@@ -33,6 +34,7 @@ export const EditTransformFlyoutForm: FC<EditTransformFlyoutFormProps> = ({
         value={formFields.description.value}
       />
       <EditTransformFlyoutFormTextInput
+        dataTestSubj="transformEditFlyoutDocsPerSecondInput"
         errorMessages={formFields.docsPerSecond.errorMessages}
         helpText={i18n.translate(
           'xpack.transform.transformList.editFlyoutFormDocsPerSecondHelptext',
@@ -48,6 +50,7 @@ export const EditTransformFlyoutForm: FC<EditTransformFlyoutFormProps> = ({
         value={formFields.docsPerSecond.value}
       />
       <EditTransformFlyoutFormTextInput
+        dataTestSubj="transformEditFlyoutFrequencyInput"
         errorMessages={formFields.frequency.errorMessages}
         helpText={i18n.translate('xpack.transform.transformList.editFlyoutFormFrequencyHelptext', {
           defaultMessage:
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout_form_text_input.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout_form_text_input.tsx
index 86edb78e6dcb..639b5a7c49a6 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout_form_text_input.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout_form_text_input.tsx
@@ -9,6 +9,7 @@ import React, { FC } from 'react';
 import { EuiFieldText, EuiFormRow } from '@elastic/eui';
 
 interface EditTransformFlyoutFormTextInputProps {
+  dataTestSubj: string;
   errorMessages: string[];
   helpText?: string;
   label: string;
@@ -18,6 +19,7 @@ interface EditTransformFlyoutFormTextInputProps {
 }
 
 export const EditTransformFlyoutFormTextInput: FC<EditTransformFlyoutFormTextInputProps> = ({
+  dataTestSubj,
   errorMessages,
   helpText,
   label,
@@ -33,6 +35,7 @@ export const EditTransformFlyoutFormTextInput: FC<EditTransformFlyoutFormTextInp
       error={errorMessages}
     >
       <EuiFieldText
+        data-test-subj={dataTestSubj}
         placeholder={placeholder}
         isInvalid={errorMessages.length > 0}
         value={value}
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_delete.test.tsx.snap b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_delete.test.tsx.snap
index 5695b8a84749..da5ad27c9d6b 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_delete.test.tsx.snap
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_delete.test.tsx.snap
@@ -10,6 +10,7 @@ exports[`Transform: Transform List Actions <DeleteAction /> Minimal initializati
     <EuiButtonEmpty
       aria-label="Delete"
       color="text"
+      data-test-subj="transformActionDelete"
       disabled={true}
       iconType="trash"
       onClick={[Function]}
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_start.test.tsx.snap b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_start.test.tsx.snap
index 17018576ad71..d534f05d3be9 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_start.test.tsx.snap
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_start.test.tsx.snap
@@ -10,6 +10,7 @@ exports[`Transform: Transform List Actions <StartAction /> Minimal initializatio
     <EuiButtonEmpty
       aria-label="Start"
       color="text"
+      data-test-subj="transformActionStart"
       disabled={true}
       iconType="play"
       onClick={[Function]}
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_stop.test.tsx.snap b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_stop.test.tsx.snap
index 95962ac11b65..97d393bc8128 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_stop.test.tsx.snap
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/__snapshots__/action_stop.test.tsx.snap
@@ -9,6 +9,7 @@ exports[`Transform: Transform List Actions <StopAction /> Minimal initialization
   <EuiButtonEmpty
     aria-label="Stop"
     color="text"
+    data-test-subj="transformActionStop"
     disabled={true}
     iconType="stop"
     onClick={[Function]}
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_clone.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_clone.tsx
index 48188fd70bd7..aa78dfb4315f 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_clone.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_clone.tsx
@@ -35,6 +35,7 @@ export const CloneAction: FC<CloneActionProps> = ({ itemId }) => {
 
   const cloneButton = (
     <EuiButtonEmpty
+      data-test-subj="transformActionClone"
       size="xs"
       color="text"
       disabled={!canCreateTransform}
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_delete.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_delete.tsx
index 19297eb25d0b..79a9e45e317e 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_delete.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_delete.tsx
@@ -205,6 +205,7 @@ export const DeleteAction: FC<DeleteActionProps> = ({ items, forceDisable }) =>
 
   let deleteButton = (
     <EuiButtonEmpty
+      data-test-subj="transformActionDelete"
       size="xs"
       color="text"
       disabled={forceDisable === true || disabled || !canDeleteTransform}
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_edit.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_edit.tsx
index 1aafbac1e1bc..dfb4cd443e90 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_edit.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_edit.tsx
@@ -35,6 +35,7 @@ export const EditAction: FC<EditActionProps> = ({ config }) => {
 
   const editButton = (
     <EuiButtonEmpty
+      data-test-subj="transformActionEdit"
       size="xs"
       color="text"
       disabled={!canCreateTransform}
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_start.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_start.tsx
index b6b8a75b4b73..9edfe7fab70a 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_start.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_start.tsx
@@ -91,6 +91,7 @@ export const StartAction: FC<StartActionProps> = ({ items, forceDisable }) => {
 
   let startButton = (
     <EuiButtonEmpty
+      data-test-subj="transformActionStart"
       size="xs"
       color="text"
       disabled={forceDisable === true || actionIsDisabled}
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_stop.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_stop.tsx
index f6b63191b538..3f35bef45895 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_stop.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/action_stop.tsx
@@ -59,6 +59,7 @@ export const StopAction: FC<StopActionProps> = ({ items, forceDisable }) => {
 
   const stopButton = (
     <EuiButtonEmpty
+      data-test-subj="transformActionStop"
       size="xs"
       color="text"
       disabled={forceDisable === true || !canStartStopTransform || stoppedTransform === true}
diff --git a/x-pack/test/functional/apps/transform/cloning.ts b/x-pack/test/functional/apps/transform/cloning.ts
index b7e71860bcb5..d94923d9a7cc 100644
--- a/x-pack/test/functional/apps/transform/cloning.ts
+++ b/x-pack/test/functional/apps/transform/cloning.ts
@@ -3,6 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { TransformPivotConfig } from '../../../../plugins/transform/public/app/common';
@@ -46,21 +47,183 @@ export default function ({ getService }: FtrProviderContext) {
 
     const testDataList = [
       {
-        suiteTitle: 'batch transform with terms group and avg agg',
-        expected: {},
+        suiteTitle: 'clone transform',
+        transformId: `clone_${transformConfig.id}`,
+        transformDescription: `a cloned transform`,
+        get destinationIndex(): string {
+          return `user-${this.transformId}`;
+        },
+        expected: {
+          aggs: {
+            index: 0,
+            label: 'products.base_price.avg',
+          },
+          indexPreview: {
+            columns: 10,
+            rows: 5,
+          },
+          groupBy: {
+            index: 0,
+            label: 'category',
+          },
+          pivotPreview: {
+            column: 0,
+            values: [
+              `Men's Accessories`,
+              `Men's Clothing`,
+              `Men's Shoes`,
+              `Women's Accessories`,
+              `Women's Clothing`,
+            ],
+          },
+        },
       },
     ];
 
     for (const testData of testDataList) {
       describe(`${testData.suiteTitle}`, function () {
         after(async () => {
-          // await transform.api.deleteIndices(<CLONE_DEST_INDEX>);
+          await transform.api.deleteIndices(testData.destinationIndex);
+          await transform.testResources.deleteIndexPatternByTitle(testData.destinationIndex);
         });
 
-        it('loads the home page', async () => {
+        it('should load the home page', async () => {
           await transform.navigation.navigateTo();
           await transform.management.assertTransformListPageExists();
         });
+
+        it('should display the transforms table', async () => {
+          await transform.management.assertTransformsTableExists();
+        });
+
+        it('should display the original transform in the transform list', async () => {
+          await transform.table.refreshTransformList();
+          await transform.table.filterWithSearchString(transformConfig.id);
+          const rows = await transform.table.parseTransformTable();
+          expect(rows.filter((row) => row.id === transformConfig.id)).to.have.length(1);
+        });
+
+        it('should show the actions popover', async () => {
+          await transform.table.assertTransformRowActions(false);
+        });
+
+        it('should display the define pivot step', async () => {
+          await transform.table.clickTransformRowAction('Clone');
+          await transform.wizard.assertDefineStepActive();
+        });
+
+        it('should load the index preview', async () => {
+          await transform.wizard.assertIndexPreviewLoaded();
+        });
+
+        it('should show the index preview', async () => {
+          await transform.wizard.assertIndexPreview(
+            testData.expected.indexPreview.columns,
+            testData.expected.indexPreview.rows
+          );
+        });
+
+        it('should display the query input', async () => {
+          await transform.wizard.assertQueryInputExists();
+          await transform.wizard.assertQueryValue('');
+        });
+
+        it('should show the pre-filled group-by configuration', async () => {
+          await transform.wizard.assertGroupByEntryExists(
+            testData.expected.groupBy.index,
+            testData.expected.groupBy.label
+          );
+        });
+
+        it('should show the pre-filled aggs configuration', async () => {
+          await transform.wizard.assertAggregationEntryExists(
+            testData.expected.aggs.index,
+            testData.expected.aggs.label
+          );
+        });
+
+        it('should show the pivot preview', async () => {
+          await transform.wizard.assertPivotPreviewChartHistogramButtonMissing();
+          await transform.wizard.assertPivotPreviewColumnValues(
+            testData.expected.pivotPreview.column,
+            testData.expected.pivotPreview.values
+          );
+        });
+
+        it('should load the details step', async () => {
+          await transform.wizard.advanceToDetailsStep();
+        });
+
+        it('should input the transform id', async () => {
+          await transform.wizard.assertTransformIdInputExists();
+          await transform.wizard.assertTransformIdValue('');
+          await transform.wizard.setTransformId(testData.transformId);
+        });
+
+        it('should input the transform description', async () => {
+          await transform.wizard.assertTransformDescriptionInputExists();
+          await transform.wizard.assertTransformDescriptionValue('');
+          await transform.wizard.setTransformDescription(testData.transformDescription);
+        });
+
+        it('should input the destination index', async () => {
+          await transform.wizard.assertDestinationIndexInputExists();
+          await transform.wizard.assertDestinationIndexValue('');
+          await transform.wizard.setDestinationIndex(testData.destinationIndex);
+        });
+
+        it('should display the create index pattern switch', async () => {
+          await transform.wizard.assertCreateIndexPatternSwitchExists();
+          await transform.wizard.assertCreateIndexPatternSwitchCheckState(true);
+        });
+
+        it('should display the continuous mode switch', async () => {
+          await transform.wizard.assertContinuousModeSwitchExists();
+          await transform.wizard.assertContinuousModeSwitchCheckState(false);
+        });
+
+        it('should load the create step', async () => {
+          await transform.wizard.advanceToCreateStep();
+        });
+
+        it('should display the create and start button', async () => {
+          await transform.wizard.assertCreateAndStartButtonExists();
+          await transform.wizard.assertCreateAndStartButtonEnabled(true);
+        });
+
+        it('should display the create button', async () => {
+          await transform.wizard.assertCreateButtonExists();
+          await transform.wizard.assertCreateButtonEnabled(true);
+        });
+
+        it('should display the copy to clipboard button', async () => {
+          await transform.wizard.assertCopyToClipboardButtonExists();
+          await transform.wizard.assertCopyToClipboardButtonEnabled(true);
+        });
+
+        it('should create the transform', async () => {
+          await transform.wizard.createTransform();
+        });
+
+        it('should start the transform and finish processing', async () => {
+          await transform.wizard.startTransform();
+          await transform.wizard.waitForProgressBarComplete();
+        });
+
+        it('should return to the management page', async () => {
+          await transform.wizard.returnToManagement();
+        });
+
+        it('should display the transforms table', async () => {
+          await transform.management.assertTransformsTableExists();
+        });
+
+        it('should display the created transform in the transform list', async () => {
+          await transform.table.refreshTransformList();
+          await transform.table.filterWithSearchString(testData.transformId);
+          const rows = await transform.table.parseTransformTable();
+          expect(rows.filter((row) => row.id === testData.transformId)).to.have.length(1);
+        });
       });
     }
   });
diff --git a/x-pack/test/functional/apps/transform/creation_index_pattern.ts b/x-pack/test/functional/apps/transform/creation_index_pattern.ts
index bf267c80cdcc..7c9983101f60 100644
--- a/x-pack/test/functional/apps/transform/creation_index_pattern.ts
+++ b/x-pack/test/functional/apps/transform/creation_index_pattern.ts
@@ -432,7 +432,7 @@ export default function ({ getService }: FtrProviderContext) {
           expect(rows.filter((row) => row.id === testData.transformId)).to.have.length(1);
         });
 
-        it('job creation displays details for the created job in the job list', async () => {
+        it('transform creation displays details for the created transform in the transform list', async () => {
           await transform.table.assertTransformRowFields(testData.transformId, {
             id: testData.transformId,
             description: testData.transformDescription,
diff --git a/x-pack/test/functional/apps/transform/creation_saved_search.ts b/x-pack/test/functional/apps/transform/creation_saved_search.ts
index bc4ded49660f..54cc5b3f6293 100644
--- a/x-pack/test/functional/apps/transform/creation_saved_search.ts
+++ b/x-pack/test/functional/apps/transform/creation_saved_search.ts
@@ -235,7 +235,7 @@ export default function ({ getService }: FtrProviderContext) {
           expect(rows.filter((row) => row.id === testData.transformId)).to.have.length(1);
         });
 
-        it('job creation displays details for the created job in the job list', async () => {
+        it('transform creation displays details for the created transform in the transform list', async () => {
           await transform.table.assertTransformRowFields(testData.transformId, {
             id: testData.transformId,
             description: testData.transformDescription,
diff --git a/x-pack/test/functional/apps/transform/editing.ts b/x-pack/test/functional/apps/transform/editing.ts
new file mode 100644
index 000000000000..44ecca17328a
--- /dev/null
+++ b/x-pack/test/functional/apps/transform/editing.ts
@@ -0,0 +1,149 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect';
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+import { TransformPivotConfig } from '../../../../plugins/transform/public/app/common';
+
+function getTransformConfig(): TransformPivotConfig {
+  const date = Date.now();
+  return {
+    id: `ec_2_${date}`,
+    source: { index: ['ft_ecommerce'] },
+    pivot: {
+      group_by: { category: { terms: { field: 'category.keyword' } } },
+      aggregations: { 'products.base_price.avg': { avg: { field: 'products.base_price' } } },
+    },
+    description:
+      'ecommerce batch transform with avg(products.base_price) grouped by terms(category.keyword)',
+    dest: { index: `user-ec_2_${date}` },
+  };
+}
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const transform = getService('transform');
+
+  describe('editing', function () {
+    const transformConfig = getTransformConfig();
+
+    before(async () => {
+      await esArchiver.loadIfNeeded('ml/ecommerce');
+      await transform.testResources.createIndexPatternIfNeeded('ft_ecommerce', 'order_date');
+      await transform.api.createAndRunTransform(transformConfig);
+      await transform.testResources.setKibanaTimeZoneToUTC();
+
+      await transform.securityUI.loginAsTransformPowerUser();
+    });
+
+    after(async () => {
+      await transform.testResources.deleteIndexPatternByTitle(transformConfig.dest.index);
+      await transform.api.deleteIndices(transformConfig.dest.index);
+      await transform.api.cleanTransformIndices();
+    });
+
+    const testData = {
+      suiteTitle: 'edit transform',
+      transformDescription: 'updated description',
+      transformDocsPerSecond: '1000',
+      transformFrequency: '10m',
+      expected: {
+        messageText: 'updated transform.',
+        row: {
+          status: 'stopped',
+          mode: 'batch',
+          progress: '100',
+        },
+      },
+    };
+
+    describe(`${testData.suiteTitle}`, function () {
+      it('should load the home page', async () => {
+        await transform.navigation.navigateTo();
+        await transform.management.assertTransformListPageExists();
+      });
+
+      it('should display the transforms table', async () => {
+        await transform.management.assertTransformsTableExists();
+      });
+
+      it('should display the original transform in the transform list', async () => {
+        await transform.table.refreshTransformList();
+        await transform.table.filterWithSearchString(transformConfig.id);
+        const rows = await transform.table.parseTransformTable();
+        expect(rows.filter((row) => row.id === transformConfig.id)).to.have.length(1);
+      });
+
+      it('should show the actions popover', async () => {
+        await transform.table.assertTransformRowActions(false);
+      });
+
+      it('should show the edit flyout', async () => {
+        await transform.table.clickTransformRowAction('Edit');
+        await transform.editFlyout.assertTransformEditFlyoutExists();
+      });
+
+      it('should update the transform description', async () => {
+        await transform.editFlyout.assertTransformEditFlyoutInputExists('Description');
+        await transform.editFlyout.assertTransformEditFlyoutInputValue(
+          'Description',
+          transformConfig?.description ?? ''
+        );
+        await transform.editFlyout.setTransformEditFlyoutInputValue(
+          'Description',
+          testData.transformDescription
+        );
+      });
+
+      it('should update the transform documents per second', async () => {
+        await transform.editFlyout.assertTransformEditFlyoutInputExists('DocsPerSecond');
+        await transform.editFlyout.assertTransformEditFlyoutInputValue('DocsPerSecond', '');
+        await transform.editFlyout.setTransformEditFlyoutInputValue(
+          'DocsPerSecond',
+          testData.transformDocsPerSecond
+        );
+      });
+
+      it('should update the transform frequency', async () => {
+        await transform.editFlyout.assertTransformEditFlyoutInputExists('Frequency');
+        await transform.editFlyout.assertTransformEditFlyoutInputValue('Frequency', '');
+        await transform.editFlyout.setTransformEditFlyoutInputValue(
+          'Frequency',
+          testData.transformFrequency
+        );
+      });
+
+      it('should update the transform', async () => {
+        await transform.editFlyout.updateTransform();
+      });
+
+      it('should display the transforms table', async () => {
+        await transform.management.assertTransformsTableExists();
+      });
+
+      it('should display the updated transform in the transform list', async () => {
+        await transform.table.refreshTransformList();
+        await transform.table.filterWithSearchString(transformConfig.id);
+        const rows = await transform.table.parseTransformTable();
+        expect(rows.filter((row) => row.id === transformConfig.id)).to.have.length(1);
+      });
+
+      it('should display the updated transform in the transform list row cells', async () => {
+        await transform.table.assertTransformRowFields(transformConfig.id, {
+          id: transformConfig.id,
+          description: testData.transformDescription,
+          status: testData.expected.row.status,
+          mode: testData.expected.row.mode,
+          progress: testData.expected.row.progress,
+        });
+      });
+
+      it('should display the messages tab and include an update message', async () => {
+        await transform.table.assertTransformExpandedRowMessages(testData.expected.messageText);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/transform/index.ts b/x-pack/test/functional/apps/transform/index.ts
index a7859be6923d..04a751279bf3 100644
--- a/x-pack/test/functional/apps/transform/index.ts
+++ b/x-pack/test/functional/apps/transform/index.ts
@@ -35,5 +35,6 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./creation_index_pattern'));
     loadTestFile(require.resolve('./creation_saved_search'));
     loadTestFile(require.resolve('./cloning'));
+    loadTestFile(require.resolve('./editing'));
   });
 }
diff --git a/x-pack/test/functional/services/transform/edit_flyout.ts b/x-pack/test/functional/services/transform/edit_flyout.ts
new file mode 100644
index 000000000000..f9504deb39f6
--- /dev/null
+++ b/x-pack/test/functional/services/transform/edit_flyout.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect';
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export function TransformEditFlyoutProvider({ getService }: FtrProviderContext) {
+  const retry = getService('retry');
+  const testSubjects = getService('testSubjects');
+
+  return {
+    async assertTransformEditFlyoutExists() {
+      await testSubjects.existOrFail('transformEditFlyout');
+    },
+
+    async assertTransformEditFlyoutMissing() {
+      await testSubjects.missingOrFail('transformEditFlyout');
+    },
+
+    async assertTransformEditFlyoutInputExists(input: string) {
+      await testSubjects.existOrFail(`transformEditFlyout${input}Input`);
+    },
+
+    async assertTransformEditFlyoutInputValue(input: string, expectedValue: string) {
+      const actualValue = await testSubjects.getAttribute(
+        `transformEditFlyout${input}Input`,
+        'value'
+      );
+      expect(actualValue).to.eql(
+        expectedValue,
+        `Transform edit flyout '${input}' input text should be '${expectedValue}' (got '${actualValue}')`
+      );
+    },
+
+    async setTransformEditFlyoutInputValue(input: string, value: string) {
+      await testSubjects.setValue(`transformEditFlyout${input}Input`, value, {
+        clearWithKeyboard: true,
+      });
+      await this.assertTransformEditFlyoutInputValue(input, value);
+    },
+
+    async updateTransform() {
+      await testSubjects.click('transformEditFlyoutUpdateButton');
+      await retry.tryForTime(5000, async () => {
+        await this.assertTransformEditFlyoutMissing();
+      });
+    },
+  };
+}
diff --git a/x-pack/test/functional/services/transform/index.ts b/x-pack/test/functional/services/transform/index.ts
index 070bc48b432e..24091ba77321 100644
--- a/x-pack/test/functional/services/transform/index.ts
+++ b/x-pack/test/functional/services/transform/index.ts
@@ -7,6 +7,7 @@
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 import { TransformAPIProvider } from './api';
+import { TransformEditFlyoutProvider } from './edit_flyout';
 import { TransformManagementProvider } from './management';
 import { TransformNavigationProvider } from './navigation';
 import { TransformSecurityCommonProvider } from './security_common';
@@ -19,6 +20,7 @@ import { MachineLearningTestResourcesProvider } from '../ml/test_resources';
 
 export function TransformProvider(context: FtrProviderContext) {
   const api = TransformAPIProvider(context);
+  const editFlyout = TransformEditFlyoutProvider(context);
   const management = TransformManagementProvider(context);
   const navigation = TransformNavigationProvider(context);
   const securityCommon = TransformSecurityCommonProvider(context);
@@ -30,6 +32,7 @@ export function TransformProvider(context: FtrProviderContext) {
 
   return {
     api,
+    editFlyout,
     management,
     navigation,
     securityCommon,
diff --git a/x-pack/test/functional/services/transform/transform_table.ts b/x-pack/test/functional/services/transform/transform_table.ts
index 0c9a5414bdd2..453dca904b60 100644
--- a/x-pack/test/functional/services/transform/transform_table.ts
+++ b/x-pack/test/functional/services/transform/transform_table.ts
@@ -145,12 +145,52 @@ export function TransformTableProvider({ getService }: FtrProviderContext) {
       await testSubjects.existOrFail('~transformPivotPreview');
     }
 
+    public async assertTransformExpandedRowMessages(expectedText: string) {
+      await testSubjects.click('transformListRowDetailsToggle');
+
+      // The expanded row should show the details tab content by default
+      await testSubjects.existOrFail('transformDetailsTab');
+      await testSubjects.existOrFail('~transformDetailsTabContent');
+
+      // Click on the messages tab and assert the messages
+      await testSubjects.existOrFail('transformMessagesTab');
+      await testSubjects.click('transformMessagesTab');
+      await testSubjects.existOrFail('~transformMessagesTabContent');
+      await retry.tryForTime(5000, async () => {
+        const actualText = await testSubjects.getVisibleText('~transformMessagesTabContent');
+        expect(actualText.includes(expectedText)).to.eql(
+          true,
+          `Expected transform messages text to include '${expectedText}'`
+        );
+      });
+    }
+
+    public async assertTransformRowActions(isTransformRunning = false) {
+      await testSubjects.click('euiCollapsedItemActionsButton');
+
+      await testSubjects.existOrFail('transformActionClone');
+      await testSubjects.existOrFail('transformActionDelete');
+      await testSubjects.existOrFail('transformActionEdit');
+
+      if (isTransformRunning) {
+        await testSubjects.missingOrFail('transformActionStart');
+        await testSubjects.existOrFail('transformActionStop');
+      } else {
+        await testSubjects.existOrFail('transformActionStart');
+        await testSubjects.missingOrFail('transformActionStop');
+      }
+    }
+
+    public async clickTransformRowAction(action: string) {
+      await testSubjects.click(`transformAction${action}`);
+    }
+
     public async waitForTransformsExpandedRowPreviewTabToLoad() {
       await testSubjects.existOrFail('~transformPivotPreview', { timeout: 60 * 1000 });
       await testSubjects.existOrFail('transformPivotPreview loaded', { timeout: 30 * 1000 });
     }
 
-    async assertTransformsExpandedRowPreviewColumnValues(column: number, values: string[]) {
+    public async assertTransformsExpandedRowPreviewColumnValues(column: number, values: string[]) {
       await this.waitForTransformsExpandedRowPreviewTabToLoad();
       await this.assertEuiDataGridColumnValues('transformPivotPreview', column, values);
     }

From 4845bef18194bf90778f6c156b7548dfc98f86c8 Mon Sep 17 00:00:00 2001
From: John Dorlus <silne.dorlus@elastic.co>
Date: Fri, 26 Jun 2020 11:59:50 -0400
Subject: [PATCH 51/78] Fixed issue where promise chain was broken. (#70004)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 x-pack/test/functional/apps/rollup_job/rollup_jobs.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/test/functional/apps/rollup_job/rollup_jobs.js b/x-pack/test/functional/apps/rollup_job/rollup_jobs.js
index 28f5e2ae00f0..5b6484d7184f 100644
--- a/x-pack/test/functional/apps/rollup_job/rollup_jobs.js
+++ b/x-pack/test/functional/apps/rollup_job/rollup_jobs.js
@@ -31,9 +31,9 @@ export default function ({ getService, getPageObjects }) {
     it('create new rollup job', async () => {
       const interval = '1000ms';
 
-      pastDates.map(async (day) => {
+      for (const day of pastDates) {
         await es.index(mockIndices(day, rollupSourceDataPrepend));
-      });
+      }
 
       await PageObjects.common.navigateToApp('rollupJob');
       await PageObjects.rollup.createNewRollUpJob(

From 100a5fd18b7c500a99932a8e8c0cf47c12bfe7e5 Mon Sep 17 00:00:00 2001
From: Angela Chuang <6295984+angorayc@users.noreply.github.com>
Date: Fri, 26 Jun 2020 17:12:21 +0100
Subject: [PATCH 52/78] [SIEM] Update readme for timeline apis (#67038)

* update doc

* update unit test

* remove redundant params

* fix types

* update readme

* update readme

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../public/timelines/containers/api.ts        |  12 +-
 .../server/lib/timeline/routes/README.md      | 299 +++++++++++++++++-
 .../routes/__mocks__/request_responses.ts     |   1 -
 .../routes/export_timelines_route.test.ts     |   2 +-
 .../routes/schemas/export_timelines_schema.ts |   1 -
 5 files changed, 301 insertions(+), 14 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/timelines/containers/api.ts b/x-pack/plugins/security_solution/public/timelines/containers/api.ts
index 10893feccfed..a2277897e99b 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/api.ts
+++ b/x-pack/plugins/security_solution/public/timelines/containers/api.ts
@@ -103,8 +103,6 @@ export const persistTimeline = async ({
 
 export const importTimelines = async ({
   fileToImport,
-  overwrite = false,
-  signal,
 }: ImportDataProps): Promise<ImportDataResponse> => {
   const formData = new FormData();
   formData.append('file', fileToImport);
@@ -112,31 +110,25 @@ export const importTimelines = async ({
   return KibanaServices.get().http.fetch<ImportDataResponse>(`${TIMELINE_IMPORT_URL}`, {
     method: 'POST',
     headers: { 'Content-Type': undefined },
-    query: { overwrite },
     body: formData,
-    signal,
   });
 };
 
 export const exportSelectedTimeline: ExportSelectedData = async ({
-  excludeExportDetails = false,
   filename = `timelines_export.ndjson`,
   ids = [],
   signal,
 }): Promise<Blob> => {
   const body = ids.length > 0 ? JSON.stringify({ ids }) : undefined;
-  const response = await KibanaServices.get().http.fetch<Blob>(`${TIMELINE_EXPORT_URL}`, {
+  const response = await KibanaServices.get().http.fetch<{ body: Blob }>(`${TIMELINE_EXPORT_URL}`, {
     method: 'POST',
     body,
     query: {
-      exclude_export_details: excludeExportDetails,
       file_name: filename,
     },
-    signal,
-    asResponse: true,
   });
 
-  return response.body!;
+  return response.body;
 };
 
 export const getDraftTimeline = async ({
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md b/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md
index 2c5547e39fc4..ee57d5bb3d03 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md
@@ -323,4 +323,301 @@ kbn-version: 8.0.0
      "timelineId":"f5a4bd10-83cd-11ea-bf78-0547a65f1281", // This is a must as well
      "version":"Wzg2LDFd" // Please provide the existing timeline version
 }
-```
\ No newline at end of file
+```
+
+## Export timeline api
+
+#### POST /api/timeline/_export
+
+##### Authorization
+
+Type: Basic Auth
+
+username: Your Kibana username
+
+password: Your Kibana password
+
+
+
+
+##### Request header
+
+```
+
+Content-Type: application/json
+
+kbn-version: 8.0.0
+
+```
+
+##### Request param
+
+```
+file_name:	${filename}.ndjson
+```
+
+##### Request body
+```json
+{
+	ids: [
+		${timelineId}
+	]
+}
+```
+
+## Import timeline api
+
+#### POST /api/timeline/_import
+
+##### Authorization
+
+Type: Basic Auth
+
+username: Your Kibana username
+
+password: Your Kibana password
+
+
+
+
+##### Request header
+
+```
+
+Content-Type: application/json
+
+kbn-version: 8.0.0
+
+```
+
+##### Request body
+
+```
+{
+  file: sample.ndjson
+}
+```
+
+
+(each json in the file should match this format)
+example:
+```
+{"savedObjectId":"a3002fd0-781b-11ea-85e4-df9002f1452c","version":"WzIzLDFd","columns":[{"columnHeaderType":"not-filtered","id":"@timestamp"},{"columnHeaderType":"not-filtered","id":"message"},{"columnHeaderType":"not-filtered","id":"event.category"},{"columnHeaderType":"not-filtered","id":"event.action"},{"columnHeaderType":"not-filtered","id":"host.name"},{"columnHeaderType":"not-filtered","id":"source.ip"},{"columnHeaderType":"not-filtered","id":"destination.ip"},{"columnHeaderType":"not-filtered","id":"user.name"}],"dataProviders":[],"description":"tes description","eventType":"all","filters":[{"meta":{"field":null,"negate":false,"alias":null,"disabled":false,"params":"{\"query\":\"MacBook-Pro-de-Gloria.local\"}","type":"phrase","key":"host.name"},"query":"{\"match_phrase\":{\"host.name\":\"MacBook-Pro-de-Gloria.local\"}}","missing":null,"exists":null,"match_all":null,"range":null,"script":null}],"kqlMode":"filter","kqlQuery":{"filterQuery":{"serializedQuery":"{\"bool\":{\"should\":[{\"exists\":{\"field\":\"host.name\"}}],\"minimum_should_match\":1}}","kuery":{"expression":"host.name: *","kind":"kuery"}}},"title":"Test","dateRange":{"start":1585227005527,"end":1585313405527},"savedQueryId":null,"sort":{"columnId":"@timestamp","sortDirection":"desc"},"created":1586187068132,"createdBy":"angela","updated":1586187068132,"updatedBy":"angela","eventNotes":[],"globalNotes":[{"noteId":"a3b4d9d0-781b-11ea-85e4-df9002f1452c","version":"WzI1LDFd","note":"this is a note","timelineId":"a3002fd0-781b-11ea-85e4-df9002f1452c","created":1586187069313,"createdBy":"angela","updated":1586187069313,"updatedBy":"angela"}],"pinnedEventIds":[]}
+```
+
+##### Response
+```
+{"success":true,"success_count":1,"errors":[]}
+```
+
+## Get draft timeline api
+
+#### GET /api/timeline/_draft
+
+##### Authorization
+
+Type: Basic Auth
+
+username: Your Kibana username
+
+password: Your Kibana password
+
+
+##### Request header
+
+```
+
+Content-Type: application/json
+
+kbn-version: 8.0.0
+
+```
+
+##### Request param
+```
+timelineType: `default` or `template`
+```
+
+##### Response
+```json
+{
+    "data": {
+        "persistTimeline": {
+            "timeline": {
+                "savedObjectId": "ababbd90-99de-11ea-8446-1d7fd9f03ebf",
+                "version": "WzM2MiwzXQ==",
+                "columns": [
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "@timestamp"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "message"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "event.category"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "event.action"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "host.name"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "source.ip"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "destination.ip"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "user.name"
+                    }
+                ],
+                "dataProviders": [],
+                "description": "",
+                "eventType": "all",
+                "filters": [],
+                "kqlMode": "filter",
+                "timelineType": "default",
+                "kqlQuery": {
+                    "filterQuery": null
+                },
+                "title": "",
+                "sort": {
+                    "columnId": "@timestamp",
+                    "sortDirection": "desc"
+                },
+                "status": "draft",
+                "created": 1589899222908,
+                "createdBy": "casetester",
+                "updated": 1589899222908,
+                "updatedBy": "casetester",
+                "templateTimelineId": null,
+                "templateTimelineVersion": null,
+                "favorite": [],
+                "eventIdToNoteIds": [],
+                "noteIds": [],
+                "notes": [],
+                "pinnedEventIds": [],
+                "pinnedEventsSaveObject": []
+            }
+        }
+    }
+}
+```
+
+## Create draft timeline api
+
+#### POST /api/timeline/_draft
+
+##### Authorization
+
+Type: Basic Auth
+
+username: Your Kibana username
+
+password: Your Kibana password
+
+
+##### Request header
+
+```
+
+Content-Type: application/json
+
+kbn-version: 8.0.0
+
+```
+
+##### Request body
+
+```json
+{
+	"timelineType": "default" or "template"
+}
+```
+
+##### Response
+```json
+{
+    "data": {
+        "persistTimeline": {
+            "timeline": {
+                "savedObjectId": "ababbd90-99de-11ea-8446-1d7fd9f03ebf",
+                "version": "WzQyMywzXQ==",
+                "columns": [
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "@timestamp"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "message"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "event.category"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "event.action"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "host.name"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "source.ip"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "destination.ip"
+                    },
+                    {
+                        "columnHeaderType": "not-filtered",
+                        "id": "user.name"
+                    }
+                ],
+                "dataProviders": [],
+                "description": "",
+                "eventType": "all",
+                "filters": [],
+                "kqlMode": "filter",
+                "timelineType": "default",
+                "kqlQuery": {
+                    "filterQuery": null
+                },
+                "title": "",
+                "sort": {
+                    "columnId": "@timestamp",
+                    "sortDirection": "desc"
+                },
+                "status": "draft",
+                "created": 1589903306582,
+                "createdBy": "casetester",
+                "updated": 1589903306582,
+                "updatedBy": "casetester",
+                "templateTimelineId": null,
+                "templateTimelineVersion": null,
+                "favorite": [],
+                "eventIdToNoteIds": [],
+                "noteIds": [],
+                "notes": [],
+                "pinnedEventIds": [],
+                "pinnedEventsSaveObject": []
+            }
+        }
+    }
+}
+```
+
+
+
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts
index 470ba1a853b5..0b320459c76a 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts
@@ -23,7 +23,6 @@ export const getExportTimelinesRequest = () =>
     path: TIMELINE_EXPORT_URL,
     query: {
       file_name: 'mock_export_timeline.ndjson',
-      exclude_export_details: 'false',
     },
     body: {
       ids: ['f0e58720-57b6-11ea-b88d-3f1a31716be8', '890b8ae0-57df-11ea-a7c9-3976b7f1cb37'],
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.test.ts
index 2bccb7c39383..c66bf7b192c6 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.test.ts
@@ -98,7 +98,7 @@ describe('export timelines', () => {
       const result = server.validate(request);
 
       expect(result.badRequest.mock.calls[1][0]).toEqual(
-        'Invalid value "undefined" supplied to "file_name",Invalid value "undefined" supplied to "exclude_export_details",Invalid value "undefined" supplied to "exclude_export_details"'
+        'Invalid value "undefined" supplied to "file_name"'
       );
     });
   });
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/export_timelines_schema.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/export_timelines_schema.ts
index 6f8265903b2a..9264f1e3e504 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/export_timelines_schema.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/export_timelines_schema.ts
@@ -8,7 +8,6 @@ import * as rt from 'io-ts';
 
 export const exportTimelinesQuerySchema = rt.type({
   file_name: rt.string,
-  exclude_export_details: rt.union([rt.literal('true'), rt.literal('false')]),
 });
 
 export const exportTimelinesRequestBodySchema = rt.type({

From 3ac5bc53236608fe598bdc7f45c226a91544b2ca Mon Sep 17 00:00:00 2001
From: Anton Dosov <anton.dosov@elastic.co>
Date: Fri, 26 Jun 2020 18:33:32 +0200
Subject: [PATCH 53/78] Dynamic uiActions & license support (#68507)

This pr adds convenient license support to dynamic uiActions in x-pack.
Works for actions created with action factories & drilldowns.

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../public/actions/action_internal.ts         |  3 +
 .../public/service/ui_actions_service.test.ts |  2 +-
 .../public/service/ui_actions_service.ts      |  1 -
 .../dashboard_to_url_drilldown/index.tsx      |  2 +
 x-pack/plugins/licensing/public/mocks.ts      | 14 +++-
 .../plugins/ui_actions_enhanced/kibana.json   |  3 +-
 .../action_wizard/action_wizard.test.tsx      | 26 +++++-
 .../action_wizard/action_wizard.tsx           | 44 +++++++++--
 .../components/action_wizard/test_data.tsx    | 10 ++-
 .../connected_flyout_manage_drilldowns.tsx    |  7 ++
 .../i18n.ts                                   | 20 +++++
 .../flyout_list_manage_drilldowns.story.tsx   |  2 +-
 .../form_drilldown_wizard.tsx                 | 27 ++++++-
 .../list_manage_drilldowns.test.tsx           |  7 +-
 .../list_manage_drilldowns.tsx                | 20 ++++-
 .../public/drilldowns/drilldown_definition.ts |  7 ++
 .../dynamic_actions/action_factory.test.ts    | 46 +++++++++++
 .../public/dynamic_actions/action_factory.ts  | 30 +++++--
 .../action_factory_definition.ts              | 11 ++-
 .../dynamic_action_manager.test.ts            | 79 +++++++++++++++----
 .../dynamic_actions/dynamic_action_manager.ts | 16 ++--
 .../ui_actions_enhanced/public/mocks.ts       |  2 +
 .../ui_actions_enhanced/public/plugin.ts      | 25 +++++-
 .../ui_actions_service_enhancements.test.ts   | 11 ++-
 .../ui_actions_service_enhancements.ts        | 13 ++-
 25 files changed, 370 insertions(+), 58 deletions(-)
 create mode 100644 x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts

diff --git a/src/plugins/ui_actions/public/actions/action_internal.ts b/src/plugins/ui_actions/public/actions/action_internal.ts
index aba1e22fe09e..10eb760b1308 100644
--- a/src/plugins/ui_actions/public/actions/action_internal.ts
+++ b/src/plugins/ui_actions/public/actions/action_internal.ts
@@ -24,6 +24,9 @@ import { Presentable } from '../util/presentable';
 import { uiToReactComponent } from '../../../kibana_react/public';
 import { ActionType } from '../types';
 
+/**
+ * @internal
+ */
 export class ActionInternal<A extends ActionDefinition = ActionDefinition>
   implements Action<Context<A>>, Presentable<Context<A>> {
   constructor(public readonly definition: A) {}
diff --git a/src/plugins/ui_actions/public/service/ui_actions_service.test.ts b/src/plugins/ui_actions/public/service/ui_actions_service.test.ts
index 45a1bdffa52a..39502c3dd17f 100644
--- a/src/plugins/ui_actions/public/service/ui_actions_service.test.ts
+++ b/src/plugins/ui_actions/public/service/ui_actions_service.test.ts
@@ -20,7 +20,7 @@
 import { UiActionsService } from './ui_actions_service';
 import { Action, ActionInternal, createAction } from '../actions';
 import { createHelloWorldAction } from '../tests/test_samples';
-import { ActionRegistry, TriggerRegistry, TriggerId, ActionType } from '../types';
+import { TriggerRegistry, TriggerId, ActionType, ActionRegistry } from '../types';
 import { Trigger } from '../triggers';
 
 // Casting to ActionType or TriggerId is a hack - in a real situation use
diff --git a/src/plugins/ui_actions/public/service/ui_actions_service.ts b/src/plugins/ui_actions/public/service/ui_actions_service.ts
index 760897f0287d..11f5769a9464 100644
--- a/src/plugins/ui_actions/public/service/ui_actions_service.ts
+++ b/src/plugins/ui_actions/public/service/ui_actions_service.ts
@@ -220,7 +220,6 @@ export class UiActionsService {
     for (const [key, value] of this.actions.entries()) actions.set(key, value);
     for (const [key, value] of this.triggerToActions.entries())
       triggerToActions.set(key, [...value]);
-
     return new UiActionsService({ triggers, actions, triggerToActions });
   };
 }
diff --git a/x-pack/examples/ui_actions_enhanced_examples/public/dashboard_to_url_drilldown/index.tsx b/x-pack/examples/ui_actions_enhanced_examples/public/dashboard_to_url_drilldown/index.tsx
index 4810fb2d6ad8..5e4ba5486446 100644
--- a/x-pack/examples/ui_actions_enhanced_examples/public/dashboard_to_url_drilldown/index.tsx
+++ b/x-pack/examples/ui_actions_enhanced_examples/public/dashboard_to_url_drilldown/index.tsx
@@ -39,6 +39,8 @@ export class DashboardToUrlDrilldown implements Drilldown<Config, ActionContext>
 
   public readonly order = 8;
 
+  readonly minimalLicense = 'gold'; // example of minimal license support
+
   public readonly getDisplayName = () => 'Go to URL (example)';
 
   public readonly euiIcon = 'link';
diff --git a/x-pack/plugins/licensing/public/mocks.ts b/x-pack/plugins/licensing/public/mocks.ts
index 68b280c5341f..8421a343d91c 100644
--- a/x-pack/plugins/licensing/public/mocks.ts
+++ b/x-pack/plugins/licensing/public/mocks.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { BehaviorSubject } from 'rxjs';
-import { LicensingPluginSetup } from './types';
+import { LicensingPluginSetup, LicensingPluginStart } from './types';
 import { licenseMock } from '../common/licensing.mock';
 
 const createSetupMock = () => {
@@ -18,7 +18,19 @@ const createSetupMock = () => {
   return mock;
 };
 
+const createStartMock = () => {
+  const license = licenseMock.createLicense();
+  const mock: jest.Mocked<LicensingPluginStart> = {
+    license$: new BehaviorSubject(license),
+    refresh: jest.fn(),
+  };
+  mock.refresh.mockResolvedValue(license);
+
+  return mock;
+};
+
 export const licensingMock = {
   createSetup: createSetupMock,
+  createStart: createStartMock,
   ...licenseMock,
 };
diff --git a/x-pack/plugins/ui_actions_enhanced/kibana.json b/x-pack/plugins/ui_actions_enhanced/kibana.json
index 027004f165c3..a813903d8b21 100644
--- a/x-pack/plugins/ui_actions_enhanced/kibana.json
+++ b/x-pack/plugins/ui_actions_enhanced/kibana.json
@@ -4,7 +4,8 @@
   "configPath": ["xpack", "ui_actions_enhanced"],
   "requiredPlugins": [
     "embeddable",
-    "uiActions"
+    "uiActions",
+    "licensing"
   ],
   "server": false,
   "ui": true
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx
index 745b3c403afc..78252dccd20d 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx
@@ -7,7 +7,15 @@
 import React from 'react';
 import { cleanup, fireEvent, render } from '@testing-library/react/pure';
 import { TEST_SUBJ_ACTION_FACTORY_ITEM, TEST_SUBJ_SELECTED_ACTION_FACTORY } from './action_wizard';
-import { dashboardFactory, dashboards, Demo, urlFactory } from './test_data';
+import {
+  dashboardFactory,
+  dashboards,
+  Demo,
+  urlFactory,
+  urlDrilldownActionFactory,
+} from './test_data';
+import { ActionFactory } from '../../dynamic_actions';
+import { licenseMock } from '../../../../licensing/common/licensing.mock';
 
 // TODO: afterEach is not available for it globally during setup
 // https://github.com/elastic/kibana/issues/59469
@@ -54,3 +62,19 @@ test('If only one actions factory is available then actionFactory selection is e
   // check that can't change to action factory type
   expect(screen.queryByTestId(/change/i)).not.toBeInTheDocument();
 });
+
+test('If not enough license, button is disabled', () => {
+  const urlWithGoldLicense = new ActionFactory(
+    {
+      ...urlDrilldownActionFactory,
+      minimalLicense: 'gold',
+    },
+    () => licenseMock.createLicense()
+  );
+  const screen = render(<Demo actionFactories={[dashboardFactory, urlWithGoldLicense]} />);
+
+  // check that all factories are displayed to pick
+  expect(screen.getAllByTestId(new RegExp(TEST_SUBJ_ACTION_FACTORY_ITEM))).toHaveLength(2);
+
+  expect(screen.getByText(/Go to URL/i)).toBeDisabled();
+});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
index ccadf60426ed..6769c8bab073 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
@@ -10,10 +10,12 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
   EuiIcon,
+  EuiKeyPadMenuItem,
   EuiSpacer,
   EuiText,
-  EuiKeyPadMenuItem,
+  EuiToolTip,
 } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { txtChangeButton } from './i18n';
 import './action_wizard.scss';
 import { ActionFactory } from '../../dynamic_actions';
@@ -61,7 +63,11 @@ export const ActionWizard: React.FC<ActionWizardProps> = ({
   context,
 }) => {
   // auto pick action factory if there is only 1 available
-  if (!currentActionFactory && actionFactories.length === 1) {
+  if (
+    !currentActionFactory &&
+    actionFactories.length === 1 &&
+    actionFactories[0].isCompatibleLicence()
+  ) {
     onActionFactoryChange(actionFactories[0]);
   }
 
@@ -175,24 +181,46 @@ const ActionFactorySelector: React.FC<ActionFactorySelectorProps> = ({
     willChange: 'opacity',
   };
 
+  /**
+   * make sure not compatible factories are in the end
+   */
+  const ensureOrder = (factories: ActionFactory[]) => {
+    const compatibleLicense = factories.filter((f) => f.isCompatibleLicence());
+    const notCompatibleLicense = factories.filter((f) => !f.isCompatibleLicence());
+    return [
+      ...compatibleLicense.sort((f1, f2) => f2.order - f1.order),
+      ...notCompatibleLicense.sort((f1, f2) => f2.order - f1.order),
+    ];
+  };
+
   return (
     <EuiFlexGroup gutterSize="m" wrap={true} style={firefoxBugFix}>
-      {[...actionFactories]
-        .sort((f1, f2) => f2.order - f1.order)
-        .map((actionFactory) => (
-          <EuiFlexItem grow={false} key={actionFactory.id}>
+      {ensureOrder(actionFactories).map((actionFactory) => (
+        <EuiFlexItem grow={false} key={actionFactory.id}>
+          <EuiToolTip
+            content={
+              !actionFactory.isCompatibleLicence() && (
+                <FormattedMessage
+                  defaultMessage="Insufficient license level"
+                  id="xpack.uiActionsEnhanced.components.actionWizard.insufficientLicenseLevelTooltip"
+                />
+              )
+            }
+          >
             <EuiKeyPadMenuItem
               className="auaActionWizard__actionFactoryItem"
               label={actionFactory.getDisplayName(context)}
               data-test-subj={`${TEST_SUBJ_ACTION_FACTORY_ITEM}-${actionFactory.id}`}
               onClick={() => onActionFactorySelected(actionFactory)}
+              disabled={!actionFactory.isCompatibleLicence()}
             >
               {actionFactory.getIconType(context) && (
                 <EuiIcon type={actionFactory.getIconType(context)!} size="m" />
               )}
             </EuiKeyPadMenuItem>
-          </EuiFlexItem>
-        ))}
+          </EuiToolTip>
+        </EuiFlexItem>
+      ))}
     </EuiFlexGroup>
   );
 };
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/test_data.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/test_data.tsx
index 0a135e60126c..2672a086dca7 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/test_data.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/test_data.tsx
@@ -10,6 +10,7 @@ import { reactToUiComponent } from '../../../../../../src/plugins/kibana_react/p
 import { ActionWizard } from './action_wizard';
 import { ActionFactoryDefinition, ActionFactory } from '../../dynamic_actions';
 import { CollectConfigProps } from '../../../../../../src/plugins/kibana_utils/public';
+import { licenseMock } from '../../../../licensing/common/licensing.mock';
 
 type ActionBaseConfig = object;
 
@@ -101,10 +102,13 @@ export const dashboardDrilldownActionFactory: ActionFactoryDefinition<
   create: () => ({
     id: 'test',
     execute: async () => alert('Navigate to dashboard!'),
+    enhancements: {},
   }),
 };
 
-export const dashboardFactory = new ActionFactory(dashboardDrilldownActionFactory);
+export const dashboardFactory = new ActionFactory(dashboardDrilldownActionFactory, () =>
+  licenseMock.createLicense()
+);
 
 interface UrlDrilldownConfig {
   url: string;
@@ -159,7 +163,9 @@ export const urlDrilldownActionFactory: ActionFactoryDefinition<UrlDrilldownConf
   create: () => null as any,
 };
 
-export const urlFactory = new ActionFactory(urlDrilldownActionFactory);
+export const urlFactory = new ActionFactory(urlDrilldownActionFactory, () =>
+  licenseMock.createLicense()
+);
 
 export function Demo({ actionFactories }: { actionFactories: Array<ActionFactory<any>> }) {
   const [state, setState] = useState<{
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
index fbc72d047063..20d15b4f4d2b 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
@@ -18,6 +18,8 @@ import {
 import { useContainerState } from '../../../../../../../src/plugins/kibana_utils/public';
 import { DrilldownListItem } from '../list_manage_drilldowns';
 import {
+  insufficientLicenseLevel,
+  invalidDrilldownType,
   toastDrilldownCreated,
   toastDrilldownDeleted,
   toastDrilldownEdited,
@@ -133,6 +135,11 @@ export function createFlyoutManageDrilldowns({
         drilldownName: drilldown.action.name,
         actionName: actionFactory?.getDisplayName(factoryContext) ?? drilldown.action.factoryId,
         icon: actionFactory?.getIconType(factoryContext),
+        error: !actionFactory
+          ? invalidDrilldownType(drilldown.action.factoryId) // this shouldn't happen for the end user, but useful during development
+          : !actionFactory.isCompatibleLicence()
+          ? insufficientLicenseLevel
+          : undefined,
       };
     }
 
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/i18n.ts
index e75ee2634aa4..4b2be5db0c55 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/i18n.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/i18n.ts
@@ -86,3 +86,23 @@ export const toastDrilldownsCRUDError = i18n.translate(
     description: 'Title for generic error toast when persisting drilldown updates failed',
   }
 );
+
+export const insufficientLicenseLevel = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.insufficientLicenseLevelError',
+  {
+    defaultMessage: 'Insufficient license level',
+    description:
+      'User created drilldown with higher license type, but then downgraded the license. This error is shown in the list near created drilldown',
+  }
+);
+
+export const invalidDrilldownType = (type: string) =>
+  i18n.translate(
+    'xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.invalidDrilldownType',
+    {
+      defaultMessage: "Drilldown type {type} doesn't exist",
+      values: {
+        type,
+      },
+    }
+  );
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.story.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.story.tsx
index 0529f0451b16..603de39bc890 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.story.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.story.tsx
@@ -15,7 +15,7 @@ storiesOf('components/FlyoutListManageDrilldowns', module).add('default', () =>
       drilldowns={[
         { id: '1', actionName: 'Dashboard', drilldownName: 'Drilldown 1' },
         { id: '2', actionName: 'Dashboard', drilldownName: 'Drilldown 2' },
-        { id: '3', actionName: 'Dashboard', drilldownName: 'Drilldown 3' },
+        { id: '3', actionName: 'Dashboard', drilldownName: 'Drilldown 3', error: 'Some error...' },
       ]}
     />
   </EuiFlyout>
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx
index 622ed58e3625..e7e7f72dbf58 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx
@@ -5,11 +5,14 @@
  */
 
 import React from 'react';
-import { EuiFieldText, EuiForm, EuiFormRow, EuiSpacer } from '@elastic/eui';
+import { EuiFieldText, EuiForm, EuiFormRow, EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { txtDrilldownAction, txtNameOfDrilldown, txtUntitledDrilldown } from './i18n';
 import { ActionFactory } from '../../../dynamic_actions';
 import { ActionWizard } from '../../../components/action_wizard';
 
+const GET_MORE_ACTIONS_LINK = 'https://www.elastic.co/subscriptions';
+
 const noopFn = () => {};
 
 export interface FormDrilldownWizardProps {
@@ -49,10 +52,32 @@ export const FormDrilldownWizard: React.FC<FormDrilldownWizardProps> = ({
     </EuiFormRow>
   );
 
+  const hasNotCompatibleLicenseFactory = () =>
+    actionFactories?.some((f) => !f.isCompatibleLicence());
+
+  const renderGetMoreActionsLink = () => (
+    <EuiText size="s">
+      <EuiLink
+        href={GET_MORE_ACTIONS_LINK}
+        target="_blank"
+        external
+        data-test-subj={'getMoreActionsLink'}
+      >
+        <FormattedMessage
+          id="xpack.uiActionsEnhanced.drilldowns.components.FormDrilldownWizard.getMoreActionsLinkLabel"
+          defaultMessage="Get more actions"
+        />
+      </EuiLink>
+    </EuiText>
+  );
+
   const actionWizard = (
     <EuiFormRow
       label={actionFactories?.length > 1 ? txtDrilldownAction : undefined}
       fullWidth={true}
+      labelAppend={
+        !currentActionFactory && hasNotCompatibleLicenseFactory() && renderGetMoreActionsLink()
+      }
     >
       <ActionWizard
         actionFactories={actionFactories}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.test.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.test.tsx
index 715bba74cf8e..889f8983254d 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.test.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.test.tsx
@@ -19,7 +19,7 @@ afterEach(cleanup);
 const drilldowns: DrilldownListItem[] = [
   { id: '1', actionName: 'Dashboard', drilldownName: 'Drilldown 1' },
   { id: '2', actionName: 'Dashboard', drilldownName: 'Drilldown 2' },
-  { id: '3', actionName: 'Dashboard', drilldownName: 'Drilldown 3' },
+  { id: '3', actionName: 'Dashboard', drilldownName: 'Drilldown 3', error: 'an error' },
 ];
 
 test('Render list of drilldowns', () => {
@@ -67,3 +67,8 @@ test('Can delete drilldowns', () => {
 
   expect(fn).toBeCalledWith([drilldowns[1].id, drilldowns[2].id]);
 });
+
+test('Error is displayed', () => {
+  const screen = render(<ListManageDrilldowns drilldowns={drilldowns} />);
+  expect(screen.getByLabelText('an error')).toBeInTheDocument();
+});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.tsx
index cd41a3d6ec23..b828c4d7d076 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.tsx
@@ -14,6 +14,7 @@ import {
   EuiIcon,
   EuiSpacer,
   EuiTextColor,
+  EuiToolTip,
 } from '@elastic/eui';
 import React, { useState } from 'react';
 import {
@@ -28,6 +29,7 @@ export interface DrilldownListItem {
   actionName: string;
   drilldownName: string;
   icon?: string;
+  error?: string;
 }
 
 export interface ListManageDrilldownsProps {
@@ -52,11 +54,27 @@ export function ListManageDrilldowns({
 
   const columns: Array<EuiBasicTableColumn<DrilldownListItem>> = [
     {
-      field: 'drilldownName',
       name: 'Name',
       truncateText: true,
       width: '50%',
       'data-test-subj': 'drilldownListItemName',
+      render: (drilldown: DrilldownListItem) => (
+        <div>
+          {drilldown.drilldownName}{' '}
+          {drilldown.error && (
+            <EuiToolTip id={`drilldownError-${drilldown.id}`} content={drilldown.error}>
+              <EuiIcon
+                type="alert"
+                color="danger"
+                title={drilldown.error}
+                aria-label={drilldown.error}
+                data-test-subj={`drilldownError-${drilldown.id}`}
+                style={{ marginLeft: '4px' }} /* a bit of spacing from text */
+              />
+            </EuiToolTip>
+          )}
+        </div>
+      ),
     },
     {
       name: 'Action',
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts
index f01dd22c06bc..a41ae851e185 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts
@@ -5,6 +5,7 @@
  */
 
 import { ActionFactoryDefinition } from '../dynamic_actions';
+import { LicenseType } from '../../../licensing/public';
 
 /**
  * This is a convenience interface to register a drilldown. Drilldown has
@@ -28,6 +29,12 @@ export interface DrilldownDefinition<
    */
   id: string;
 
+  /**
+   * Minimal licence level
+   * Empty means no restrictions
+   */
+  minimalLicense?: LicenseType;
+
   /**
    * Determines the display order of the drilldowns in the flyout picker.
    * Higher numbers are displayed first.
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts
new file mode 100644
index 000000000000..918c6422546f
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ActionFactory } from './action_factory';
+import { ActionFactoryDefinition } from './action_factory_definition';
+import { licensingMock } from '../../../licensing/public/mocks';
+
+const def: ActionFactoryDefinition = {
+  id: 'ACTION_FACTORY_1',
+  CollectConfig: {} as any,
+  createConfig: () => ({}),
+  isConfigValid: (() => true) as any,
+  create: ({ name }) => ({
+    id: '',
+    execute: async () => {},
+    getDisplayName: () => name,
+    enhancements: {},
+  }),
+};
+
+describe('License & ActionFactory', () => {
+  test('no license requirements', async () => {
+    const factory = new ActionFactory(def, () => licensingMock.createLicense());
+    expect(await factory.isCompatible({})).toBe(true);
+    expect(factory.isCompatibleLicence()).toBe(true);
+  });
+
+  test('not enough license level', async () => {
+    const factory = new ActionFactory({ ...def, minimalLicense: 'gold' }, () =>
+      licensingMock.createLicense()
+    );
+    expect(await factory.isCompatible({})).toBe(true);
+    expect(factory.isCompatibleLicence()).toBe(false);
+  });
+
+  test('enough license level', async () => {
+    const factory = new ActionFactory({ ...def, minimalLicense: 'gold' }, () =>
+      licensingMock.createLicense({ license: { type: 'gold' } })
+    );
+    expect(await factory.isCompatible({})).toBe(true);
+    expect(factory.isCompatibleLicence()).toBe(true);
+  });
+});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
index 262a5ef7d456..95b7941b48ed 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
@@ -5,13 +5,12 @@
  */
 
 import { uiToReactComponent } from '../../../../../src/plugins/kibana_react/public';
-import {
-  UiActionsActionDefinition as ActionDefinition,
-  UiActionsPresentable as Presentable,
-} from '../../../../../src/plugins/ui_actions/public';
+import { UiActionsPresentable as Presentable } from '../../../../../src/plugins/ui_actions/public';
 import { ActionFactoryDefinition } from './action_factory_definition';
 import { Configurable } from '../../../../../src/plugins/kibana_utils/public';
 import { SerializedAction } from './types';
+import { ILicense } from '../../../licensing/public';
+import { UiActionsActionDefinition as ActionDefinition } from '../../../../../src/plugins/ui_actions/public';
 
 export class ActionFactory<
   Config extends object = object,
@@ -19,10 +18,12 @@ export class ActionFactory<
   ActionContext extends object = object
 > implements Omit<Presentable<FactoryContext>, 'getHref'>, Configurable<Config, FactoryContext> {
   constructor(
-    protected readonly def: ActionFactoryDefinition<Config, FactoryContext, ActionContext>
+    protected readonly def: ActionFactoryDefinition<Config, FactoryContext, ActionContext>,
+    protected readonly getLicence: () => ILicense
   ) {}
 
   public readonly id = this.def.id;
+  public readonly minimalLicense = this.def.minimalLicense;
   public readonly order = this.def.order || 0;
   public readonly MenuItem? = this.def.MenuItem;
   public readonly ReactMenuItem? = this.MenuItem ? uiToReactComponent(this.MenuItem) : undefined;
@@ -51,9 +52,26 @@ export class ActionFactory<
     return await this.def.isCompatible(context);
   }
 
+  /**
+   * Does this action factory licence requirements
+   * compatible with current license?
+   */
+  public isCompatibleLicence() {
+    if (!this.minimalLicense) return true;
+    return this.getLicence().hasAtLeast(this.minimalLicense);
+  }
+
   public create(
     serializedAction: Omit<SerializedAction<Config>, 'factoryId'>
   ): ActionDefinition<ActionContext> {
-    return this.def.create(serializedAction);
+    const action = this.def.create(serializedAction);
+    return {
+      ...action,
+      isCompatible: async (context: ActionContext): Promise<boolean> => {
+        if (!this.isCompatibleLicence()) return false;
+        if (!action.isCompatible) return true;
+        return action.isCompatible(context);
+      },
+    };
   }
 }
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts
index d3751fe81166..d63f69ba5ab7 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts
@@ -4,12 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { Configurable } from '../../../../../src/plugins/kibana_utils/public';
+import { SerializedAction } from './types';
+import { LicenseType } from '../../../licensing/public';
 import {
   UiActionsActionDefinition as ActionDefinition,
   UiActionsPresentable as Presentable,
 } from '../../../../../src/plugins/ui_actions/public';
-import { Configurable } from '../../../../../src/plugins/kibana_utils/public';
-import { SerializedAction } from './types';
 
 /**
  * This is a convenience interface for registering new action factories.
@@ -28,6 +29,12 @@ export interface ActionFactoryDefinition<
    */
   id: string;
 
+  /**
+   * Minimal licence level
+   * Empty means no licence restrictions
+   */
+  readonly minimalLicense?: LicenseType;
+
   /**
    * This method should return a definition of a new action, normally used to
    * register it in `ui_actions` registry.
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.test.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.test.ts
index 516b1f3cd277..930f88ff0877 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.test.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.test.ts
@@ -7,11 +7,12 @@
 import { DynamicActionManager } from './dynamic_action_manager';
 import { ActionStorage, MemoryActionStorage } from './dynamic_action_storage';
 import { UiActionsService } from '../../../../../src/plugins/ui_actions/public';
-import { ActionInternal } from '../../../../../src/plugins/ui_actions/public/actions';
+import { ActionRegistry } from '../../../../../src/plugins/ui_actions/public/types';
 import { of } from '../../../../../src/plugins/kibana_utils';
 import { UiActionsServiceEnhancements } from '../services';
 import { ActionFactoryDefinition } from './action_factory_definition';
 import { SerializedAction, SerializedEvent } from './types';
+import { licensingMock } from '../../../licensing/public/mocks';
 
 const actionFactoryDefinition1: ActionFactoryDefinition = {
   id: 'ACTION_FACTORY_1',
@@ -67,14 +68,21 @@ const event3: SerializedEvent = {
   },
 };
 
-const setup = (events: readonly SerializedEvent[] = []) => {
+const setup = (
+  events: readonly SerializedEvent[] = [],
+  { getLicenseInfo = () => licensingMock.createLicense() } = {
+    getLicenseInfo: () => licensingMock.createLicense(),
+  }
+) => {
   const isCompatible = async () => true;
   const storage: ActionStorage = new MemoryActionStorage(events);
-  const actions = new Map<string, ActionInternal>();
+  const actions: ActionRegistry = new Map();
   const uiActions = new UiActionsService({
     actions,
   });
-  const uiActionsEnhancements = new UiActionsServiceEnhancements();
+  const uiActionsEnhancements = new UiActionsServiceEnhancements({
+    getLicenseInfo,
+  });
   const manager = new DynamicActionManager({
     isCompatible,
     storage,
@@ -95,6 +103,9 @@ const setup = (events: readonly SerializedEvent[] = []) => {
 };
 
 describe('DynamicActionManager', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
   test('can instantiate', () => {
     const { manager } = setup([event1]);
     expect(manager).toBeInstanceOf(DynamicActionManager);
@@ -103,11 +114,11 @@ describe('DynamicActionManager', () => {
   describe('.start()', () => {
     test('instantiates stored events', async () => {
       const { manager, actions, uiActions } = setup([event1]);
-      const create1 = jest.fn();
-      const create2 = jest.fn();
+      const create1 = jest.spyOn(actionFactoryDefinition1, 'create');
+      const create2 = jest.spyOn(actionFactoryDefinition2, 'create');
 
-      uiActions.registerActionFactory({ ...actionFactoryDefinition1, create: create1 });
-      uiActions.registerActionFactory({ ...actionFactoryDefinition2, create: create2 });
+      uiActions.registerActionFactory(actionFactoryDefinition1);
+      uiActions.registerActionFactory(actionFactoryDefinition2);
 
       expect(create1).toHaveBeenCalledTimes(0);
       expect(create2).toHaveBeenCalledTimes(0);
@@ -122,11 +133,11 @@ describe('DynamicActionManager', () => {
 
     test('does nothing when no events stored', async () => {
       const { manager, actions, uiActions } = setup();
-      const create1 = jest.fn();
-      const create2 = jest.fn();
+      const create1 = jest.spyOn(actionFactoryDefinition1, 'create');
+      const create2 = jest.spyOn(actionFactoryDefinition2, 'create');
 
-      uiActions.registerActionFactory({ ...actionFactoryDefinition1, create: create1 });
-      uiActions.registerActionFactory({ ...actionFactoryDefinition2, create: create2 });
+      uiActions.registerActionFactory(actionFactoryDefinition1);
+      uiActions.registerActionFactory(actionFactoryDefinition2);
 
       expect(create1).toHaveBeenCalledTimes(0);
       expect(create2).toHaveBeenCalledTimes(0);
@@ -207,11 +218,9 @@ describe('DynamicActionManager', () => {
   describe('.stop()', () => {
     test('removes events from UI actions registry', async () => {
       const { manager, actions, uiActions } = setup([event1, event2]);
-      const create1 = jest.fn();
-      const create2 = jest.fn();
 
-      uiActions.registerActionFactory({ ...actionFactoryDefinition1, create: create1 });
-      uiActions.registerActionFactory({ ...actionFactoryDefinition2, create: create2 });
+      uiActions.registerActionFactory(actionFactoryDefinition1);
+      uiActions.registerActionFactory(actionFactoryDefinition2);
 
       expect(actions.size).toBe(0);
 
@@ -632,4 +641,42 @@ describe('DynamicActionManager', () => {
       });
     });
   });
+
+  test('revived actions incompatible when license is not enough', async () => {
+    const getLicenseInfo = jest.fn(() =>
+      licensingMock.createLicense({ license: { type: 'basic' } })
+    );
+    const { manager, uiActions } = setup([event1, event3], { getLicenseInfo });
+    const basicActionFactory: ActionFactoryDefinition = {
+      ...actionFactoryDefinition1,
+      minimalLicense: 'basic',
+    };
+
+    const goldActionFactory: ActionFactoryDefinition = {
+      ...actionFactoryDefinition2,
+      minimalLicense: 'gold',
+    };
+
+    uiActions.registerActionFactory(basicActionFactory);
+    uiActions.registerActionFactory(goldActionFactory);
+
+    await manager.start();
+
+    const basicActions = await uiActions.getTriggerCompatibleActions(
+      'VALUE_CLICK_TRIGGER',
+      {} as any
+    );
+    expect(basicActions).toHaveLength(1);
+
+    getLicenseInfo.mockImplementation(() =>
+      licensingMock.createLicense({ license: { type: 'gold' } })
+    );
+
+    const basicAndGoldActions = await uiActions.getTriggerCompatibleActions(
+      'VALUE_CLICK_TRIGGER',
+      {} as any
+    );
+
+    expect(basicAndGoldActions).toHaveLength(2);
+  });
 });
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.ts
index 58344026079e..4afefe3006a4 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.ts
@@ -72,14 +72,18 @@ export class DynamicActionManager {
     const { uiActions, isCompatible } = this.params;
 
     const actionId = this.generateActionId(eventId);
+
     const factory = uiActions.getActionFactory(event.action.factoryId);
-    const actionDefinition: ActionDefinition = {
-      ...factory.create(action as SerializedAction<object>),
+    const actionDefinition: ActionDefinition = factory.create(action as SerializedAction<object>);
+    uiActions.registerAction({
+      ...actionDefinition,
       id: actionId,
-      isCompatible,
-    };
-
-    uiActions.registerAction(actionDefinition);
+      isCompatible: async (context) => {
+        if (!(await isCompatible(context))) return false;
+        if (!actionDefinition.isCompatible) return true;
+        return actionDefinition.isCompatible(context);
+      },
+    });
     for (const trigger of triggers) uiActions.attachAction(trigger as any, actionId);
   }
 
diff --git a/x-pack/plugins/ui_actions_enhanced/public/mocks.ts b/x-pack/plugins/ui_actions_enhanced/public/mocks.ts
index 196b8f2c1d5c..ff07d6e74a9c 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/mocks.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/mocks.ts
@@ -10,6 +10,7 @@ import { uiActionsPluginMock } from '../../../../src/plugins/ui_actions/public/m
 import { embeddablePluginMock } from '../../../../src/plugins/embeddable/public/mocks';
 import { AdvancedUiActionsSetup, AdvancedUiActionsStart } from '.';
 import { plugin as pluginInitializer } from '.';
+import { licensingMock } from '../../licensing/public/mocks';
 
 export type Setup = jest.Mocked<AdvancedUiActionsSetup>;
 export type Start = jest.Mocked<AdvancedUiActionsStart>;
@@ -62,6 +63,7 @@ const createPlugin = (
       return plugin.start(anotherCoreStart, {
         uiActions: uiActionsStart,
         embeddable: embeddableStart,
+        licensing: licensingMock.createStart(),
       });
     },
   };
diff --git a/x-pack/plugins/ui_actions_enhanced/public/plugin.ts b/x-pack/plugins/ui_actions_enhanced/public/plugin.ts
index 04caef92f15a..a625ea2e2118 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/plugin.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/plugin.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { BehaviorSubject, Subscription } from 'rxjs';
 import {
   PluginInitializerContext,
   CoreSetup,
@@ -31,6 +32,7 @@ import {
 } from './custom_time_range_badge';
 import { CommonlyUsedRange } from './types';
 import { UiActionsServiceEnhancements } from './services';
+import { ILicense, LicensingPluginStart } from '../../licensing/public';
 import { createFlyoutManageDrilldowns } from './drilldowns';
 import { Storage } from '../../../../src/plugins/kibana_utils/public';
 
@@ -42,6 +44,7 @@ interface SetupDependencies {
 interface StartDependencies {
   embeddable: EmbeddableStart;
   uiActions: UiActionsStart;
+  licensing: LicensingPluginStart;
 }
 
 export interface SetupContract
@@ -63,7 +66,19 @@ declare module '../../../../src/plugins/ui_actions/public' {
 
 export class AdvancedUiActionsPublicPlugin
   implements Plugin<SetupContract, StartContract, SetupDependencies, StartDependencies> {
-  private readonly enhancements = new UiActionsServiceEnhancements();
+  readonly licenceInfo = new BehaviorSubject<ILicense | undefined>(undefined);
+  private getLicenseInfo(): ILicense {
+    if (!this.licenceInfo.getValue()) {
+      throw new Error(
+        'AdvancedUiActionsPublicPlugin: Licence is not ready! Licence becomes available only after setup.'
+      );
+    }
+    return this.licenceInfo.getValue()!;
+  }
+  private readonly enhancements = new UiActionsServiceEnhancements({
+    getLicenseInfo: () => this.getLicenseInfo(),
+  });
+  private subs: Subscription[] = [];
 
   constructor(initializerContext: PluginInitializerContext) {}
 
@@ -74,7 +89,9 @@ export class AdvancedUiActionsPublicPlugin
     };
   }
 
-  public start(core: CoreStart, { uiActions }: StartDependencies): StartContract {
+  public start(core: CoreStart, { uiActions, licensing }: StartDependencies): StartContract {
+    this.subs.push(licensing.license$.subscribe(this.licenceInfo));
+
     const dateFormat = core.uiSettings.get('dateFormat') as string;
     const commonlyUsedRanges = core.uiSettings.get(
       UI_SETTINGS.TIMEPICKER_QUICK_RANGES
@@ -106,5 +123,7 @@ export class AdvancedUiActionsPublicPlugin
     };
   }
 
-  public stop() {}
+  public stop() {
+    this.subs.forEach((s) => s.unsubscribe());
+  }
 }
diff --git a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.test.ts b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.test.ts
index 3137e35a2fe4..4f2ddcf7e049 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.test.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.test.ts
@@ -6,6 +6,9 @@
 
 import { UiActionsServiceEnhancements } from './ui_actions_service_enhancements';
 import { ActionFactoryDefinition, ActionFactory } from '../dynamic_actions';
+import { licensingMock } from '../../../licensing/public/mocks';
+
+const getLicenseInfo = () => licensingMock.createLicense();
 
 describe('UiActionsService', () => {
   describe('action factories', () => {
@@ -25,7 +28,7 @@ describe('UiActionsService', () => {
     };
 
     test('.getActionFactories() returns empty array if no action factories registered', () => {
-      const service = new UiActionsServiceEnhancements();
+      const service = new UiActionsServiceEnhancements({ getLicenseInfo });
 
       const factories = service.getActionFactories();
 
@@ -33,7 +36,7 @@ describe('UiActionsService', () => {
     });
 
     test('can register and retrieve an action factory', () => {
-      const service = new UiActionsServiceEnhancements();
+      const service = new UiActionsServiceEnhancements({ getLicenseInfo });
 
       service.registerActionFactory(factoryDefinition1);
 
@@ -44,7 +47,7 @@ describe('UiActionsService', () => {
     });
 
     test('can retrieve all action factories', () => {
-      const service = new UiActionsServiceEnhancements();
+      const service = new UiActionsServiceEnhancements({ getLicenseInfo });
 
       service.registerActionFactory(factoryDefinition1);
       service.registerActionFactory(factoryDefinition2);
@@ -58,7 +61,7 @@ describe('UiActionsService', () => {
     });
 
     test('throws when retrieving action factory that does not exist', () => {
-      const service = new UiActionsServiceEnhancements();
+      const service = new UiActionsServiceEnhancements({ getLicenseInfo });
 
       service.registerActionFactory(factoryDefinition1);
 
diff --git a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
index b7bdced22858..bd05659d59e9 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
@@ -7,16 +7,20 @@
 import { ActionFactoryRegistry } from '../types';
 import { ActionFactory, ActionFactoryDefinition } from '../dynamic_actions';
 import { DrilldownDefinition } from '../drilldowns';
+import { ILicense } from '../../../licensing/common/types';
 
 export interface UiActionsServiceEnhancementsParams {
   readonly actionFactories?: ActionFactoryRegistry;
+  readonly getLicenseInfo: () => ILicense;
 }
 
 export class UiActionsServiceEnhancements {
   protected readonly actionFactories: ActionFactoryRegistry;
+  protected readonly getLicenseInfo: () => ILicense;
 
-  constructor({ actionFactories = new Map() }: UiActionsServiceEnhancementsParams = {}) {
+  constructor({ actionFactories = new Map(), getLicenseInfo }: UiActionsServiceEnhancementsParams) {
     this.actionFactories = actionFactories;
+    this.getLicenseInfo = getLicenseInfo;
   }
 
   /**
@@ -34,7 +38,10 @@ export class UiActionsServiceEnhancements {
       throw new Error(`ActionFactory [actionFactory.id = ${definition.id}] already registered.`);
     }
 
-    const actionFactory = new ActionFactory<Config, FactoryContext, ActionContext>(definition);
+    const actionFactory = new ActionFactory<Config, FactoryContext, ActionContext>(
+      definition,
+      this.getLicenseInfo
+    );
 
     this.actionFactories.set(actionFactory.id, actionFactory as ActionFactory<any, any, any>);
   };
@@ -72,9 +79,11 @@ export class UiActionsServiceEnhancements {
     euiIcon,
     execute,
     getHref,
+    minimalLicense,
   }: DrilldownDefinition<Config, ExecutionContext>): void => {
     const actionFactory: ActionFactoryDefinition<Config, object, ExecutionContext> = {
       id: factoryId,
+      minimalLicense,
       order,
       CollectConfig,
       createConfig,

From 7440eea3dc4d0d614e39f4728def24f8bc5cd16d Mon Sep 17 00:00:00 2001
From: Marta Bondyra <marta.bondyra@elastic.co>
Date: Fri, 26 Jun 2020 18:43:35 +0200
Subject: [PATCH 54/78] [Lens] Use accordion menus in field list for available
 and empty fields (#68871)

---
 .../__mocks__/loader.ts                       |   1 -
 .../no_fields_callout.test.tsx.snap           |  49 ++
 .../indexpattern_datasource/_index.scss       |   1 -
 .../{_datapanel.scss => datapanel.scss}       |  14 +-
 .../datapanel.test.tsx                        | 203 ++++---
 .../indexpattern_datasource/datapanel.tsx     | 508 ++++++++++--------
 .../dimension_panel/dimension_panel.test.tsx  |   2 -
 .../dimension_panel/field_select.tsx          |  47 +-
 .../dimension_panel/popover_editor.tsx        |   1 -
 .../field_item.test.tsx                       |   6 +-
 .../indexpattern_datasource/field_item.tsx    |   8 +-
 .../fields_accordion.test.tsx                 |  97 ++++
 .../fields_accordion.tsx                      | 101 ++++
 .../indexpattern.test.ts                      |   5 -
 .../indexpattern_suggestions.test.tsx         |   8 -
 .../layerpanel.test.tsx                       |   1 -
 .../indexpattern_datasource/loader.test.ts    |   7 -
 .../public/indexpattern_datasource/loader.ts  |   2 -
 .../no_fields_callout.test.tsx                |  36 ++
 .../no_fields_callout.tsx                     |  75 +++
 .../definitions/date_histogram.test.tsx       |   1 -
 .../operations/definitions/terms.test.tsx     |   1 -
 .../operations/operations.test.ts             |   1 -
 .../state_helpers.test.ts                     |   8 -
 .../public/indexpattern_datasource/types.ts   |   1 -
 .../translations/translations/ja-JP.json      |   6 -
 .../translations/translations/zh-CN.json      |   6 -
 .../test/functional/page_objects/lens_page.ts |   9 -
 28 files changed, 784 insertions(+), 421 deletions(-)
 create mode 100644 x-pack/plugins/lens/public/indexpattern_datasource/__snapshots__/no_fields_callout.test.tsx.snap
 rename x-pack/plugins/lens/public/indexpattern_datasource/{_datapanel.scss => datapanel.scss} (81%)
 create mode 100644 x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.test.tsx
 create mode 100644 x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
 create mode 100644 x-pack/plugins/lens/public/indexpattern_datasource/no_fields_callout.test.tsx
 create mode 100644 x-pack/plugins/lens/public/indexpattern_datasource/no_fields_callout.tsx

diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/__mocks__/loader.ts b/x-pack/plugins/lens/public/indexpattern_datasource/__mocks__/loader.ts
index fe865edd6298..f2fedda1fa35 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/__mocks__/loader.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/__mocks__/loader.ts
@@ -19,7 +19,6 @@ export function loadInitialState() {
       [restricted.id]: restricted,
     },
     layers: {},
-    showEmptyFields: false,
   };
   return result;
 }
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/__snapshots__/no_fields_callout.test.tsx.snap b/x-pack/plugins/lens/public/indexpattern_datasource/__snapshots__/no_fields_callout.test.tsx.snap
new file mode 100644
index 000000000000..607f968d86fa
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/__snapshots__/no_fields_callout.test.tsx.snap
@@ -0,0 +1,49 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`NoFieldCallout renders properly for index with no fields 1`] = `
+<EuiCallOut
+  color="warning"
+  size="s"
+  title="No fields exist in this index pattern."
+/>
+`;
+
+exports[`NoFieldCallout renders properly when affected by field filter 1`] = `
+<EuiCallOut
+  color="warning"
+  size="s"
+  title="No fields match the selected filters."
+>
+  <strong>
+    Try:
+  </strong>
+  <ul>
+    <li>
+      Using different field filters
+    </li>
+  </ul>
+</EuiCallOut>
+`;
+
+exports[`NoFieldCallout renders properly when affected by field filters, global filter and timerange 1`] = `
+<EuiCallOut
+  color="warning"
+  size="s"
+  title="No fields match the selected filters."
+>
+  <strong>
+    Try:
+  </strong>
+  <ul>
+    <li>
+      Extending the time range
+    </li>
+    <li>
+      Using different field filters
+    </li>
+    <li>
+      Changing the global filters
+    </li>
+  </ul>
+</EuiCallOut>
+`;
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/_index.scss b/x-pack/plugins/lens/public/indexpattern_datasource/_index.scss
index a0f3e53d7ac2..a10dde488169 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/_index.scss
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/_index.scss
@@ -1,2 +1 @@
-@import 'datapanel';
 @import 'field_item';
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/_datapanel.scss b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.scss
similarity index 81%
rename from x-pack/plugins/lens/public/indexpattern_datasource/_datapanel.scss
rename to x-pack/plugins/lens/public/indexpattern_datasource/datapanel.scss
index 77d4b41a0413..3e767502fae3 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/_datapanel.scss
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.scss
@@ -16,10 +16,6 @@
   line-height: $euiSizeXXL;
 }
 
-.lnsInnerIndexPatternDataPanel__filterWrapper {
-  flex-grow: 0;
-}
-
 /**
  * 1. Don't cut off the shadow of the field items
  */
@@ -41,11 +37,9 @@
   right: $euiSizeXS; /* 1 */
 }
 
-.lnsInnerIndexPatternDataPanel__filterButton {
-  width: 100%;
-  color: $euiColorPrimary;
-  padding-left: $euiSizeS;
-  padding-right: $euiSizeS;
+.lnsInnerIndexPatternDataPanel__fieldItems {
+  // Quick fix for making sure the shadow and focus rings are visible outside the accordion bounds
+  padding: $euiSizeXS $euiSizeXS 0;
 }
 
 .lnsInnerIndexPatternDataPanel__textField {
@@ -54,7 +48,9 @@
 }
 
 .lnsInnerIndexPatternDataPanel__filterType {
+  font-size: $euiFontSizeS;
   padding: $euiSizeS;
+  border-bottom: 1px solid $euiColorLightestShade;
 }
 
 .lnsInnerIndexPatternDataPanel__filterTypeInner {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.test.tsx
index 187ccb8c4756..7653dab2c9b8 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.test.tsx
@@ -9,19 +9,19 @@ import { createMockedDragDropContext } from './mocks';
 import { dataPluginMock } from '../../../../../src/plugins/data/public/mocks';
 import { InnerIndexPatternDataPanel, IndexPatternDataPanel, MemoizedDataPanel } from './datapanel';
 import { FieldItem } from './field_item';
+import { NoFieldsCallout } from './no_fields_callout';
 import { act } from 'react-dom/test-utils';
 import { coreMock } from 'src/core/public/mocks';
 import { IndexPatternPrivateState } from './types';
 import { mountWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
 import { ChangeIndexPattern } from './change_indexpattern';
-import { EuiProgress } from '@elastic/eui';
+import { EuiProgress, EuiLoadingSpinner } from '@elastic/eui';
 import { documentField } from './document_field';
 
 const initialState: IndexPatternPrivateState = {
   indexPatternRefs: [],
   existingFields: {},
   currentIndexPatternId: '1',
-  showEmptyFields: false,
   layers: {
     first: {
       indexPatternId: '1',
@@ -229,8 +229,6 @@ describe('IndexPattern Data Panel', () => {
       },
       query: { query: '', language: 'lucene' },
       filters: [],
-      showEmptyFields: false,
-      onToggleEmptyFields: jest.fn(),
     };
   });
 
@@ -303,7 +301,6 @@ describe('IndexPattern Data Panel', () => {
         state: {
           indexPatternRefs: [],
           existingFields: {},
-          showEmptyFields: false,
           currentIndexPatternId: 'a',
           indexPatterns: {
             a: { id: 'a', title: 'aaa', timeFieldName: 'atime', fields: [] },
@@ -534,42 +531,97 @@ describe('IndexPattern Data Panel', () => {
     });
   });
 
-  describe('while showing empty fields', () => {
-    it('should list all supported fields in the pattern sorted alphabetically', async () => {
-      const wrapper = shallowWithIntl(
-        <InnerIndexPatternDataPanel {...defaultProps} showEmptyFields={true} />
+  describe('displaying field list', () => {
+    let props: Parameters<typeof InnerIndexPatternDataPanel>[0];
+    beforeEach(() => {
+      props = {
+        ...defaultProps,
+        existingFields: {
+          idx1: {
+            bytes: true,
+            memory: true,
+          },
+        },
+      };
+    });
+    it('should list all supported fields in the pattern sorted alphabetically in groups', async () => {
+      const wrapper = mountWithIntl(<InnerIndexPatternDataPanel {...props} />);
+      expect(wrapper.find(FieldItem).first().prop('field').name).toEqual('Records');
+      expect(
+        wrapper
+          .find('[data-test-subj="lnsIndexPatternAvailableFields"]')
+          .find(FieldItem)
+          .map((fieldItem) => fieldItem.prop('field').name)
+      ).toEqual(['bytes', 'memory']);
+      wrapper
+        .find('[data-test-subj="lnsIndexPatternEmptyFields"]')
+        .find('button')
+        .first()
+        .simulate('click');
+      expect(
+        wrapper
+          .find('[data-test-subj="lnsIndexPatternEmptyFields"]')
+          .find(FieldItem)
+          .map((fieldItem) => fieldItem.prop('field').name)
+      ).toEqual(['client', 'source', 'timestamp']);
+    });
+
+    it('should display NoFieldsCallout when all fields are empty', async () => {
+      const wrapper = mountWithIntl(
+        <InnerIndexPatternDataPanel {...defaultProps} existingFields={{ idx1: {} }} />
       );
+      expect(wrapper.find(NoFieldsCallout).length).toEqual(1);
+      expect(
+        wrapper
+          .find('[data-test-subj="lnsIndexPatternAvailableFields"]')
+          .find(FieldItem)
+          .map((fieldItem) => fieldItem.prop('field').name)
+      ).toEqual([]);
+      wrapper
+        .find('[data-test-subj="lnsIndexPatternEmptyFields"]')
+        .find('button')
+        .first()
+        .simulate('click');
+      expect(
+        wrapper
+          .find('[data-test-subj="lnsIndexPatternEmptyFields"]')
+          .find(FieldItem)
+          .map((fieldItem) => fieldItem.prop('field').name)
+      ).toEqual(['bytes', 'client', 'memory', 'source', 'timestamp']);
+    });
 
-      expect(wrapper.find(FieldItem).map((fieldItem) => fieldItem.prop('field').name)).toEqual([
-        'Records',
-        'bytes',
-        'client',
-        'memory',
-        'source',
-        'timestamp',
-      ]);
+    it('should display spinner for available fields accordion if existing fields are not loaded yet', async () => {
+      const wrapper = mountWithIntl(<InnerIndexPatternDataPanel {...defaultProps} />);
+      expect(
+        wrapper.find('[data-test-subj="lnsIndexPatternAvailableFields"]').find(EuiLoadingSpinner)
+          .length
+      ).toEqual(1);
+      wrapper.setProps({ existingFields: { idx1: {} } });
+      expect(wrapper.find(NoFieldsCallout).length).toEqual(1);
     });
 
     it('should filter down by name', () => {
-      const wrapper = shallowWithIntl(
-        <InnerIndexPatternDataPanel {...defaultProps} showEmptyFields={true} />
-      );
-
+      const wrapper = mountWithIntl(<InnerIndexPatternDataPanel {...props} />);
       act(() => {
         wrapper.find('[data-test-subj="lnsIndexPatternFieldSearch"]').prop('onChange')!({
-          target: { value: 'mem' },
+          target: { value: 'me' },
         } as ChangeEvent<HTMLInputElement>);
       });
 
+      wrapper
+        .find('[data-test-subj="lnsIndexPatternEmptyFields"]')
+        .find('button')
+        .first()
+        .simulate('click');
+
       expect(wrapper.find(FieldItem).map((fieldItem) => fieldItem.prop('field').name)).toEqual([
         'memory',
+        'timestamp',
       ]);
     });
 
     it('should filter down by type', () => {
-      const wrapper = mountWithIntl(
-        <InnerIndexPatternDataPanel {...defaultProps} showEmptyFields={true} />
-      );
+      const wrapper = mountWithIntl(<InnerIndexPatternDataPanel {...props} />);
 
       wrapper.find('[data-test-subj="lnsIndexPatternFiltersToggle"]').first().simulate('click');
 
@@ -581,112 +633,55 @@ describe('IndexPattern Data Panel', () => {
       ]);
     });
 
-    it('should toggle type if clicked again', () => {
-      const wrapper = mountWithIntl(
-        <InnerIndexPatternDataPanel {...defaultProps} showEmptyFields={true} />
-      );
+    it('should display no fields in groups when filtered by type Record', () => {
+      const wrapper = mountWithIntl(<InnerIndexPatternDataPanel {...props} />);
 
       wrapper.find('[data-test-subj="lnsIndexPatternFiltersToggle"]').first().simulate('click');
 
-      wrapper.find('[data-test-subj="typeFilter-number"]').first().simulate('click');
-      wrapper.find('[data-test-subj="typeFilter-number"]').first().simulate('click');
+      wrapper.find('[data-test-subj="typeFilter-document"]').first().simulate('click');
 
       expect(wrapper.find(FieldItem).map((fieldItem) => fieldItem.prop('field').name)).toEqual([
         'Records',
-        'bytes',
-        'client',
-        'memory',
-        'source',
-        'timestamp',
       ]);
+      expect(wrapper.find(NoFieldsCallout).length).toEqual(2);
     });
 
-    it('should filter down by type and by name', () => {
-      const wrapper = mountWithIntl(
-        <InnerIndexPatternDataPanel {...defaultProps} showEmptyFields={true} />
-      );
-
-      act(() => {
-        wrapper.find('[data-test-subj="lnsIndexPatternFieldSearch"]').prop('onChange')!({
-          target: { value: 'mem' },
-        } as ChangeEvent<HTMLInputElement>);
-      });
-
+    it('should toggle type if clicked again', () => {
+      const wrapper = mountWithIntl(<InnerIndexPatternDataPanel {...props} />);
       wrapper.find('[data-test-subj="lnsIndexPatternFiltersToggle"]').first().simulate('click');
 
       wrapper.find('[data-test-subj="typeFilter-number"]').first().simulate('click');
-
-      expect(wrapper.find(FieldItem).map((fieldItem) => fieldItem.prop('field').name)).toEqual([
-        'memory',
-      ]);
-    });
-  });
-
-  describe('filtering out empty fields', () => {
-    let emptyFieldsTestProps: typeof defaultProps;
-
-    beforeEach(() => {
-      emptyFieldsTestProps = {
-        ...defaultProps,
-        indexPatterns: {
-          ...defaultProps.indexPatterns,
-          '1': {
-            ...defaultProps.indexPatterns['1'],
-            fields: defaultProps.indexPatterns['1'].fields.map((field) => ({
-              ...field,
-              exists: field.type === 'number',
-            })),
-          },
-        },
-        onToggleEmptyFields: jest.fn(),
-      };
-    });
-
-    it('should list all supported fields in the pattern sorted alphabetically', async () => {
-      const props = {
-        ...emptyFieldsTestProps,
-        existingFields: {
-          idx1: {
-            bytes: true,
-            memory: true,
-          },
-        },
-      };
-      const wrapper = shallowWithIntl(<InnerIndexPatternDataPanel {...props} />);
-
+      wrapper.find('[data-test-subj="typeFilter-number"]').first().simulate('click');
+      wrapper
+        .find('[data-test-subj="lnsIndexPatternEmptyFields"]')
+        .find('button')
+        .first()
+        .simulate('click');
       expect(wrapper.find(FieldItem).map((fieldItem) => fieldItem.prop('field').name)).toEqual([
         'Records',
         'bytes',
         'memory',
+        'client',
+        'source',
+        'timestamp',
       ]);
     });
 
-    it('should filter down by name', () => {
-      const wrapper = shallowWithIntl(
-        <InnerIndexPatternDataPanel {...emptyFieldsTestProps} showEmptyFields={true} />
-      );
-
+    it('should filter down by type and by name', () => {
+      const wrapper = mountWithIntl(<InnerIndexPatternDataPanel {...props} />);
       act(() => {
         wrapper.find('[data-test-subj="lnsIndexPatternFieldSearch"]').prop('onChange')!({
-          target: { value: 'mem' },
+          target: { value: 'me' },
         } as ChangeEvent<HTMLInputElement>);
       });
 
-      expect(wrapper.find(FieldItem).map((fieldItem) => fieldItem.prop('field').name)).toEqual([
-        'memory',
-      ]);
-    });
-
-    it('should allow removing the filter for data', () => {
-      const wrapper = mountWithIntl(<InnerIndexPatternDataPanel {...emptyFieldsTestProps} />);
-
       wrapper.find('[data-test-subj="lnsIndexPatternFiltersToggle"]').first().simulate('click');
 
-      wrapper.find('[data-test-subj="lnsEmptyFilter"]').first().prop('onChange')!(
-        {} as ChangeEvent
-      );
+      wrapper.find('[data-test-subj="typeFilter-number"]').first().simulate('click');
 
-      expect(emptyFieldsTestProps.onToggleEmptyFields).toHaveBeenCalled();
+      expect(wrapper.find(FieldItem).map((fieldItem) => fieldItem.prop('field').name)).toEqual([
+        'memory',
+      ]);
     });
   });
 });
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
index ae5632ddae84..b72f87e243dc 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
@@ -4,26 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { uniq, indexBy } from 'lodash';
-import React, { useState, useEffect, memo, useCallback } from 'react';
+import './datapanel.scss';
+import { uniq, indexBy, groupBy, throttle } from 'lodash';
+import React, { useState, useEffect, memo, useCallback, useMemo } from 'react';
 import {
-  // @ts-ignore
-  EuiHighlight,
   EuiFlexGroup,
   EuiFlexItem,
   EuiContextMenuPanel,
   EuiContextMenuItem,
   EuiContextMenuPanelProps,
   EuiPopover,
-  EuiPopoverTitle,
-  EuiPopoverFooter,
   EuiCallOut,
   EuiFormControlLayout,
-  EuiSwitch,
-  EuiFacetButton,
-  EuiIcon,
   EuiSpacer,
-  EuiFormLabel,
+  EuiFilterGroup,
+  EuiFilterButton,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -31,6 +26,7 @@ import { DataPublicPluginStart } from 'src/plugins/data/public';
 import { DatasourceDataPanelProps, DataType, StateSetter } from '../types';
 import { ChildDragDropProvider, DragContextState } from '../drag_drop';
 import { FieldItem } from './field_item';
+import { NoFieldsCallout } from './no_fields_callout';
 import {
   IndexPattern,
   IndexPatternPrivateState,
@@ -41,6 +37,7 @@ import { trackUiEvent } from '../lens_ui_telemetry';
 import { syncExistingFields } from './loader';
 import { fieldExists } from './pure_helpers';
 import { Loader } from '../loader';
+import { FieldsAccordion } from './fields_accordion';
 import { esQuery, IIndexPattern } from '../../../../../src/plugins/data/public';
 
 export type Props = DatasourceDataPanelProps<IndexPatternPrivateState> & {
@@ -87,21 +84,9 @@ export function IndexPatternDataPanel({
   changeIndexPattern,
 }: Props) {
   const { indexPatternRefs, indexPatterns, currentIndexPatternId } = state;
-
   const onChangeIndexPattern = useCallback(
     (id: string) => changeIndexPattern(id, state, setState),
-    [state, setState]
-  );
-
-  const onToggleEmptyFields = useCallback(
-    (showEmptyFields?: boolean) => {
-      setState((prevState) => ({
-        ...prevState,
-        showEmptyFields:
-          showEmptyFields === undefined ? !prevState.showEmptyFields : showEmptyFields,
-      }));
-    },
-    [setState]
+    [state, setState, changeIndexPattern]
   );
 
   const indexPatternList = uniq(
@@ -179,8 +164,6 @@ export function IndexPatternDataPanel({
           dateRange={dateRange}
           filters={filters}
           dragDropContext={dragDropContext}
-          showEmptyFields={state.showEmptyFields}
-          onToggleEmptyFields={onToggleEmptyFields}
           core={core}
           data={data}
           onChangeIndexPattern={onChangeIndexPattern}
@@ -195,8 +178,26 @@ interface DataPanelState {
   nameFilter: string;
   typeFilter: DataType[];
   isTypeFilterOpen: boolean;
+  isAvailableAccordionOpen: boolean;
+  isEmptyAccordionOpen: boolean;
+}
+
+export interface FieldsGroup {
+  specialFields: IndexPatternField[];
+  availableFields: IndexPatternField[];
+  emptyFields: IndexPatternField[];
 }
 
+const defaultFieldGroups = {
+  specialFields: [],
+  availableFields: [],
+  emptyFields: [],
+};
+
+const fieldFiltersLabel = i18n.translate('xpack.lens.indexPatterns.fieldFiltersLabel', {
+  defaultMessage: 'Field filters',
+});
+
 export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
   currentIndexPatternId,
   indexPatternRefs,
@@ -206,8 +207,6 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
   filters,
   dragDropContext,
   onChangeIndexPattern,
-  showEmptyFields,
-  onToggleEmptyFields,
   core,
   data,
   existingFields,
@@ -217,8 +216,6 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
   indexPatternRefs: IndexPatternRef[];
   indexPatterns: Record<string, IndexPattern>;
   dragDropContext: DragContextState;
-  showEmptyFields: boolean;
-  onToggleEmptyFields: (showEmptyFields?: boolean) => void;
   onChangeIndexPattern: (newId: string) => void;
   existingFields: IndexPatternPrivateState['existingFields'];
 }) {
@@ -226,79 +223,158 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
     nameFilter: '',
     typeFilter: [],
     isTypeFilterOpen: false,
+    isAvailableAccordionOpen: true,
+    isEmptyAccordionOpen: false,
   });
   const [pageSize, setPageSize] = useState(PAGINATION_SIZE);
   const [scrollContainer, setScrollContainer] = useState<Element | undefined>(undefined);
   const currentIndexPattern = indexPatterns[currentIndexPatternId];
   const allFields = currentIndexPattern.fields;
-  const fieldByName = indexBy(allFields, 'name');
   const clearLocalState = () => setLocalState((s) => ({ ...s, nameFilter: '', typeFilter: [] }));
-
-  const lazyScroll = () => {
-    if (scrollContainer) {
-      const nearBottom =
-        scrollContainer.scrollTop + scrollContainer.clientHeight >
-        scrollContainer.scrollHeight * 0.9;
-      if (nearBottom) {
-        setPageSize(Math.max(PAGINATION_SIZE, Math.min(pageSize * 1.5, allFields.length)));
-      }
-    }
-  };
+  const hasSyncedExistingFields = existingFields[currentIndexPattern.title];
+  const availableFieldTypes = uniq(allFields.map(({ type }) => type)).filter(
+    (type) => type in fieldTypeNames
+  );
 
   useEffect(() => {
     // Reset the scroll if we have made material changes to the field list
     if (scrollContainer) {
       scrollContainer.scrollTop = 0;
       setPageSize(PAGINATION_SIZE);
-      lazyScroll();
     }
-  }, [localState.nameFilter, localState.typeFilter, currentIndexPatternId, showEmptyFields]);
+  }, [localState.nameFilter, localState.typeFilter, currentIndexPatternId, scrollContainer]);
 
-  const availableFieldTypes = uniq(allFields.map(({ type }) => type)).filter(
-    (type) => type in fieldTypeNames
-  );
+  const fieldGroups: FieldsGroup = useMemo(() => {
+    const containsData = (field: IndexPatternField) => {
+      const fieldByName = indexBy(allFields, 'name');
+      const overallField = fieldByName[field.name];
 
-  const displayedFields = allFields.filter((field) => {
-    if (!supportedFieldTypes.has(field.type)) {
-      return false;
-    }
+      return (
+        overallField && fieldExists(existingFields, currentIndexPattern.title, overallField.name)
+      );
+    };
 
-    if (
-      localState.nameFilter.length &&
-      !field.name.toLowerCase().includes(localState.nameFilter.toLowerCase())
-    ) {
-      return false;
+    const allSupportedTypesFields = allFields.filter((field) =>
+      supportedFieldTypes.has(field.type)
+    );
+    const sorted = allSupportedTypesFields.sort(sortFields);
+    // optimization before existingFields are synced
+    if (!hasSyncedExistingFields) {
+      return {
+        ...defaultFieldGroups,
+        ...groupBy(sorted, (field) => {
+          if (field.type === 'document') {
+            return 'specialFields';
+          } else {
+            return 'emptyFields';
+          }
+        }),
+      };
     }
+    return {
+      ...defaultFieldGroups,
+      ...groupBy(sorted, (field) => {
+        if (field.type === 'document') {
+          return 'specialFields';
+        } else if (containsData(field)) {
+          return 'availableFields';
+        } else return 'emptyFields';
+      }),
+    };
+  }, [allFields, existingFields, currentIndexPattern, hasSyncedExistingFields]);
 
-    if (!showEmptyFields) {
-      const indexField = currentIndexPattern && fieldByName[field.name];
-      const exists =
-        field.type === 'document' ||
-        (indexField && fieldExists(existingFields, currentIndexPattern.title, indexField.name));
-      if (localState.typeFilter.length > 0) {
-        return exists && localState.typeFilter.includes(field.type as DataType);
-      }
+  const filteredFieldGroups: FieldsGroup = useMemo(() => {
+    const filterFieldGroup = (fieldGroup: IndexPatternField[]) =>
+      fieldGroup.filter((field) => {
+        if (
+          localState.nameFilter.length &&
+          !field.name.toLowerCase().includes(localState.nameFilter.toLowerCase())
+        ) {
+          return false;
+        }
 
-      return exists;
-    }
+        if (localState.typeFilter.length > 0) {
+          return localState.typeFilter.includes(field.type as DataType);
+        }
+        return true;
+      });
 
-    if (localState.typeFilter.length > 0) {
-      return localState.typeFilter.includes(field.type as DataType);
+    return Object.entries(fieldGroups).reduce((acc, [name, fields]) => {
+      return {
+        ...acc,
+        [name]: filterFieldGroup(fields),
+      };
+    }, defaultFieldGroups);
+  }, [fieldGroups, localState.nameFilter, localState.typeFilter]);
+
+  const lazyScroll = useCallback(() => {
+    if (scrollContainer) {
+      const nearBottom =
+        scrollContainer.scrollTop + scrollContainer.clientHeight >
+        scrollContainer.scrollHeight * 0.9;
+      if (nearBottom) {
+        const displayedFieldsLength =
+          (localState.isAvailableAccordionOpen ? filteredFieldGroups.availableFields.length : 0) +
+          (localState.isEmptyAccordionOpen ? filteredFieldGroups.emptyFields.length : 0);
+        setPageSize(
+          Math.max(
+            PAGINATION_SIZE,
+            Math.min(pageSize + PAGINATION_SIZE * 0.5, displayedFieldsLength)
+          )
+        );
+      }
     }
+  }, [
+    scrollContainer,
+    localState.isAvailableAccordionOpen,
+    localState.isEmptyAccordionOpen,
+    filteredFieldGroups,
+    pageSize,
+    setPageSize,
+  ]);
 
-    return true;
-  });
+  const [paginatedAvailableFields, paginatedEmptyFields]: [
+    IndexPatternField[],
+    IndexPatternField[]
+  ] = useMemo(() => {
+    const { availableFields, emptyFields } = filteredFieldGroups;
+    const isAvailableAccordionOpen = localState.isAvailableAccordionOpen;
+    const isEmptyAccordionOpen = localState.isEmptyAccordionOpen;
+
+    if (isAvailableAccordionOpen && isEmptyAccordionOpen) {
+      if (availableFields.length > pageSize) {
+        return [availableFields.slice(0, pageSize), []];
+      } else {
+        return [availableFields, emptyFields.slice(0, pageSize - availableFields.length)];
+      }
+    }
+    if (isAvailableAccordionOpen && !isEmptyAccordionOpen) {
+      return [availableFields.slice(0, pageSize), []];
+    }
 
-  const specialFields = displayedFields.filter((f) => f.type === 'document');
-  const paginatedFields = displayedFields
-    .filter((f) => f.type !== 'document')
-    .sort(sortFields)
-    .slice(0, pageSize);
-  const hilight = localState.nameFilter.toLowerCase();
+    if (!isAvailableAccordionOpen && isEmptyAccordionOpen) {
+      return [[], emptyFields.slice(0, pageSize)];
+    }
+    return [[], []];
+  }, [
+    localState.isAvailableAccordionOpen,
+    localState.isEmptyAccordionOpen,
+    filteredFieldGroups,
+    pageSize,
+  ]);
 
-  const filterByTypeLabel = i18n.translate('xpack.lens.indexPatterns.filterByTypeLabel', {
-    defaultMessage: 'Filter by type',
-  });
+  const fieldProps = useMemo(
+    () => ({
+      core,
+      data,
+      indexPattern: currentIndexPattern,
+      highlight: localState.nameFilter.toLowerCase(),
+      dateRange,
+      query,
+      filters,
+    }),
+    [core, data, currentIndexPattern, dateRange, query, filters, localState.nameFilter]
+  );
 
   return (
     <ChildDragDropProvider {...dragDropContext}>
@@ -308,7 +384,7 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
         direction="column"
         responsive={false}
       >
-        <EuiFlexItem grow={null}>
+        <EuiFlexItem grow={false}>
           <div className="lnsInnerIndexPatternDataPanel__header">
             <ChangeIndexPattern
               data-test-subj="indexPattern-switcher"
@@ -327,58 +403,59 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
             />
           </div>
         </EuiFlexItem>
-        <EuiFlexItem>
-          <div className="lnsInnerIndexPatternDataPanel__filterWrapper">
-            <EuiFormControlLayout
-              icon="search"
-              fullWidth
-              clear={{
-                title: i18n.translate('xpack.lens.indexPatterns.clearFiltersLabel', {
-                  defaultMessage: 'Clear name and type filters',
-                }),
-                'aria-label': i18n.translate('xpack.lens.indexPatterns.clearFiltersLabel', {
-                  defaultMessage: 'Clear name and type filters',
-                }),
-                onClick: () => {
-                  trackUiEvent('indexpattern_filters_cleared');
-                  clearLocalState();
-                },
+        <EuiFlexItem grow={false}>
+          <EuiFormControlLayout
+            icon="search"
+            fullWidth
+            clear={{
+              title: i18n.translate('xpack.lens.indexPatterns.clearFiltersLabel', {
+                defaultMessage: 'Clear name and type filters',
+              }),
+              'aria-label': i18n.translate('xpack.lens.indexPatterns.clearFiltersLabel', {
+                defaultMessage: 'Clear name and type filters',
+              }),
+              onClick: () => {
+                trackUiEvent('indexpattern_filters_cleared');
+                clearLocalState();
+              },
+            }}
+          >
+            <input
+              className="euiFieldText euiFieldText--fullWidth lnsInnerIndexPatternDataPanel__textField"
+              data-test-subj="lnsIndexPatternFieldSearch"
+              placeholder={i18n.translate('xpack.lens.indexPatterns.filterByNameLabel', {
+                defaultMessage: 'Search field names',
+                description: 'Search the list of fields in the index pattern for the provided text',
+              })}
+              value={localState.nameFilter}
+              onChange={(e) => {
+                setLocalState({ ...localState, nameFilter: e.target.value });
               }}
-            >
-              <input
-                className="euiFieldText euiFieldText--fullWidth lnsInnerIndexPatternDataPanel__textField"
-                data-test-subj="lnsIndexPatternFieldSearch"
-                placeholder={i18n.translate('xpack.lens.indexPatterns.filterByNameLabel', {
-                  defaultMessage: 'Search field names',
-                  description:
-                    'Search the list of fields in the index pattern for the provided text',
-                })}
-                value={localState.nameFilter}
-                onChange={(e) => {
-                  setLocalState({ ...localState, nameFilter: e.target.value });
-                }}
-                aria-label={i18n.translate('xpack.lens.indexPatterns.filterByNameAriaLabel', {
-                  defaultMessage: 'Search fields',
-                })}
-              />
-            </EuiFormControlLayout>
-          </div>
-          <div className="lnsInnerIndexPatternDataPanel__filtersWrapper">
+              aria-label={i18n.translate('xpack.lens.indexPatterns.filterByNameAriaLabel', {
+                defaultMessage: 'Search fields',
+              })}
+            />
+          </EuiFormControlLayout>
+
+          <EuiSpacer size="xs" />
+
+          <EuiFilterGroup>
             <EuiPopover
               id="dataPanelTypeFilter"
               panelClassName="euiFilterGroup__popoverPanel"
               panelPaddingSize="none"
-              anchorPosition="rightDown"
+              anchorPosition="rightUp"
               display="block"
               isOpen={localState.isTypeFilterOpen}
               closePopover={() => setLocalState(() => ({ ...localState, isTypeFilterOpen: false }))}
               button={
-                <EuiFacetButton
+                <EuiFilterButton
+                  iconType="arrowDown"
+                  isSelected={localState.isTypeFilterOpen}
+                  numFilters={localState.typeFilter.length}
+                  hasActiveFilters={!!localState.typeFilter.length}
+                  numActiveFilters={localState.typeFilter.length}
                   data-test-subj="lnsIndexPatternFiltersToggle"
-                  className="lnsInnerIndexPatternDataPanel__filterButton"
-                  quantity={localState.typeFilter.length}
-                  icon={<EuiIcon type="filter" />}
-                  isSelected={localState.typeFilter.length ? true : false}
                   onClick={() => {
                     setLocalState((s) => ({
                       ...s,
@@ -386,11 +463,10 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
                     }));
                   }}
                 >
-                  {filterByTypeLabel}
-                </EuiFacetButton>
+                  {fieldFiltersLabel}
+                </EuiFilterButton>
               }
             >
-              <EuiPopoverTitle>{filterByTypeLabel}</EuiPopoverTitle>
               <FixedEuiContextMenuPanel
                 watchedItemProps={['icon', 'disabled']}
                 data-test-subj="lnsIndexPatternTypeFilterOptions"
@@ -416,22 +492,10 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
                   </EuiContextMenuItem>
                 ))}
               />
-              <EuiPopoverFooter>
-                <EuiSwitch
-                  compressed
-                  checked={!showEmptyFields}
-                  onChange={() => {
-                    trackUiEvent('indexpattern_existence_toggled');
-                    onToggleEmptyFields();
-                  }}
-                  label={i18n.translate('xpack.lens.indexPatterns.toggleEmptyFieldsSwitch', {
-                    defaultMessage: 'Only show fields with data',
-                  })}
-                  data-test-subj="lnsEmptyFilter"
-                />
-              </EuiPopoverFooter>
             </EuiPopover>
-          </div>
+          </EuiFilterGroup>
+        </EuiFlexItem>
+        <EuiFlexItem>
           <div
             className="lnsInnerIndexPatternDataPanel__listWrapper"
             ref={(el) => {
@@ -440,101 +504,95 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
                 setScrollContainer(el);
               }
             }}
-            onScroll={lazyScroll}
+            onScroll={throttle(lazyScroll, 100)}
           >
             <div className="lnsInnerIndexPatternDataPanel__list">
-              {specialFields.map((field) => (
+              {filteredFieldGroups.specialFields.map((field: IndexPatternField) => (
                 <FieldItem
-                  core={core}
-                  data={data}
-                  key={field.name}
-                  indexPattern={currentIndexPattern}
+                  {...fieldProps}
+                  exists={!!fieldGroups.availableFields.length}
                   field={field}
-                  highlight={hilight}
-                  exists={paginatedFields.length > 0}
-                  dateRange={dateRange}
-                  query={query}
-                  filters={filters}
                   hideDetails={true}
+                  key={field.name}
                 />
               ))}
-              {specialFields.length > 0 && (
-                <>
-                  <EuiSpacer size="s" />
-                  <EuiFormLabel>
-                    {i18n.translate('xpack.lens.indexPattern.individualFieldsLabel', {
-                      defaultMessage: 'Individual fields',
-                    })}
-                  </EuiFormLabel>
-                  <EuiSpacer size="s" />
-                </>
-              )}
-              {paginatedFields.map((field) => {
-                const overallField = fieldByName[field.name];
-                return (
-                  <FieldItem
-                    core={core}
-                    data={data}
-                    indexPattern={currentIndexPattern}
-                    key={field.name}
-                    field={field}
-                    highlight={hilight}
-                    exists={
-                      overallField &&
-                      fieldExists(existingFields, currentIndexPattern.title, overallField.name)
+
+              <EuiSpacer size="s" />
+              <FieldsAccordion
+                initialIsOpen={localState.isAvailableAccordionOpen}
+                id="lnsIndexPatternAvailableFields"
+                label={i18n.translate('xpack.lens.indexPattern.availableFieldsLabel', {
+                  defaultMessage: 'Available fields',
+                })}
+                exists={true}
+                hasLoaded={!!hasSyncedExistingFields}
+                fieldsCount={filteredFieldGroups.availableFields.length}
+                isFiltered={
+                  filteredFieldGroups.availableFields.length !== fieldGroups.availableFields.length
+                }
+                paginatedFields={paginatedAvailableFields}
+                fieldProps={fieldProps}
+                onToggle={(open) => {
+                  setLocalState((s) => ({
+                    ...s,
+                    isAvailableAccordionOpen: open,
+                  }));
+                  const displayedFieldLength =
+                    (open ? filteredFieldGroups.availableFields.length : 0) +
+                    (localState.isEmptyAccordionOpen ? filteredFieldGroups.emptyFields.length : 0);
+                  setPageSize(
+                    Math.max(PAGINATION_SIZE, Math.min(pageSize * 1.5, displayedFieldLength))
+                  );
+                }}
+                renderCallout={
+                  <NoFieldsCallout
+                    isAffectedByGlobalFilter={!!filters.length}
+                    isAffectedByFieldFilter={
+                      !!(localState.typeFilter.length || localState.nameFilter.length)
                     }
-                    dateRange={dateRange}
-                    query={query}
-                    filters={filters}
+                    isAffectedByTimerange={true}
+                    existFieldsInIndex={!!fieldGroups.emptyFields.length}
                   />
-                );
-              })}
-
-              {paginatedFields.length === 0 && (
-                <EuiCallOut
-                  size="s"
-                  color="warning"
-                  title={
-                    localState.typeFilter.length || localState.nameFilter.length
-                      ? i18n.translate('xpack.lens.indexPatterns.noFilteredFieldsLabel', {
-                          defaultMessage: 'No fields match the current filters.',
-                        })
-                      : showEmptyFields
-                      ? i18n.translate('xpack.lens.indexPatterns.noFieldsLabel', {
-                          defaultMessage: 'No fields exist in this index pattern.',
-                        })
-                      : i18n.translate('xpack.lens.indexPatterns.emptyFieldsWithDataLabel', {
-                          defaultMessage: 'Looks like you don’t have any data.',
-                        })
-                  }
-                >
-                  {(!showEmptyFields ||
-                    localState.typeFilter.length ||
-                    localState.nameFilter.length) && (
-                    <>
-                      <strong>
-                        {i18n.translate('xpack.lens.indexPatterns.noFields.tryText', {
-                          defaultMessage: 'Try:',
-                        })}
-                      </strong>
-                      <ul>
-                        <li>
-                          {i18n.translate('xpack.lens.indexPatterns.noFields.extendTimeBullet', {
-                            defaultMessage: 'Extending the time range',
-                          })}
-                        </li>
-                        <li>
-                          {i18n.translate('xpack.lens.indexPatterns.noFields.fieldFilterBullet', {
-                            defaultMessage:
-                              'Using {filterByTypeLabel} {arrow} to show fields without data',
-                            values: { filterByTypeLabel, arrow: '↑' },
-                          })}
-                        </li>
-                      </ul>
-                    </>
-                  )}
-                </EuiCallOut>
-              )}
+                }
+              />
+              <EuiSpacer size="m" />
+              <FieldsAccordion
+                initialIsOpen={localState.isEmptyAccordionOpen}
+                isFiltered={
+                  filteredFieldGroups.emptyFields.length !== fieldGroups.emptyFields.length
+                }
+                fieldsCount={filteredFieldGroups.emptyFields.length}
+                paginatedFields={paginatedEmptyFields}
+                hasLoaded={!!hasSyncedExistingFields}
+                exists={false}
+                fieldProps={fieldProps}
+                id="lnsIndexPatternEmptyFields"
+                label={i18n.translate('xpack.lens.indexPattern.emptyFieldsLabel', {
+                  defaultMessage: 'Empty fields',
+                })}
+                onToggle={(open) => {
+                  setLocalState((s) => ({
+                    ...s,
+                    isEmptyAccordionOpen: open,
+                  }));
+                  const displayedFieldLength =
+                    (localState.isAvailableAccordionOpen
+                      ? filteredFieldGroups.availableFields.length
+                      : 0) + (open ? filteredFieldGroups.emptyFields.length : 0);
+                  setPageSize(
+                    Math.max(PAGINATION_SIZE, Math.min(pageSize * 1.5, displayedFieldLength))
+                  );
+                }}
+                renderCallout={
+                  <NoFieldsCallout
+                    isAffectedByFieldFilter={
+                      !!(localState.typeFilter.length || localState.nameFilter.length)
+                    }
+                    existFieldsInIndex={!!fieldGroups.emptyFields.length}
+                  />
+                }
+              />
+              <EuiSpacer size="m" />
             </div>
           </div>
         </EuiFlexItem>
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
index ebf5abd4fbfe..ee9b6778650e 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
@@ -79,7 +79,6 @@ describe('IndexPatternDimensionEditorPanel', () => {
       indexPatternRefs: [],
       indexPatterns: expectedIndexPatterns,
       currentIndexPatternId: '1',
-      showEmptyFields: false,
       existingFields: {
         'my-fake-index-pattern': {
           timestamp: true,
@@ -1258,7 +1257,6 @@ describe('IndexPatternDimensionEditorPanel', () => {
           },
         },
         currentIndexPatternId: '1',
-        showEmptyFields: false,
         layers: {
           myLayer: {
             indexPatternId: 'foo',
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/field_select.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/field_select.tsx
index ee566951d2b7..35c510521b35 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/field_select.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/field_select.tsx
@@ -27,7 +27,6 @@ export interface FieldChoice {
 
 export interface FieldSelectProps {
   currentIndexPattern: IndexPattern;
-  showEmptyFields: boolean;
   fieldMap: Record<string, IndexPatternField>;
   incompatibleSelectedOperationType: OperationType | null;
   selectedColumnOperationType?: OperationType;
@@ -40,7 +39,6 @@ export interface FieldSelectProps {
 
 export function FieldSelect({
   currentIndexPattern,
-  showEmptyFields,
   fieldMap,
   incompatibleSelectedOperationType,
   selectedColumnOperationType,
@@ -69,6 +67,10 @@ export function FieldSelect({
       (field) => fieldMap[field].type === 'document'
     );
 
+    const containsData = (field: string) =>
+      fieldMap[field].type === 'document' ||
+      fieldExists(existingFields, currentIndexPattern.title, field);
+
     function fieldNamesToOptions(items: string[]) {
       return items
         .map((field) => ({
@@ -82,12 +84,9 @@ export function FieldSelect({
                 ? selectedColumnOperationType
                 : undefined,
           },
-          exists:
-            fieldMap[field].type === 'document' ||
-            fieldExists(existingFields, currentIndexPattern.title, field),
+          exists: containsData(field),
           compatible: isCompatibleWithCurrentOperation(field),
         }))
-        .filter((field) => showEmptyFields || field.exists)
         .sort((a, b) => {
           if (a.compatible && !b.compatible) {
             return -1;
@@ -108,18 +107,33 @@ export function FieldSelect({
         }));
     }
 
-    const fieldOptions: unknown[] = fieldNamesToOptions(specialFields);
+    const [availableFields, emptyFields] = _.partition(normalFields, containsData);
 
-    if (fields.length > 0) {
-      fieldOptions.push({
-        label: i18n.translate('xpack.lens.indexPattern.individualFieldsLabel', {
-          defaultMessage: 'Individual fields',
-        }),
-        options: fieldNamesToOptions(normalFields),
-      });
-    }
+    const constructFieldsOptions = (fieldsArr: string[], label: string) =>
+      fieldsArr.length > 0 && {
+        label,
+        options: fieldNamesToOptions(fieldsArr),
+      };
+
+    const availableFieldsOptions = constructFieldsOptions(
+      availableFields,
+      i18n.translate('xpack.lens.indexPattern.availableFieldsLabel', {
+        defaultMessage: 'Available fields',
+      })
+    );
+
+    const emptyFieldsOptions = constructFieldsOptions(
+      emptyFields,
+      i18n.translate('xpack.lens.indexPattern.emptyFieldsLabel', {
+        defaultMessage: 'Empty fields',
+      })
+    );
 
-    return fieldOptions;
+    return [
+      ...fieldNamesToOptions(specialFields),
+      availableFieldsOptions,
+      emptyFieldsOptions,
+    ].filter(Boolean);
   }, [
     incompatibleSelectedOperationType,
     selectedColumnOperationType,
@@ -127,7 +141,6 @@ export function FieldSelect({
     operationFieldSupportMatrix,
     currentIndexPattern,
     fieldMap,
-    showEmptyFields,
   ]);
 
   return (
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
index 4468686aa41e..eb2475756417 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
@@ -200,7 +200,6 @@ export function PopoverEditor(props: PopoverEditorProps) {
           <FieldSelect
             currentIndexPattern={currentIndexPattern}
             existingFields={state.existingFields}
-            showEmptyFields={state.showEmptyFields}
             fieldMap={fieldMap}
             operationFieldSupportMatrix={operationFieldSupportMatrix}
             selectedColumnOperationType={selectedColumn && selectedColumn.operationType}
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/field_item.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/field_item.test.tsx
index 511ba3c0442c..e8dfbc250c53 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/field_item.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/field_item.test.tsx
@@ -7,7 +7,7 @@
 import React from 'react';
 import { act } from 'react-dom/test-utils';
 import { EuiLoadingSpinner, EuiPopover } from '@elastic/eui';
-import { FieldItem, FieldItemProps } from './field_item';
+import { InnerFieldItem, FieldItemProps } from './field_item';
 import { coreMock } from 'src/core/public/mocks';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { DataPublicPluginStart } from '../../../../../src/plugins/data/public';
@@ -94,7 +94,7 @@ describe('IndexPattern Field Item', () => {
     core.http.post.mockImplementationOnce(() => {
       return Promise.resolve({});
     });
-    const wrapper = mountWithIntl(<FieldItem {...defaultProps} />);
+    const wrapper = mountWithIntl(<InnerFieldItem {...defaultProps} />);
 
     await act(async () => {
       wrapper.find('[data-test-subj="lnsFieldListPanelField-bytes"]').simulate('click');
@@ -119,7 +119,7 @@ describe('IndexPattern Field Item', () => {
       });
     });
 
-    const wrapper = mountWithIntl(<FieldItem {...defaultProps} />);
+    const wrapper = mountWithIntl(<InnerFieldItem {...defaultProps} />);
 
     wrapper.find('[data-test-subj="lnsFieldListPanelField-bytes"]').simulate('click');
 
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/field_item.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/field_item.tsx
index 6c00706cc860..1a1a34d30f8a 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/field_item.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/field_item.tsx
@@ -49,6 +49,8 @@ import { IndexPattern, IndexPatternField } from './types';
 import { LensFieldIcon } from './lens_field_icon';
 import { trackUiEvent } from '../lens_ui_telemetry';
 
+import { debouncedComponent } from '../debounced_component';
+
 export interface FieldItemProps {
   core: DatasourceDataPanelProps['core'];
   data: DataPublicPluginStart;
@@ -78,7 +80,7 @@ function wrapOnDot(str?: string) {
   return str ? str.replace(/\./g, '.\u200B') : '';
 }
 
-export const FieldItem = React.memo(function FieldItem(props: FieldItemProps) {
+export const InnerFieldItem = function InnerFieldItem(props: FieldItemProps) {
   const {
     core,
     field,
@@ -239,7 +241,9 @@ export const FieldItem = React.memo(function FieldItem(props: FieldItemProps) {
       <FieldItemPopoverContents {...state} {...props} />
     </EuiPopover>
   );
-});
+};
+
+export const FieldItem = debouncedComponent(InnerFieldItem);
 
 function FieldItemPopoverContents(props: State & FieldItemProps) {
   const {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.test.tsx
new file mode 100644
index 000000000000..41d90a4f8870
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.test.tsx
@@ -0,0 +1,97 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { EuiLoadingSpinner, EuiNotificationBadge } from '@elastic/eui';
+import { coreMock } from 'src/core/public/mocks';
+import { mountWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
+import { DataPublicPluginStart } from '../../../../../src/plugins/data/public';
+import { dataPluginMock } from '../../../../../src/plugins/data/public/mocks';
+import { IndexPattern } from './types';
+import { FieldItem } from './field_item';
+import { FieldsAccordion, FieldsAccordionProps, FieldItemSharedProps } from './fields_accordion';
+
+describe('Fields Accordion', () => {
+  let defaultProps: FieldsAccordionProps;
+  let indexPattern: IndexPattern;
+  let core: ReturnType<typeof coreMock['createSetup']>;
+  let data: DataPublicPluginStart;
+  let fieldProps: FieldItemSharedProps;
+
+  beforeEach(() => {
+    indexPattern = {
+      id: '1',
+      title: 'my-fake-index-pattern',
+      timeFieldName: 'timestamp',
+      fields: [
+        {
+          name: 'timestamp',
+          type: 'date',
+          aggregatable: true,
+          searchable: true,
+        },
+        {
+          name: 'bytes',
+          type: 'number',
+          aggregatable: true,
+          searchable: true,
+        },
+      ],
+    } as IndexPattern;
+    core = coreMock.createSetup();
+    data = dataPluginMock.createStartContract();
+    core.http.post.mockClear();
+
+    fieldProps = {
+      indexPattern,
+      data,
+      core,
+      highlight: '',
+      dateRange: {
+        fromDate: 'now-7d',
+        toDate: 'now',
+      },
+      query: { query: '', language: 'lucene' },
+      filters: [],
+    };
+
+    defaultProps = {
+      initialIsOpen: true,
+      onToggle: jest.fn(),
+      id: 'id',
+      label: 'label',
+      hasLoaded: true,
+      fieldsCount: 2,
+      isFiltered: false,
+      paginatedFields: indexPattern.fields,
+      fieldProps,
+      renderCallout: <div id="lens-test-callout">Callout</div>,
+      exists: true,
+    };
+  });
+
+  it('renders correct number of Field Items', () => {
+    const wrapper = mountWithIntl(<FieldsAccordion {...defaultProps} />);
+    expect(wrapper.find(FieldItem).length).toEqual(2);
+  });
+
+  it('renders callout if no fields', () => {
+    const wrapper = shallowWithIntl(
+      <FieldsAccordion {...defaultProps} fieldsCount={0} paginatedFields={[]} />
+    );
+    expect(wrapper.find('#lens-test-callout').length).toEqual(1);
+  });
+
+  it('renders accented notificationBadge state if isFiltered', () => {
+    const wrapper = mountWithIntl(<FieldsAccordion {...defaultProps} isFiltered={true} />);
+    expect(wrapper.find(EuiNotificationBadge).prop('color')).toEqual('accent');
+  });
+
+  it('renders spinner if has not loaded', () => {
+    const wrapper = mountWithIntl(<FieldsAccordion {...defaultProps} hasLoaded={false} />);
+    expect(wrapper.find(EuiLoadingSpinner).length).toEqual(1);
+  });
+});
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
new file mode 100644
index 000000000000..b756cf81a907
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import './datapanel.scss';
+import React, { memo, useCallback } from 'react';
+import {
+  EuiText,
+  EuiNotificationBadge,
+  EuiSpacer,
+  EuiAccordion,
+  EuiLoadingSpinner,
+} from '@elastic/eui';
+import { DataPublicPluginStart } from 'src/plugins/data/public';
+import { IndexPatternField } from './types';
+import { FieldItem } from './field_item';
+import { Query, Filter } from '../../../../../src/plugins/data/public';
+import { DatasourceDataPanelProps } from '../types';
+import { IndexPattern } from './types';
+
+export interface FieldItemSharedProps {
+  core: DatasourceDataPanelProps['core'];
+  data: DataPublicPluginStart;
+  indexPattern: IndexPattern;
+  highlight?: string;
+  query: Query;
+  dateRange: DatasourceDataPanelProps['dateRange'];
+  filters: Filter[];
+}
+
+export interface FieldsAccordionProps {
+  initialIsOpen: boolean;
+  onToggle: (open: boolean) => void;
+  id: string;
+  label: string;
+  hasLoaded: boolean;
+  fieldsCount: number;
+  isFiltered: boolean;
+  paginatedFields: IndexPatternField[];
+  fieldProps: FieldItemSharedProps;
+  renderCallout: JSX.Element;
+  exists: boolean;
+}
+
+export const InnerFieldsAccordion = function InnerFieldsAccordion({
+  initialIsOpen,
+  onToggle,
+  id,
+  label,
+  hasLoaded,
+  fieldsCount,
+  isFiltered,
+  paginatedFields,
+  fieldProps,
+  renderCallout,
+  exists,
+}: FieldsAccordionProps) {
+  const renderField = useCallback(
+    (field: IndexPatternField) => {
+      return <FieldItem {...fieldProps} key={field.name} field={field} exists={!!exists} />;
+    },
+    [fieldProps, exists]
+  );
+
+  return (
+    <EuiAccordion
+      initialIsOpen={initialIsOpen}
+      onToggle={onToggle}
+      data-test-subj={id}
+      id={id}
+      buttonContent={
+        <EuiText size="xs">
+          <strong>{label}</strong>
+        </EuiText>
+      }
+      extraAction={
+        hasLoaded ? (
+          <EuiNotificationBadge size="m" color={isFiltered ? 'accent' : 'subdued'}>
+            {fieldsCount}
+          </EuiNotificationBadge>
+        ) : (
+          <EuiLoadingSpinner size="m" />
+        )
+      }
+    >
+      <EuiSpacer size="s" />
+      {hasLoaded &&
+        (!!fieldsCount ? (
+          <div className="lnsInnerIndexPatternDataPanel__fieldItems">
+            {paginatedFields && paginatedFields.map(renderField)}
+          </div>
+        ) : (
+          renderCallout
+        ))}
+    </EuiAccordion>
+  );
+};
+
+export const FieldsAccordion = memo(InnerFieldsAccordion);
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.test.ts
index d8449143b569..a69d7c055eaa 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.test.ts
@@ -127,7 +127,6 @@ function stateFromPersistedState(
     indexPatterns: expectedIndexPatterns,
     indexPatternRefs: [],
     existingFields: {},
-    showEmptyFields: true,
   };
 }
 
@@ -402,7 +401,6 @@ describe('IndexPattern Data Source', () => {
           },
         },
         currentIndexPatternId: '1',
-        showEmptyFields: false,
       };
       expect(indexPatternDatasource.insertLayer(state, 'newLayer')).toEqual({
         ...state,
@@ -423,7 +421,6 @@ describe('IndexPattern Data Source', () => {
       const state = {
         indexPatternRefs: [],
         existingFields: {},
-        showEmptyFields: false,
         indexPatterns: expectedIndexPatterns,
         layers: {
           first: {
@@ -458,7 +455,6 @@ describe('IndexPattern Data Source', () => {
         indexPatternDatasource.getLayers({
           indexPatternRefs: [],
           existingFields: {},
-          showEmptyFields: false,
           indexPatterns: expectedIndexPatterns,
           layers: {
             first: {
@@ -484,7 +480,6 @@ describe('IndexPattern Data Source', () => {
         indexPatternDatasource.getMetaData({
           indexPatternRefs: [],
           existingFields: {},
-          showEmptyFields: false,
           indexPatterns: expectedIndexPatterns,
           layers: {
             first: {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx
index 5eca55cbfcbd..87d91b56d2a5 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx
@@ -146,7 +146,6 @@ function testInitialState(): IndexPatternPrivateState {
         },
       },
     },
-    showEmptyFields: false,
   };
 }
 
@@ -305,7 +304,6 @@ describe('IndexPattern Data Source suggestions', () => {
           indexPatternRefs: [],
           existingFields: {},
           currentIndexPatternId: '1',
-          showEmptyFields: false,
           indexPatterns: {
             1: {
               id: '1',
@@ -510,7 +508,6 @@ describe('IndexPattern Data Source suggestions', () => {
           indexPatternRefs: [],
           existingFields: {},
           currentIndexPatternId: '1',
-          showEmptyFields: false,
           indexPatterns: {
             1: {
               id: '1',
@@ -1049,7 +1046,6 @@ describe('IndexPattern Data Source suggestions', () => {
     it('returns no suggestions if there are no columns', () => {
       expect(
         getDatasourceSuggestionsFromCurrentState({
-          showEmptyFields: false,
           indexPatternRefs: [],
           existingFields: {},
           indexPatterns: expectedIndexPatterns,
@@ -1355,7 +1351,6 @@ describe('IndexPattern Data Source suggestions', () => {
             ],
           },
         },
-        showEmptyFields: true,
         layers: {
           first: {
             ...initialState.layers.first,
@@ -1475,7 +1470,6 @@ describe('IndexPattern Data Source suggestions', () => {
             ],
           },
         },
-        showEmptyFields: true,
         layers: {
           first: {
             ...initialState.layers.first,
@@ -1529,7 +1523,6 @@ describe('IndexPattern Data Source suggestions', () => {
             ],
           },
         },
-        showEmptyFields: true,
         layers: {
           first: {
             ...initialState.layers.first,
@@ -1560,7 +1553,6 @@ describe('IndexPattern Data Source suggestions', () => {
         existingFields: {},
         currentIndexPatternId: '1',
         indexPatterns: expectedIndexPatterns,
-        showEmptyFields: true,
         layers: {
           first: {
             ...initialState.layers.first,
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/layerpanel.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/layerpanel.test.tsx
index 0d16e2d054a7..9cbd624b42d3 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/layerpanel.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/layerpanel.test.tsx
@@ -22,7 +22,6 @@ const initialState: IndexPatternPrivateState = {
   ],
   existingFields: {},
   currentIndexPatternId: '1',
-  showEmptyFields: false,
   layers: {
     first: {
       indexPatternId: '1',
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
index 55fd8a6d936d..5e59627d8c33 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
@@ -294,7 +294,6 @@ describe('loader', () => {
           a: sampleIndexPatterns.a,
         },
         layers: {},
-        showEmptyFields: false,
       });
       expect(storage.set).toHaveBeenCalledWith('lens-settings', {
         indexPatternId: 'a',
@@ -363,7 +362,6 @@ describe('loader', () => {
           b: sampleIndexPatterns.b,
         },
         layers: {},
-        showEmptyFields: false,
       });
       expect(storage.set).toHaveBeenCalledWith('lens-settings', {
         indexPatternId: 'b',
@@ -416,7 +414,6 @@ describe('loader', () => {
           b: sampleIndexPatterns.b,
         },
         layers: savedState.layers,
-        showEmptyFields: false,
       });
 
       expect(storage.set).toHaveBeenCalledWith('lens-settings', {
@@ -434,7 +431,6 @@ describe('loader', () => {
         indexPatterns: {},
         existingFields: {},
         layers: {},
-        showEmptyFields: true,
       };
       const storage = createMockStorage({ indexPatternId: 'b' });
 
@@ -469,7 +465,6 @@ describe('loader', () => {
         existingFields: {},
         indexPatterns: {},
         layers: {},
-        showEmptyFields: true,
       };
 
       const storage = createMockStorage({ indexPatternId: 'b' });
@@ -527,7 +522,6 @@ describe('loader', () => {
             indexPatternId: 'a',
           },
         },
-        showEmptyFields: true,
       };
 
       const storage = createMockStorage({ indexPatternId: 'a' });
@@ -596,7 +590,6 @@ describe('loader', () => {
             indexPatternId: 'a',
           },
         },
-        showEmptyFields: true,
       };
 
       const storage = createMockStorage({ indexPatternId: 'b' });
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
index ca52ffe73a87..6c57988dfc7b 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
@@ -118,7 +118,6 @@ export async function loadInitialState({
       currentIndexPatternId,
       indexPatternRefs,
       indexPatterns,
-      showEmptyFields: false,
       existingFields: {},
     };
   }
@@ -128,7 +127,6 @@ export async function loadInitialState({
     indexPatternRefs,
     indexPatterns,
     layers: {},
-    showEmptyFields: false,
     existingFields: {},
   };
 }
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/no_fields_callout.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/no_fields_callout.test.tsx
new file mode 100644
index 000000000000..f32bf52339e1
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/no_fields_callout.test.tsx
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { shallow } from 'enzyme';
+import { NoFieldsCallout } from './no_fields_callout';
+
+describe('NoFieldCallout', () => {
+  it('renders properly for index with no fields', () => {
+    const component = shallow(
+      <NoFieldsCallout existFieldsInIndex={false} isAffectedByFieldFilter={false} />
+    );
+    expect(component).toMatchSnapshot();
+  });
+
+  it('renders properly when affected by field filters, global filter and timerange', () => {
+    const component = shallow(
+      <NoFieldsCallout
+        existFieldsInIndex={true}
+        isAffectedByFieldFilter={true}
+        isAffectedByTimerange={true}
+        isAffectedByGlobalFilter={true}
+      />
+    );
+    expect(component).toMatchSnapshot();
+  });
+
+  it('renders properly when affected by field filter', () => {
+    const component = shallow(
+      <NoFieldsCallout existFieldsInIndex={true} isAffectedByFieldFilter={true} />
+    );
+    expect(component).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/no_fields_callout.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/no_fields_callout.tsx
new file mode 100644
index 000000000000..066d60f00620
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/no_fields_callout.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { EuiCallOut } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+export const NoFieldsCallout = ({
+  isAffectedByFieldFilter,
+  existFieldsInIndex,
+  isAffectedByTimerange = false,
+  isAffectedByGlobalFilter = false,
+}: {
+  isAffectedByFieldFilter: boolean;
+  existFieldsInIndex: boolean;
+  isAffectedByTimerange?: boolean;
+  isAffectedByGlobalFilter?: boolean;
+}) => {
+  return (
+    <EuiCallOut
+      size="s"
+      color="warning"
+      title={
+        isAffectedByFieldFilter
+          ? i18n.translate('xpack.lens.indexPatterns.noFilteredFieldsLabel', {
+              defaultMessage: 'No fields match the selected filters.',
+            })
+          : existFieldsInIndex
+          ? i18n.translate('xpack.lens.indexPatterns.noDataLabel', {
+              defaultMessage: `There are no available fields that contain data.`,
+            })
+          : i18n.translate('xpack.lens.indexPatterns.noFieldsLabel', {
+              defaultMessage: 'No fields exist in this index pattern.',
+            })
+      }
+    >
+      {existFieldsInIndex && (
+        <>
+          <strong>
+            {i18n.translate('xpack.lens.indexPatterns.noFields.tryText', {
+              defaultMessage: 'Try:',
+            })}
+          </strong>
+          <ul>
+            {isAffectedByTimerange && (
+              <>
+                <li>
+                  {i18n.translate('xpack.lens.indexPatterns.noFields.extendTimeBullet', {
+                    defaultMessage: 'Extending the time range',
+                  })}
+                </li>
+              </>
+            )}
+            {isAffectedByFieldFilter ? (
+              <li>
+                {i18n.translate('xpack.lens.indexPatterns.noFields.fieldTypeFilterBullet', {
+                  defaultMessage: 'Using different field filters',
+                })}
+              </li>
+            ) : null}
+            {isAffectedByGlobalFilter ? (
+              <li>
+                {i18n.translate('xpack.lens.indexPatterns.noFields.globalFiltersBullet', {
+                  defaultMessage: 'Changing the global filters',
+                })}
+              </li>
+            ) : null}
+          </ul>
+        </>
+      )}
+    </EuiCallOut>
+  );
+};
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/date_histogram.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/date_histogram.test.tsx
index defc142d4976..d0c7af42114e 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/date_histogram.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/date_histogram.test.tsx
@@ -51,7 +51,6 @@ describe('date_histogram', () => {
       indexPatternRefs: [],
       existingFields: {},
       currentIndexPatternId: '1',
-      showEmptyFields: false,
       indexPatterns: {
         1: {
           id: '1',
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms.test.tsx
index 89d02708a900..1e1d83a0a5c4 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms.test.tsx
@@ -34,7 +34,6 @@ describe('terms', () => {
       indexPatterns: {},
       existingFields: {},
       currentIndexPatternId: '1',
-      showEmptyFields: false,
       layers: {
         first: {
           indexPatternId: '1',
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/operations.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/operations.test.ts
index e5d20839aae3..a73f6e13d94c 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/operations.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/operations.test.ts
@@ -147,7 +147,6 @@ describe('getOperationTypesForField', () => {
       indexPatternRefs: [],
       existingFields: {},
       currentIndexPatternId: '1',
-      showEmptyFields: false,
       indexPatterns: expectedIndexPatterns,
       layers: {
         first: {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/state_helpers.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/state_helpers.test.ts
index 074cb8f5bde1..65a2401fd689 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/state_helpers.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/state_helpers.test.ts
@@ -42,7 +42,6 @@ describe('state_helpers', () => {
         existingFields: {},
         indexPatterns: {},
         currentIndexPatternId: '1',
-        showEmptyFields: false,
         layers: {
           first: {
             indexPatternId: '1',
@@ -96,7 +95,6 @@ describe('state_helpers', () => {
         existingFields: {},
         indexPatterns: {},
         currentIndexPatternId: '1',
-        showEmptyFields: false,
         layers: {
           first: {
             indexPatternId: '1',
@@ -147,7 +145,6 @@ describe('state_helpers', () => {
         existingFields: {},
         indexPatterns: {},
         currentIndexPatternId: '1',
-        showEmptyFields: false,
         layers: {
           first: {
             indexPatternId: '1',
@@ -188,7 +185,6 @@ describe('state_helpers', () => {
         existingFields: {},
         indexPatterns: {},
         currentIndexPatternId: '1',
-        showEmptyFields: false,
         layers: {
           first: {
             indexPatternId: '1',
@@ -222,7 +218,6 @@ describe('state_helpers', () => {
         existingFields: {},
         indexPatterns: {},
         currentIndexPatternId: '1',
-        showEmptyFields: false,
         layers: {
           first: {
             indexPatternId: '1',
@@ -284,7 +279,6 @@ describe('state_helpers', () => {
         existingFields: {},
         indexPatterns: {},
         currentIndexPatternId: '1',
-        showEmptyFields: false,
         layers: {
           first: {
             indexPatternId: '1',
@@ -337,7 +331,6 @@ describe('state_helpers', () => {
         existingFields: {},
         indexPatterns: {},
         currentIndexPatternId: '1',
-        showEmptyFields: false,
         layers: {
           first: {
             indexPatternId: '1',
@@ -417,7 +410,6 @@ describe('state_helpers', () => {
         existingFields: {},
         indexPatterns: {},
         currentIndexPatternId: '1',
-        showEmptyFields: false,
         layers: {
           first: {
             indexPatternId: '1',
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
index 563af40ed272..35a82d877413 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
@@ -51,7 +51,6 @@ export type IndexPatternPrivateState = IndexPatternPersistedState & {
    * indexPatternId -> fieldName -> boolean
    */
   existingFields: Record<string, Record<string, boolean>>;
-  showEmptyFields: boolean;
 };
 
 export interface IndexPatternRef {
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 2a7517540e70..ab7215ef923a 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -8645,7 +8645,6 @@
     "xpack.lens.indexPattern.groupingSecondDateHistogram": "各 {target} の日付",
     "xpack.lens.indexPattern.groupingSecondTerms": "各 {target} のトップの値",
     "xpack.lens.indexPattern.indexPatternLoadError": "インデックスパターンの読み込み中にエラーが発生",
-    "xpack.lens.indexPattern.individualFieldsLabel": "個々のフィールド",
     "xpack.lens.indexPattern.invalidInterval": "無効な間隔値",
     "xpack.lens.indexPattern.invalidOperationLabel": "この関数を使用するには、別のフィールドを選択してください。",
     "xpack.lens.indexPattern.max": "最高",
@@ -8676,16 +8675,11 @@
     "xpack.lens.indexPattern.termsOf": "{name} のトップの値",
     "xpack.lens.indexPattern.uniqueLabel": "{label} [{num}]",
     "xpack.lens.indexPatterns.clearFiltersLabel": "名前とタイプフィルターを消去",
-    "xpack.lens.indexPatterns.emptyFieldsWithDataLabel": "データがないようです。",
     "xpack.lens.indexPatterns.filterByNameAriaLabel": "検索フィールド",
     "xpack.lens.indexPatterns.filterByNameLabel": "フィールドを検索",
-    "xpack.lens.indexPatterns.filterByTypeLabel": "タイプでフィルタリング",
     "xpack.lens.indexPatterns.noFields.extendTimeBullet": "時間範囲を拡張中",
-    "xpack.lens.indexPatterns.noFields.fieldFilterBullet": "{filterByTypeLabel} {arrow} を使用してデータなしのフィールドを表示",
     "xpack.lens.indexPatterns.noFields.tryText": "試行対象:",
     "xpack.lens.indexPatterns.noFieldsLabel": "このインデックスパターンにはフィールドがありません。",
-    "xpack.lens.indexPatterns.noFilteredFieldsLabel": "現在のフィルターと一致するフィールドはありません。",
-    "xpack.lens.indexPatterns.toggleEmptyFieldsSwitch": "データがあるフィールドだけを表示",
     "xpack.lens.indexPatternSuggestion.removeLayerLabel": "{indexPatternTitle}のみを表示",
     "xpack.lens.indexPatternSuggestion.removeLayerPositionLabel": "レイヤー{layerNumber}のみを表示",
     "xpack.lens.lensSavedObjectLabel": "レンズビジュアライゼーション",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 9a55fee2b889..a72b79c3ae0c 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -8649,7 +8649,6 @@
     "xpack.lens.indexPattern.groupingSecondDateHistogram": "每个 {target} 的日期",
     "xpack.lens.indexPattern.groupingSecondTerms": "每个 {target} 的排名最前值",
     "xpack.lens.indexPattern.indexPatternLoadError": "加载索引模式时出错",
-    "xpack.lens.indexPattern.individualFieldsLabel": "各个字段",
     "xpack.lens.indexPattern.invalidInterval": "时间间隔值无效",
     "xpack.lens.indexPattern.invalidOperationLabel": "要使用此函数，请选择不同的字段。",
     "xpack.lens.indexPattern.max": "最大值",
@@ -8680,16 +8679,11 @@
     "xpack.lens.indexPattern.termsOf": "{name} 的排名最前值",
     "xpack.lens.indexPattern.uniqueLabel": "{label} [{num}]",
     "xpack.lens.indexPatterns.clearFiltersLabel": "清除名称和类型筛选",
-    "xpack.lens.indexPatterns.emptyFieldsWithDataLabel": "似乎您没有任何数据。",
     "xpack.lens.indexPatterns.filterByNameAriaLabel": "搜索字段",
     "xpack.lens.indexPatterns.filterByNameLabel": "搜索字段",
-    "xpack.lens.indexPatterns.filterByTypeLabel": "按类型筛选",
     "xpack.lens.indexPatterns.noFields.extendTimeBullet": "延伸时间范围",
-    "xpack.lens.indexPatterns.noFields.fieldFilterBullet": "使用 {filterByTypeLabel} {arrow} 显示没有数据的字段",
     "xpack.lens.indexPatterns.noFields.tryText": "尝试：",
     "xpack.lens.indexPatterns.noFieldsLabel": "在此索引模式中不存在任何字段。",
-    "xpack.lens.indexPatterns.noFilteredFieldsLabel": "没有任何字段匹配当前筛选。",
-    "xpack.lens.indexPatterns.toggleEmptyFieldsSwitch": "仅显示具有数据的字段",
     "xpack.lens.indexPatternSuggestion.removeLayerLabel": "仅显示 {indexPatternTitle}",
     "xpack.lens.indexPatternSuggestion.removeLayerPositionLabel": "仅显示图层 {layerNumber}",
     "xpack.lens.lensSavedObjectLabel": "Lens 可视化",
diff --git a/x-pack/test/functional/page_objects/lens_page.ts b/x-pack/test/functional/page_objects/lens_page.ts
index 3f048a9ee2aa..bae11e1ea8a9 100644
--- a/x-pack/test/functional/page_objects/lens_page.ts
+++ b/x-pack/test/functional/page_objects/lens_page.ts
@@ -30,15 +30,6 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
       await testSubjects.click('lnsIndexPatternFiltersToggle');
     },
 
-    /**
-     * Toggles the field existence checkbox.
-     */
-    async toggleExistenceFilter() {
-      await this.toggleIndexPatternFiltersPopover();
-      await testSubjects.click('lnsEmptyFilter');
-      await this.toggleIndexPatternFiltersPopover();
-    },
-
     async findAllFields() {
       return await testSubjects.findAll('lnsFieldListPanelField');
     },

From 6ebf56ba66c89f382e68fa81d0f3d4837904aa22 Mon Sep 17 00:00:00 2001
From: Dmitry Lemeshko <dzmitry.lemechko@elastic.co>
Date: Fri, 26 Jun 2020 19:02:30 +0200
Subject: [PATCH 55/78] Adding saved_objects_page in OSS (#69900)

* add savedObjects own PO

* fix usage

* simplify functions

* fix test

* fix title parsing

* add missing await

* improve parsing

* wait for table is loaded

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 test/functional/apps/dashboard/time_zones.js  |  12 +-
 .../apps/management/_import_objects.js        | 199 ++++++++----------
 .../management/_mgmt_import_saved_objects.js  |  12 +-
 .../edit_saved_object.ts                      |  14 +-
 test/functional/page_objects/index.ts         |   2 +
 .../management/saved_objects_page.ts          | 184 ++++++++++++++++
 test/functional/page_objects/settings_page.ts | 179 +---------------
 .../saved_objects_management_security.ts      |  25 ++-
 .../copy_saved_objects_to_space_page.ts       |  16 +-
 9 files changed, 331 insertions(+), 312 deletions(-)
 create mode 100644 test/functional/page_objects/management/saved_objects_page.ts

diff --git a/test/functional/apps/dashboard/time_zones.js b/test/functional/apps/dashboard/time_zones.js
index b0344a8b6906..4e95a14efb4d 100644
--- a/test/functional/apps/dashboard/time_zones.js
+++ b/test/functional/apps/dashboard/time_zones.js
@@ -24,7 +24,13 @@ export default function ({ getService, getPageObjects }) {
   const pieChart = getService('pieChart');
   const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
-  const PageObjects = getPageObjects(['dashboard', 'timePicker', 'settings', 'common']);
+  const PageObjects = getPageObjects([
+    'dashboard',
+    'timePicker',
+    'settings',
+    'common',
+    'savedObjects',
+  ]);
 
   describe('dashboard time zones', function () {
     this.tags('includeFirefox');
@@ -36,10 +42,10 @@ export default function ({ getService, getPageObjects }) {
       });
       await PageObjects.settings.navigateTo();
       await PageObjects.settings.clickKibanaSavedObjects();
-      await PageObjects.settings.importFile(
+      await PageObjects.savedObjects.importFile(
         path.join(__dirname, 'exports', 'timezonetest_6_2_4.json')
       );
-      await PageObjects.settings.checkImportSucceeded();
+      await PageObjects.savedObjects.checkImportSucceeded();
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.preserveCrossAppState();
       await PageObjects.dashboard.loadSavedDashboard('time zone test');
diff --git a/test/functional/apps/management/_import_objects.js b/test/functional/apps/management/_import_objects.js
index 6306d11eadb6..c69111be6972 100644
--- a/test/functional/apps/management/_import_objects.js
+++ b/test/functional/apps/management/_import_objects.js
@@ -24,7 +24,7 @@ import { indexBy } from 'lodash';
 export default function ({ getService, getPageObjects }) {
   const kibanaServer = getService('kibanaServer');
   const esArchiver = getService('esArchiver');
-  const PageObjects = getPageObjects(['common', 'settings', 'header']);
+  const PageObjects = getPageObjects(['common', 'settings', 'header', 'savedObjects']);
   const testSubjects = getService('testSubjects');
   const log = getService('log');
 
@@ -43,22 +43,19 @@ export default function ({ getService, getPageObjects }) {
       });
 
       it('should import saved objects', async function () {
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects.ndjson')
         );
-        await PageObjects.settings.checkImportSucceeded();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportSucceeded();
+        await PageObjects.savedObjects.clickImportDone();
 
         // get all the elements in the table, and index them by the 'title' visible text field
-        const elements = indexBy(
-          await PageObjects.settings.getSavedObjectElementsInTable(),
-          'title'
-        );
+        const elements = indexBy(await PageObjects.savedObjects.getElementsInTable(), 'title');
         log.debug("check that 'Log Agents' is in table as a visualization");
         expect(elements['Log Agents'].objectType).to.eql('visualization');
 
         await elements['logstash-*'].relationshipsElement.click();
-        const flyout = indexBy(await PageObjects.settings.getRelationshipFlyout(), 'title');
+        const flyout = indexBy(await PageObjects.savedObjects.getRelationshipFlyout(), 'title');
         log.debug(
           "check that 'Shared-Item Visualization AreaChart' shows 'logstash-*' as it's Parent"
         );
@@ -68,18 +65,18 @@ export default function ({ getService, getPageObjects }) {
       });
 
       it('should provide dialog to allow the importing of saved objects with index pattern conflicts', async function () {
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_conflicts.ndjson')
         );
-        await PageObjects.settings.checkImportConflictsWarning();
+        await PageObjects.savedObjects.checkImportConflictsWarning();
         await PageObjects.settings.associateIndexPattern(
           'd1e4c910-a2e6-11e7-bb30-233be9be6a15',
           'logstash-*'
         );
-        await PageObjects.settings.clickConfirmChanges();
+        await PageObjects.savedObjects.clickConfirmChanges();
         await PageObjects.header.waitUntilLoadingHasFinished();
-        await PageObjects.settings.clickImportDone();
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        await PageObjects.savedObjects.clickImportDone();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object with index pattern conflict');
         expect(isSavedObjectImported).to.be(true);
       });
@@ -87,14 +84,14 @@ export default function ({ getService, getPageObjects }) {
       it('should allow the user to override duplicate saved objects', async function () {
         // This data has already been loaded by the "visualize" esArchive. We'll load it again
         // so that we can override the existing visualization.
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_exists.ndjson'),
           false
         );
 
-        await PageObjects.settings.checkImportConflictsWarning();
+        await PageObjects.savedObjects.checkImportConflictsWarning();
         await PageObjects.settings.associateIndexPattern('logstash-*', 'logstash-*');
-        await PageObjects.settings.clickConfirmChanges();
+        await PageObjects.savedObjects.clickConfirmChanges();
 
         // Override the visualization.
         await PageObjects.common.clickConfirmOnModal();
@@ -106,14 +103,14 @@ export default function ({ getService, getPageObjects }) {
       it('should allow the user to cancel overriding duplicate saved objects', async function () {
         // This data has already been loaded by the "visualize" esArchive. We'll load it again
         // so that we can be prompted to override the existing visualization.
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_exists.ndjson'),
           false
         );
 
-        await PageObjects.settings.checkImportConflictsWarning();
+        await PageObjects.savedObjects.checkImportConflictsWarning();
         await PageObjects.settings.associateIndexPattern('logstash-*', 'logstash-*');
-        await PageObjects.settings.clickConfirmChanges();
+        await PageObjects.savedObjects.clickConfirmChanges();
 
         // *Don't* override the visualization.
         await PageObjects.common.clickCancelOnModal();
@@ -123,86 +120,80 @@ export default function ({ getService, getPageObjects }) {
       });
 
       it('should import saved objects linked to saved searches', async function () {
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_saved_search.ndjson')
         );
-        await PageObjects.settings.checkImportSucceeded();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportSucceeded();
+        await PageObjects.savedObjects.clickImportDone();
 
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_connected_to_saved_search.ndjson')
         );
-        await PageObjects.settings.checkImportSucceeded();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportSucceeded();
+        await PageObjects.savedObjects.clickImportDone();
 
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
         expect(isSavedObjectImported).to.be(true);
       });
 
       it('should not import saved objects linked to saved searches when saved search does not exist', async function () {
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_connected_to_saved_search.ndjson')
         );
-        await PageObjects.settings.checkNoneImported();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkNoneImported();
+        await PageObjects.savedObjects.clickImportDone();
 
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
         expect(isSavedObjectImported).to.be(false);
       });
 
       it('should not import saved objects linked to saved searches when saved search index pattern does not exist', async function () {
-        const elements = indexBy(
-          await PageObjects.settings.getSavedObjectElementsInTable(),
-          'title'
-        );
+        const elements = indexBy(await PageObjects.savedObjects.getElementsInTable(), 'title');
         await elements['logstash-*'].checkbox.click();
-        await PageObjects.settings.clickSavedObjectsDelete();
+        await PageObjects.savedObjects.clickDelete();
 
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_with_saved_search.ndjson')
         );
         // Wait for all the saves to happen
-        await PageObjects.settings.checkImportConflictsWarning();
-        await PageObjects.settings.clickConfirmChanges();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportConflictsWarning();
+        await PageObjects.savedObjects.clickConfirmChanges();
+        await PageObjects.savedObjects.clickImportDone();
 
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
         expect(isSavedObjectImported).to.be(false);
       });
 
       it('should import saved objects with index patterns when index patterns already exists', async () => {
         // First, import the objects
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_with_index_patterns.ndjson')
         );
-        await PageObjects.settings.checkImportSucceeded();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportSucceeded();
+        await PageObjects.savedObjects.clickImportDone();
 
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object imported with index pattern');
         expect(isSavedObjectImported).to.be(true);
       });
 
       it('should import saved objects with index patterns when index patterns does not exists', async () => {
         // First, we need to delete the index pattern
-        const elements = indexBy(
-          await PageObjects.settings.getSavedObjectElementsInTable(),
-          'title'
-        );
+        const elements = indexBy(await PageObjects.savedObjects.getElementsInTable(), 'title');
         await elements['logstash-*'].checkbox.click();
-        await PageObjects.settings.clickSavedObjectsDelete();
+        await PageObjects.savedObjects.clickDelete();
 
         // Then, import the objects
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_with_index_patterns.ndjson')
         );
-        await PageObjects.settings.checkImportSucceeded();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportSucceeded();
+        await PageObjects.savedObjects.clickImportDone();
 
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object imported with index pattern');
         expect(isSavedObjectImported).to.be(true);
       });
@@ -222,30 +213,30 @@ export default function ({ getService, getPageObjects }) {
       });
 
       it('should import saved objects', async function () {
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects.json')
         );
-        await PageObjects.settings.checkImportSucceeded();
-        await PageObjects.settings.clickImportDone();
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        await PageObjects.savedObjects.checkImportSucceeded();
+        await PageObjects.savedObjects.clickImportDone();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('Log Agents');
         expect(isSavedObjectImported).to.be(true);
       });
 
       it('should provide dialog to allow the importing of saved objects with index pattern conflicts', async function () {
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects-conflicts.json')
         );
-        await PageObjects.settings.checkImportLegacyWarning();
-        await PageObjects.settings.checkImportConflictsWarning();
+        await PageObjects.savedObjects.checkImportLegacyWarning();
+        await PageObjects.savedObjects.checkImportConflictsWarning();
         await PageObjects.settings.associateIndexPattern(
           'd1e4c910-a2e6-11e7-bb30-233be9be6a15',
           'logstash-*'
         );
-        await PageObjects.settings.clickConfirmChanges();
+        await PageObjects.savedObjects.clickConfirmChanges();
         await PageObjects.header.waitUntilLoadingHasFinished();
-        await PageObjects.settings.clickImportDone();
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        await PageObjects.savedObjects.clickImportDone();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object with index pattern conflict');
         expect(isSavedObjectImported).to.be(true);
       });
@@ -253,15 +244,15 @@ export default function ({ getService, getPageObjects }) {
       it('should allow the user to override duplicate saved objects', async function () {
         // This data has already been loaded by the "visualize" esArchive. We'll load it again
         // so that we can override the existing visualization.
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_exists.json'),
           false
         );
 
-        await PageObjects.settings.checkImportLegacyWarning();
-        await PageObjects.settings.checkImportConflictsWarning();
+        await PageObjects.savedObjects.checkImportLegacyWarning();
+        await PageObjects.savedObjects.checkImportConflictsWarning();
         await PageObjects.settings.associateIndexPattern('logstash-*', 'logstash-*');
-        await PageObjects.settings.clickConfirmChanges();
+        await PageObjects.savedObjects.clickConfirmChanges();
 
         // Override the visualization.
         await PageObjects.common.clickConfirmOnModal();
@@ -273,15 +264,15 @@ export default function ({ getService, getPageObjects }) {
       it('should allow the user to cancel overriding duplicate saved objects', async function () {
         // This data has already been loaded by the "visualize" esArchive. We'll load it again
         // so that we can be prompted to override the existing visualization.
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_exists.json'),
           false
         );
 
-        await PageObjects.settings.checkImportLegacyWarning();
-        await PageObjects.settings.checkImportConflictsWarning();
+        await PageObjects.savedObjects.checkImportLegacyWarning();
+        await PageObjects.savedObjects.checkImportConflictsWarning();
         await PageObjects.settings.associateIndexPattern('logstash-*', 'logstash-*');
-        await PageObjects.settings.clickConfirmChanges();
+        await PageObjects.savedObjects.clickConfirmChanges();
 
         // *Don't* override the visualization.
         await PageObjects.common.clickCancelOnModal();
@@ -291,95 +282,89 @@ export default function ({ getService, getPageObjects }) {
       });
 
       it('should import saved objects linked to saved searches', async function () {
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_saved_search.json')
         );
-        await PageObjects.settings.checkImportSucceeded();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportSucceeded();
+        await PageObjects.savedObjects.clickImportDone();
 
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_connected_to_saved_search.json')
         );
-        await PageObjects.settings.checkImportSucceeded();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportSucceeded();
+        await PageObjects.savedObjects.clickImportDone();
 
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
         expect(isSavedObjectImported).to.be(true);
       });
 
       it('should not import saved objects linked to saved searches when saved search does not exist', async function () {
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_connected_to_saved_search.json')
         );
-        await PageObjects.settings.checkImportFailedWarning();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportFailedWarning();
+        await PageObjects.savedObjects.clickImportDone();
 
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
         expect(isSavedObjectImported).to.be(false);
       });
 
       it('should not import saved objects linked to saved searches when saved search index pattern does not exist', async function () {
         // First, import the saved search
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_saved_search.json')
         );
         // Wait for all the saves to happen
-        await PageObjects.settings.checkImportSucceeded();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportSucceeded();
+        await PageObjects.savedObjects.clickImportDone();
 
         // Second, we need to delete the index pattern
-        const elements = indexBy(
-          await PageObjects.settings.getSavedObjectElementsInTable(),
-          'title'
-        );
+        const elements = indexBy(await PageObjects.savedObjects.getElementsInTable(), 'title');
         await elements['logstash-*'].checkbox.click();
-        await PageObjects.settings.clickSavedObjectsDelete();
+        await PageObjects.savedObjects.clickDelete();
 
         // Last, import a saved object connected to the saved search
         // This should NOT show the conflicts
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_connected_to_saved_search.json')
         );
         // Wait for all the saves to happen
-        await PageObjects.settings.checkNoneImported();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkNoneImported();
+        await PageObjects.savedObjects.clickImportDone();
 
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
         expect(isSavedObjectImported).to.be(false);
       });
 
       it('should import saved objects with index patterns when index patterns already exists', async () => {
         // First, import the objects
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_with_index_patterns.json')
         );
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.clickImportDone();
 
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object imported with index pattern');
         expect(isSavedObjectImported).to.be(true);
       });
 
       it('should import saved objects with index patterns when index patterns does not exists', async () => {
         // First, we need to delete the index pattern
-        const elements = indexBy(
-          await PageObjects.settings.getSavedObjectElementsInTable(),
-          'title'
-        );
+        const elements = indexBy(await PageObjects.savedObjects.getElementsInTable(), 'title');
         await elements['logstash-*'].checkbox.click();
-        await PageObjects.settings.clickSavedObjectsDelete();
+        await PageObjects.savedObjects.clickDelete();
 
         // Then, import the objects
-        await PageObjects.settings.importFile(
+        await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_with_index_patterns.json')
         );
-        await PageObjects.settings.checkImportSucceeded();
-        await PageObjects.settings.clickImportDone();
+        await PageObjects.savedObjects.checkImportSucceeded();
+        await PageObjects.savedObjects.clickImportDone();
 
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
+        const objects = await PageObjects.savedObjects.getRowTitles();
         const isSavedObjectImported = objects.includes('saved object imported with index pattern');
         expect(isSavedObjectImported).to.be(true);
       });
diff --git a/test/functional/apps/management/_mgmt_import_saved_objects.js b/test/functional/apps/management/_mgmt_import_saved_objects.js
index a8a0a19d4962..3a9f8665fd33 100644
--- a/test/functional/apps/management/_mgmt_import_saved_objects.js
+++ b/test/functional/apps/management/_mgmt_import_saved_objects.js
@@ -22,7 +22,7 @@ import path from 'path';
 
 export default function ({ getService, getPageObjects }) {
   const esArchiver = getService('esArchiver');
-  const PageObjects = getPageObjects(['common', 'settings', 'header']);
+  const PageObjects = getPageObjects(['common', 'settings', 'header', 'savedObjects']);
 
   //in 6.4.0 bug the Saved Search conflict would be resolved and get imported but the visualization
   //that referenced the saved search was not imported.( https://github.com/elastic/kibana/issues/22238)
@@ -40,19 +40,19 @@ export default function ({ getService, getPageObjects }) {
 
     it('should import saved objects mgmt', async function () {
       await PageObjects.settings.clickKibanaSavedObjects();
-      await PageObjects.settings.importFile(
+      await PageObjects.savedObjects.importFile(
         path.join(__dirname, 'exports', 'mgmt_import_objects.json')
       );
       await PageObjects.settings.associateIndexPattern(
         '4c3f3c30-ac94-11e8-a651-614b2788174a',
         'logstash-*'
       );
-      await PageObjects.settings.clickConfirmChanges();
-      await PageObjects.settings.clickImportDone();
-      await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
+      await PageObjects.savedObjects.clickConfirmChanges();
+      await PageObjects.savedObjects.clickImportDone();
+      await PageObjects.savedObjects.waitTableIsLoaded();
 
       //instead of asserting on count- am asserting on the titles- which is more accurate than count.
-      const objects = await PageObjects.settings.getSavedObjectsInTable();
+      const objects = await PageObjects.savedObjects.getRowTitles();
       expect(objects.includes('mysavedsearch')).to.be(true);
       expect(objects.includes('mysavedviz')).to.be(true);
     });
diff --git a/test/functional/apps/saved_objects_management/edit_saved_object.ts b/test/functional/apps/saved_objects_management/edit_saved_object.ts
index 6e4b820879ed..2c9200c2f8d9 100644
--- a/test/functional/apps/saved_objects_management/edit_saved_object.ts
+++ b/test/functional/apps/saved_objects_management/edit_saved_object.ts
@@ -25,7 +25,7 @@ const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
 export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const testSubjects = getService('testSubjects');
-  const PageObjects = getPageObjects(['common', 'settings']);
+  const PageObjects = getPageObjects(['common', 'settings', 'savedObjects']);
   const browser = getService('browser');
   const find = getService('find');
 
@@ -79,7 +79,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
       await PageObjects.settings.navigateTo();
       await PageObjects.settings.clickKibanaSavedObjects();
 
-      let objects = await PageObjects.settings.getSavedObjectsInTable();
+      let objects = await PageObjects.savedObjects.getRowTitles();
       expect(objects.includes('A Dashboard')).to.be(true);
 
       await PageObjects.common.navigateToUrl(
@@ -99,7 +99,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
       await focusAndClickButton('savedObjectEditSave');
 
-      objects = await PageObjects.settings.getSavedObjectsInTable();
+      objects = await PageObjects.savedObjects.getRowTitles();
       expect(objects.includes('A Dashboard')).to.be(false);
       expect(objects.includes('Edited Dashboard')).to.be(true);
 
@@ -127,7 +127,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
       await focusAndClickButton('savedObjectEditDelete');
       await PageObjects.common.clickConfirmOnModal();
 
-      const objects = await PageObjects.settings.getSavedObjectsInTable();
+      const objects = await PageObjects.savedObjects.getRowTitles();
       expect(objects.includes('A Dashboard')).to.be(false);
     });
 
@@ -145,7 +145,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
       await PageObjects.settings.navigateTo();
       await PageObjects.settings.clickKibanaSavedObjects();
 
-      const objects = await PageObjects.settings.getSavedObjectsInTable();
+      const objects = await PageObjects.savedObjects.getRowTitles();
       expect(objects.includes('A Pie')).to.be(true);
 
       await PageObjects.common.navigateToUrl('management', testVisualizationUrl, {
@@ -160,7 +160,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
       await focusAndClickButton('savedObjectEditSave');
 
-      await PageObjects.settings.getSavedObjectsInTable();
+      await PageObjects.savedObjects.getRowTitles();
 
       await PageObjects.common.navigateToUrl('management', testVisualizationUrl, {
         shouldUseHashForSubUrl: false,
@@ -173,7 +173,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
       await focusAndClickButton('savedObjectEditSave');
 
-      await PageObjects.settings.getSavedObjectsInTable();
+      await PageObjects.savedObjects.getRowTitles();
 
       await PageObjects.common.navigateToUrl('management', testVisualizationUrl, {
         shouldUseHashForSubUrl: false,
diff --git a/test/functional/page_objects/index.ts b/test/functional/page_objects/index.ts
index 10b09c742f58..d3a8fb73ac3e 100644
--- a/test/functional/page_objects/index.ts
+++ b/test/functional/page_objects/index.ts
@@ -38,6 +38,7 @@ import { VisualizeChartPageProvider } from './visualize_chart_page';
 import { TileMapPageProvider } from './tile_map_page';
 import { TagCloudPageProvider } from './tag_cloud_page';
 import { VegaChartPageProvider } from './vega_chart_page';
+import { SavedObjectsPageProvider } from './management/saved_objects_page';
 
 export const pageObjects = {
   common: CommonPageProvider,
@@ -61,4 +62,5 @@ export const pageObjects = {
   tileMap: TileMapPageProvider,
   tagCloud: TagCloudPageProvider,
   vegaChart: VegaChartPageProvider,
+  savedObjects: SavedObjectsPageProvider,
 };
diff --git a/test/functional/page_objects/management/saved_objects_page.ts b/test/functional/page_objects/management/saved_objects_page.ts
new file mode 100644
index 000000000000..d058695ea681
--- /dev/null
+++ b/test/functional/page_objects/management/saved_objects_page.ts
@@ -0,0 +1,184 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { map as mapAsync } from 'bluebird';
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export function SavedObjectsPageProvider({ getService, getPageObjects }: FtrProviderContext) {
+  const log = getService('log');
+  const retry = getService('retry');
+  const browser = getService('browser');
+  const find = getService('find');
+  const testSubjects = getService('testSubjects');
+  const PageObjects = getPageObjects(['header', 'common']);
+
+  class SavedObjectsPage {
+    async searchForObject(objectName: string) {
+      const searchBox = await testSubjects.find('savedObjectSearchBar');
+      await searchBox.clearValue();
+      await searchBox.type(objectName);
+      await searchBox.pressKeys(browser.keys.ENTER);
+    }
+
+    async importFile(path: string, overwriteAll = true) {
+      log.debug(`importFile(${path})`);
+
+      log.debug(`Clicking importObjects`);
+      await testSubjects.click('importObjects');
+      await PageObjects.common.setFileInputPath(path);
+
+      if (!overwriteAll) {
+        log.debug(`Toggling overwriteAll`);
+        await testSubjects.click('importSavedObjectsOverwriteToggle');
+      } else {
+        log.debug(`Leaving overwriteAll alone`);
+      }
+      await testSubjects.click('importSavedObjectsImportBtn');
+      log.debug(`done importing the file`);
+
+      // Wait for all the saves to happen
+      await PageObjects.header.waitUntilLoadingHasFinished();
+    }
+
+    async checkImportSucceeded() {
+      await testSubjects.existOrFail('importSavedObjectsSuccess', { timeout: 20000 });
+    }
+
+    async checkNoneImported() {
+      await testSubjects.existOrFail('importSavedObjectsSuccessNoneImported', { timeout: 20000 });
+    }
+
+    async checkImportConflictsWarning() {
+      await testSubjects.existOrFail('importSavedObjectsConflictsWarning', { timeout: 20000 });
+    }
+
+    async checkImportLegacyWarning() {
+      await testSubjects.existOrFail('importSavedObjectsLegacyWarning', { timeout: 20000 });
+    }
+
+    async checkImportFailedWarning() {
+      await testSubjects.existOrFail('importSavedObjectsFailedWarning', { timeout: 20000 });
+    }
+
+    async clickImportDone() {
+      await testSubjects.click('importSavedObjectsDoneBtn');
+      await this.waitTableIsLoaded();
+    }
+
+    async clickConfirmChanges() {
+      await testSubjects.click('importSavedObjectsConfirmBtn');
+    }
+
+    async waitTableIsLoaded() {
+      return retry.try(async () => {
+        const exists = await find.existsByDisplayedByCssSelector(
+          '*[data-test-subj="savedObjectsTable"] .euiBasicTable-loading'
+        );
+        if (exists) {
+          throw new Error('Waiting');
+        }
+        return true;
+      });
+    }
+
+    async getElementsInTable() {
+      const rows = await testSubjects.findAll('~savedObjectsTableRow');
+      return mapAsync(rows, async (row) => {
+        const checkbox = await row.findByCssSelector('[data-test-subj*="checkboxSelectRow"]');
+        // return the object type aria-label="index patterns"
+        const objectType = await row.findByTestSubject('objectType');
+        const titleElement = await row.findByTestSubject('savedObjectsTableRowTitle');
+        // not all rows have inspect button - Advanced Settings objects don't
+        let inspectElement;
+        const innerHtml = await row.getAttribute('innerHTML');
+        if (innerHtml.includes('Inspect')) {
+          inspectElement = await row.findByTestSubject('savedObjectsTableAction-inspect');
+        } else {
+          inspectElement = null;
+        }
+        const relationshipsElement = await row.findByTestSubject(
+          'savedObjectsTableAction-relationships'
+        );
+        return {
+          checkbox,
+          objectType: await objectType.getAttribute('aria-label'),
+          titleElement,
+          title: await titleElement.getVisibleText(),
+          inspectElement,
+          relationshipsElement,
+        };
+      });
+    }
+
+    async getRowTitles() {
+      await this.waitTableIsLoaded();
+      const table = await testSubjects.find('savedObjectsTable');
+      const $ = await table.parseDomContent();
+      return $.findTestSubjects('savedObjectsTableRowTitle')
+        .toArray()
+        .map((cell) => $(cell).find('.euiTableCellContent').text());
+    }
+
+    async getRelationshipFlyout() {
+      const rows = await testSubjects.findAll('relationshipsTableRow');
+      return mapAsync(rows, async (row) => {
+        const objectType = await row.findByTestSubject('relationshipsObjectType');
+        const relationship = await row.findByTestSubject('directRelationship');
+        const titleElement = await row.findByTestSubject('relationshipsTitle');
+        const inspectElement = await row.findByTestSubject('relationshipsTableAction-inspect');
+        return {
+          objectType: await objectType.getAttribute('aria-label'),
+          relationship: await relationship.getVisibleText(),
+          titleElement,
+          title: await titleElement.getVisibleText(),
+          inspectElement,
+        };
+      });
+    }
+
+    async getTableSummary() {
+      const table = await testSubjects.find('savedObjectsTable');
+      const $ = await table.parseDomContent();
+      return $('tbody tr')
+        .toArray()
+        .map((row) => {
+          return {
+            title: $(row).find('td:nth-child(3) .euiTableCellContent').text(),
+            canViewInApp: Boolean($(row).find('td:nth-child(3) a').length),
+          };
+        });
+    }
+
+    async clickTableSelectAll() {
+      await testSubjects.click('checkboxSelectAll');
+    }
+
+    async canBeDeleted() {
+      return await testSubjects.isEnabled('savedObjectsManagementDelete');
+    }
+
+    async clickDelete() {
+      await testSubjects.click('savedObjectsManagementDelete');
+      await testSubjects.click('confirmModalConfirmButton');
+      await this.waitTableIsLoaded();
+    }
+  }
+
+  return new SavedObjectsPage();
+}
diff --git a/test/functional/page_objects/settings_page.ts b/test/functional/page_objects/settings_page.ts
index f5b4eb7ad5de..e491cd7e4fe4 100644
--- a/test/functional/page_objects/settings_page.ts
+++ b/test/functional/page_objects/settings_page.ts
@@ -29,7 +29,7 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
   const flyout = getService('flyout');
   const testSubjects = getService('testSubjects');
   const comboBox = getService('comboBox');
-  const PageObjects = getPageObjects(['header', 'common']);
+  const PageObjects = getPageObjects(['header', 'common', 'savedObjects']);
 
   class SettingsPage {
     async clickNavigation() {
@@ -47,7 +47,7 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
 
     async clickKibanaSavedObjects() {
       await testSubjects.click('objects');
-      await this.waitUntilSavedObjectsTableIsNotLoading();
+      await PageObjects.savedObjects.waitTableIsLoaded();
     }
 
     async clickKibanaIndexPatterns() {
@@ -68,13 +68,13 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
 
     async getAdvancedSettings(propertyName: string) {
       log.debug('in getAdvancedSettings');
-      const setting = await testSubjects.find(`advancedSetting-editField-${propertyName}`);
-      return await setting.getAttribute('value');
+      return await testSubjects.getAttribute(`advancedSetting-editField-${propertyName}`, 'value');
     }
 
     async expectDisabledAdvancedSetting(propertyName: string) {
-      const setting = await testSubjects.find(`advancedSetting-editField-${propertyName}`);
-      expect(setting.getAttribute('disabled')).to.eql('');
+      expect(
+        await testSubjects.getAttribute(`advancedSetting-editField-${propertyName}`, 'disabled')
+      ).to.eql('true');
     }
 
     async getAdvancedSettingCheckbox(propertyName: string) {
@@ -274,9 +274,7 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
     }
 
     async increasePopularity() {
-      const field = await testSubjects.find('editorFieldCount');
-      await field.clearValueWithKeyboard();
-      await field.type('1');
+      await testSubjects.setValue('editorFieldCount', '1', { clearWithKeyboard: true });
     }
 
     async getPopularity() {
@@ -499,9 +497,7 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
 
     async setScriptedFieldName(name: string) {
       log.debug('set scripted field name = ' + name);
-      const field = await testSubjects.find('editorFieldName');
-      await field.clearValue();
-      await field.type(name);
+      await testSubjects.setValue('editorFieldName', name);
     }
 
     async setScriptedFieldLanguage(language: string) {
@@ -568,9 +564,7 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
 
     async setScriptedFieldPopularity(popularity: string) {
       log.debug('set scripted field popularity = ' + popularity);
-      const field = await testSubjects.find('editorFieldCount');
-      await field.clearValue();
-      await field.type(popularity);
+      await testSubjects.setValue('editorFieldCount', popularity);
     }
 
     async setScriptedFieldScript(script: string) {
@@ -623,55 +617,6 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
       return scriptResults;
     }
 
-    async importFile(path: string, overwriteAll = true) {
-      log.debug(`importFile(${path})`);
-
-      log.debug(`Clicking importObjects`);
-      await testSubjects.click('importObjects');
-      await PageObjects.common.setFileInputPath(path);
-
-      if (!overwriteAll) {
-        log.debug(`Toggling overwriteAll`);
-        await testSubjects.click('importSavedObjectsOverwriteToggle');
-      } else {
-        log.debug(`Leaving overwriteAll alone`);
-      }
-      await testSubjects.click('importSavedObjectsImportBtn');
-      log.debug(`done importing the file`);
-
-      // Wait for all the saves to happen
-      await PageObjects.header.waitUntilLoadingHasFinished();
-    }
-
-    async checkImportSucceeded() {
-      await testSubjects.existOrFail('importSavedObjectsSuccess', { timeout: 20000 });
-    }
-
-    async checkNoneImported() {
-      await testSubjects.existOrFail('importSavedObjectsSuccessNoneImported', { timeout: 20000 });
-    }
-
-    async checkImportConflictsWarning() {
-      await testSubjects.existOrFail('importSavedObjectsConflictsWarning', { timeout: 20000 });
-    }
-
-    async checkImportLegacyWarning() {
-      await testSubjects.existOrFail('importSavedObjectsLegacyWarning', { timeout: 20000 });
-    }
-
-    async checkImportFailedWarning() {
-      await testSubjects.existOrFail('importSavedObjectsFailedWarning', { timeout: 20000 });
-    }
-
-    async clickImportDone() {
-      await testSubjects.click('importSavedObjectsDoneBtn');
-      await this.waitUntilSavedObjectsTableIsNotLoading();
-    }
-
-    async clickConfirmChanges() {
-      await testSubjects.click('importSavedObjectsConfirmBtn');
-    }
-
     async clickEditFieldFormat() {
       await testSubjects.click('editFieldFormat');
     }
@@ -686,112 +631,6 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
     async clickChangeIndexConfirmButton() {
       await testSubjects.click('changeIndexConfirmButton');
     }
-
-    async waitUntilSavedObjectsTableIsNotLoading() {
-      return retry.try(async () => {
-        const exists = await find.existsByDisplayedByCssSelector(
-          '*[data-test-subj="savedObjectsTable"] .euiBasicTable-loading'
-        );
-        if (exists) {
-          throw new Error('Waiting');
-        }
-        return true;
-      });
-    }
-
-    async getSavedObjectElementsInTable() {
-      const rows = await testSubjects.findAll('~savedObjectsTableRow');
-      return mapAsync(rows, async (row) => {
-        const checkbox = await row.findByCssSelector('[data-test-subj*="checkboxSelectRow"]');
-        // return the object type aria-label="index patterns"
-        const objectType = await row.findByTestSubject('objectType');
-        const titleElement = await row.findByTestSubject('savedObjectsTableRowTitle');
-        // not all rows have inspect button - Advanced Settings objects don't
-        let inspectElement;
-        const innerHtml = await row.getAttribute('innerHTML');
-        if (innerHtml.includes('Inspect')) {
-          inspectElement = await row.findByTestSubject('savedObjectsTableAction-inspect');
-        } else {
-          inspectElement = null;
-        }
-        const relationshipsElement = await row.findByTestSubject(
-          'savedObjectsTableAction-relationships'
-        );
-        return {
-          checkbox,
-          objectType: await objectType.getAttribute('aria-label'),
-          titleElement,
-          title: await titleElement.getVisibleText(),
-          inspectElement,
-          relationshipsElement,
-        };
-      });
-    }
-
-    async getSavedObjectsInTable() {
-      const table = await testSubjects.find('savedObjectsTable');
-      const cells = await table.findAllByTestSubject('savedObjectsTableRowTitle');
-
-      const objects = [];
-      for (const cell of cells) {
-        objects.push(await cell.getVisibleText());
-      }
-
-      return objects;
-    }
-
-    async getRelationshipFlyout() {
-      const rows = await testSubjects.findAll('relationshipsTableRow');
-      return mapAsync(rows, async (row) => {
-        const objectType = await row.findByTestSubject('relationshipsObjectType');
-        const relationship = await row.findByTestSubject('directRelationship');
-        const titleElement = await row.findByTestSubject('relationshipsTitle');
-        const inspectElement = await row.findByTestSubject('relationshipsTableAction-inspect');
-        return {
-          objectType: await objectType.getAttribute('aria-label'),
-          relationship: await relationship.getVisibleText(),
-          titleElement,
-          title: await titleElement.getVisibleText(),
-          inspectElement,
-        };
-      });
-    }
-
-    async getSavedObjectsTableSummary() {
-      const table = await testSubjects.find('savedObjectsTable');
-      const rows = await table.findAllByCssSelector('tbody tr');
-
-      const summary = [];
-      for (const row of rows) {
-        const titleCell = await row.findByCssSelector('td:nth-child(3)');
-        const title = await titleCell.getVisibleText();
-
-        const viewInAppButtons = await row.findAllByCssSelector('td:nth-child(3) a');
-        const canViewInApp = Boolean(viewInAppButtons.length);
-        summary.push({
-          title,
-          canViewInApp,
-        });
-      }
-
-      return summary;
-    }
-
-    async clickSavedObjectsTableSelectAll() {
-      const checkboxSelectAll = await testSubjects.find('checkboxSelectAll');
-      await checkboxSelectAll.click();
-    }
-
-    async canSavedObjectsBeDeleted() {
-      const deleteButton = await testSubjects.find('savedObjectsManagementDelete');
-      return await deleteButton.isEnabled();
-    }
-
-    async clickSavedObjectsDelete() {
-      await testSubjects.click('savedObjectsManagementDelete');
-      await testSubjects.click('confirmModalConfirmButton');
-      await this.waitUntilSavedObjectsTableIsNotLoading();
-    }
   }
 
   return new SettingsPage();
diff --git a/x-pack/test/functional/apps/saved_objects_management/feature_controls/saved_objects_management_security.ts b/x-pack/test/functional/apps/saved_objects_management/feature_controls/saved_objects_management_security.ts
index 9969608bd2a4..819d03d81194 100644
--- a/x-pack/test/functional/apps/saved_objects_management/feature_controls/saved_objects_management_security.ts
+++ b/x-pack/test/functional/apps/saved_objects_management/feature_controls/saved_objects_management_security.ts
@@ -10,7 +10,14 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const security = getService('security');
   const testSubjects = getService('testSubjects');
-  const PageObjects = getPageObjects(['common', 'settings', 'security', 'error', 'header']);
+  const PageObjects = getPageObjects([
+    'common',
+    'settings',
+    'security',
+    'error',
+    'header',
+    'savedObjects',
+  ]);
   let version: string = '';
 
   describe('feature controls saved objects management', () => {
@@ -66,7 +73,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         });
 
         it('shows all saved objects', async () => {
-          const objects = await PageObjects.settings.getSavedObjectsInTable();
+          const objects = await PageObjects.savedObjects.getRowTitles();
           expect(objects).to.eql([
             'Advanced Settings [6.0.0]',
             `Advanced Settings [${version}]`,
@@ -77,7 +84,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         });
 
         it('can view all saved objects in applications', async () => {
-          const bools = await PageObjects.settings.getSavedObjectsTableSummary();
+          const bools = await PageObjects.savedObjects.getTableSummary();
           expect(bools).to.eql([
             {
               title: 'Advanced Settings [6.0.0]',
@@ -103,8 +110,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         });
 
         it('can delete all saved objects', async () => {
-          await PageObjects.settings.clickSavedObjectsTableSelectAll();
-          const actual = await PageObjects.settings.canSavedObjectsBeDeleted();
+          await PageObjects.savedObjects.clickTableSelectAll();
+          const actual = await PageObjects.savedObjects.canBeDeleted();
           expect(actual).to.be(true);
         });
       });
@@ -185,7 +192,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         });
 
         it('shows all saved objects', async () => {
-          const objects = await PageObjects.settings.getSavedObjectsInTable();
+          const objects = await PageObjects.savedObjects.getRowTitles();
           expect(objects).to.eql([
             'Advanced Settings [6.0.0]',
             `Advanced Settings [${version}]`,
@@ -196,7 +203,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         });
 
         it('cannot view any saved objects in applications', async () => {
-          const bools = await PageObjects.settings.getSavedObjectsTableSummary();
+          const bools = await PageObjects.savedObjects.getTableSummary();
           expect(bools).to.eql([
             {
               title: 'Advanced Settings [6.0.0]',
@@ -222,8 +229,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         });
 
         it(`can't delete all saved objects`, async () => {
-          await PageObjects.settings.clickSavedObjectsTableSelectAll();
-          const actual = await PageObjects.settings.canSavedObjectsBeDeleted();
+          await PageObjects.savedObjects.clickTableSelectAll();
+          const actual = await PageObjects.savedObjects.canBeDeleted();
           expect(actual).to.be(false);
         });
       });
diff --git a/x-pack/test/functional/page_objects/copy_saved_objects_to_space_page.ts b/x-pack/test/functional/page_objects/copy_saved_objects_to_space_page.ts
index 69e79d63d5fd..03596aa68dbc 100644
--- a/x-pack/test/functional/page_objects/copy_saved_objects_to_space_page.ts
+++ b/x-pack/test/functional/page_objects/copy_saved_objects_to_space_page.ts
@@ -10,21 +10,17 @@ function extractCountFromSummary(str: string) {
   return parseInt(str.split('\n')[1], 10);
 }
 
-export function CopySavedObjectsToSpacePageProvider({ getService }: FtrProviderContext) {
+export function CopySavedObjectsToSpacePageProvider({
+  getService,
+  getPageObjects,
+}: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
-  const browser = getService('browser');
   const find = getService('find');
+  const { savedObjects } = getPageObjects(['savedObjects']);
 
   return {
-    async searchForObject(objectName: string) {
-      const searchBox = await testSubjects.find('savedObjectSearchBar');
-      await searchBox.clearValue();
-      await searchBox.type(objectName);
-      await searchBox.pressKeys(browser.keys.ENTER);
-    },
-
     async openCopyToSpaceFlyoutForObject(objectName: string) {
-      await this.searchForObject(objectName);
+      await savedObjects.searchForObject(objectName);
 
       // Click action button to show context menu
       await find.clickByCssSelector(

From 1c9c0fc339e7b5533b7294f5204ea5c5513c98a5 Mon Sep 17 00:00:00 2001
From: MadameSheema <snootchie.boochies@gmail.com>
Date: Fri, 26 Jun 2020 19:58:51 +0200
Subject: [PATCH 56/78] renames SIEM to Security Solution (#70070)

---
 test/scripts/jenkins_xpack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/scripts/jenkins_xpack.sh b/test/scripts/jenkins_xpack.sh
index 067ed213c49f..bc927b1ed7b4 100755
--- a/test/scripts/jenkins_xpack.sh
+++ b/test/scripts/jenkins_xpack.sh
@@ -15,9 +15,9 @@ if [[ -z "$CODE_COVERAGE" ]] ; then
   echo ""
   echo ""
 
-  echo " -> Running SIEM cyclic dependency test"
+  echo " -> Running Security Solution cyclic dependency test"
   cd "$XPACK_DIR"
-  checks-reporter-with-killswitch "X-Pack SIEM cyclic dependency test" node plugins/security_solution/scripts/check_circular_deps
+  checks-reporter-with-killswitch "X-Pack Security Solution cyclic dependency test" node plugins/security_solution/scripts/check_circular_deps
   echo ""
   echo ""
 

From 497dfc7af3bd300f311ab7063aca9e19159c6ac9 Mon Sep 17 00:00:00 2001
From: CJ Cenizal <cj@cenizal.com>
Date: Fri, 26 Jun 2020 10:59:59 -0700
Subject: [PATCH 57/78] Add API integration test for deleting data streams.
 (#70020)

---
 .../index_management/data_streams.ts          | 160 ++++++++++++------
 1 file changed, 106 insertions(+), 54 deletions(-)

diff --git a/x-pack/test/api_integration/apis/management/index_management/data_streams.ts b/x-pack/test/api_integration/apis/management/index_management/data_streams.ts
index e1756df42ca2..74ab59f2ffdc 100644
--- a/x-pack/test/api_integration/apis/management/index_management/data_streams.ts
+++ b/x-pack/test/api_integration/apis/management/index_management/data_streams.ts
@@ -19,79 +19,131 @@ export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const es = getService('legacyEs');
 
-  const createDataStream = (name: string) => {
+  const createDataStream = async (name: string) => {
     // A data stream requires an index template before it can be created.
-    return es.dataManagement
-      .saveComposableIndexTemplate({
-        name,
-        body: {
-          // We need to match the names of backing indices with this template
-          index_patterns: [name + '*'],
-          template: {
-            mappings: {
-              properties: {
-                '@timestamp': {
-                  type: 'date',
-                },
+    await es.dataManagement.saveComposableIndexTemplate({
+      name,
+      body: {
+        // We need to match the names of backing indices with this template.
+        index_patterns: [name + '*'],
+        template: {
+          mappings: {
+            properties: {
+              '@timestamp': {
+                type: 'date',
               },
             },
           },
-          data_stream: {
-            timestamp_field: '@timestamp',
-          },
         },
-      })
-      .then(() =>
-        es.dataManagement.createDataStream({
-          name,
-        })
-      );
+        data_stream: {
+          timestamp_field: '@timestamp',
+        },
+      },
+    });
+
+    await es.dataManagement.createDataStream({ name });
   };
 
-  const deleteDataStream = (name: string) => {
-    return es.dataManagement
-      .deleteDataStream({
-        name,
-      })
-      .then(() =>
-        es.dataManagement.deleteComposableIndexTemplate({
-          name,
-        })
-      );
+  const deleteComposableIndexTemplate = async (name: string) => {
+    await es.dataManagement.deleteComposableIndexTemplate({ name });
   };
 
-  // Unskip once ES snapshot has been promoted that updates the data stream response
-  describe.skip('Data streams', function () {
-    const testDataStreamName = 'test-data-stream';
+  const deleteDataStream = async (name: string) => {
+    await es.dataManagement.deleteDataStream({ name });
+    await deleteComposableIndexTemplate(name);
+  };
 
+  describe('Data streams', function () {
     describe('Get', () => {
+      const testDataStreamName = 'test-data-stream';
+
       before(async () => await createDataStream(testDataStreamName));
       after(async () => await deleteDataStream(testDataStreamName));
 
-      describe('all data streams', () => {
-        it('returns an array of data streams', async () => {
-          const { body: dataStreams } = await supertest
-            .get(`${API_BASE_PATH}/data_streams`)
-            .set('kbn-xsrf', 'xxx')
-            .expect(200);
+      it('returns an array of all data streams', async () => {
+        const { body: dataStreams } = await supertest
+          .get(`${API_BASE_PATH}/data_streams`)
+          .set('kbn-xsrf', 'xxx')
+          .expect(200);
+
+        // ES determines these values so we'll just echo them back.
+        const { name: indexName, uuid } = dataStreams[0].indices[0];
+        expect(dataStreams).to.eql([
+          {
+            name: testDataStreamName,
+            timeStampField: { name: '@timestamp', mapping: { type: 'date' } },
+            indices: [
+              {
+                name: indexName,
+                uuid,
+              },
+            ],
+            generation: 1,
+          },
+        ]);
+      });
+
+      it('returns a single data stream by ID', async () => {
+        const { body: dataStream } = await supertest
+          .get(`${API_BASE_PATH}/data_streams/${testDataStreamName}`)
+          .set('kbn-xsrf', 'xxx')
+          .expect(200);
 
-          // ES determines these values so we'll just echo them back.
-          const { name: indexName, uuid } = dataStreams[0].indices[0];
-          expect(dataStreams).to.eql([
+        // ES determines these values so we'll just echo them back.
+        const { name: indexName, uuid } = dataStream.indices[0];
+        expect(dataStream).to.eql({
+          name: testDataStreamName,
+          timeStampField: { name: '@timestamp', mapping: { type: 'date' } },
+          indices: [
             {
-              name: testDataStreamName,
-              timeStampField: { name: '@timestamp', mapping: { type: 'date' } },
-              indices: [
-                {
-                  name: indexName,
-                  uuid,
-                },
-              ],
-              generation: 1,
+              name: indexName,
+              uuid,
             },
-          ]);
+          ],
+          generation: 1,
         });
       });
     });
+
+    describe('Delete', () => {
+      const testDataStreamName1 = 'test-data-stream1';
+      const testDataStreamName2 = 'test-data-stream2';
+
+      before(async () => {
+        await Promise.all([
+          createDataStream(testDataStreamName1),
+          createDataStream(testDataStreamName2),
+        ]);
+      });
+
+      after(async () => {
+        // The Delete API only deletes the data streams, so we still need to manually delete their
+        // related index patterns to clean up.
+        await Promise.all([
+          deleteComposableIndexTemplate(testDataStreamName1),
+          deleteComposableIndexTemplate(testDataStreamName2),
+        ]);
+      });
+
+      it('deletes multiple data streams', async () => {
+        await supertest
+          .post(`${API_BASE_PATH}/delete_data_streams`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            dataStreams: [testDataStreamName1, testDataStreamName2],
+          })
+          .expect(200);
+
+        await supertest
+          .get(`${API_BASE_PATH}/data_streams/${testDataStreamName1}`)
+          .set('kbn-xsrf', 'xxx')
+          .expect(404);
+
+        await supertest
+          .get(`${API_BASE_PATH}/data_streams/${testDataStreamName2}`)
+          .set('kbn-xsrf', 'xxx')
+          .expect(404);
+      });
+    });
   });
 }

From 8aa2206e04ff59c9ea651a5257232aa52b00ff52 Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Fri, 26 Jun 2020 12:12:35 -0600
Subject: [PATCH 58/78] [Maps] remove indexing state from redux (#69765)

* [Maps] remove indexing state from redux

* add indexing step

* tslint

* tslint fixes

* tslint item

* clear preview when file changes

* review feedback

* use prevState instead of this.state in setState

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../plugins/maps/public/actions/ui_actions.ts |  10 +-
 .../classes/layers/layer_wizard_registry.ts   |  20 +-
 .../create_client_file_source_editor.js       |  29 ---
 .../create_client_file_source_editor.tsx      | 160 +++++++++++++
 .../upload_layer_wizard.tsx                   | 111 ++-------
 .../flyout_body/flyout_body.tsx               |  18 +-
 .../add_layer_panel/flyout_body/index.ts      |  13 +-
 .../add_layer_panel/flyout_footer/index.ts    |  32 ---
 .../add_layer_panel/flyout_footer/view.tsx    |  65 -----
 .../add_layer_panel/index.ts                  |  19 +-
 .../add_layer_panel/view.tsx                  | 225 +++++++++++-------
 x-pack/plugins/maps/public/reducers/ui.ts     |  12 -
 .../maps/public/selectors/ui_selectors.ts     |   4 +-
 .../translations/translations/ja-JP.json      |   3 -
 .../translations/translations/zh-CN.json      |   3 -
 15 files changed, 356 insertions(+), 368 deletions(-)
 delete mode 100644 x-pack/plugins/maps/public/classes/sources/client_file_source/create_client_file_source_editor.js
 create mode 100644 x-pack/plugins/maps/public/classes/sources/client_file_source/create_client_file_source_editor.tsx
 delete mode 100644 x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_footer/index.ts
 delete mode 100644 x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_footer/view.tsx

diff --git a/x-pack/plugins/maps/public/actions/ui_actions.ts b/x-pack/plugins/maps/public/actions/ui_actions.ts
index eaf6cf42eb73..8f2650beb012 100644
--- a/x-pack/plugins/maps/public/actions/ui_actions.ts
+++ b/x-pack/plugins/maps/public/actions/ui_actions.ts
@@ -7,7 +7,7 @@
 import { Dispatch } from 'redux';
 import { MapStoreState } from '../reducers/store';
 import { getFlyoutDisplay } from '../selectors/ui_selectors';
-import { FLYOUT_STATE, INDEXING_STAGE } from '../reducers/ui';
+import { FLYOUT_STATE } from '../reducers/ui';
 import { trackMapSettings } from './map_actions';
 import { setSelectedLayer } from './layer_actions';
 
@@ -20,7 +20,6 @@ export const SET_READ_ONLY = 'SET_READ_ONLY';
 export const SET_OPEN_TOC_DETAILS = 'SET_OPEN_TOC_DETAILS';
 export const SHOW_TOC_DETAILS = 'SHOW_TOC_DETAILS';
 export const HIDE_TOC_DETAILS = 'HIDE_TOC_DETAILS';
-export const UPDATE_INDEXING_STAGE = 'UPDATE_INDEXING_STAGE';
 
 export function exitFullScreen() {
   return {
@@ -95,10 +94,3 @@ export function hideTOCDetails(layerId: string) {
     layerId,
   };
 }
-
-export function updateIndexingStage(stage: INDEXING_STAGE | null) {
-  return {
-    type: UPDATE_INDEXING_STAGE,
-    stage,
-  };
-}
diff --git a/x-pack/plugins/maps/public/classes/layers/layer_wizard_registry.ts b/x-pack/plugins/maps/public/classes/layers/layer_wizard_registry.ts
index a255ffb00e31..0eb1d2c3b222 100644
--- a/x-pack/plugins/maps/public/classes/layers/layer_wizard_registry.ts
+++ b/x-pack/plugins/maps/public/classes/layers/layer_wizard_registry.ts
@@ -10,14 +10,18 @@ import { LayerDescriptor } from '../../../common/descriptor_types';
 import { LAYER_WIZARD_CATEGORY } from '../../../common/constants';
 
 export type RenderWizardArguments = {
-  previewLayers: (layerDescriptors: LayerDescriptor[], isIndexingSource?: boolean) => void;
+  previewLayers: (layerDescriptors: LayerDescriptor[]) => void;
   mapColors: string[];
-  // upload arguments
-  isIndexingTriggered: boolean;
-  onRemove: () => void;
-  onIndexReady: (indexReady: boolean) => void;
-  importSuccessHandler: (indexResponses: unknown) => void;
-  importErrorHandler: (indexResponses: unknown) => void;
+  // multi-step arguments for wizards that supply 'prerequisiteSteps'
+  currentStepId: string | null;
+  enableNextBtn: () => void;
+  disableNextBtn: () => void;
+  startStepLoading: () => void;
+  stopStepLoading: () => void;
+  // Typically, next step will be triggered via user clicking next button.
+  // However, this method is made available to trigger next step manually
+  // for async task completion that triggers the next step.
+  advanceToNextStep: () => void;
 };
 
 export type LayerWizard = {
@@ -25,7 +29,7 @@ export type LayerWizard = {
   checkVisibility?: () => Promise<boolean>;
   description: string;
   icon: string;
-  isIndexingSource?: boolean;
+  prerequisiteSteps?: Array<{ id: string; label: string }>;
   renderWizard(renderWizardArguments: RenderWizardArguments): ReactElement<any>;
   title: string;
 };
diff --git a/x-pack/plugins/maps/public/classes/sources/client_file_source/create_client_file_source_editor.js b/x-pack/plugins/maps/public/classes/sources/client_file_source/create_client_file_source_editor.js
deleted file mode 100644
index f9bfc4ddde91..000000000000
--- a/x-pack/plugins/maps/public/classes/sources/client_file_source/create_client_file_source_editor.js
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { getFileUploadComponent } from '../../../kibana_services';
-
-export function ClientFileCreateSourceEditor({
-  previewGeojsonFile,
-  isIndexingTriggered = false,
-  onIndexingComplete,
-  onRemove,
-  onIndexReady,
-}) {
-  const FileUpload = getFileUploadComponent();
-  return (
-    <FileUpload
-      appName={'Maps'}
-      isIndexingTriggered={isIndexingTriggered}
-      onFileUpload={previewGeojsonFile}
-      onFileRemove={onRemove}
-      onIndexReady={onIndexReady}
-      transformDetails={'geo'}
-      onIndexingComplete={onIndexingComplete}
-    />
-  );
-}
diff --git a/x-pack/plugins/maps/public/classes/sources/client_file_source/create_client_file_source_editor.tsx b/x-pack/plugins/maps/public/classes/sources/client_file_source/create_client_file_source_editor.tsx
new file mode 100644
index 000000000000..344bdc92489e
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/sources/client_file_source/create_client_file_source_editor.tsx
@@ -0,0 +1,160 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { Component } from 'react';
+import { IFieldType } from 'src/plugins/data/public';
+import {
+  ES_GEO_FIELD_TYPE,
+  DEFAULT_MAX_RESULT_WINDOW,
+  SCALING_TYPES,
+} from '../../../../common/constants';
+import { getFileUploadComponent } from '../../../kibana_services';
+// @ts-ignore
+import { GeojsonFileSource } from './geojson_file_source';
+import { VectorLayer } from '../../layers/vector_layer/vector_layer';
+// @ts-ignore
+import { createDefaultLayerDescriptor } from '../es_search_source';
+import { RenderWizardArguments } from '../../layers/layer_wizard_registry';
+
+export const INDEX_SETUP_STEP_ID = 'INDEX_SETUP_STEP_ID';
+export const INDEXING_STEP_ID = 'INDEXING_STEP_ID';
+
+enum INDEXING_STAGE {
+  READY = 'READY',
+  TRIGGERED = 'TRIGGERED',
+  SUCCESS = 'SUCCESS',
+  ERROR = 'ERROR',
+}
+
+interface State {
+  indexingStage: INDEXING_STAGE | null;
+}
+
+export class ClientFileCreateSourceEditor extends Component<RenderWizardArguments, State> {
+  private _isMounted: boolean = false;
+
+  state = {
+    indexingStage: null,
+  };
+
+  componentDidMount() {
+    this._isMounted = true;
+  }
+
+  componentWillUnmount() {
+    this._isMounted = false;
+  }
+
+  componentDidUpdate() {
+    if (
+      this.props.currentStepId === INDEXING_STEP_ID &&
+      this.state.indexingStage === INDEXING_STAGE.READY
+    ) {
+      this.setState({ indexingStage: INDEXING_STAGE.TRIGGERED });
+      this.props.startStepLoading();
+    }
+  }
+
+  _onFileUpload = (geojsonFile: unknown, name: string) => {
+    if (!this._isMounted) {
+      return;
+    }
+
+    if (!geojsonFile) {
+      this.props.previewLayers([]);
+      return;
+    }
+
+    const sourceDescriptor = GeojsonFileSource.createDescriptor(geojsonFile, name);
+    const layerDescriptor = VectorLayer.createDescriptor(
+      { sourceDescriptor },
+      this.props.mapColors
+    );
+    this.props.previewLayers([layerDescriptor]);
+  };
+
+  _onIndexingComplete = (indexResponses: { indexDataResp: unknown; indexPatternResp: unknown }) => {
+    if (!this._isMounted) {
+      return;
+    }
+
+    this.props.advanceToNextStep();
+
+    const { indexDataResp, indexPatternResp } = indexResponses;
+
+    // @ts-ignore
+    const indexCreationFailed = !(indexDataResp && indexDataResp.success);
+    // @ts-ignore
+    const allDocsFailed = indexDataResp.failures.length === indexDataResp.docCount;
+    // @ts-ignore
+    const indexPatternCreationFailed = !(indexPatternResp && indexPatternResp.success);
+    if (indexCreationFailed || allDocsFailed || indexPatternCreationFailed) {
+      this.setState({ indexingStage: INDEXING_STAGE.ERROR });
+      return;
+    }
+
+    // @ts-ignore
+    const { fields, id: indexPatternId } = indexPatternResp;
+    const geoField = fields.find((field: IFieldType) =>
+      [ES_GEO_FIELD_TYPE.GEO_POINT as string, ES_GEO_FIELD_TYPE.GEO_SHAPE as string].includes(
+        field.type
+      )
+    );
+    if (!indexPatternId || !geoField) {
+      this.setState({ indexingStage: INDEXING_STAGE.ERROR });
+      this.props.previewLayers([]);
+    } else {
+      const esSearchSourceConfig = {
+        indexPatternId,
+        geoField: geoField.name,
+        // Only turn on bounds filter for large doc counts
+        // @ts-ignore
+        filterByMapBounds: indexDataResp.docCount > DEFAULT_MAX_RESULT_WINDOW,
+        scalingType:
+          geoField.type === ES_GEO_FIELD_TYPE.GEO_POINT
+            ? SCALING_TYPES.CLUSTERS
+            : SCALING_TYPES.LIMIT,
+      };
+      this.setState({ indexingStage: INDEXING_STAGE.SUCCESS });
+      this.props.previewLayers([
+        createDefaultLayerDescriptor(esSearchSourceConfig, this.props.mapColors),
+      ]);
+    }
+  };
+
+  // Called on file upload screen when UI state changes
+  _onIndexReady = (indexReady: boolean) => {
+    if (!this._isMounted) {
+      return;
+    }
+    this.setState({ indexingStage: indexReady ? INDEXING_STAGE.READY : null });
+    if (indexReady) {
+      this.props.enableNextBtn();
+    } else {
+      this.props.disableNextBtn();
+    }
+  };
+
+  // Called on file upload screen when upload file is changed or removed
+  _onFileRemove = () => {
+    this.props.previewLayers([]);
+  };
+
+  render() {
+    const FileUpload = getFileUploadComponent();
+    return (
+      <FileUpload
+        appName={'Maps'}
+        isIndexingTriggered={this.state.indexingStage === INDEXING_STAGE.TRIGGERED}
+        onFileUpload={this._onFileUpload}
+        onFileRemove={this._onFileRemove}
+        onIndexReady={this._onIndexReady}
+        transformDetails={'geo'}
+        onIndexingComplete={this._onIndexingComplete}
+      />
+    );
+  }
+}
diff --git a/x-pack/plugins/maps/public/classes/sources/client_file_source/upload_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/client_file_source/upload_layer_wizard.tsx
index 0a224f75b981..05b4b18eb3ed 100644
--- a/x-pack/plugins/maps/public/classes/sources/client_file_source/upload_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/client_file_source/upload_layer_wizard.tsx
@@ -6,102 +6,37 @@
 
 import { i18n } from '@kbn/i18n';
 import React from 'react';
-import { IFieldType } from 'src/plugins/data/public';
-import {
-  ES_GEO_FIELD_TYPE,
-  DEFAULT_MAX_RESULT_WINDOW,
-  SCALING_TYPES,
-} from '../../../../common/constants';
-// @ts-ignore
-import { createDefaultLayerDescriptor } from '../es_search_source';
 import { LayerWizard, RenderWizardArguments } from '../../layers/layer_wizard_registry';
-// @ts-ignore
-import { ClientFileCreateSourceEditor } from './create_client_file_source_editor';
-// @ts-ignore
-import { GeojsonFileSource } from './geojson_file_source';
-import { VectorLayer } from '../../layers/vector_layer/vector_layer';
+import {
+  ClientFileCreateSourceEditor,
+  INDEX_SETUP_STEP_ID,
+  INDEXING_STEP_ID,
+} from './create_client_file_source_editor';
 
 export const uploadLayerWizardConfig: LayerWizard = {
   categories: [],
-  description: i18n.translate('xpack.maps.source.geojsonFileDescription', {
+  description: i18n.translate('xpack.maps.fileUploadWizard.description', {
     defaultMessage: 'Index GeoJSON data in Elasticsearch',
   }),
   icon: 'importAction',
-  isIndexingSource: true,
-  renderWizard: ({
-    previewLayers,
-    mapColors,
-    isIndexingTriggered,
-    onRemove,
-    onIndexReady,
-    importSuccessHandler,
-    importErrorHandler,
-  }: RenderWizardArguments) => {
-    function previewGeojsonFile(geojsonFile: unknown, name: string) {
-      if (!geojsonFile) {
-        previewLayers([]);
-        return;
-      }
-      const sourceDescriptor = GeojsonFileSource.createDescriptor(geojsonFile, name);
-      const layerDescriptor = VectorLayer.createDescriptor({ sourceDescriptor }, mapColors);
-      // TODO figure out a better way to handle passing this information back to layer_addpanel
-      previewLayers([layerDescriptor], true);
-    }
-
-    function viewIndexedData(indexResponses: {
-      indexDataResp: unknown;
-      indexPatternResp: unknown;
-    }) {
-      const { indexDataResp, indexPatternResp } = indexResponses;
-
-      // @ts-ignore
-      const indexCreationFailed = !(indexDataResp && indexDataResp.success);
-      // @ts-ignore
-      const allDocsFailed = indexDataResp.failures.length === indexDataResp.docCount;
-      // @ts-ignore
-      const indexPatternCreationFailed = !(indexPatternResp && indexPatternResp.success);
-
-      if (indexCreationFailed || allDocsFailed || indexPatternCreationFailed) {
-        importErrorHandler(indexResponses);
-        return;
-      }
-      // @ts-ignore
-      const { fields, id: indexPatternId } = indexPatternResp;
-      const geoField = fields.find((field: IFieldType) =>
-        [ES_GEO_FIELD_TYPE.GEO_POINT as string, ES_GEO_FIELD_TYPE.GEO_SHAPE as string].includes(
-          field.type
-        )
-      );
-      if (!indexPatternId || !geoField) {
-        previewLayers([]);
-      } else {
-        const esSearchSourceConfig = {
-          indexPatternId,
-          geoField: geoField.name,
-          // Only turn on bounds filter for large doc counts
-          // @ts-ignore
-          filterByMapBounds: indexDataResp.docCount > DEFAULT_MAX_RESULT_WINDOW,
-          scalingType:
-            geoField.type === ES_GEO_FIELD_TYPE.GEO_POINT
-              ? SCALING_TYPES.CLUSTERS
-              : SCALING_TYPES.LIMIT,
-        };
-        previewLayers([createDefaultLayerDescriptor(esSearchSourceConfig, mapColors)]);
-        importSuccessHandler(indexResponses);
-      }
-    }
-
-    return (
-      <ClientFileCreateSourceEditor
-        previewGeojsonFile={previewGeojsonFile}
-        isIndexingTriggered={isIndexingTriggered}
-        onIndexingComplete={viewIndexedData}
-        onRemove={onRemove}
-        onIndexReady={onIndexReady}
-      />
-    );
+  prerequisiteSteps: [
+    {
+      id: INDEX_SETUP_STEP_ID,
+      label: i18n.translate('xpack.maps.fileUploadWizard.importFileSetupLabel', {
+        defaultMessage: 'Import file',
+      }),
+    },
+    {
+      id: INDEXING_STEP_ID,
+      label: i18n.translate('xpack.maps.fileUploadWizard.indexingLabel', {
+        defaultMessage: 'Importing file',
+      }),
+    },
+  ],
+  renderWizard: (renderWizardArguments: RenderWizardArguments) => {
+    return <ClientFileCreateSourceEditor {...renderWizardArguments} />;
   },
-  title: i18n.translate('xpack.maps.source.geojsonFileTitle', {
+  title: i18n.translate('xpack.maps.fileUploadWizard.title', {
     defaultMessage: 'Upload GeoJSON',
   }),
 };
diff --git a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/flyout_body.tsx b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/flyout_body.tsx
index b287064938ce..38474b84114f 100644
--- a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/flyout_body.tsx
+++ b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/flyout_body.tsx
@@ -15,25 +15,27 @@ type Props = RenderWizardArguments & {
   layerWizard: LayerWizard | null;
   onClear: () => void;
   onWizardSelect: (layerWizard: LayerWizard) => void;
+  showBackButton: boolean;
 };
 
 export const FlyoutBody = (props: Props) => {
   function renderContent() {
-    if (!props.layerWizard) {
+    if (!props.layerWizard || !props.currentStepId) {
       return <LayerWizardSelect onSelect={props.onWizardSelect} />;
     }
 
     const renderWizardArgs = {
       previewLayers: props.previewLayers,
       mapColors: props.mapColors,
-      isIndexingTriggered: props.isIndexingTriggered,
-      onRemove: props.onRemove,
-      onIndexReady: props.onIndexReady,
-      importSuccessHandler: props.importSuccessHandler,
-      importErrorHandler: props.importErrorHandler,
+      currentStepId: props.currentStepId,
+      enableNextBtn: props.enableNextBtn,
+      disableNextBtn: props.disableNextBtn,
+      startStepLoading: props.startStepLoading,
+      stopStepLoading: props.stopStepLoading,
+      advanceToNextStep: props.advanceToNextStep,
     };
 
-    const backButton = props.isIndexingTriggered ? null : (
+    const backButton = props.showBackButton ? (
       <Fragment>
         <EuiButtonEmpty size="xs" flush="left" onClick={props.onClear} iconType="arrowLeft">
           <FormattedMessage
@@ -43,7 +45,7 @@ export const FlyoutBody = (props: Props) => {
         </EuiButtonEmpty>
         <EuiSpacer size="s" />
       </Fragment>
-    );
+    ) : null;
 
     return (
       <Fragment>
diff --git a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/index.ts b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/index.ts
index d285c8ddebf3..2cc35abdb53e 100644
--- a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/index.ts
+++ b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/index.ts
@@ -6,25 +6,14 @@
 
 import { connect } from 'react-redux';
 import { FlyoutBody } from './flyout_body';
-import { INDEXING_STAGE } from '../../../reducers/ui';
-import { updateIndexingStage } from '../../../actions';
-import { getIndexingStage } from '../../../selectors/ui_selectors';
 import { MapStoreState } from '../../../reducers/store';
 import { getMapColors } from '../../../selectors/map_selectors';
 
 function mapStateToProps(state: MapStoreState) {
   return {
-    isIndexingTriggered: getIndexingStage(state) === INDEXING_STAGE.TRIGGERED,
     mapColors: getMapColors(state),
   };
 }
 
-const mapDispatchToProps = {
-  onIndexReady: (indexReady: boolean) =>
-    indexReady ? updateIndexingStage(INDEXING_STAGE.READY) : updateIndexingStage(null),
-  importSuccessHandler: () => updateIndexingStage(INDEXING_STAGE.SUCCESS),
-  importErrorHandler: () => updateIndexingStage(INDEXING_STAGE.ERROR),
-};
-
-const connected = connect(mapStateToProps, mapDispatchToProps)(FlyoutBody);
+const connected = connect(mapStateToProps, {})(FlyoutBody);
 export { connected as FlyoutBody };
diff --git a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_footer/index.ts b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_footer/index.ts
deleted file mode 100644
index 470e83f2d809..000000000000
--- a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_footer/index.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { AnyAction, Dispatch } from 'redux';
-import { connect } from 'react-redux';
-import { FlyoutFooter } from './view';
-import { hasPreviewLayers, isLoadingPreviewLayers } from '../../../selectors/map_selectors';
-import { removePreviewLayers, updateFlyout } from '../../../actions';
-import { MapStoreState } from '../../../reducers/store';
-import { FLYOUT_STATE } from '../../../reducers/ui';
-
-function mapStateToProps(state: MapStoreState) {
-  return {
-    hasPreviewLayers: hasPreviewLayers(state),
-    isLoading: isLoadingPreviewLayers(state),
-  };
-}
-
-function mapDispatchToProps(dispatch: Dispatch<AnyAction>) {
-  return {
-    closeFlyout: () => {
-      dispatch(updateFlyout(FLYOUT_STATE.NONE));
-      dispatch<any>(removePreviewLayers());
-    },
-  };
-}
-
-const connectedFlyOut = connect(mapStateToProps, mapDispatchToProps)(FlyoutFooter);
-export { connectedFlyOut as FlyoutFooter };
diff --git a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_footer/view.tsx b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_footer/view.tsx
deleted file mode 100644
index 2e122324c50f..000000000000
--- a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_footer/view.tsx
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiFlyoutFooter,
-  EuiButtonEmpty,
-  EuiButton,
-} from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
-
-interface Props {
-  onClick: () => void;
-  showNextButton: boolean;
-  disableNextButton: boolean;
-  nextButtonText: string;
-  closeFlyout: () => void;
-  hasPreviewLayers: boolean;
-  isLoading: boolean;
-}
-
-export const FlyoutFooter = ({
-  onClick,
-  showNextButton,
-  disableNextButton,
-  nextButtonText,
-  closeFlyout,
-  hasPreviewLayers,
-  isLoading,
-}: Props) => {
-  const nextButton = showNextButton ? (
-    <EuiButton
-      data-test-subj="importFileButton"
-      disabled={disableNextButton || !hasPreviewLayers || isLoading}
-      isLoading={isLoading}
-      iconSide="right"
-      iconType={'sortRight'}
-      onClick={onClick}
-      fill
-    >
-      {nextButtonText}
-    </EuiButton>
-  ) : null;
-
-  return (
-    <EuiFlyoutFooter className="mapLayerPanel__footer">
-      <EuiFlexGroup justifyContent="spaceBetween" responsive={false}>
-        <EuiFlexItem grow={false}>
-          <EuiButtonEmpty onClick={closeFlyout} flush="left" data-test-subj="layerAddCancelButton">
-            <FormattedMessage
-              id="xpack.maps.addLayerPanel.footer.cancelButtonLabel"
-              defaultMessage="Cancel"
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>{nextButton}</EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiFlyoutFooter>
-  );
-};
diff --git a/x-pack/plugins/maps/public/connected_components/add_layer_panel/index.ts b/x-pack/plugins/maps/public/connected_components/add_layer_panel/index.ts
index 5527733f5571..8b5dc2a0e50b 100644
--- a/x-pack/plugins/maps/public/connected_components/add_layer_panel/index.ts
+++ b/x-pack/plugins/maps/public/connected_components/add_layer_panel/index.ts
@@ -7,25 +7,22 @@
 import { AnyAction, Dispatch } from 'redux';
 import { connect } from 'react-redux';
 import { AddLayerPanel } from './view';
-import { FLYOUT_STATE, INDEXING_STAGE } from '../../reducers/ui';
-import { getFlyoutDisplay, getIndexingStage } from '../../selectors/ui_selectors';
+import { FLYOUT_STATE } from '../../reducers/ui';
 import {
   addPreviewLayers,
   promotePreviewLayers,
+  removePreviewLayers,
   setFirstPreviewLayerToSelectedLayer,
   updateFlyout,
-  updateIndexingStage,
 } from '../../actions';
 import { MapStoreState } from '../../reducers/store';
 import { LayerDescriptor } from '../../../common/descriptor_types';
+import { hasPreviewLayers, isLoadingPreviewLayers } from '../../selectors/map_selectors';
 
 function mapStateToProps(state: MapStoreState) {
-  const indexingStage = getIndexingStage(state);
   return {
-    flyoutVisible: getFlyoutDisplay(state) !== FLYOUT_STATE.NONE,
-    isIndexingTriggered: indexingStage === INDEXING_STAGE.TRIGGERED,
-    isIndexingSuccess: indexingStage === INDEXING_STAGE.SUCCESS,
-    isIndexingReady: indexingStage === INDEXING_STAGE.READY,
+    hasPreviewLayers: hasPreviewLayers(state),
+    isLoadingPreviewLayers: isLoadingPreviewLayers(state),
   };
 }
 
@@ -39,8 +36,10 @@ function mapDispatchToProps(dispatch: Dispatch<AnyAction>) {
       dispatch(updateFlyout(FLYOUT_STATE.LAYER_PANEL));
       dispatch<any>(promotePreviewLayers());
     },
-    setIndexingTriggered: () => dispatch(updateIndexingStage(INDEXING_STAGE.TRIGGERED)),
-    resetIndexing: () => dispatch(updateIndexingStage(null)),
+    closeFlyout: () => {
+      dispatch(updateFlyout(FLYOUT_STATE.NONE));
+      dispatch<any>(removePreviewLayers());
+    },
   };
 }
 
diff --git a/x-pack/plugins/maps/public/connected_components/add_layer_panel/view.tsx b/x-pack/plugins/maps/public/connected_components/add_layer_panel/view.tsx
index c1b6dcc1e12a..e2529fff66f3 100644
--- a/x-pack/plugins/maps/public/connected_components/add_layer_panel/view.tsx
+++ b/x-pack/plugins/maps/public/connected_components/add_layer_panel/view.tsx
@@ -4,141 +4,194 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { Component, Fragment } from 'react';
-import { EuiTitle, EuiFlyoutHeader } from '@elastic/eui';
+import React, { Component } from 'react';
+import {
+  EuiTitle,
+  EuiFlyoutHeader,
+  EuiFlyoutFooter,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButton,
+  EuiButtonEmpty,
+} from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { FlyoutFooter } from './flyout_footer';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { FlyoutBody } from './flyout_body';
 import { LayerDescriptor } from '../../../common/descriptor_types';
 import { LayerWizard } from '../../classes/layers/layer_wizard_registry';
 
+const ADD_LAYER_STEP_ID = 'ADD_LAYER_STEP_ID';
+const ADD_LAYER_STEP_LABEL = i18n.translate('xpack.maps.addLayerPanel.addLayer', {
+  defaultMessage: 'Add layer',
+});
+const SELECT_WIZARD_LABEL = ADD_LAYER_STEP_LABEL;
+
 interface Props {
-  flyoutVisible: boolean;
-  isIndexingReady: boolean;
-  isIndexingSuccess: boolean;
-  isIndexingTriggered: boolean;
   addPreviewLayers: (layerDescriptors: LayerDescriptor[]) => void;
+  closeFlyout: () => void;
+  hasPreviewLayers: boolean;
+  isLoadingPreviewLayers: boolean;
   promotePreviewLayers: () => void;
-  resetIndexing: () => void;
-  setIndexingTriggered: () => void;
 }
 
 interface State {
-  importView: boolean;
-  isIndexingSource: boolean;
-  layerImportAddReady: boolean;
+  currentStepIndex: number;
+  currentStep: { id: string; label: string } | null;
+  layerSteps: Array<{ id: string; label: string }> | null;
   layerWizard: LayerWizard | null;
+  isNextStepBtnEnabled: boolean;
+  isStepLoading: boolean;
 }
 
-export class AddLayerPanel extends Component<Props, State> {
-  private _isMounted: boolean = false;
+const INITIAL_STATE: State = {
+  currentStepIndex: 0,
+  currentStep: null,
+  layerSteps: null,
+  layerWizard: null,
+  isNextStepBtnEnabled: false,
+  isStepLoading: false,
+};
 
+export class AddLayerPanel extends Component<Props, State> {
   state = {
-    layerWizard: null,
-    isIndexingSource: false,
-    importView: false,
-    layerImportAddReady: false,
+    ...INITIAL_STATE,
   };
 
-  componentDidMount() {
-    this._isMounted = true;
-  }
-
-  componentWillUnmount() {
-    this._isMounted = false;
-  }
-
-  componentDidUpdate() {
-    if (!this.state.layerImportAddReady && this.props.isIndexingSuccess) {
-      this.setState({ layerImportAddReady: true });
-    }
-  }
+  _previewLayers = (layerDescriptors: LayerDescriptor[]) => {
+    this.props.addPreviewLayers(layerDescriptors);
+  };
 
-  _previewLayers = (layerDescriptors: LayerDescriptor[], isIndexingSource?: boolean) => {
-    if (!this._isMounted) {
-      return;
-    }
+  _clearLayerWizard = () => {
+    this.setState(INITIAL_STATE);
+    this.props.addPreviewLayers([]);
+  };
 
-    this.setState({ isIndexingSource: layerDescriptors.length ? !!isIndexingSource : false });
-    this.props.addPreviewLayers(layerDescriptors);
+  _onWizardSelect = (layerWizard: LayerWizard) => {
+    const layerSteps = [
+      ...(layerWizard.prerequisiteSteps ? layerWizard.prerequisiteSteps : []),
+      {
+        id: ADD_LAYER_STEP_ID,
+        label: ADD_LAYER_STEP_LABEL,
+      },
+    ];
+    this.setState({
+      ...INITIAL_STATE,
+      layerWizard,
+      layerSteps,
+      currentStep: layerSteps[0],
+    });
   };
 
-  _clearLayerData = ({ keepSourceType = false }: { keepSourceType: boolean }) => {
-    if (!this._isMounted) {
+  _onNext = () => {
+    if (!this.state.layerSteps) {
       return;
     }
 
-    const newState: Partial<State> = {
-      isIndexingSource: false,
-    };
-    if (!keepSourceType) {
-      newState.layerWizard = null;
-      newState.importView = false;
+    if (this.state.layerSteps.length - 1 === this.state.currentStepIndex) {
+      // last step
+      this.props.promotePreviewLayers();
+    } else {
+      this.setState((prevState) => {
+        const nextIndex = prevState.currentStepIndex + 1;
+        return {
+          currentStepIndex: nextIndex,
+          currentStep: prevState.layerSteps![nextIndex],
+          isNextStepBtnEnabled: false,
+          isStepLoading: false,
+        };
+      });
     }
-    // @ts-ignore
-    this.setState(newState);
+  };
 
-    this.props.addPreviewLayers([]);
+  _enableNextBtn = () => {
+    this.setState({ isNextStepBtnEnabled: true });
   };
 
-  _onWizardSelect = (layerWizard: LayerWizard) => {
-    this.setState({ layerWizard, importView: !!layerWizard.isIndexingSource });
+  _disableNextBtn = () => {
+    this.setState({ isNextStepBtnEnabled: false });
   };
 
-  _layerAddHandler = () => {
-    if (this.state.isIndexingSource && !this.props.isIndexingTriggered) {
-      this.props.setIndexingTriggered();
-    } else {
-      this.props.promotePreviewLayers();
-      if (this.state.importView) {
-        this.setState({
-          layerImportAddReady: false,
-        });
-        this.props.resetIndexing();
-      }
-    }
+  _startStepLoading = () => {
+    this.setState({ isStepLoading: true });
   };
 
-  render() {
-    if (!this.props.flyoutVisible) {
+  _stopStepLoading = () => {
+    this.setState({ isStepLoading: false });
+  };
+
+  _renderNextButton() {
+    if (!this.state.currentStep) {
       return null;
     }
 
-    const panelDescription =
-      this.state.layerImportAddReady || !this.state.importView
-        ? i18n.translate('xpack.maps.addLayerPanel.addLayer', {
-            defaultMessage: 'Add layer',
-          })
-        : i18n.translate('xpack.maps.addLayerPanel.importFile', {
-            defaultMessage: 'Import file',
-          });
-    const isNextBtnEnabled = this.state.importView
-      ? this.props.isIndexingReady || this.props.isIndexingSuccess
-      : true;
+    let isDisabled = !this.state.isNextStepBtnEnabled;
+    let isLoading = this.state.isStepLoading;
+    if (this.state.currentStep.id === ADD_LAYER_STEP_ID) {
+      isDisabled = !this.props.hasPreviewLayers;
+      isLoading = this.props.isLoadingPreviewLayers;
+    } else {
+      isDisabled = !this.state.isNextStepBtnEnabled;
+      isLoading = this.state.isStepLoading;
+    }
 
     return (
-      <Fragment>
+      <EuiFlexItem grow={false}>
+        <EuiButton
+          data-test-subj="importFileButton"
+          disabled={isDisabled || isLoading}
+          isLoading={isLoading}
+          iconSide="right"
+          iconType={'sortRight'}
+          onClick={this._onNext}
+          fill
+        >
+          {this.state.currentStep.label}
+        </EuiButton>
+      </EuiFlexItem>
+    );
+  }
+
+  render() {
+    return (
+      <>
         <EuiFlyoutHeader hasBorder className="mapLayerPanel__header">
           <EuiTitle size="s">
-            <h2>{panelDescription}</h2>
+            <h2>{this.state.currentStep ? this.state.currentStep.label : SELECT_WIZARD_LABEL}</h2>
           </EuiTitle>
         </EuiFlyoutHeader>
 
         <FlyoutBody
           layerWizard={this.state.layerWizard}
-          onClear={() => this._clearLayerData({ keepSourceType: false })}
-          onRemove={() => this._clearLayerData({ keepSourceType: true })}
+          onClear={this._clearLayerWizard}
           onWizardSelect={this._onWizardSelect}
           previewLayers={this._previewLayers}
+          showBackButton={!this.state.isStepLoading}
+          currentStepId={this.state.currentStep ? this.state.currentStep.id : null}
+          enableNextBtn={this._enableNextBtn}
+          disableNextBtn={this._disableNextBtn}
+          startStepLoading={this._startStepLoading}
+          stopStepLoading={this._stopStepLoading}
+          advanceToNextStep={this._onNext}
         />
 
-        <FlyoutFooter
-          showNextButton={!!this.state.layerWizard}
-          disableNextButton={!isNextBtnEnabled}
-          onClick={this._layerAddHandler}
-          nextButtonText={panelDescription}
-        />
-      </Fragment>
+        <EuiFlyoutFooter className="mapLayerPanel__footer">
+          <EuiFlexGroup justifyContent="spaceBetween" responsive={false}>
+            <EuiFlexItem grow={false}>
+              <EuiButtonEmpty
+                onClick={this.props.closeFlyout}
+                flush="left"
+                data-test-subj="layerAddCancelButton"
+              >
+                <FormattedMessage
+                  id="xpack.maps.addLayerPanel.footer.cancelButtonLabel"
+                  defaultMessage="Cancel"
+                />
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+            {this._renderNextButton()}
+          </EuiFlexGroup>
+        </EuiFlyoutFooter>
+      </>
     );
   }
 }
diff --git a/x-pack/plugins/maps/public/reducers/ui.ts b/x-pack/plugins/maps/public/reducers/ui.ts
index ff521c92568b..2ea0798d1e76 100644
--- a/x-pack/plugins/maps/public/reducers/ui.ts
+++ b/x-pack/plugins/maps/public/reducers/ui.ts
@@ -15,7 +15,6 @@ import {
   SET_OPEN_TOC_DETAILS,
   SHOW_TOC_DETAILS,
   HIDE_TOC_DETAILS,
-  UPDATE_INDEXING_STAGE,
 } from '../actions';
 
 export enum FLYOUT_STATE {
@@ -25,13 +24,6 @@ export enum FLYOUT_STATE {
   MAP_SETTINGS_PANEL = 'MAP_SETTINGS_PANEL',
 }
 
-export enum INDEXING_STAGE {
-  READY = 'READY',
-  TRIGGERED = 'TRIGGERED',
-  SUCCESS = 'SUCCESS',
-  ERROR = 'ERROR',
-}
-
 export type MapUiState = {
   flyoutDisplay: FLYOUT_STATE;
   isFullScreen: boolean;
@@ -39,7 +31,6 @@ export type MapUiState = {
   isLayerTOCOpen: boolean;
   isSetViewOpen: boolean;
   openTOCDetails: string[];
-  importIndexingStage: INDEXING_STAGE | null;
 };
 
 export const DEFAULT_IS_LAYER_TOC_OPEN = true;
@@ -53,7 +44,6 @@ export const DEFAULT_MAP_UI_STATE = {
   // storing TOC detail visibility outside of map.layerList because its UI state and not map rendering state.
   // This also makes for easy read/write access for embeddables.
   openTOCDetails: [],
-  importIndexingStage: null,
 };
 
 // Reducer
@@ -85,8 +75,6 @@ export function ui(state: MapUiState = DEFAULT_MAP_UI_STATE, action: any) {
           return layerId !== action.layerId;
         }),
       };
-    case UPDATE_INDEXING_STAGE:
-      return { ...state, importIndexingStage: action.stage };
     default:
       return state;
   }
diff --git a/x-pack/plugins/maps/public/selectors/ui_selectors.ts b/x-pack/plugins/maps/public/selectors/ui_selectors.ts
index 32d4beeb381d..a87fc60ec43e 100644
--- a/x-pack/plugins/maps/public/selectors/ui_selectors.ts
+++ b/x-pack/plugins/maps/public/selectors/ui_selectors.ts
@@ -6,7 +6,7 @@
 
 import { MapStoreState } from '../reducers/store';
 
-import { FLYOUT_STATE, INDEXING_STAGE } from '../reducers/ui';
+import { FLYOUT_STATE } from '../reducers/ui';
 
 export const getFlyoutDisplay = ({ ui }: MapStoreState): FLYOUT_STATE => ui.flyoutDisplay;
 export const getIsSetViewOpen = ({ ui }: MapStoreState): boolean => ui.isSetViewOpen;
@@ -14,5 +14,3 @@ export const getIsLayerTOCOpen = ({ ui }: MapStoreState): boolean => ui.isLayerT
 export const getOpenTOCDetails = ({ ui }: MapStoreState): string[] => ui.openTOCDetails;
 export const getIsFullScreen = ({ ui }: MapStoreState): boolean => ui.isFullScreen;
 export const getIsReadOnly = ({ ui }: MapStoreState): boolean => ui.isReadOnly;
-export const getIndexingStage = ({ ui }: MapStoreState): INDEXING_STAGE | null =>
-  ui.importIndexingStage;
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index ab7215ef923a..e6e9111e6b43 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -8925,7 +8925,6 @@
     "xpack.maps.addLayerPanel.addLayer": "レイヤーを追加",
     "xpack.maps.addLayerPanel.changeDataSourceButtonLabel": "レイヤーを変更",
     "xpack.maps.addLayerPanel.footer.cancelButtonLabel": "キャンセル",
-    "xpack.maps.addLayerPanel.importFile": "ファイルのインポート",
     "xpack.maps.aggs.defaultCountLabel": "カウント",
     "xpack.maps.appTitle": "マップ",
     "xpack.maps.blendedVectorLayer.clusteredLayerName": "クラスター化 {displayName}",
@@ -9216,8 +9215,6 @@
     "xpack.maps.source.esSource.requestFailedErrorMessage": "Elasticsearch 検索リクエストに失敗。エラー: {message}",
     "xpack.maps.source.esSource.stylePropsMetaRequestDescription": "シンボル化バンドを計算するために使用されるフィールドメタデータを取得するElasticsearchリクエスト。",
     "xpack.maps.source.esSource.stylePropsMetaRequestName": "{layerName} - メタデータ",
-    "xpack.maps.source.geojsonFileDescription": "ElasticsearchでGeoJSONデータにインデックスします",
-    "xpack.maps.source.geojsonFileTitle": "GeoJSONをアップロード",
     "xpack.maps.source.kbnRegionMap.noConfigErrorMessage": "{name} の map.regionmap 構成が見つかりません",
     "xpack.maps.source.kbnRegionMap.noLayerAvailableHelptext": "ベクターレイヤーが利用できません。システム管理者に、kibana.yml で「map.regionmap」を設定するよう依頼してください。",
     "xpack.maps.source.kbnRegionMap.vectorLayerLabel": "ベクターレイヤー",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index a72b79c3ae0c..7086b48290c7 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -8929,7 +8929,6 @@
     "xpack.maps.addLayerPanel.addLayer": "添加图层",
     "xpack.maps.addLayerPanel.changeDataSourceButtonLabel": "更改图层",
     "xpack.maps.addLayerPanel.footer.cancelButtonLabel": "鍙栨秷",
-    "xpack.maps.addLayerPanel.importFile": "导入文件",
     "xpack.maps.aggs.defaultCountLabel": "计数",
     "xpack.maps.appTitle": "Maps",
     "xpack.maps.blendedVectorLayer.clusteredLayerName": "集群 {displayName}",
@@ -9220,8 +9219,6 @@
     "xpack.maps.source.esSource.requestFailedErrorMessage": "Elasticsearch 搜索请求失败，错误：{message}",
     "xpack.maps.source.esSource.stylePropsMetaRequestDescription": "检索用于计算符号化带的字段元数据的 Elasticsearch 请求。",
     "xpack.maps.source.esSource.stylePropsMetaRequestName": "{layerName} - 元数据",
-    "xpack.maps.source.geojsonFileDescription": "在 Elasticsearch 索引 GeoJSON 文件",
-    "xpack.maps.source.geojsonFileTitle": "上传 GeoJSON",
     "xpack.maps.source.kbnRegionMap.noConfigErrorMessage": "找不到 {name} 的 map.regionmap 配置",
     "xpack.maps.source.kbnRegionMap.noLayerAvailableHelptext": "没有可用的矢量图层。让您的系统管理员在 kibana.yml 中设置“map.regionmap”。",
     "xpack.maps.source.kbnRegionMap.vectorLayerLabel": "矢量图层",

From e4043b736b800fade10ab80b03aeb7b0292e0540 Mon Sep 17 00:00:00 2001
From: Yara Tercero <yctercero@users.noreply.github.com>
Date: Fri, 26 Jun 2020 14:15:35 -0400
Subject: [PATCH 59/78] [SIEM][Exceptions] - Cleaned up and updated exception
 list item comment structure (#69532)

### Summary

This PR is a follow up to #68864 . That PR used a partial to differentiate between new and existing comments, this meant that comments could be updated when they shouldn't. It was decided in our discussion of exception list schemas that comments should be append only. This PR assures that's the case, but also leaves it open to editing comments (via API). It checks to make sure that users can only update their own comments.
---
 .../create_exception_list_item_schema.test.ts |  54 ++-
 .../create_exception_list_item_schema.ts      |   6 +-
 .../update_exception_list_item_schema.ts      |   8 +-
 .../common/schemas/types/comments.mock.ts     |  21 +-
 .../common/schemas/types/comments.test.ts     | 217 +++++++++
 .../lists/common/schemas/types/comments.ts    |  32 +-
 .../schemas/types/create_comments.mock.ts     |  12 +
 .../schemas/types/create_comments.test.ts     | 134 ++++++
 .../common/schemas/types/create_comments.ts   |  18 +
 .../types/default_comments_array.test.ts      |  68 +++
 .../schemas/types/default_comments_array.ts   |  29 +-
 .../default_create_comments_array.test.ts     |  66 +++
 .../types/default_create_comments_array.ts    |  28 ++
 .../default_update_comments_array.test.ts     |  70 +++
 .../types/default_update_comments_array.ts    |  28 ++
 .../lists/common/schemas/types/index.ts       |   8 +-
 .../schemas/types/update_comments.mock.ts     |  14 +
 .../schemas/types/update_comments.test.ts     | 108 +++++
 .../common/schemas/types/update_comments.ts   |  14 +
 .../lists/public/exceptions/api.test.ts       |   2 +-
 x-pack/plugins/lists/public/exceptions/api.ts |   2 +-
 .../server/saved_objects/exception_list.ts    |   6 +
 .../updates/simple_update_item.json           |   9 +-
 .../create_exception_list_item.ts             |   9 +-
 .../exception_list_client_types.ts            |   7 +-
 .../update_exception_list_item.ts             |  13 +-
 .../services/exception_lists/utils.test.ts    | 437 ++++++++++++++++++
 .../server/services/exception_lists/utils.ts  | 106 ++++-
 .../components/exceptions/helpers.test.tsx    |  10 +-
 .../common/components/exceptions/helpers.tsx  |   5 +-
 .../common/components/exceptions/types.ts     |   6 -
 .../exception_item/exception_details.test.tsx |  14 +-
 .../viewer/exception_item/index.stories.tsx   |   6 +-
 .../viewer/exception_item/index.test.tsx      |   6 +-
 .../public/lists_plugin_deps.ts               |   1 +
 35 files changed, 1437 insertions(+), 137 deletions(-)
 create mode 100644 x-pack/plugins/lists/common/schemas/types/comments.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/create_comments.mock.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/create_comments.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/create_comments.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/default_create_comments_array.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/default_update_comments_array.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/update_comments.mock.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/update_comments.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/update_comments.ts
 create mode 100644 x-pack/plugins/lists/server/services/exception_lists/utils.test.ts

diff --git a/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts
index ccafe70406ec..34551b74d8c9 100644
--- a/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts
@@ -8,6 +8,9 @@ import { left } from 'fp-ts/lib/Either';
 import { pipe } from 'fp-ts/lib/pipeable';
 
 import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+import { getCreateCommentsArrayMock } from '../types/create_comments.mock';
+import { getCommentsMock } from '../types/comments.mock';
+import { CommentsArray } from '../types';
 
 import {
   CreateExceptionListItemSchema,
@@ -26,7 +29,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual(payload);
   });
 
-  test('it should not accept an undefined for "description"', () => {
+  test('it should not validate an undefined for "description"', () => {
     const payload = getCreateExceptionListItemSchemaMock();
     delete payload.description;
     const decoded = createExceptionListItemSchema.decode(payload);
@@ -38,7 +41,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual({});
   });
 
-  test('it should not accept an undefined for "name"', () => {
+  test('it should not validate an undefined for "name"', () => {
     const payload = getCreateExceptionListItemSchemaMock();
     delete payload.name;
     const decoded = createExceptionListItemSchema.decode(payload);
@@ -50,7 +53,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual({});
   });
 
-  test('it should not accept an undefined for "type"', () => {
+  test('it should not validate an undefined for "type"', () => {
     const payload = getCreateExceptionListItemSchemaMock();
     delete payload.type;
     const decoded = createExceptionListItemSchema.decode(payload);
@@ -62,7 +65,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual({});
   });
 
-  test('it should not accept an undefined for "list_id"', () => {
+  test('it should not validate an undefined for "list_id"', () => {
     const inputPayload = getCreateExceptionListItemSchemaMock();
     delete inputPayload.list_id;
     const decoded = createExceptionListItemSchema.decode(inputPayload);
@@ -74,7 +77,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual({});
   });
 
-  test('it should accept an undefined for "meta" but strip it out and generate a correct body not counting the auto generated uuid', () => {
+  test('it should validate an undefined for "meta" but strip it out and generate a correct body not counting the auto generated uuid', () => {
     const payload = getCreateExceptionListItemSchemaMock();
     const outputPayload = getCreateExceptionListItemSchemaMock();
     delete payload.meta;
@@ -87,7 +90,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual(outputPayload);
   });
 
-  test('it should accept an undefined for "comments" but return an array and generate a correct body not counting the auto generated uuid', () => {
+  test('it should validate an undefined for "comments" but return an array and generate a correct body not counting the auto generated uuid', () => {
     const inputPayload = getCreateExceptionListItemSchemaMock();
     const outputPayload = getCreateExceptionListItemSchemaMock();
     delete inputPayload.comments;
@@ -100,7 +103,34 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual(outputPayload);
   });
 
-  test('it should accept an undefined for "entries" but return an array', () => {
+  test('it should validate "comments" array', () => {
+    const inputPayload = {
+      ...getCreateExceptionListItemSchemaMock(),
+      comments: getCreateCommentsArrayMock(),
+    };
+    const decoded = createExceptionListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete (message.schema as CreateExceptionListItemSchema).item_id;
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(inputPayload);
+  });
+
+  test('it should NOT validate "comments" with "created_at" or "created_by" values', () => {
+    const inputPayload: Omit<CreateExceptionListItemSchema, 'comments'> & {
+      comments?: CommentsArray;
+    } = {
+      ...getCreateExceptionListItemSchemaMock(),
+      comments: [getCommentsMock()],
+    };
+    const decoded = createExceptionListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "created_at,created_by"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should validate an undefined for "entries" but return an array', () => {
     const inputPayload = getCreateExceptionListItemSchemaMock();
     const outputPayload = getCreateExceptionListItemSchemaMock();
     delete inputPayload.entries;
@@ -113,7 +143,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual(outputPayload);
   });
 
-  test('it should accept an undefined for "namespace_type" but return enum "single" and generate a correct body not counting the auto generated uuid', () => {
+  test('it should validate an undefined for "namespace_type" but return enum "single" and generate a correct body not counting the auto generated uuid', () => {
     const inputPayload = getCreateExceptionListItemSchemaMock();
     const outputPayload = getCreateExceptionListItemSchemaMock();
     delete inputPayload.namespace_type;
@@ -126,7 +156,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual(outputPayload);
   });
 
-  test('it should accept an undefined for "tags" but return an array and generate a correct body not counting the auto generated uuid', () => {
+  test('it should validate an undefined for "tags" but return an array and generate a correct body not counting the auto generated uuid', () => {
     const inputPayload = getCreateExceptionListItemSchemaMock();
     const outputPayload = getCreateExceptionListItemSchemaMock();
     delete inputPayload.tags;
@@ -139,7 +169,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual(outputPayload);
   });
 
-  test('it should accept an undefined for "_tags" but return an array and generate a correct body not counting the auto generated uuid', () => {
+  test('it should validate an undefined for "_tags" but return an array and generate a correct body not counting the auto generated uuid', () => {
     const inputPayload = getCreateExceptionListItemSchemaMock();
     const outputPayload = getCreateExceptionListItemSchemaMock();
     delete inputPayload._tags;
@@ -152,7 +182,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual(outputPayload);
   });
 
-  test('it should accept an undefined for "item_id" and auto generate a uuid', () => {
+  test('it should validate an undefined for "item_id" and auto generate a uuid', () => {
     const inputPayload = getCreateExceptionListItemSchemaMock();
     delete inputPayload.item_id;
     const decoded = createExceptionListItemSchema.decode(inputPayload);
@@ -164,7 +194,7 @@ describe('create_exception_list_item_schema', () => {
     );
   });
 
-  test('it should accept an undefined for "item_id" and generate a correct body not counting the uuid', () => {
+  test('it should validate an undefined for "item_id" and generate a correct body not counting the uuid', () => {
     const inputPayload = getCreateExceptionListItemSchemaMock();
     delete inputPayload.item_id;
     const decoded = createExceptionListItemSchema.decode(inputPayload);
diff --git a/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts b/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts
index f593b5d16403..fb452ac89576 100644
--- a/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts
@@ -23,7 +23,7 @@ import {
   tags,
 } from '../common/schemas';
 import { Identity, RequiredKeepUndefined } from '../../types';
-import { CommentsPartialArray, DefaultCommentsPartialArray, DefaultEntryArray } from '../types';
+import { CreateCommentsArray, DefaultCreateCommentsArray, DefaultEntryArray } from '../types';
 import { EntriesArray } from '../types/entries';
 import { DefaultUuid } from '../../siem_common_deps';
 
@@ -39,7 +39,7 @@ export const createExceptionListItemSchema = t.intersection([
   t.exact(
     t.partial({
       _tags, // defaults to empty array if not set during decode
-      comments: DefaultCommentsPartialArray, // defaults to empty array if not set during decode
+      comments: DefaultCreateCommentsArray, // defaults to empty array if not set during decode
       entries: DefaultEntryArray, // defaults to empty array if not set during decode
       item_id: DefaultUuid, // defaults to GUID (uuid v4) if not set during decode
       meta, // defaults to undefined if not set during decode
@@ -63,7 +63,7 @@ export type CreateExceptionListItemSchemaDecoded = Identity<
     '_tags' | 'tags' | 'item_id' | 'entries' | 'namespace_type' | 'comments'
   > & {
     _tags: _Tags;
-    comments: CommentsPartialArray;
+    comments: CreateCommentsArray;
     tags: Tags;
     item_id: ItemId;
     entries: EntriesArray;
diff --git a/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts b/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts
index c32b15fecb57..582fabdc160f 100644
--- a/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts
@@ -23,10 +23,10 @@ import {
 } from '../common/schemas';
 import { Identity, RequiredKeepUndefined } from '../../types';
 import {
-  CommentsPartialArray,
-  DefaultCommentsPartialArray,
   DefaultEntryArray,
+  DefaultUpdateCommentsArray,
   EntriesArray,
+  UpdateCommentsArray,
 } from '../types';
 
 export const updateExceptionListItemSchema = t.intersection([
@@ -40,7 +40,7 @@ export const updateExceptionListItemSchema = t.intersection([
   t.exact(
     t.partial({
       _tags, // defaults to empty array if not set during decode
-      comments: DefaultCommentsPartialArray, // defaults to empty array if not set during decode
+      comments: DefaultUpdateCommentsArray, // defaults to empty array if not set during decode
       entries: DefaultEntryArray, // defaults to empty array if not set during decode
       id, // defaults to undefined if not set during decode
       item_id: t.union([t.string, t.undefined]),
@@ -65,7 +65,7 @@ export type UpdateExceptionListItemSchemaDecoded = Identity<
     '_tags' | 'tags' | 'entries' | 'namespace_type' | 'comments'
   > & {
     _tags: _Tags;
-    comments: CommentsPartialArray;
+    comments: UpdateCommentsArray;
     tags: Tags;
     entries: EntriesArray;
     namespace_type: NamespaceType;
diff --git a/x-pack/plugins/lists/common/schemas/types/comments.mock.ts b/x-pack/plugins/lists/common/schemas/types/comments.mock.ts
index ee58fafe074c..9e56ac292f8b 100644
--- a/x-pack/plugins/lists/common/schemas/types/comments.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/types/comments.mock.ts
@@ -6,17 +6,12 @@
 
 import { DATE_NOW, USER } from '../../constants.mock';
 
-import { CommentsArray } from './comments';
+import { Comments, CommentsArray } from './comments';
 
-export const getCommentsMock = (): CommentsArray => [
-  {
-    comment: 'some comment',
-    created_at: DATE_NOW,
-    created_by: USER,
-  },
-  {
-    comment: 'some other comment',
-    created_at: DATE_NOW,
-    created_by: 'lily',
-  },
-];
+export const getCommentsMock = (): Comments => ({
+  comment: 'some old comment',
+  created_at: DATE_NOW,
+  created_by: USER,
+});
+
+export const getCommentsArrayMock = (): CommentsArray => [getCommentsMock(), getCommentsMock()];
diff --git a/x-pack/plugins/lists/common/schemas/types/comments.test.ts b/x-pack/plugins/lists/common/schemas/types/comments.test.ts
new file mode 100644
index 000000000000..29bfde03abcc
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/comments.test.ts
@@ -0,0 +1,217 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { DATE_NOW } from '../../constants.mock';
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getCommentsArrayMock, getCommentsMock } from './comments.mock';
+import {
+  Comments,
+  CommentsArray,
+  CommentsArrayOrUndefined,
+  comments,
+  commentsArray,
+  commentsArrayOrUndefined,
+} from './comments';
+
+describe('Comments', () => {
+  describe('comments', () => {
+    test('it should validate a comments', () => {
+      const payload = getCommentsMock();
+      const decoded = comments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should validate with "updated_at" and "updated_by"', () => {
+      const payload = getCommentsMock();
+      payload.updated_at = DATE_NOW;
+      payload.updated_by = 'someone';
+      const decoded = comments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should not validate when undefined', () => {
+      const payload = undefined;
+      const decoded = comments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "undefined" supplied to "({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)"',
+        'Invalid value "undefined" supplied to "({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should not validate when "comment" is not a string', () => {
+      const payload: Omit<Comments, 'comment'> & { comment: string[] } = {
+        ...getCommentsMock(),
+        comment: ['some value'],
+      };
+      const decoded = comments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "["some value"]" supplied to "comment"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should not validate when "created_at" is not a string', () => {
+      const payload: Omit<Comments, 'created_at'> & { created_at: number } = {
+        ...getCommentsMock(),
+        created_at: 1,
+      };
+      const decoded = comments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "1" supplied to "created_at"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should not validate when "created_by" is not a string', () => {
+      const payload: Omit<Comments, 'created_by'> & { created_by: number } = {
+        ...getCommentsMock(),
+        created_by: 1,
+      };
+      const decoded = comments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "1" supplied to "created_by"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should not validate when "updated_at" is not a string', () => {
+      const payload: Omit<Comments, 'updated_at'> & { updated_at: number } = {
+        ...getCommentsMock(),
+        updated_at: 1,
+      };
+      const decoded = comments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "1" supplied to "updated_at"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should not validate when "updated_by" is not a string', () => {
+      const payload: Omit<Comments, 'updated_by'> & { updated_by: number } = {
+        ...getCommentsMock(),
+        updated_by: 1,
+      };
+      const decoded = comments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "1" supplied to "updated_by"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should strip out extra keys', () => {
+      const payload: Comments & {
+        extraKey?: string;
+      } = getCommentsMock();
+      payload.extraKey = 'some value';
+      const decoded = comments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(getCommentsMock());
+    });
+  });
+
+  describe('commentsArray', () => {
+    test('it should validate an array of comments', () => {
+      const payload = getCommentsArrayMock();
+      const decoded = commentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should validate when a comments includes "updated_at" and "updated_by"', () => {
+      const commentsPayload = getCommentsMock();
+      commentsPayload.updated_at = DATE_NOW;
+      commentsPayload.updated_by = 'someone';
+      const payload = [{ ...commentsPayload }, ...getCommentsArrayMock()];
+      const decoded = commentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should not validate when undefined', () => {
+      const payload = undefined;
+      const decoded = commentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "undefined" supplied to "Array<({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)>"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should not validate when array includes non comments types', () => {
+      const payload = ([1] as unknown) as CommentsArray;
+      const decoded = commentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "1" supplied to "Array<({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)>"',
+        'Invalid value "1" supplied to "Array<({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)>"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+  });
+
+  describe('commentsArrayOrUndefined', () => {
+    test('it should validate an array of comments', () => {
+      const payload = getCommentsArrayMock();
+      const decoded = commentsArrayOrUndefined.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should validate when undefined', () => {
+      const payload = undefined;
+      const decoded = commentsArrayOrUndefined.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should not validate when array includes non comments types', () => {
+      const payload = ([1] as unknown) as CommentsArrayOrUndefined;
+      const decoded = commentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "1" supplied to "Array<({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)>"',
+        'Invalid value "1" supplied to "Array<({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)>"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/comments.ts b/x-pack/plugins/lists/common/schemas/types/comments.ts
index d61608c3508f..0ee3b05c8102 100644
--- a/x-pack/plugins/lists/common/schemas/types/comments.ts
+++ b/x-pack/plugins/lists/common/schemas/types/comments.ts
@@ -5,36 +5,24 @@
  */
 import * as t from 'io-ts';
 
-export const comment = t.exact(
-  t.type({
-    comment: t.string,
-    created_at: t.string, // TODO: Make this into an ISO Date string check,
-    created_by: t.string,
-  })
-);
-
-export const commentsArray = t.array(comment);
-export type CommentsArray = t.TypeOf<typeof commentsArray>;
-export type Comment = t.TypeOf<typeof comment>;
-export const commentsArrayOrUndefined = t.union([commentsArray, t.undefined]);
-export type CommentsArrayOrUndefined = t.TypeOf<typeof commentsArrayOrUndefined>;
-
-export const commentPartial = t.intersection([
+export const comments = t.intersection([
   t.exact(
     t.type({
       comment: t.string,
+      created_at: t.string, // TODO: Make this into an ISO Date string check,
+      created_by: t.string,
     })
   ),
   t.exact(
     t.partial({
-      created_at: t.string, // TODO: Make this into an ISO Date string check,
-      created_by: t.string,
+      updated_at: t.string,
+      updated_by: t.string,
     })
   ),
 ]);
 
-export const commentsPartialArray = t.array(commentPartial);
-export type CommentsPartialArray = t.TypeOf<typeof commentsPartialArray>;
-export type CommentPartial = t.TypeOf<typeof commentPartial>;
-export const commentsPartialArrayOrUndefined = t.union([commentsPartialArray, t.undefined]);
-export type CommentsPartialArrayOrUndefined = t.TypeOf<typeof commentsPartialArrayOrUndefined>;
+export const commentsArray = t.array(comments);
+export type CommentsArray = t.TypeOf<typeof commentsArray>;
+export type Comments = t.TypeOf<typeof comments>;
+export const commentsArrayOrUndefined = t.union([commentsArray, t.undefined]);
+export type CommentsArrayOrUndefined = t.TypeOf<typeof commentsArrayOrUndefined>;
diff --git a/x-pack/plugins/lists/common/schemas/types/create_comments.mock.ts b/x-pack/plugins/lists/common/schemas/types/create_comments.mock.ts
new file mode 100644
index 000000000000..60a59432275c
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/create_comments.mock.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { CreateComments, CreateCommentsArray } from './create_comments';
+
+export const getCreateCommentsMock = (): CreateComments => ({
+  comment: 'some comments',
+});
+
+export const getCreateCommentsArrayMock = (): CreateCommentsArray => [getCreateCommentsMock()];
diff --git a/x-pack/plugins/lists/common/schemas/types/create_comments.test.ts b/x-pack/plugins/lists/common/schemas/types/create_comments.test.ts
new file mode 100644
index 000000000000..d2680750e05e
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/create_comments.test.ts
@@ -0,0 +1,134 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getCreateCommentsArrayMock, getCreateCommentsMock } from './create_comments.mock';
+import {
+  CreateComments,
+  CreateCommentsArray,
+  CreateCommentsArrayOrUndefined,
+  createComments,
+  createCommentsArray,
+  createCommentsArrayOrUndefined,
+} from './create_comments';
+
+describe('CreateComments', () => {
+  describe('createComments', () => {
+    test('it should validate a comments', () => {
+      const payload = getCreateCommentsMock();
+      const decoded = createComments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should not validate when undefined', () => {
+      const payload = undefined;
+      const decoded = createComments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "undefined" supplied to "{| comment: string |}"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should not validate when "comment" is not a string', () => {
+      const payload: Omit<CreateComments, 'comment'> & { comment: string[] } = {
+        ...getCreateCommentsMock(),
+        comment: ['some value'],
+      };
+      const decoded = createComments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "["some value"]" supplied to "comment"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should strip out extra keys', () => {
+      const payload: CreateComments & {
+        extraKey?: string;
+      } = getCreateCommentsMock();
+      payload.extraKey = 'some value';
+      const decoded = createComments.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(getCreateCommentsMock());
+    });
+  });
+
+  describe('createCommentsArray', () => {
+    test('it should validate an array of comments', () => {
+      const payload = getCreateCommentsArrayMock();
+      const decoded = createCommentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should not validate when undefined', () => {
+      const payload = undefined;
+      const decoded = createCommentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "undefined" supplied to "Array<{| comment: string |}>"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should not validate when array includes non comments types', () => {
+      const payload = ([1] as unknown) as CreateCommentsArray;
+      const decoded = createCommentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "1" supplied to "Array<{| comment: string |}>"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+  });
+
+  describe('createCommentsArrayOrUndefined', () => {
+    test('it should validate an array of comments', () => {
+      const payload = getCreateCommentsArrayMock();
+      const decoded = createCommentsArrayOrUndefined.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should validate when undefined', () => {
+      const payload = undefined;
+      const decoded = createCommentsArrayOrUndefined.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should not validate when array includes non comments types', () => {
+      const payload = ([1] as unknown) as CreateCommentsArrayOrUndefined;
+      const decoded = createCommentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "1" supplied to "Array<{| comment: string |}>"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/create_comments.ts b/x-pack/plugins/lists/common/schemas/types/create_comments.ts
new file mode 100644
index 000000000000..c34419298ef9
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/create_comments.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as t from 'io-ts';
+
+export const createComments = t.exact(
+  t.type({
+    comment: t.string,
+  })
+);
+
+export const createCommentsArray = t.array(createComments);
+export type CreateCommentsArray = t.TypeOf<typeof createCommentsArray>;
+export type CreateComments = t.TypeOf<typeof createComments>;
+export const createCommentsArrayOrUndefined = t.union([createCommentsArray, t.undefined]);
+export type CreateCommentsArrayOrUndefined = t.TypeOf<typeof createCommentsArrayOrUndefined>;
diff --git a/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts b/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts
new file mode 100644
index 000000000000..3a4241aaec82
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { DefaultCommentsArray } from './default_comments_array';
+import { CommentsArray } from './comments';
+import { getCommentsArrayMock } from './comments.mock';
+
+describe('default_comments_array', () => {
+  test('it should validate an empty array', () => {
+    const payload: CommentsArray = [];
+    const decoded = DefaultCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an array of comments', () => {
+    const payload: CommentsArray = getCommentsArrayMock();
+    const decoded = DefaultCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should NOT validate an array of numbers', () => {
+    const payload = [1];
+    const decoded = DefaultCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    // TODO: Known weird error formatting that is on our list to address
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "1" supplied to "Array<({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)>"',
+      'Invalid value "1" supplied to "Array<({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)>"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate an array of strings', () => {
+    const payload = ['some string'];
+    const decoded = DefaultCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "some string" supplied to "Array<({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)>"',
+      'Invalid value "some string" supplied to "Array<({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>)>"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should return a default array entry', () => {
+    const payload = null;
+    const decoded = DefaultCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual([]);
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/default_comments_array.ts b/x-pack/plugins/lists/common/schemas/types/default_comments_array.ts
index e824d481b361..e8be299246ab 100644
--- a/x-pack/plugins/lists/common/schemas/types/default_comments_array.ts
+++ b/x-pack/plugins/lists/common/schemas/types/default_comments_array.ts
@@ -7,14 +7,9 @@
 import * as t from 'io-ts';
 import { Either } from 'fp-ts/lib/Either';
 
-import { CommentsArray, CommentsPartialArray, comment, commentPartial } from './comments';
+import { CommentsArray, comments } from './comments';
 
 export type DefaultCommentsArrayC = t.Type<CommentsArray, CommentsArray, unknown>;
-export type DefaultCommentsPartialArrayC = t.Type<
-  CommentsPartialArray,
-  CommentsPartialArray,
-  unknown
->;
 
 /**
  * Types the DefaultCommentsArray as:
@@ -26,24 +21,8 @@ export const DefaultCommentsArray: DefaultCommentsArrayC = new t.Type<
   unknown
 >(
   'DefaultCommentsArray',
-  t.array(comment).is,
-  (input, context): Either<t.Errors, CommentsArray> =>
-    input == null ? t.success([]) : t.array(comment).validate(input, context),
-  t.identity
-);
-
-/**
- * Types the DefaultCommentsPartialArray as:
- *   - If null or undefined, then a default array of type entry will be set
- */
-export const DefaultCommentsPartialArray: DefaultCommentsPartialArrayC = new t.Type<
-  CommentsPartialArray,
-  CommentsPartialArray,
-  unknown
->(
-  'DefaultCommentsPartialArray',
-  t.array(commentPartial).is,
-  (input, context): Either<t.Errors, CommentsPartialArray> =>
-    input == null ? t.success([]) : t.array(commentPartial).validate(input, context),
+  t.array(comments).is,
+  (input): Either<t.Errors, CommentsArray> =>
+    input == null ? t.success([]) : t.array(comments).decode(input),
   t.identity
 );
diff --git a/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts b/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts
new file mode 100644
index 000000000000..f5ef7d0ad96b
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { DefaultCreateCommentsArray } from './default_create_comments_array';
+import { CreateCommentsArray } from './create_comments';
+import { getCreateCommentsArrayMock } from './create_comments.mock';
+
+describe('default_create_comments_array', () => {
+  test('it should validate an empty array', () => {
+    const payload: CreateCommentsArray = [];
+    const decoded = DefaultCreateCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an array of comments', () => {
+    const payload: CreateCommentsArray = getCreateCommentsArrayMock();
+    const decoded = DefaultCreateCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should NOT validate an array of numbers', () => {
+    const payload = [1];
+    const decoded = DefaultCreateCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    // TODO: Known weird error formatting that is on our list to address
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "1" supplied to "Array<{| comment: string |}>"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate an array of strings', () => {
+    const payload = ['some string'];
+    const decoded = DefaultCreateCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "some string" supplied to "Array<{| comment: string |}>"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should return a default array entry', () => {
+    const payload = null;
+    const decoded = DefaultCreateCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual([]);
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.ts b/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.ts
new file mode 100644
index 000000000000..51431b9c3985
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { Either } from 'fp-ts/lib/Either';
+
+import { CreateCommentsArray, createComments } from './create_comments';
+
+export type DefaultCreateCommentsArrayC = t.Type<CreateCommentsArray, CreateCommentsArray, unknown>;
+
+/**
+ * Types the DefaultCreateComments as:
+ *   - If null or undefined, then a default array of type entry will be set
+ */
+export const DefaultCreateCommentsArray: DefaultCreateCommentsArrayC = new t.Type<
+  CreateCommentsArray,
+  CreateCommentsArray,
+  unknown
+>(
+  'DefaultCreateComments',
+  t.array(createComments).is,
+  (input): Either<t.Errors, CreateCommentsArray> =>
+    input == null ? t.success([]) : t.array(createComments).decode(input),
+  t.identity
+);
diff --git a/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts b/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts
new file mode 100644
index 000000000000..b023e73cb932
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { DefaultUpdateCommentsArray } from './default_update_comments_array';
+import { UpdateCommentsArray } from './update_comments';
+import { getUpdateCommentsArrayMock } from './update_comments.mock';
+
+describe('default_update_comments_array', () => {
+  test('it should validate an empty array', () => {
+    const payload: UpdateCommentsArray = [];
+    const decoded = DefaultUpdateCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an array of comments', () => {
+    const payload: UpdateCommentsArray = getUpdateCommentsArrayMock();
+    const decoded = DefaultUpdateCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should NOT validate an array of numbers', () => {
+    const payload = [1];
+    const decoded = DefaultUpdateCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    // TODO: Known weird error formatting that is on our list to address
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "1" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+      'Invalid value "1" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+      'Invalid value "1" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate an array of strings', () => {
+    const payload = ['some string'];
+    const decoded = DefaultUpdateCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "some string" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+      'Invalid value "some string" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+      'Invalid value "some string" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should return a default array entry', () => {
+    const payload = null;
+    const decoded = DefaultUpdateCommentsArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual([]);
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.ts b/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.ts
new file mode 100644
index 000000000000..c2593826a635
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { Either } from 'fp-ts/lib/Either';
+
+import { UpdateCommentsArray, updateCommentsArray } from './update_comments';
+
+export type DefaultUpdateCommentsArrayC = t.Type<UpdateCommentsArray, UpdateCommentsArray, unknown>;
+
+/**
+ * Types the DefaultCommentsUpdate as:
+ *   - If null or undefined, then a default array of type entry will be set
+ */
+export const DefaultUpdateCommentsArray: DefaultUpdateCommentsArrayC = new t.Type<
+  UpdateCommentsArray,
+  UpdateCommentsArray,
+  unknown
+>(
+  'DefaultCreateComments',
+  updateCommentsArray.is,
+  (input): Either<t.Errors, UpdateCommentsArray> =>
+    input == null ? t.success([]) : updateCommentsArray.decode(input),
+  t.identity
+);
diff --git a/x-pack/plugins/lists/common/schemas/types/index.ts b/x-pack/plugins/lists/common/schemas/types/index.ts
index 97f2b0f59a5f..16433e00f2b1 100644
--- a/x-pack/plugins/lists/common/schemas/types/index.ts
+++ b/x-pack/plugins/lists/common/schemas/types/index.ts
@@ -3,8 +3,12 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+export * from './comments';
+export * from './create_comments';
+export * from './update_comments';
 export * from './default_comments_array';
-export * from './default_entries_array';
+export * from './default_create_comments_array';
+export * from './default_update_comments_array';
 export * from './default_namespace';
-export * from './comments';
+export * from './default_entries_array';
 export * from './entries';
diff --git a/x-pack/plugins/lists/common/schemas/types/update_comments.mock.ts b/x-pack/plugins/lists/common/schemas/types/update_comments.mock.ts
new file mode 100644
index 000000000000..3e963c2607dc
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/update_comments.mock.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getCommentsMock } from './comments.mock';
+import { getCreateCommentsMock } from './create_comments.mock';
+import { UpdateCommentsArray } from './update_comments';
+
+export const getUpdateCommentsArrayMock = (): UpdateCommentsArray => [
+  getCommentsMock(),
+  getCreateCommentsMock(),
+];
diff --git a/x-pack/plugins/lists/common/schemas/types/update_comments.test.ts b/x-pack/plugins/lists/common/schemas/types/update_comments.test.ts
new file mode 100644
index 000000000000..7668504b031b
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/update_comments.test.ts
@@ -0,0 +1,108 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getUpdateCommentsArrayMock } from './update_comments.mock';
+import {
+  UpdateCommentsArray,
+  UpdateCommentsArrayOrUndefined,
+  updateCommentsArray,
+  updateCommentsArrayOrUndefined,
+} from './update_comments';
+import { getCommentsMock } from './comments.mock';
+import { getCreateCommentsMock } from './create_comments.mock';
+
+describe('CommentsUpdate', () => {
+  describe('updateCommentsArray', () => {
+    test('it should validate an array of comments', () => {
+      const payload = getUpdateCommentsArrayMock();
+      const decoded = updateCommentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should validate an array of existing comments', () => {
+      const payload = [getCommentsMock()];
+      const decoded = updateCommentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should validate an array of new comments', () => {
+      const payload = [getCreateCommentsMock()];
+      const decoded = updateCommentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should not validate when undefined', () => {
+      const payload = undefined;
+      const decoded = updateCommentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "undefined" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+
+    test('it should not validate when array includes non comments types', () => {
+      const payload = ([1] as unknown) as UpdateCommentsArray;
+      const decoded = updateCommentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "1" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+        'Invalid value "1" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+        'Invalid value "1" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+  });
+
+  describe('updateCommentsArrayOrUndefined', () => {
+    test('it should validate an array of comments', () => {
+      const payload = getUpdateCommentsArrayMock();
+      const decoded = updateCommentsArrayOrUndefined.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should validate when undefined', () => {
+      const payload = undefined;
+      const decoded = updateCommentsArrayOrUndefined.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
+    test('it should not validate when array includes non comments types', () => {
+      const payload = ([1] as unknown) as UpdateCommentsArrayOrUndefined;
+      const decoded = updateCommentsArray.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "1" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+        'Invalid value "1" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+        'Invalid value "1" supplied to "Array<(({| comment: string, created_at: string, created_by: string |} & Partial<{| updated_at: string, updated_by: string |}>) | {| comment: string |})>"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/update_comments.ts b/x-pack/plugins/lists/common/schemas/types/update_comments.ts
new file mode 100644
index 000000000000..4a21bfa363d4
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/update_comments.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as t from 'io-ts';
+
+import { comments } from './comments';
+import { createComments } from './create_comments';
+
+export const updateCommentsArray = t.array(t.union([comments, createComments]));
+export type UpdateCommentsArray = t.TypeOf<typeof updateCommentsArray>;
+export const updateCommentsArrayOrUndefined = t.union([updateCommentsArray, t.undefined]);
+export type UpdateCommentsArrayOrUndefined = t.TypeOf<typeof updateCommentsArrayOrUndefined>;
diff --git a/x-pack/plugins/lists/public/exceptions/api.test.ts b/x-pack/plugins/lists/public/exceptions/api.test.ts
index 72a689650ea2..975641b9bebe 100644
--- a/x-pack/plugins/lists/public/exceptions/api.test.ts
+++ b/x-pack/plugins/lists/public/exceptions/api.test.ts
@@ -250,7 +250,7 @@ describe('Exceptions Lists API', () => {
       });
       // TODO Would like to just use getExceptionListSchemaMock() here, but
       // validation returns object in different order, making the strings not match
-      expect(fetchMock).toHaveBeenCalledWith('/api/exception_lists', {
+      expect(fetchMock).toHaveBeenCalledWith('/api/exception_lists/items', {
         body: JSON.stringify(payload),
         method: 'PUT',
         signal: abortCtrl.signal,
diff --git a/x-pack/plugins/lists/public/exceptions/api.ts b/x-pack/plugins/lists/public/exceptions/api.ts
index 2ab7695d8c17..a581cfd08ecc 100644
--- a/x-pack/plugins/lists/public/exceptions/api.ts
+++ b/x-pack/plugins/lists/public/exceptions/api.ts
@@ -176,7 +176,7 @@ export const updateExceptionListItem = async ({
 
   if (validatedRequest != null) {
     try {
-      const response = await http.fetch<ExceptionListItemSchema>(EXCEPTION_LIST_URL, {
+      const response = await http.fetch<ExceptionListItemSchema>(EXCEPTION_LIST_ITEM_URL, {
         body: JSON.stringify(listItem),
         method: 'PUT',
         signal,
diff --git a/x-pack/plugins/lists/server/saved_objects/exception_list.ts b/x-pack/plugins/lists/server/saved_objects/exception_list.ts
index 57bc63e6f7e3..fc04c5e278d6 100644
--- a/x-pack/plugins/lists/server/saved_objects/exception_list.ts
+++ b/x-pack/plugins/lists/server/saved_objects/exception_list.ts
@@ -77,6 +77,12 @@ export const exceptionListItemMapping: SavedObjectsType['mappings'] = {
         created_by: {
           type: 'keyword',
         },
+        updated_at: {
+          type: 'keyword',
+        },
+        updated_by: {
+          type: 'keyword',
+        },
       },
     },
     entries: {
diff --git a/x-pack/plugins/lists/server/scripts/exception_lists/updates/simple_update_item.json b/x-pack/plugins/lists/server/scripts/exception_lists/updates/simple_update_item.json
index 33c9303c7b52..08bd95b7d124 100644
--- a/x-pack/plugins/lists/server/scripts/exception_lists/updates/simple_update_item.json
+++ b/x-pack/plugins/lists/server/scripts/exception_lists/updates/simple_update_item.json
@@ -5,14 +5,7 @@
   "type": "simple",
   "description": "This is a sample change here this list",
   "name": "Sample Endpoint Exception List update change",
-  "comments": [
-    {
-      "comment": "this was an old comment.",
-      "created_by": "lily",
-      "created_at": "2020-04-20T15:25:31.830Z"
-    },
-    { "comment": "this is a newly added comment" }
-  ],
+  "comments": [{ "comment": "this is a newly added comment" }],
   "entries": [
     {
       "field": "event.category",
diff --git a/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts b/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts
index 22a9fbcfb53a..a84283aeabbb 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts
@@ -8,7 +8,7 @@ import { SavedObjectsClientContract } from 'kibana/server';
 import uuid from 'uuid';
 
 import {
-  CommentsPartialArray,
+  CreateCommentsArray,
   Description,
   EntriesArray,
   ExceptionListItemSchema,
@@ -25,13 +25,13 @@ import {
 
 import {
   getSavedObjectType,
-  transformComments,
+  transformCreateCommentsToComments,
   transformSavedObjectToExceptionListItem,
 } from './utils';
 
 interface CreateExceptionListItemOptions {
   _tags: _Tags;
-  comments: CommentsPartialArray;
+  comments: CreateCommentsArray;
   listId: ListId;
   itemId: ItemId;
   savedObjectsClient: SavedObjectsClientContract;
@@ -64,9 +64,10 @@ export const createExceptionListItem = async ({
 }: CreateExceptionListItemOptions): Promise<ExceptionListItemSchema> => {
   const savedObjectType = getSavedObjectType({ namespaceType });
   const dateNow = new Date().toISOString();
+  const transformedComments = transformCreateCommentsToComments({ comments, user });
   const savedObject = await savedObjectsClient.create<ExceptionListSoSchema>(savedObjectType, {
     _tags,
-    comments: transformComments({ comments, user }),
+    comments: transformedComments,
     created_at: dateNow,
     created_by: user,
     description,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
index 03f5de516561..203d32911a6d 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
@@ -7,7 +7,7 @@
 import { SavedObjectsClientContract } from 'kibana/server';
 
 import {
-  CommentsPartialArray,
+  CreateCommentsArray,
   Description,
   DescriptionOrUndefined,
   EntriesArray,
@@ -30,6 +30,7 @@ import {
   SortOrderOrUndefined,
   Tags,
   TagsOrUndefined,
+  UpdateCommentsArray,
   _Tags,
   _TagsOrUndefined,
 } from '../../../common/schemas';
@@ -88,7 +89,7 @@ export interface GetExceptionListItemOptions {
 
 export interface CreateExceptionListItemOptions {
   _tags: _Tags;
-  comments: CommentsPartialArray;
+  comments: CreateCommentsArray;
   entries: EntriesArray;
   itemId: ItemId;
   listId: ListId;
@@ -102,7 +103,7 @@ export interface CreateExceptionListItemOptions {
 
 export interface UpdateExceptionListItemOptions {
   _tags: _TagsOrUndefined;
-  comments: CommentsPartialArray;
+  comments: UpdateCommentsArray;
   entries: EntriesArrayOrUndefined;
   id: IdOrUndefined;
   itemId: ItemIdOrUndefined;
diff --git a/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts b/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts
index 7ca9bfd83ab6..5578063fd9b6 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts
@@ -7,7 +7,6 @@
 import { SavedObjectsClientContract } from 'kibana/server';
 
 import {
-  CommentsPartialArray,
   DescriptionOrUndefined,
   EntriesArrayOrUndefined,
   ExceptionListItemSchema,
@@ -19,19 +18,20 @@ import {
   NameOrUndefined,
   NamespaceType,
   TagsOrUndefined,
+  UpdateCommentsArrayOrUndefined,
   _TagsOrUndefined,
 } from '../../../common/schemas';
 
 import {
   getSavedObjectType,
-  transformComments,
   transformSavedObjectUpdateToExceptionListItem,
+  transformUpdateCommentsToComments,
 } from './utils';
 import { getExceptionListItem } from './get_exception_list_item';
 
 interface UpdateExceptionListItemOptions {
   id: IdOrUndefined;
-  comments: CommentsPartialArray;
+  comments: UpdateCommentsArrayOrUndefined;
   _tags: _TagsOrUndefined;
   name: NameOrUndefined;
   description: DescriptionOrUndefined;
@@ -71,12 +71,17 @@ export const updateExceptionListItem = async ({
   if (exceptionListItem == null) {
     return null;
   } else {
+    const transformedComments = transformUpdateCommentsToComments({
+      comments,
+      existingComments: exceptionListItem.comments,
+      user,
+    });
     const savedObject = await savedObjectsClient.update<ExceptionListSoSchema>(
       savedObjectType,
       exceptionListItem.id,
       {
         _tags,
-        comments: transformComments({ comments, user }),
+        comments: transformedComments,
         description,
         entries,
         meta,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils.test.ts b/x-pack/plugins/lists/server/services/exception_lists/utils.test.ts
new file mode 100644
index 000000000000..9cc2aacd8845
--- /dev/null
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils.test.ts
@@ -0,0 +1,437 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import sinon from 'sinon';
+import moment from 'moment';
+
+import { DATE_NOW, USER } from '../../../common/constants.mock';
+
+import {
+  isCommentEqual,
+  transformCreateCommentsToComments,
+  transformUpdateComments,
+  transformUpdateCommentsToComments,
+} from './utils';
+
+describe('utils', () => {
+  const anchor = '2020-06-17T20:34:51.337Z';
+  const unix = moment(anchor).valueOf();
+  let clock: sinon.SinonFakeTimers;
+
+  beforeEach(() => {
+    clock = sinon.useFakeTimers(unix);
+  });
+
+  afterEach(() => {
+    clock.restore();
+  });
+
+  describe('#transformUpdateCommentsToComments', () => {
+    test('it returns empty array if "comments" is undefined and no comments exist', () => {
+      const comments = transformUpdateCommentsToComments({
+        comments: undefined,
+        existingComments: [],
+        user: 'lily',
+      });
+
+      expect(comments).toEqual([]);
+    });
+
+    test('it formats newly added comments', () => {
+      const comments = transformUpdateCommentsToComments({
+        comments: [
+          { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+          { comment: 'Im a new comment' },
+        ],
+        existingComments: [
+          { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+        ],
+        user: 'lily',
+      });
+
+      expect(comments).toEqual([
+        {
+          comment: 'Im an old comment',
+          created_at: anchor,
+          created_by: 'lily',
+        },
+        {
+          comment: 'Im a new comment',
+          created_at: anchor,
+          created_by: 'lily',
+        },
+      ]);
+    });
+
+    test('it formats multiple newly added comments', () => {
+      const comments = transformUpdateCommentsToComments({
+        comments: [
+          { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+          { comment: 'Im a new comment' },
+          { comment: 'Im another new comment' },
+        ],
+        existingComments: [
+          { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+        ],
+        user: 'lily',
+      });
+
+      expect(comments).toEqual([
+        {
+          comment: 'Im an old comment',
+          created_at: anchor,
+          created_by: 'lily',
+        },
+        {
+          comment: 'Im a new comment',
+          created_at: anchor,
+          created_by: 'lily',
+        },
+        {
+          comment: 'Im another new comment',
+          created_at: anchor,
+          created_by: 'lily',
+        },
+      ]);
+    });
+
+    test('it should not throw if comments match existing comments', () => {
+      const comments = transformUpdateCommentsToComments({
+        comments: [{ comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' }],
+        existingComments: [
+          { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+        ],
+        user: 'lily',
+      });
+
+      expect(comments).toEqual([
+        {
+          comment: 'Im an old comment',
+          created_at: anchor,
+          created_by: 'lily',
+        },
+      ]);
+    });
+
+    test('it does not throw if user tries to update one of their own existing comments', () => {
+      const comments = transformUpdateCommentsToComments({
+        comments: [
+          {
+            comment: 'Im an old comment that is trying to be updated',
+            created_at: DATE_NOW,
+            created_by: 'lily',
+          },
+        ],
+        existingComments: [
+          { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+        ],
+        user: 'lily',
+      });
+
+      expect(comments).toEqual([
+        {
+          comment: 'Im an old comment that is trying to be updated',
+          created_at: DATE_NOW,
+          created_by: 'lily',
+          updated_at: anchor,
+          updated_by: 'lily',
+        },
+      ]);
+    });
+
+    test('it throws an error if user tries to update their comment, without passing in the "created_at" and "created_by" properties', () => {
+      expect(() =>
+        transformUpdateCommentsToComments({
+          comments: [
+            {
+              comment: 'Im an old comment that is trying to be updated',
+            },
+          ],
+          existingComments: [
+            { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+          ],
+          user: 'lily',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"When trying to update a comment, \\"created_at\\" and \\"created_by\\" must be present"`
+      );
+    });
+
+    test('it throws an error if user tries to delete comments', () => {
+      expect(() =>
+        transformUpdateCommentsToComments({
+          comments: [],
+          existingComments: [
+            { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+          ],
+          user: 'lily',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"Comments cannot be deleted, only new comments may be added"`
+      );
+    });
+
+    test('it throws if user tries to update existing comment timestamp', () => {
+      expect(() =>
+        transformUpdateCommentsToComments({
+          comments: [{ comment: 'Im an old comment', created_at: anchor, created_by: 'lily' }],
+          existingComments: [
+            { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+          ],
+          user: 'bane',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"Not authorized to edit others comments"`);
+    });
+
+    test('it throws if user tries to update existing comment author', () => {
+      expect(() =>
+        transformUpdateCommentsToComments({
+          comments: [{ comment: 'Im an old comment', created_at: anchor, created_by: 'lily' }],
+          existingComments: [
+            { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'me!' },
+          ],
+          user: 'bane',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"Not authorized to edit others comments"`);
+    });
+
+    test('it throws if user tries to update an existing comment that is not their own', () => {
+      expect(() =>
+        transformUpdateCommentsToComments({
+          comments: [
+            {
+              comment: 'Im an old comment that is trying to be updated',
+              created_at: DATE_NOW,
+              created_by: 'lily',
+            },
+          ],
+          existingComments: [
+            { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+          ],
+          user: 'bane',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"Not authorized to edit others comments"`);
+    });
+
+    test('it throws if user tries to update order of comments', () => {
+      expect(() =>
+        transformUpdateCommentsToComments({
+          comments: [
+            { comment: 'Im a new comment' },
+            { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+          ],
+          existingComments: [
+            { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+          ],
+          user: 'lily',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"When trying to update a comment, \\"created_at\\" and \\"created_by\\" must be present"`
+      );
+    });
+
+    test('it throws an error if user tries to add comment formatted as existing comment when none yet exist', () => {
+      expect(() =>
+        transformUpdateCommentsToComments({
+          comments: [
+            { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+            { comment: 'Im a new comment' },
+          ],
+          existingComments: [],
+          user: 'lily',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"Only new comments may be added"`);
+    });
+
+    test('it throws if empty comment exists', () => {
+      expect(() =>
+        transformUpdateCommentsToComments({
+          comments: [
+            { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+            { comment: '    ' },
+          ],
+          existingComments: [
+            { comment: 'Im an old comment', created_at: DATE_NOW, created_by: 'lily' },
+          ],
+          user: 'lily',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"Empty comments not allowed"`);
+    });
+  });
+
+  describe('#transformCreateCommentsToComments', () => {
+    test('it returns "undefined" if "comments" is "undefined"', () => {
+      const comments = transformCreateCommentsToComments({
+        comments: undefined,
+        user: 'lily',
+      });
+
+      expect(comments).toBeUndefined();
+    });
+
+    test('it formats newly added comments', () => {
+      const comments = transformCreateCommentsToComments({
+        comments: [{ comment: 'Im a new comment' }, { comment: 'Im another new comment' }],
+        user: 'lily',
+      });
+
+      expect(comments).toEqual([
+        {
+          comment: 'Im a new comment',
+          created_at: anchor,
+          created_by: 'lily',
+        },
+        {
+          comment: 'Im another new comment',
+          created_at: anchor,
+          created_by: 'lily',
+        },
+      ]);
+    });
+
+    test('it throws an error if user tries to add an empty comment', () => {
+      expect(() =>
+        transformCreateCommentsToComments({
+          comments: [{ comment: '   ' }],
+          user: 'lily',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"Empty comments not allowed"`);
+    });
+  });
+
+  describe('#transformUpdateComments', () => {
+    test('it updates comment and adds "updated_at" and "updated_by"', () => {
+      const comments = transformUpdateComments({
+        comment: {
+          comment: 'Im an old comment that is trying to be updated',
+          created_at: DATE_NOW,
+          created_by: 'lily',
+        },
+        existingComment: {
+          comment: 'Im an old comment',
+          created_at: DATE_NOW,
+          created_by: 'lily',
+        },
+        user: 'lily',
+      });
+
+      expect(comments).toEqual({
+        comment: 'Im an old comment that is trying to be updated',
+        created_at: '2020-04-20T15:25:31.830Z',
+        created_by: 'lily',
+        updated_at: anchor,
+        updated_by: 'lily',
+      });
+    });
+
+    test('it throws if user tries to update an existing comment that is not their own', () => {
+      expect(() =>
+        transformUpdateComments({
+          comment: {
+            comment: 'Im an old comment that is trying to be updated',
+            created_at: DATE_NOW,
+            created_by: 'lily',
+          },
+          existingComment: {
+            comment: 'Im an old comment',
+            created_at: DATE_NOW,
+            created_by: 'lily',
+          },
+          user: 'bane',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"Not authorized to edit others comments"`);
+    });
+
+    test('it throws if user tries to update an existing comments timestamp', () => {
+      expect(() =>
+        transformUpdateComments({
+          comment: {
+            comment: 'Im an old comment that is trying to be updated',
+            created_at: anchor,
+            created_by: 'lily',
+          },
+          existingComment: {
+            comment: 'Im an old comment',
+            created_at: DATE_NOW,
+            created_by: 'lily',
+          },
+          user: 'lily',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"Unable to update comment"`);
+    });
+  });
+
+  describe('#isCommentEqual', () => {
+    test('it returns false if "comment" values differ', () => {
+      const result = isCommentEqual(
+        {
+          comment: 'some old comment',
+          created_at: DATE_NOW,
+          created_by: USER,
+        },
+        {
+          comment: 'some older comment',
+          created_at: DATE_NOW,
+          created_by: USER,
+        }
+      );
+
+      expect(result).toBeFalsy();
+    });
+
+    test('it returns false if "created_at" values differ', () => {
+      const result = isCommentEqual(
+        {
+          comment: 'some old comment',
+          created_at: DATE_NOW,
+          created_by: USER,
+        },
+        {
+          comment: 'some old comment',
+          created_at: anchor,
+          created_by: USER,
+        }
+      );
+
+      expect(result).toBeFalsy();
+    });
+
+    test('it returns false if "created_by" values differ', () => {
+      const result = isCommentEqual(
+        {
+          comment: 'some old comment',
+          created_at: DATE_NOW,
+          created_by: USER,
+        },
+        {
+          comment: 'some old comment',
+          created_at: DATE_NOW,
+          created_by: 'lily',
+        }
+      );
+
+      expect(result).toBeFalsy();
+    });
+
+    test('it returns true if comment values are equivalent', () => {
+      const result = isCommentEqual(
+        {
+          comment: 'some old comment',
+          created_at: DATE_NOW,
+          created_by: USER,
+        },
+        {
+          created_at: DATE_NOW,
+          created_by: USER,
+          // Disabling to assure that order doesn't matter
+          // eslint-disable-next-line sort-keys
+          comment: 'some old comment',
+        }
+      );
+
+      expect(result).toBeTruthy();
+    });
+  });
+});
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils.ts b/x-pack/plugins/lists/server/services/exception_lists/utils.ts
index 5690a42bed87..14b5309f67dc 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/utils.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils.ts
@@ -6,15 +6,21 @@
 
 import { SavedObject, SavedObjectsFindResponse, SavedObjectsUpdateResponse } from 'kibana/server';
 
+import { ErrorWithStatusCode } from '../../error_with_status_code';
 import {
+  Comments,
+  CommentsArray,
   CommentsArrayOrUndefined,
-  CommentsPartialArrayOrUndefined,
+  CreateComments,
+  CreateCommentsArrayOrUndefined,
   ExceptionListItemSchema,
   ExceptionListSchema,
   ExceptionListSoSchema,
   FoundExceptionListItemSchema,
   FoundExceptionListSchema,
   NamespaceType,
+  UpdateCommentsArrayOrUndefined,
+  comments as commentsSchema,
 } from '../../../common/schemas';
 import {
   SavedObjectType,
@@ -251,21 +257,103 @@ export const transformSavedObjectsToFoundExceptionList = ({
   };
 };
 
-export const transformComments = ({
+/*
+ * Determines whether two comments are equal, this is a very
+ * naive implementation, not meant to be used for deep equality of complex objects
+ */
+export const isCommentEqual = (commentA: Comments, commentB: Comments): boolean => {
+  const a = Object.values(commentA).sort().join();
+  const b = Object.values(commentB).sort().join();
+
+  return a === b;
+};
+
+export const transformUpdateCommentsToComments = ({
+  comments,
+  existingComments,
+  user,
+}: {
+  comments: UpdateCommentsArrayOrUndefined;
+  existingComments: CommentsArray;
+  user: string;
+}): CommentsArray => {
+  const newComments = comments ?? [];
+
+  if (newComments.length < existingComments.length) {
+    throw new ErrorWithStatusCode(
+      'Comments cannot be deleted, only new comments may be added',
+      403
+    );
+  } else {
+    return newComments.flatMap((c, index) => {
+      const existingComment = existingComments[index];
+
+      if (commentsSchema.is(existingComment) && !commentsSchema.is(c)) {
+        throw new ErrorWithStatusCode(
+          'When trying to update a comment, "created_at" and "created_by" must be present',
+          403
+        );
+      } else if (commentsSchema.is(c) && existingComment == null) {
+        throw new ErrorWithStatusCode('Only new comments may be added', 403);
+      } else if (
+        commentsSchema.is(c) &&
+        existingComment != null &&
+        !isCommentEqual(c, existingComment)
+      ) {
+        return transformUpdateComments({ comment: c, existingComment, user });
+      } else {
+        return transformCreateCommentsToComments({ comments: [c], user }) ?? [];
+      }
+    });
+  }
+};
+
+export const transformUpdateComments = ({
+  comment,
+  existingComment,
+  user,
+}: {
+  comment: Comments;
+  existingComment: Comments;
+  user: string;
+}): Comments => {
+  if (comment.created_by !== user) {
+    // existing comment is being edited, can only be edited by author
+    throw new ErrorWithStatusCode('Not authorized to edit others comments', 401);
+  } else if (existingComment.created_at !== comment.created_at) {
+    throw new ErrorWithStatusCode('Unable to update comment', 403);
+  } else if (comment.comment.trim().length === 0) {
+    throw new ErrorWithStatusCode('Empty comments not allowed', 403);
+  } else {
+    const dateNow = new Date().toISOString();
+
+    return {
+      ...comment,
+      updated_at: dateNow,
+      updated_by: user,
+    };
+  }
+};
+
+export const transformCreateCommentsToComments = ({
   comments,
   user,
 }: {
-  comments: CommentsPartialArrayOrUndefined;
+  comments: CreateCommentsArrayOrUndefined;
   user: string;
 }): CommentsArrayOrUndefined => {
   const dateNow = new Date().toISOString();
   if (comments != null) {
-    return comments.map((comment) => {
-      return {
-        comment: comment.comment,
-        created_at: comment.created_at ?? dateNow,
-        created_by: comment.created_by ?? user,
-      };
+    return comments.map((c: CreateComments) => {
+      if (c.comment.trim().length === 0) {
+        throw new ErrorWithStatusCode('Empty comments not allowed', 403);
+      } else {
+        return {
+          comment: c.comment,
+          created_at: dateNow,
+          created_by: user,
+        };
+      }
     });
   } else {
     return comments;
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
index 244819080c93..b936aea04769 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
@@ -37,7 +37,7 @@ import {
   getEntryMatchAnyMock,
   getEntriesArrayMock,
 } from '../../../../../lists/common/schemas/types/entries.mock';
-import { getCommentsMock } from '../../../../../lists/common/schemas/types/comments.mock';
+import { getCommentsArrayMock } from '../../../../../lists/common/schemas/types/comments.mock';
 
 describe('Exception helpers', () => {
   beforeEach(() => {
@@ -382,7 +382,7 @@ describe('Exception helpers', () => {
 
   describe('#getFormattedComments', () => {
     test('it returns formatted comment object with username and timestamp', () => {
-      const payload = getCommentsMock();
+      const payload = getCommentsArrayMock();
       const result = getFormattedComments(payload);
 
       expect(result[0].username).toEqual('some user');
@@ -390,7 +390,7 @@ describe('Exception helpers', () => {
     });
 
     test('it returns formatted timeline icon with comment users initial', () => {
-      const payload = getCommentsMock();
+      const payload = getCommentsArrayMock();
       const result = getFormattedComments(payload);
 
       const wrapper = mount<React.ReactElement>(result[0].timelineIcon as React.ReactElement);
@@ -399,12 +399,12 @@ describe('Exception helpers', () => {
     });
 
     test('it returns comment text', () => {
-      const payload = getCommentsMock();
+      const payload = getCommentsArrayMock();
       const result = getFormattedComments(payload);
 
       const wrapper = mount<React.ReactElement>(result[0].children as React.ReactElement);
 
-      expect(wrapper.text()).toEqual('some comment');
+      expect(wrapper.text()).toEqual('some old comment');
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
index 164940db619f..ae4131f9f62c 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
@@ -10,9 +10,10 @@ import { capitalize } from 'lodash';
 import moment from 'moment';
 
 import * as i18n from './translations';
-import { FormattedEntry, OperatorOption, DescriptionListItem, Comment } from './types';
+import { FormattedEntry, OperatorOption, DescriptionListItem } from './types';
 import { EXCEPTION_OPERATORS, isOperator } from './operators';
 import {
+  CommentsArray,
   Entry,
   EntriesArray,
   ExceptionListItemSchema,
@@ -183,7 +184,7 @@ export const getDescriptionListContent = (
  *
  * @param comments ExceptionItem.comments
  */
-export const getFormattedComments = (comments: Comment[]): EuiCommentProps[] =>
+export const getFormattedComments = (comments: CommentsArray): EuiCommentProps[] =>
   comments.map((comment) => ({
     username: comment.created_by,
     timestamp: moment(comment.created_at).format('on MMM Do YYYY @ HH:mm:ss'),
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts b/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts
index 24c328462ce2..ed2be64b4430 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts
@@ -26,12 +26,6 @@ export interface DescriptionListItem {
   description: NonNullable<ReactNode>;
 }
 
-export interface Comment {
-  created_by: string;
-  created_at: string;
-  comment: string;
-}
-
 export enum ExceptionListType {
   DETECTION_ENGINE = 'detection',
   ENDPOINT = 'endpoint',
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/exception_details.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/exception_details.test.tsx
index 3ea8507d82a1..f5b34b7838d2 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/exception_details.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/exception_details.test.tsx
@@ -12,7 +12,7 @@ import moment from 'moment-timezone';
 
 import { ExceptionDetails } from './exception_details';
 import { getExceptionListItemSchemaMock } from '../../../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
-import { getCommentsMock } from '../../../../../../../lists/common/schemas/types/comments.mock';
+import { getCommentsArrayMock } from '../../../../../../../lists/common/schemas/types/comments.mock';
 
 describe('ExceptionDetails', () => {
   beforeEach(() => {
@@ -42,7 +42,7 @@ describe('ExceptionDetails', () => {
 
   test('it renders comments button if comments exist', () => {
     const exceptionItem = getExceptionListItemSchemaMock();
-    exceptionItem.comments = getCommentsMock();
+    exceptionItem.comments = getCommentsArrayMock();
     const wrapper = mount(
       <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
         <ExceptionDetails
@@ -60,7 +60,7 @@ describe('ExceptionDetails', () => {
 
   test('it renders correct number of comments', () => {
     const exceptionItem = getExceptionListItemSchemaMock();
-    exceptionItem.comments = [getCommentsMock()[0]];
+    exceptionItem.comments = [getCommentsArrayMock()[0]];
     const wrapper = mount(
       <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
         <ExceptionDetails
@@ -78,7 +78,7 @@ describe('ExceptionDetails', () => {
 
   test('it renders comments plural if more than one', () => {
     const exceptionItem = getExceptionListItemSchemaMock();
-    exceptionItem.comments = getCommentsMock();
+    exceptionItem.comments = getCommentsArrayMock();
     const wrapper = mount(
       <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
         <ExceptionDetails
@@ -96,7 +96,7 @@ describe('ExceptionDetails', () => {
 
   test('it renders comments show text if "showComments" is false', () => {
     const exceptionItem = getExceptionListItemSchemaMock();
-    exceptionItem.comments = getCommentsMock();
+    exceptionItem.comments = getCommentsArrayMock();
     const wrapper = mount(
       <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
         <ExceptionDetails
@@ -114,7 +114,7 @@ describe('ExceptionDetails', () => {
 
   test('it renders comments hide text if "showComments" is true', () => {
     const exceptionItem = getExceptionListItemSchemaMock();
-    exceptionItem.comments = getCommentsMock();
+    exceptionItem.comments = getCommentsArrayMock();
     const wrapper = mount(
       <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
         <ExceptionDetails
@@ -133,7 +133,7 @@ describe('ExceptionDetails', () => {
   test('it invokes "onCommentsClick" when comments button clicked', () => {
     const mockOnCommentsClick = jest.fn();
     const exceptionItem = getExceptionListItemSchemaMock();
-    exceptionItem.comments = getCommentsMock();
+    exceptionItem.comments = getCommentsArrayMock();
     const wrapper = mount(
       <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
         <ExceptionDetails
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.stories.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.stories.tsx
index b5f18feb4850..56b029aaee81 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.stories.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.stories.tsx
@@ -11,7 +11,7 @@ import euiLightVars from '@elastic/eui/dist/eui_theme_light.json';
 
 import { ExceptionItem } from './';
 import { getExceptionListItemSchemaMock } from '../../../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
-import { getCommentsMock } from '../../../../../../../lists/common/schemas/types/comments.mock';
+import { getCommentsArrayMock } from '../../../../../../../lists/common/schemas/types/comments.mock';
 
 addDecorator((storyFn) => (
   <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>{storyFn()}</ThemeProvider>
@@ -68,7 +68,7 @@ storiesOf('Components|ExceptionItem', module)
     const payload = getExceptionListItemSchemaMock();
     payload._tags = [];
     payload.description = '';
-    payload.comments = getCommentsMock();
+    payload.comments = getCommentsArrayMock();
     payload.entries = [
       {
         field: 'actingProcess.file.signer',
@@ -106,7 +106,7 @@ storiesOf('Components|ExceptionItem', module)
   })
   .add('with everything', () => {
     const payload = getExceptionListItemSchemaMock();
-    payload.comments = getCommentsMock();
+    payload.comments = getCommentsArrayMock();
     return (
       <ExceptionItem
         loadingItemIds={[]}
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.test.tsx
index 654193952759..0e2908fc3423 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.test.tsx
@@ -11,7 +11,7 @@ import euiLightVars from '@elastic/eui/dist/eui_theme_light.json';
 
 import { ExceptionItem } from './';
 import { getExceptionListItemSchemaMock } from '../../../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
-import { getCommentsMock } from '../../../../../../../lists/common/schemas/types/comments.mock';
+import { getCommentsArrayMock } from '../../../../../../../lists/common/schemas/types/comments.mock';
 
 describe('ExceptionItem', () => {
   it('it renders ExceptionDetails and ExceptionEntries', () => {
@@ -83,7 +83,7 @@ describe('ExceptionItem', () => {
   it('it renders comment accordion closed to begin with', () => {
     const mockOnDeleteException = jest.fn();
     const exceptionItem = getExceptionListItemSchemaMock();
-    exceptionItem.comments = getCommentsMock();
+    exceptionItem.comments = getCommentsArrayMock();
     const wrapper = mount(
       <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
         <ExceptionItem
@@ -102,7 +102,7 @@ describe('ExceptionItem', () => {
   it('it renders comment accordion open when showComments is true', () => {
     const mockOnDeleteException = jest.fn();
     const exceptionItem = getExceptionListItemSchemaMock();
-    exceptionItem.comments = getCommentsMock();
+    exceptionItem.comments = getCommentsArrayMock();
     const wrapper = mount(
       <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
         <ExceptionItem
diff --git a/x-pack/plugins/security_solution/public/lists_plugin_deps.ts b/x-pack/plugins/security_solution/public/lists_plugin_deps.ts
index 575ff26330a4..f3a724a755a4 100644
--- a/x-pack/plugins/security_solution/public/lists_plugin_deps.ts
+++ b/x-pack/plugins/security_solution/public/lists_plugin_deps.ts
@@ -15,6 +15,7 @@ export {
   UseExceptionListSuccess,
 } from '../../lists/public';
 export {
+  CommentsArray,
   ExceptionListSchema,
   ExceptionListItemSchema,
   Entry,

From 6808903d5704fa712f9a4170b3bf8fc877231545 Mon Sep 17 00:00:00 2001
From: Christos Nasikas <christos.nasikas@elastic.co>
Date: Fri, 26 Jun 2020 21:31:41 +0300
Subject: [PATCH 60/78] [SIEM][CASE] Persist callout when dismissed (#68372)

---
 x-pack/plugins/security_solution/package.json |   3 +-
 .../no_write_alerts_callout/translations.ts   |   4 +-
 .../cases/components/callout/callout.test.tsx |  89 +++++++
 .../cases/components/callout/callout.tsx      |  53 ++++
 .../cases/components/callout/helpers.test.tsx |  28 +++
 .../cases/components/callout/helpers.tsx      |  12 +-
 .../cases/components/callout/index.test.tsx   | 234 +++++++++++++-----
 .../public/cases/components/callout/index.tsx | 136 +++++-----
 .../cases/components/callout/translations.ts  |   4 +-
 .../public/cases/components/callout/types.ts  |  12 +
 .../use_push_to_service/helpers.tsx           |   9 +-
 .../use_push_to_service/index.test.tsx        |  16 +-
 .../components/use_push_to_service/index.tsx  |  11 +-
 .../public/cases/pages/case.tsx               |   6 +-
 .../public/cases/pages/case_details.tsx       |   6 +-
 .../use_messages_storage.test.tsx             |  85 +++++++
 .../local_storage/use_messages_storage.tsx    |  52 ++++
 .../public/common/mock/kibana_react.ts        |   3 +
 .../timeline/header/translations.ts           |   2 +-
 yarn.lock                                     |   7 +
 20 files changed, 618 insertions(+), 154 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/callout/callout.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/callout/callout.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/callout/helpers.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/callout/types.ts
 create mode 100644 x-pack/plugins/security_solution/public/common/containers/local_storage/use_messages_storage.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/containers/local_storage/use_messages_storage.tsx

diff --git a/x-pack/plugins/security_solution/package.json b/x-pack/plugins/security_solution/package.json
index 108ed6695885..1ce5243bf795 100644
--- a/x-pack/plugins/security_solution/package.json
+++ b/x-pack/plugins/security_solution/package.json
@@ -13,7 +13,8 @@
     "test:generate": "ts-node --project scripts/endpoint/cli_tsconfig.json scripts/endpoint/resolver_generator.ts"
   },
   "devDependencies": {
-    "@types/lodash": "^4.14.110"
+    "@types/lodash": "^4.14.110",
+    "@types/md5": "^2.2.0"
   },
   "dependencies": {
     "@types/rbush": "^3.0.0",
diff --git a/x-pack/plugins/security_solution/public/alerts/components/no_write_alerts_callout/translations.ts b/x-pack/plugins/security_solution/public/alerts/components/no_write_alerts_callout/translations.ts
index d036c422b2fb..211bd21c915c 100644
--- a/x-pack/plugins/security_solution/public/alerts/components/no_write_alerts_callout/translations.ts
+++ b/x-pack/plugins/security_solution/public/alerts/components/no_write_alerts_callout/translations.ts
@@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n';
 export const NO_WRITE_ALERTS_CALLOUT_TITLE = i18n.translate(
   'xpack.securitySolution.detectionEngine.noWriteAlertsCallOutTitle',
   {
-    defaultMessage: 'Alerts index permissions required',
+    defaultMessage: 'You cannot change alert states',
   }
 );
 
@@ -17,7 +17,7 @@ export const NO_WRITE_ALERTS_CALLOUT_MSG = i18n.translate(
   'xpack.securitySolution.detectionEngine.noWriteAlertsCallOutMsg',
   {
     defaultMessage:
-      'You are currently missing the required permissions to update alerts. Please contact your administrator for further assistance.',
+      'You only have permissions to view alerts. If you need to update alert states (open or close alerts), contact your Kibana administrator.',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/cases/components/callout/callout.test.tsx b/x-pack/plugins/security_solution/public/cases/components/callout/callout.test.tsx
new file mode 100644
index 000000000000..7a344d9360b7
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/callout/callout.test.tsx
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+
+import { CallOut, CallOutProps } from './callout';
+
+describe('Callout', () => {
+  const defaultProps: CallOutProps = {
+    id: 'md5-hex',
+    type: 'primary',
+    title: 'a tittle',
+    messages: [
+      {
+        id: 'generic-error',
+        title: 'message-one',
+        description: <p>{'error'}</p>,
+      },
+    ],
+    showCallOut: true,
+    handleDismissCallout: jest.fn(),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('It renders the callout', () => {
+    const wrapper = mount(<CallOut {...defaultProps} />);
+    expect(wrapper.find(`[data-test-subj="case-callout-md5-hex"]`).exists()).toBeTruthy();
+    expect(wrapper.find(`[data-test-subj="callout-messages-md5-hex"]`).exists()).toBeTruthy();
+    expect(wrapper.find(`[data-test-subj="callout-dismiss-md5-hex"]`).exists()).toBeTruthy();
+  });
+
+  it('hides the callout', () => {
+    const wrapper = mount(<CallOut {...defaultProps} showCallOut={false} />);
+    expect(wrapper.find(`[data-test-subj="case-callout-md5-hex"]`).exists()).toBeFalsy();
+  });
+
+  it('does not shows any messages when the list is empty', () => {
+    const wrapper = mount(<CallOut {...defaultProps} messages={[]} />);
+    expect(wrapper.find(`[data-test-subj="callout-messages-md5-hex"]`).exists()).toBeFalsy();
+  });
+
+  it('transform the button color correctly - primary', () => {
+    const wrapper = mount(<CallOut {...defaultProps} />);
+    const className =
+      wrapper.find(`button[data-test-subj="callout-dismiss-md5-hex"]`).first().prop('className') ??
+      '';
+    expect(className.includes('euiButton--primary')).toBeTruthy();
+  });
+
+  it('transform the button color correctly - success', () => {
+    const wrapper = mount(<CallOut {...defaultProps} type={'success'} />);
+    const className =
+      wrapper.find(`button[data-test-subj="callout-dismiss-md5-hex"]`).first().prop('className') ??
+      '';
+    expect(className.includes('euiButton--secondary')).toBeTruthy();
+  });
+
+  it('transform the button color correctly - warning', () => {
+    const wrapper = mount(<CallOut {...defaultProps} type={'warning'} />);
+    const className =
+      wrapper.find(`button[data-test-subj="callout-dismiss-md5-hex"]`).first().prop('className') ??
+      '';
+    expect(className.includes('euiButton--warning')).toBeTruthy();
+  });
+
+  it('transform the button color correctly - danger', () => {
+    const wrapper = mount(<CallOut {...defaultProps} type={'danger'} />);
+    const className =
+      wrapper.find(`button[data-test-subj="callout-dismiss-md5-hex"]`).first().prop('className') ??
+      '';
+    expect(className.includes('euiButton--danger')).toBeTruthy();
+  });
+
+  it('dismiss the callout correctly', () => {
+    const wrapper = mount(<CallOut {...defaultProps} messages={[]} />);
+    expect(wrapper.find(`[data-test-subj="callout-dismiss-md5-hex"]`).exists()).toBeTruthy();
+    wrapper.find(`button[data-test-subj="callout-dismiss-md5-hex"]`).simulate('click');
+    wrapper.update();
+
+    expect(defaultProps.handleDismissCallout).toHaveBeenCalledWith('md5-hex', 'primary');
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/callout/callout.tsx b/x-pack/plugins/security_solution/public/cases/components/callout/callout.tsx
new file mode 100644
index 000000000000..e1ebe5c5db17
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/callout/callout.tsx
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiCallOut, EuiButton, EuiDescriptionList } from '@elastic/eui';
+import { isEmpty } from 'lodash/fp';
+import React, { memo, useCallback } from 'react';
+
+import { ErrorMessage } from './types';
+import * as i18n from './translations';
+
+export interface CallOutProps {
+  id: string;
+  type: NonNullable<ErrorMessage['errorType']>;
+  title: string;
+  messages: ErrorMessage[];
+  showCallOut: boolean;
+  handleDismissCallout: (id: string, type: NonNullable<ErrorMessage['errorType']>) => void;
+}
+
+const CallOutComponent = ({
+  id,
+  type,
+  title,
+  messages,
+  showCallOut,
+  handleDismissCallout,
+}: CallOutProps) => {
+  const handleCallOut = useCallback(() => handleDismissCallout(id, type), [
+    handleDismissCallout,
+    id,
+    type,
+  ]);
+
+  return showCallOut ? (
+    <EuiCallOut title={title} color={type} iconType="gear" data-test-subj={`case-callout-${id}`}>
+      {!isEmpty(messages) && (
+        <EuiDescriptionList data-test-subj={`callout-messages-${id}`} listItems={messages} />
+      )}
+      <EuiButton
+        data-test-subj={`callout-dismiss-${id}`}
+        color={type === 'success' ? 'secondary' : type}
+        onClick={handleCallOut}
+      >
+        {i18n.DISMISS_CALLOUT}
+      </EuiButton>
+    </EuiCallOut>
+  ) : null;
+};
+
+export const CallOut = memo(CallOutComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/callout/helpers.test.tsx b/x-pack/plugins/security_solution/public/cases/components/callout/helpers.test.tsx
new file mode 100644
index 000000000000..c5fb7f3fa447
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/callout/helpers.test.tsx
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import md5 from 'md5';
+import { createCalloutId } from './helpers';
+
+describe('createCalloutId', () => {
+  it('creates id correctly with one id', () => {
+    const digest = md5('one');
+    const id = createCalloutId(['one']);
+    expect(id).toBe(digest);
+  });
+
+  it('creates id correctly with multiples ids', () => {
+    const digest = md5('one|two|three');
+    const id = createCalloutId(['one', 'two', 'three']);
+    expect(id).toBe(digest);
+  });
+
+  it('creates id correctly with multiples ids and delimiter', () => {
+    const digest = md5('one,two,three');
+    const id = createCalloutId(['one', 'two', 'three'], ',');
+    expect(id).toBe(digest);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/callout/helpers.tsx b/x-pack/plugins/security_solution/public/cases/components/callout/helpers.tsx
index 323710427447..23c1abda66a7 100644
--- a/x-pack/plugins/security_solution/public/cases/components/callout/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/callout/helpers.tsx
@@ -3,10 +3,18 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import React from 'react';
+import md5 from 'md5';
 
 import * as i18n from './translations';
+import { ErrorMessage } from './types';
 
-export const savedObjectReadOnly = {
+export const savedObjectReadOnlyErrorMessage: ErrorMessage = {
+  id: 'read-only-privileges-error',
   title: i18n.READ_ONLY_SAVED_OBJECT_TITLE,
-  description: i18n.READ_ONLY_SAVED_OBJECT_MSG,
+  description: <>{i18n.READ_ONLY_SAVED_OBJECT_MSG}</>,
+  errorType: 'warning',
 };
+
+export const createCalloutId = (ids: string[], delimiter: string = '|'): string =>
+  md5(ids.join(delimiter));
diff --git a/x-pack/plugins/security_solution/public/cases/components/callout/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/callout/index.test.tsx
index ee3faeb2ceeb..6d8917218c7c 100644
--- a/x-pack/plugins/security_solution/public/cases/components/callout/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/callout/index.test.tsx
@@ -7,104 +7,210 @@
 import React from 'react';
 import { mount } from 'enzyme';
 
-import { CaseCallOut } from '.';
+import { useMessagesStorage } from '../../../common/containers/local_storage/use_messages_storage';
+import { TestProviders } from '../../../common/mock';
+import { createCalloutId } from './helpers';
+import { CaseCallOut, CaseCallOutProps } from '.';
 
-const defaultProps = {
-  title: 'hey title',
+jest.mock('../../../common/containers/local_storage/use_messages_storage');
+
+const useSecurityLocalStorageMock = useMessagesStorage as jest.Mock;
+const securityLocalStorageMock = {
+  getMessages: jest.fn(() => []),
+  addMessage: jest.fn(),
 };
 
 describe('CaseCallOut ', () => {
-  it('Renders single message callout', () => {
-    const props = {
-      ...defaultProps,
-      message: 'we have one message',
-    };
-
-    const wrapper = mount(<CaseCallOut {...props} />);
-
-    expect(wrapper.find(`[data-test-subj="callout-message-primary"]`).last().exists()).toBeTruthy();
+  beforeEach(() => {
+    jest.clearAllMocks();
+    useSecurityLocalStorageMock.mockImplementation(() => securityLocalStorageMock);
   });
 
-  it('Renders multi message callout', () => {
-    const props = {
-      ...defaultProps,
+  it('renders a callout correctly', () => {
+    const props: CaseCallOutProps = {
+      title: 'hey title',
       messages: [
-        { ...defaultProps, description: <p>{'we have two messages'}</p> },
-        { ...defaultProps, description: <p>{'for real'}</p> },
+        { id: 'message-one', title: 'title', description: <p>{'we have two messages'}</p> },
+        { id: 'message-two', title: 'title', description: <p>{'for real'}</p> },
       ],
     };
-    const wrapper = mount(<CaseCallOut {...props} />);
-    expect(wrapper.find(`[data-test-subj="callout-message-primary"]`).last().exists()).toBeFalsy();
-    expect(
-      wrapper.find(`[data-test-subj="callout-messages-primary"]`).last().exists()
-    ).toBeTruthy();
+    const wrapper = mount(
+      <TestProviders>
+        <CaseCallOut {...props} />
+      </TestProviders>
+    );
+
+    const id = createCalloutId(['message-one', 'message-two']);
+    expect(wrapper.find(`[data-test-subj="callout-messages-${id}"]`).last().exists()).toBeTruthy();
   });
 
-  it('it shows the correct type of callouts', () => {
-    const props = {
-      ...defaultProps,
+  it('groups the messages correctly', () => {
+    const props: CaseCallOutProps = {
+      title: 'hey title',
       messages: [
         {
-          ...defaultProps,
+          id: 'message-one',
+          title: 'title one',
           description: <p>{'we have two messages'}</p>,
-          errorType: 'danger' as 'primary' | 'success' | 'warning' | 'danger',
+          errorType: 'danger',
         },
-        { ...defaultProps, description: <p>{'for real'}</p> },
+        { id: 'message-two', title: 'title two', description: <p>{'for real'}</p> },
       ],
     };
-    const wrapper = mount(<CaseCallOut {...props} />);
-    expect(wrapper.find(`[data-test-subj="callout-messages-danger"]`).last().exists()).toBeTruthy();
 
+    const wrapper = mount(
+      <TestProviders>
+        <CaseCallOut {...props} />
+      </TestProviders>
+    );
+
+    const idDanger = createCalloutId(['message-one']);
+    const idPrimary = createCalloutId(['message-two']);
+
+    expect(
+      wrapper.find(`[data-test-subj="case-callout-${idPrimary}"]`).last().exists()
+    ).toBeTruthy();
     expect(
-      wrapper.find(`[data-test-subj="callout-messages-primary"]`).last().exists()
+      wrapper.find(`[data-test-subj="case-callout-${idDanger}"]`).last().exists()
     ).toBeTruthy();
   });
 
-  it('it applies the correct color to button', () => {
-    const props = {
-      ...defaultProps,
+  it('dismisses the callout correctly', () => {
+    const props: CaseCallOutProps = {
+      title: 'hey title',
       messages: [
-        {
-          ...defaultProps,
-          description: <p>{'one'}</p>,
-          errorType: 'danger' as 'primary' | 'success' | 'warning' | 'danger',
-        },
-        {
-          ...defaultProps,
-          description: <p>{'two'}</p>,
-          errorType: 'success' as 'primary' | 'success' | 'warning' | 'danger',
-        },
-        {
-          ...defaultProps,
-          description: <p>{'three'}</p>,
-          errorType: 'primary' as 'primary' | 'success' | 'warning' | 'danger',
-        },
+        { id: 'message-one', title: 'title', description: <p>{'we have two messages'}</p> },
       ],
     };
+    const wrapper = mount(
+      <TestProviders>
+        <CaseCallOut {...props} />
+      </TestProviders>
+    );
 
-    const wrapper = mount(<CaseCallOut {...props} />);
+    const id = createCalloutId(['message-one']);
+
+    expect(wrapper.find(`[data-test-subj="case-callout-${id}"]`).last().exists()).toBeTruthy();
+    wrapper.find(`[data-test-subj="callout-dismiss-${id}"]`).last().simulate('click');
+    expect(wrapper.find(`[data-test-subj="case-callout-${id}"]`).exists()).toBeFalsy();
+  });
+
+  it('persist the callout of type primary when dismissed', () => {
+    const props: CaseCallOutProps = {
+      title: 'hey title',
+      messages: [
+        { id: 'message-one', title: 'title', description: <p>{'we have two messages'}</p> },
+      ],
+    };
 
-    expect(wrapper.find(`[data-test-subj="callout-dismiss-danger"]`).first().prop('color')).toBe(
-      'danger'
+    const wrapper = mount(
+      <TestProviders>
+        <CaseCallOut {...props} />
+      </TestProviders>
     );
 
-    expect(wrapper.find(`[data-test-subj="callout-dismiss-success"]`).first().prop('color')).toBe(
-      'secondary'
+    const id = createCalloutId(['message-one']);
+    expect(securityLocalStorageMock.getMessages).toHaveBeenCalledWith('case');
+    wrapper.find(`[data-test-subj="callout-dismiss-${id}"]`).last().simulate('click');
+    expect(securityLocalStorageMock.addMessage).toHaveBeenCalledWith('case', id);
+  });
+
+  it('do not show the callout if is in the localStorage', () => {
+    const props: CaseCallOutProps = {
+      title: 'hey title',
+      messages: [
+        { id: 'message-one', title: 'title', description: <p>{'we have two messages'}</p> },
+      ],
+    };
+
+    const id = createCalloutId(['message-one']);
+
+    useSecurityLocalStorageMock.mockImplementation(() => ({
+      ...securityLocalStorageMock,
+      getMessages: jest.fn(() => [id]),
+    }));
+
+    const wrapper = mount(
+      <TestProviders>
+        <CaseCallOut {...props} />
+      </TestProviders>
     );
 
-    expect(wrapper.find(`[data-test-subj="callout-dismiss-primary"]`).first().prop('color')).toBe(
-      'primary'
+    expect(wrapper.find(`[data-test-subj="case-callout-${id}"]`).last().exists()).toBeFalsy();
+  });
+
+  it('do not persist a callout of type danger', () => {
+    const props: CaseCallOutProps = {
+      title: 'hey title',
+      messages: [
+        {
+          id: 'message-one',
+          title: 'title one',
+          description: <p>{'we have two messages'}</p>,
+          errorType: 'danger',
+        },
+      ],
+    };
+
+    const wrapper = mount(
+      <TestProviders>
+        <CaseCallOut {...props} />
+      </TestProviders>
     );
+
+    const id = createCalloutId(['message-one']);
+    wrapper.find(`button[data-test-subj="callout-dismiss-${id}"]`).simulate('click');
+    wrapper.update();
+    expect(securityLocalStorageMock.addMessage).not.toHaveBeenCalled();
   });
 
-  it('Dismisses callout', () => {
-    const props = {
-      ...defaultProps,
-      message: 'we have one message',
+  it('do not persist a callout of type warning', () => {
+    const props: CaseCallOutProps = {
+      title: 'hey title',
+      messages: [
+        {
+          id: 'message-one',
+          title: 'title one',
+          description: <p>{'we have two messages'}</p>,
+          errorType: 'warning',
+        },
+      ],
     };
-    const wrapper = mount(<CaseCallOut {...props} />);
-    expect(wrapper.find(`[data-test-subj="case-call-out-primary"]`).exists()).toBeTruthy();
-    wrapper.find(`[data-test-subj="callout-dismiss-primary"]`).last().simulate('click');
-    expect(wrapper.find(`[data-test-subj="case-call-out-primary"]`).exists()).toBeFalsy();
+
+    const wrapper = mount(
+      <TestProviders>
+        <CaseCallOut {...props} />
+      </TestProviders>
+    );
+
+    const id = createCalloutId(['message-one']);
+    wrapper.find(`button[data-test-subj="callout-dismiss-${id}"]`).simulate('click');
+    wrapper.update();
+    expect(securityLocalStorageMock.addMessage).not.toHaveBeenCalled();
+  });
+
+  it('do not persist a callout of type success', () => {
+    const props: CaseCallOutProps = {
+      title: 'hey title',
+      messages: [
+        {
+          id: 'message-one',
+          title: 'title one',
+          description: <p>{'we have two messages'}</p>,
+          errorType: 'success',
+        },
+      ],
+    };
+
+    const wrapper = mount(
+      <TestProviders>
+        <CaseCallOut {...props} />
+      </TestProviders>
+    );
+
+    const id = createCalloutId(['message-one']);
+    wrapper.find(`button[data-test-subj="callout-dismiss-${id}"]`).simulate('click');
+    wrapper.update();
+    expect(securityLocalStorageMock.addMessage).not.toHaveBeenCalled();
   });
 });
diff --git a/x-pack/plugins/security_solution/public/cases/components/callout/index.tsx b/x-pack/plugins/security_solution/public/cases/components/callout/index.tsx
index 171c0508b9d9..cefaec6ad0b0 100644
--- a/x-pack/plugins/security_solution/public/cases/components/callout/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/callout/index.tsx
@@ -4,79 +4,99 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiCallOut, EuiButton, EuiDescriptionList, EuiSpacer } from '@elastic/eui';
-import { isEmpty } from 'lodash/fp';
-import React, { memo, useCallback, useState } from 'react';
+import { EuiSpacer } from '@elastic/eui';
+import React, { memo, useCallback, useState, useMemo } from 'react';
 
-import * as i18n from './translations';
+import { useMessagesStorage } from '../../../common/containers/local_storage/use_messages_storage';
+import { CallOut } from './callout';
+import { ErrorMessage } from './types';
+import { createCalloutId } from './helpers';
 
 export * from './helpers';
 
-interface ErrorMessage {
+export interface CaseCallOutProps {
   title: string;
-  description: JSX.Element;
-  errorType?: 'primary' | 'success' | 'warning' | 'danger';
+  messages?: ErrorMessage[];
 }
 
-interface CaseCallOutProps {
-  title: string;
-  message?: string;
-  messages?: ErrorMessage[];
+type GroupByTypeMessages = {
+  [key in NonNullable<ErrorMessage['errorType']>]: {
+    messagesId: string[];
+    messages: ErrorMessage[];
+  };
+};
+
+interface CalloutVisibility {
+  [index: string]: boolean;
 }
 
-const CaseCallOutComponent = ({ title, message, messages }: CaseCallOutProps) => {
-  const [showCallOut, setShowCallOut] = useState(true);
-  const handleCallOut = useCallback(() => setShowCallOut(false), [setShowCallOut]);
-  let callOutMessages = messages ?? [];
+const CaseCallOutComponent = ({ title, messages = [] }: CaseCallOutProps) => {
+  const { getMessages, addMessage } = useMessagesStorage();
+
+  const caseMessages = useMemo(() => getMessages('case'), [getMessages]);
+  const dismissedCallouts = useMemo(
+    () =>
+      caseMessages.reduce<CalloutVisibility>(
+        (acc, id) => ({
+          ...acc,
+          [id]: false,
+        }),
+        {}
+      ),
+    [caseMessages]
+  );
 
-  if (message) {
-    callOutMessages = [
-      ...callOutMessages,
-      {
-        title: '',
-        description: <p data-test-subj="callout-message-primary">{message}</p>,
-        errorType: 'primary',
-      },
-    ];
-  }
+  const [calloutVisibility, setCalloutVisibility] = useState(dismissedCallouts);
+  const handleCallOut = useCallback(
+    (id, type) => {
+      setCalloutVisibility((prevState) => ({ ...prevState, [id]: false }));
+      if (type === 'primary') {
+        addMessage('case', id);
+      }
+    },
+    [setCalloutVisibility, addMessage]
+  );
 
-  const groupedErrorMessages = callOutMessages.reduce((acc, currentMessage: ErrorMessage) => {
-    const key = currentMessage.errorType == null ? 'primary' : currentMessage.errorType;
-    return {
-      ...acc,
-      [key]: [...(acc[key] || []), currentMessage],
-    };
-  }, {} as { [key in NonNullable<ErrorMessage['errorType']>]: ErrorMessage[] });
+  const groupedByTypeErrorMessages = useMemo(
+    () =>
+      messages.reduce<GroupByTypeMessages>(
+        (acc: GroupByTypeMessages, currentMessage: ErrorMessage) => {
+          const type = currentMessage.errorType == null ? 'primary' : currentMessage.errorType;
+          return {
+            ...acc,
+            [type]: {
+              messagesId: [...(acc[type]?.messagesId ?? []), currentMessage.id],
+              messages: [...(acc[type]?.messages ?? []), currentMessage],
+            },
+          };
+        },
+        {} as GroupByTypeMessages
+      ),
+    [messages]
+  );
 
-  return showCallOut ? (
+  return (
     <>
-      {(Object.keys(groupedErrorMessages) as Array<keyof ErrorMessage['errorType']>).map((key) => (
-        <React.Fragment key={key}>
-          <EuiCallOut
-            title={title}
-            color={key}
-            iconType="gear"
-            data-test-subj={`case-call-out-${key}`}
-          >
-            {!isEmpty(groupedErrorMessages[key]) && (
-              <EuiDescriptionList
-                data-test-subj={`callout-messages-${key}`}
-                listItems={groupedErrorMessages[key]}
+      {(Object.keys(groupedByTypeErrorMessages) as Array<keyof ErrorMessage['errorType']>).map(
+        (type: NonNullable<ErrorMessage['errorType']>) => {
+          const id = createCalloutId(groupedByTypeErrorMessages[type].messagesId);
+          return (
+            <React.Fragment key={id}>
+              <CallOut
+                id={id}
+                type={type}
+                title={title}
+                messages={groupedByTypeErrorMessages[type].messages}
+                showCallOut={calloutVisibility[id] ?? true}
+                handleDismissCallout={handleCallOut}
               />
-            )}
-            <EuiButton
-              data-test-subj={`callout-dismiss-${key}`}
-              color={key === 'success' ? 'secondary' : key}
-              onClick={handleCallOut}
-            >
-              {i18n.DISMISS_CALLOUT}
-            </EuiButton>
-          </EuiCallOut>
-          <EuiSpacer />
-        </React.Fragment>
-      ))}
+              <EuiSpacer />
+            </React.Fragment>
+          );
+        }
+      )}
     </>
-  ) : null;
+  );
 };
 
 export const CaseCallOut = memo(CaseCallOutComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/callout/translations.ts b/x-pack/plugins/security_solution/public/cases/components/callout/translations.ts
index 01956ca94299..2ba3df82102e 100644
--- a/x-pack/plugins/security_solution/public/cases/components/callout/translations.ts
+++ b/x-pack/plugins/security_solution/public/cases/components/callout/translations.ts
@@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n';
 export const READ_ONLY_SAVED_OBJECT_TITLE = i18n.translate(
   'xpack.securitySolution.case.readOnlySavedObjectTitle',
   {
-    defaultMessage: 'You have read-only feature privileges',
+    defaultMessage: 'You cannot open new or update existing cases',
   }
 );
 
@@ -17,7 +17,7 @@ export const READ_ONLY_SAVED_OBJECT_MSG = i18n.translate(
   'xpack.securitySolution.case.readOnlySavedObjectDescription',
   {
     defaultMessage:
-      'You are only allowed to view cases. If you need to open and update cases, contact your Kibana administrator',
+      'You only have permissions to view cases. If you need to open and update cases, contact your Kibana administrator.',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/cases/components/callout/types.ts b/x-pack/plugins/security_solution/public/cases/components/callout/types.ts
new file mode 100644
index 000000000000..1f07ef1bd924
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/callout/types.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface ErrorMessage {
+  id: string;
+  title: string;
+  description: JSX.Element;
+  errorType?: 'primary' | 'success' | 'warning' | 'danger';
+}
diff --git a/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/helpers.tsx b/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/helpers.tsx
index 919231d2f603..43f2a2a6e12f 100644
--- a/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/helpers.tsx
@@ -10,8 +10,10 @@ import React from 'react';
 
 import * as i18n from './translations';
 import { ActionLicense } from '../../containers/types';
+import { ErrorMessage } from '../callout/types';
 
 export const getLicenseError = () => ({
+  id: 'license-error',
   title: i18n.PUSH_DISABLE_BY_LICENSE_TITLE,
   description: (
     <FormattedMessage
@@ -29,6 +31,7 @@ export const getLicenseError = () => ({
 });
 
 export const getKibanaConfigError = () => ({
+  id: 'kibana-config-error',
   title: i18n.PUSH_DISABLE_BY_KIBANA_CONFIG_TITLE,
   description: (
     <FormattedMessage
@@ -45,10 +48,8 @@ export const getKibanaConfigError = () => ({
   ),
 });
 
-export const getActionLicenseError = (
-  actionLicense: ActionLicense | null
-): Array<{ title: string; description: JSX.Element }> => {
-  let errors: Array<{ title: string; description: JSX.Element }> = [];
+export const getActionLicenseError = (actionLicense: ActionLicense | null): ErrorMessage[] => {
+  let errors: ErrorMessage[] = [];
   if (actionLicense != null && !actionLicense.enabledInLicense) {
     errors = [...errors, getLicenseError()];
   }
diff --git a/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/index.test.tsx
index f2de830a7164..d17a2bd21591 100644
--- a/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/index.test.tsx
@@ -10,9 +10,7 @@ import { usePushToService, ReturnUsePushToService, UsePushToService } from '.';
 import { TestProviders } from '../../../common/mock';
 import { usePostPushToService } from '../../containers/use_post_push_to_service';
 import { basicPush, actionLicenses } from '../../containers/mock';
-import * as i18n from './translations';
 import { useGetActionLicense } from '../../containers/use_get_action_license';
-import { getKibanaConfigError, getLicenseError } from './helpers';
 import { connectorsMock } from '../../containers/configure/mock';
 
 jest.mock('react-router-dom', () => {
@@ -110,7 +108,7 @@ describe('usePushToService', () => {
       await waitForNextUpdate();
       const errorsMsg = result.current.pushCallouts?.props.messages;
       expect(errorsMsg).toHaveLength(1);
-      expect(errorsMsg[0].title).toEqual(getLicenseError().title);
+      expect(errorsMsg[0].id).toEqual('license-error');
     });
   });
 
@@ -132,7 +130,7 @@ describe('usePushToService', () => {
       await waitForNextUpdate();
       const errorsMsg = result.current.pushCallouts?.props.messages;
       expect(errorsMsg).toHaveLength(1);
-      expect(errorsMsg[0].title).toEqual(getKibanaConfigError().title);
+      expect(errorsMsg[0].id).toEqual('kibana-config-error');
     });
   });
 
@@ -152,7 +150,7 @@ describe('usePushToService', () => {
       await waitForNextUpdate();
       const errorsMsg = result.current.pushCallouts?.props.messages;
       expect(errorsMsg).toHaveLength(1);
-      expect(errorsMsg[0].title).toEqual(i18n.PUSH_DISABLE_BY_NO_CONFIG_TITLE);
+      expect(errorsMsg[0].id).toEqual('connector-missing-error');
     });
   });
 
@@ -171,7 +169,7 @@ describe('usePushToService', () => {
       await waitForNextUpdate();
       const errorsMsg = result.current.pushCallouts?.props.messages;
       expect(errorsMsg).toHaveLength(1);
-      expect(errorsMsg[0].title).toEqual(i18n.PUSH_DISABLE_BY_NO_CASE_CONFIG_TITLE);
+      expect(errorsMsg[0].id).toEqual('connector-not-selected-error');
     });
   });
 
@@ -191,7 +189,7 @@ describe('usePushToService', () => {
       await waitForNextUpdate();
       const errorsMsg = result.current.pushCallouts?.props.messages;
       expect(errorsMsg).toHaveLength(1);
-      expect(errorsMsg[0].title).toEqual(i18n.PUSH_DISABLE_BY_NO_CASE_CONFIG_TITLE);
+      expect(errorsMsg[0].id).toEqual('connector-deleted-error');
     });
   });
 
@@ -212,7 +210,7 @@ describe('usePushToService', () => {
       await waitForNextUpdate();
       const errorsMsg = result.current.pushCallouts?.props.messages;
       expect(errorsMsg).toHaveLength(1);
-      expect(errorsMsg[0].title).toEqual(i18n.PUSH_DISABLE_BY_NO_CASE_CONFIG_TITLE);
+      expect(errorsMsg[0].id).toEqual('connector-deleted-error');
     });
   });
 
@@ -231,7 +229,7 @@ describe('usePushToService', () => {
       await waitForNextUpdate();
       const errorsMsg = result.current.pushCallouts?.props.messages;
       expect(errorsMsg).toHaveLength(1);
-      expect(errorsMsg[0].title).toEqual(i18n.PUSH_DISABLE_BECAUSE_CASE_CLOSED_TITLE);
+      expect(errorsMsg[0].id).toEqual('closed-case-push-error');
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/index.tsx b/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/index.tsx
index 45b515ccacac..7b4a29098bdd 100644
--- a/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/use_push_to_service/index.tsx
@@ -20,6 +20,7 @@ import { Connector } from '../../../../../case/common/api/cases';
 import { CaseServices } from '../../containers/use_get_case_user_actions';
 import { LinkAnchor } from '../../../common/components/links';
 import { SecurityPageName } from '../../../app/types';
+import { ErrorMessage } from '../callout/types';
 
 export interface UsePushToService {
   caseId: string;
@@ -76,11 +77,7 @@ export const usePushToService = ({
   );
 
   const errorsMsg = useMemo(() => {
-    let errors: Array<{
-      title: string;
-      description: JSX.Element;
-      errorType?: 'primary' | 'success' | 'warning' | 'danger';
-    }> = [];
+    let errors: ErrorMessage[] = [];
     if (actionLicense != null && !actionLicense.enabledInLicense) {
       errors = [...errors, getLicenseError()];
     }
@@ -88,6 +85,7 @@ export const usePushToService = ({
       errors = [
         ...errors,
         {
+          id: 'connector-missing-error',
           title: i18n.PUSH_DISABLE_BY_NO_CONFIG_TITLE,
           description: (
             <FormattedMessage
@@ -112,6 +110,7 @@ export const usePushToService = ({
       errors = [
         ...errors,
         {
+          id: 'connector-not-selected-error',
           title: i18n.PUSH_DISABLE_BY_NO_CASE_CONFIG_TITLE,
           description: (
             <FormattedMessage
@@ -125,6 +124,7 @@ export const usePushToService = ({
       errors = [
         ...errors,
         {
+          id: 'connector-deleted-error',
           title: i18n.PUSH_DISABLE_BY_NO_CASE_CONFIG_TITLE,
           description: (
             <FormattedMessage
@@ -140,6 +140,7 @@ export const usePushToService = ({
       errors = [
         ...errors,
         {
+          id: 'closed-case-push-error',
           title: i18n.PUSH_DISABLE_BECAUSE_CASE_CLOSED_TITLE,
           description: (
             <FormattedMessage
diff --git a/x-pack/plugins/security_solution/public/cases/pages/case.tsx b/x-pack/plugins/security_solution/public/cases/pages/case.tsx
index eb6da9579e4e..802394c400d2 100644
--- a/x-pack/plugins/security_solution/public/cases/pages/case.tsx
+++ b/x-pack/plugins/security_solution/public/cases/pages/case.tsx
@@ -11,7 +11,7 @@ import { useGetUserSavedObjectPermissions } from '../../common/lib/kibana';
 import { SpyRoute } from '../../common/utils/route/spy_routes';
 import { AllCases } from '../components/all_cases';
 
-import { savedObjectReadOnly, CaseCallOut } from '../components/callout';
+import { savedObjectReadOnlyErrorMessage, CaseCallOut } from '../components/callout';
 import { CaseSavedObjectNoPermissions } from './saved_object_no_permissions';
 import { SecurityPageName } from '../../app/types';
 
@@ -23,8 +23,8 @@ export const CasesPage = React.memo(() => {
       <WrapperPage>
         {userPermissions != null && !userPermissions?.crud && userPermissions?.read && (
           <CaseCallOut
-            title={savedObjectReadOnly.title}
-            message={savedObjectReadOnly.description}
+            title={savedObjectReadOnlyErrorMessage.title}
+            messages={[{ ...savedObjectReadOnlyErrorMessage }]}
           />
         )}
         <AllCases userCanCrud={userPermissions?.crud ?? false} />
diff --git a/x-pack/plugins/security_solution/public/cases/pages/case_details.tsx b/x-pack/plugins/security_solution/public/cases/pages/case_details.tsx
index 43c51b32bce0..c3538f0c18ed 100644
--- a/x-pack/plugins/security_solution/public/cases/pages/case_details.tsx
+++ b/x-pack/plugins/security_solution/public/cases/pages/case_details.tsx
@@ -15,7 +15,7 @@ import { useGetUserSavedObjectPermissions } from '../../common/lib/kibana';
 import { getCaseUrl } from '../../common/components/link_to';
 import { navTabs } from '../../app/home/home_navigations';
 import { CaseView } from '../components/case_view';
-import { savedObjectReadOnly, CaseCallOut } from '../components/callout';
+import { savedObjectReadOnlyErrorMessage, CaseCallOut } from '../components/callout';
 
 export const CaseDetailsPage = React.memo(() => {
   const history = useHistory();
@@ -33,8 +33,8 @@ export const CaseDetailsPage = React.memo(() => {
       <WrapperPage noPadding>
         {userPermissions != null && !userPermissions?.crud && userPermissions?.read && (
           <CaseCallOut
-            title={savedObjectReadOnly.title}
-            message={savedObjectReadOnly.description}
+            title={savedObjectReadOnlyErrorMessage.title}
+            messages={[{ ...savedObjectReadOnlyErrorMessage }]}
           />
         )}
         <CaseView caseId={caseId} userCanCrud={userPermissions?.crud ?? false} />
diff --git a/x-pack/plugins/security_solution/public/common/containers/local_storage/use_messages_storage.test.tsx b/x-pack/plugins/security_solution/public/common/containers/local_storage/use_messages_storage.test.tsx
new file mode 100644
index 000000000000..d52bc4b1a267
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/containers/local_storage/use_messages_storage.test.tsx
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { renderHook, act } from '@testing-library/react-hooks';
+import { useKibana } from '../../lib/kibana';
+import { createUseKibanaMock } from '../../mock/kibana_react';
+import { useMessagesStorage, UseMessagesStorage } from './use_messages_storage';
+
+jest.mock('../../lib/kibana');
+const useKibanaMock = useKibana as jest.Mock;
+
+describe('useLocalStorage', () => {
+  beforeEach(() => {
+    const services = { ...createUseKibanaMock()().services };
+    useKibanaMock.mockImplementation(() => ({ services }));
+    services.storage.store.clear();
+  });
+
+  it('should return an empty array when there is no messages', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook<string, UseMessagesStorage>(() =>
+        useMessagesStorage()
+      );
+      await waitForNextUpdate();
+      const { getMessages } = result.current;
+      expect(getMessages('case')).toEqual([]);
+    });
+  });
+
+  it('should add a message', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook<string, UseMessagesStorage>(() =>
+        useMessagesStorage()
+      );
+      await waitForNextUpdate();
+      const { getMessages, addMessage } = result.current;
+      addMessage('case', 'id-1');
+      expect(getMessages('case')).toEqual(['id-1']);
+    });
+  });
+
+  it('should add multiple messages', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook<string, UseMessagesStorage>(() =>
+        useMessagesStorage()
+      );
+      await waitForNextUpdate();
+      const { getMessages, addMessage } = result.current;
+      addMessage('case', 'id-1');
+      addMessage('case', 'id-2');
+      expect(getMessages('case')).toEqual(['id-1', 'id-2']);
+    });
+  });
+
+  it('should remove a message', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook<string, UseMessagesStorage>(() =>
+        useMessagesStorage()
+      );
+      await waitForNextUpdate();
+      const { getMessages, addMessage, removeMessage } = result.current;
+      addMessage('case', 'id-1');
+      addMessage('case', 'id-2');
+      removeMessage('case', 'id-2');
+      expect(getMessages('case')).toEqual(['id-1']);
+    });
+  });
+
+  it('should clear all messages', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook<string, UseMessagesStorage>(() =>
+        useMessagesStorage()
+      );
+      await waitForNextUpdate();
+      const { getMessages, addMessage, clearAllMessages } = result.current;
+      addMessage('case', 'id-1');
+      addMessage('case', 'id-2');
+      clearAllMessages('case');
+      expect(getMessages('case')).toEqual([]);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/containers/local_storage/use_messages_storage.tsx b/x-pack/plugins/security_solution/public/common/containers/local_storage/use_messages_storage.tsx
new file mode 100644
index 000000000000..0c96712ad9c5
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/containers/local_storage/use_messages_storage.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useCallback } from 'react';
+import { useKibana } from '../../lib/kibana';
+
+export interface UseMessagesStorage {
+  getMessages: (plugin: string) => string[];
+  addMessage: (plugin: string, id: string) => void;
+  removeMessage: (plugin: string, id: string) => void;
+  clearAllMessages: (plugin: string) => void;
+}
+
+export const useMessagesStorage = (): UseMessagesStorage => {
+  const { storage } = useKibana().services;
+
+  const getMessages = useCallback(
+    (plugin: string): string[] => storage.get(`${plugin}-messages`) ?? [],
+    [storage]
+  );
+
+  const addMessage = useCallback(
+    (plugin: string, id: string) => {
+      const pluginStorage = storage.get(`${plugin}-messages`) ?? [];
+      storage.set(`${plugin}-messages`, [...pluginStorage, id]);
+    },
+    [storage]
+  );
+
+  const removeMessage = useCallback(
+    (plugin: string, id: string) => {
+      const pluginStorage = storage.get(`${plugin}-messages`) ?? [];
+      storage.set(`${plugin}-messages`, [...pluginStorage.filter((val: string) => val !== id)]);
+    },
+    [storage]
+  );
+
+  const clearAllMessages = useCallback(
+    (plugin: string): string[] => storage.remove(`${plugin}-messages`),
+    [storage]
+  );
+
+  return {
+    getMessages,
+    addMessage,
+    clearAllMessages,
+    removeMessage,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/common/mock/kibana_react.ts b/x-pack/plugins/security_solution/public/common/mock/kibana_react.ts
index cc8970d4df5b..2b639bfdc14f 100644
--- a/x-pack/plugins/security_solution/public/common/mock/kibana_react.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/kibana_react.ts
@@ -26,6 +26,7 @@ import {
   DEFAULT_INDEX_PATTERN,
 } from '../../../common/constants';
 import { createKibanaCoreStartMock, createKibanaPluginsStartMock } from './kibana_core';
+import { createSecuritySolutionStorageMock } from './mock_local_storage';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export const mockUiSettings: Record<string, any> = {
@@ -74,6 +75,7 @@ export const createUseKibanaMock = () => {
   const core = createKibanaCoreStartMock();
   const plugins = createKibanaPluginsStartMock();
   const useUiSetting = createUseUiSettingMock();
+  const { storage } = createSecuritySolutionStorageMock();
 
   const services = {
     ...core,
@@ -82,6 +84,7 @@ export const createUseKibanaMock = () => {
       ...core.uiSettings,
       get: useUiSetting,
     },
+    storage,
   };
 
   return () => ({ services });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/translations.ts
index 7c28f88a571d..c3c11289037a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/translations.ts
@@ -10,6 +10,6 @@ export const CALL_OUT_UNAUTHORIZED_MSG = i18n.translate(
   'xpack.securitySolution.timeline.callOut.unauthorized.message.description',
   {
     defaultMessage:
-      'You require permission to auto-save timelines within the SIEM application, though you may continue to use the timeline to search and filter security events',
+      'You can use Timeline to investigate events, but you do not have the required permissions to save timelines for future use. If you need to save timelines, contact your Kibana administrator.',
   }
 );
diff --git a/yarn.lock b/yarn.lock
index 53fef40b44c9..0a7899e4ac10 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5375,6 +5375,13 @@
   dependencies:
     "@types/linkify-it" "*"
 
+"@types/md5@^2.2.0":
+  version "2.2.0"
+  resolved "https://registry.yarnpkg.com/@types/md5/-/md5-2.2.0.tgz#cd82e16b95973f94bb03dee40c5b6be4a7fb7fb4"
+  integrity sha512-JN8OVL/wiDlCWTPzplsgMPu0uE9Q6blwp68rYsfk2G8aokRUQ8XD9MEhZwihfAiQvoyE+m31m6i3GFXwYWomKQ==
+  dependencies:
+    "@types/node" "*"
+
 "@types/memoize-one@^4.1.0":
   version "4.1.1"
   resolved "https://registry.yarnpkg.com/@types/memoize-one/-/memoize-one-4.1.1.tgz#41dd138a4335b5041f7d8fc038f9d593d88b3369"

From 0bdff152973d766973702ac791dcc23ea1d24312 Mon Sep 17 00:00:00 2001
From: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
Date: Fri, 26 Jun 2020 14:59:13 -0400
Subject: [PATCH 61/78] [ENDPOINT] Hide the Timeline Flyout while on the
 Management Pages (#69998)

* hide timeline on Management pages
* adjust managment page view styles
* Added additional tests for validating no timeline button on management views
* centralize API Path responses and reuse across some tests
* Fix state being reset incorrectly
---
 .../__snapshots__/page_view.test.tsx.snap     |  48 +++---
 .../common/components/endpoint/page_view.tsx  |   7 +-
 .../utils/timeline/use_show_timeline.tsx      |   2 +-
 .../pages/endpoint_hosts/view/index.test.tsx  |   6 +
 .../policy/store/policy_details/reducer.ts    |  19 ++-
 .../store/policy_list/services/ingest.test.ts |  73 +--------
 .../store/policy_list/test_mock_utils.ts      | 148 +++++++++---------
 .../pages/policy/view/policy_details.test.tsx |  49 +++++-
 .../pages/policy/view/policy_list.test.tsx    |   6 +
 9 files changed, 175 insertions(+), 183 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/components/endpoint/__snapshots__/page_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/endpoint/__snapshots__/page_view.test.tsx.snap
index 6d8ea6b346ef..096df5ceab25 100644
--- a/x-pack/plugins/security_solution/public/common/components/endpoint/__snapshots__/page_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/endpoint/__snapshots__/page_view.test.tsx.snap
@@ -2,11 +2,11 @@
 
 exports[`PageView component should display body header custom element 1`] = `
 .c0.endpoint--isListView {
-  padding: 0 70px 0 24px;
+  padding: 0 24px;
 }
 
 .c0.endpoint--isListView .endpoint-header {
-  padding: 24px 0;
+  padding: 24px;
   margin-bottom: 0;
 }
 
@@ -22,7 +22,7 @@ exports[`PageView component should display body header custom element 1`] = `
 }
 
 .c0 .endpoint-navTabs {
-  margin-left: 24px;
+  margin-left: 12px;
 }
 
 <PageView
@@ -97,11 +97,11 @@ exports[`PageView component should display body header custom element 1`] = `
 
 exports[`PageView component should display body header wrapped in EuiTitle 1`] = `
 .c0.endpoint--isListView {
-  padding: 0 70px 0 24px;
+  padding: 0 24px;
 }
 
 .c0.endpoint--isListView .endpoint-header {
-  padding: 24px 0;
+  padding: 24px;
   margin-bottom: 0;
 }
 
@@ -117,7 +117,7 @@ exports[`PageView component should display body header wrapped in EuiTitle 1`] =
 }
 
 .c0 .endpoint-navTabs {
-  margin-left: 24px;
+  margin-left: 12px;
 }
 
 <PageView
@@ -195,11 +195,11 @@ exports[`PageView component should display body header wrapped in EuiTitle 1`] =
 
 exports[`PageView component should display header left and right 1`] = `
 .c0.endpoint--isListView {
-  padding: 0 70px 0 24px;
+  padding: 0 24px;
 }
 
 .c0.endpoint--isListView .endpoint-header {
-  padding: 24px 0;
+  padding: 24px;
   margin-bottom: 0;
 }
 
@@ -215,7 +215,7 @@ exports[`PageView component should display header left and right 1`] = `
 }
 
 .c0 .endpoint-navTabs {
-  margin-left: 24px;
+  margin-left: 12px;
 }
 
 <PageView
@@ -308,11 +308,11 @@ exports[`PageView component should display header left and right 1`] = `
 
 exports[`PageView component should display only body if not header props used 1`] = `
 .c0.endpoint--isListView {
-  padding: 0 70px 0 24px;
+  padding: 0 24px;
 }
 
 .c0.endpoint--isListView .endpoint-header {
-  padding: 24px 0;
+  padding: 24px;
   margin-bottom: 0;
 }
 
@@ -328,7 +328,7 @@ exports[`PageView component should display only body if not header props used 1`
 }
 
 .c0 .endpoint-navTabs {
-  margin-left: 24px;
+  margin-left: 12px;
 }
 
 <PageView
@@ -380,11 +380,11 @@ exports[`PageView component should display only body if not header props used 1`
 
 exports[`PageView component should display only header left 1`] = `
 .c0.endpoint--isListView {
-  padding: 0 70px 0 24px;
+  padding: 0 24px;
 }
 
 .c0.endpoint--isListView .endpoint-header {
-  padding: 24px 0;
+  padding: 24px;
   margin-bottom: 0;
 }
 
@@ -400,7 +400,7 @@ exports[`PageView component should display only header left 1`] = `
 }
 
 .c0 .endpoint-navTabs {
-  margin-left: 24px;
+  margin-left: 12px;
 }
 
 <PageView
@@ -482,11 +482,11 @@ exports[`PageView component should display only header left 1`] = `
 
 exports[`PageView component should display only header right but include an empty left side 1`] = `
 .c0.endpoint--isListView {
-  padding: 0 70px 0 24px;
+  padding: 0 24px;
 }
 
 .c0.endpoint--isListView .endpoint-header {
-  padding: 24px 0;
+  padding: 24px;
   margin-bottom: 0;
 }
 
@@ -502,7 +502,7 @@ exports[`PageView component should display only header right but include an empt
 }
 
 .c0 .endpoint-navTabs {
-  margin-left: 24px;
+  margin-left: 12px;
 }
 
 <PageView
@@ -581,11 +581,11 @@ exports[`PageView component should display only header right but include an empt
 
 exports[`PageView component should pass through EuiPage props 1`] = `
 .c0.endpoint--isListView {
-  padding: 0 70px 0 24px;
+  padding: 0 24px;
 }
 
 .c0.endpoint--isListView .endpoint-header {
-  padding: 24px 0;
+  padding: 24px;
   margin-bottom: 0;
 }
 
@@ -601,7 +601,7 @@ exports[`PageView component should pass through EuiPage props 1`] = `
 }
 
 .c0 .endpoint-navTabs {
-  margin-left: 24px;
+  margin-left: 12px;
 }
 
 <PageView
@@ -670,11 +670,11 @@ exports[`PageView component should pass through EuiPage props 1`] = `
 
 exports[`PageView component should use custom element for header left and not wrap in EuiTitle 1`] = `
 .c0.endpoint--isListView {
-  padding: 0 70px 0 24px;
+  padding: 0 24px;
 }
 
 .c0.endpoint--isListView .endpoint-header {
-  padding: 24px 0;
+  padding: 24px;
   margin-bottom: 0;
 }
 
@@ -690,7 +690,7 @@ exports[`PageView component should use custom element for header left and not wr
 }
 
 .c0 .endpoint-navTabs {
-  margin-left: 24px;
+  margin-left: 12px;
 }
 
 <PageView
diff --git a/x-pack/plugins/security_solution/public/common/components/endpoint/page_view.tsx b/x-pack/plugins/security_solution/public/common/components/endpoint/page_view.tsx
index 65c536fe1208..3d2a1d2d6fc9 100644
--- a/x-pack/plugins/security_solution/public/common/components/endpoint/page_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/endpoint/page_view.tsx
@@ -21,14 +21,13 @@ import {
 import React, { memo, MouseEventHandler, ReactNode, useMemo } from 'react';
 import styled from 'styled-components';
 import { EuiTabProps } from '@elastic/eui/src/components/tabs/tab';
-import { gutterTimeline } from '../../lib/helpers';
 
 const StyledEuiPage = styled(EuiPage)`
   &.endpoint--isListView {
-    padding: 0 ${gutterTimeline} 0 ${(props) => props.theme.eui.euiSizeL};
+    padding: 0 ${(props) => props.theme.eui.euiSizeL};
 
     .endpoint-header {
-      padding: ${(props) => props.theme.eui.euiSizeL} 0;
+      padding: ${(props) => props.theme.eui.euiSizeL};
       margin-bottom: 0;
     }
     .endpoint-page-content {
@@ -44,7 +43,7 @@ const StyledEuiPage = styled(EuiPage)`
     }
   }
   .endpoint-navTabs {
-    margin-left: ${(props) => props.theme.eui.euiSizeL};
+    margin-left: ${(props) => props.theme.eui.euiSizeM};
   }
 `;
 
diff --git a/x-pack/plugins/security_solution/public/common/utils/timeline/use_show_timeline.tsx b/x-pack/plugins/security_solution/public/common/utils/timeline/use_show_timeline.tsx
index fde3f6f8b222..a9c6660ba9c6 100644
--- a/x-pack/plugins/security_solution/public/common/utils/timeline/use_show_timeline.tsx
+++ b/x-pack/plugins/security_solution/public/common/utils/timeline/use_show_timeline.tsx
@@ -7,7 +7,7 @@
 import { useState, useEffect } from 'react';
 import { useRouteSpy } from '../route/use_route_spy';
 
-const hideTimelineForRoutes = [`/cases/configure`];
+const hideTimelineForRoutes = [`/cases/configure`, '/management'];
 
 export const useShowTimeline = () => {
   const [{ pageName, pathName }] = useRouteSpy();
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
index 224411c5f7ec..7bc101b89147 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
@@ -34,6 +34,12 @@ describe('when on the hosts page', () => {
     render = () => mockedContext.render(<HostList />);
   });
 
+  it('should NOT display timeline', async () => {
+    const renderResult = render();
+    const timelineFlyout = await renderResult.queryByTestId('flyoutOverlay');
+    expect(timelineFlyout).toBeNull();
+  });
+
   it('should show a table', async () => {
     const renderResult = render();
     const table = await renderResult.findByTestId('hostListTable');
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer.ts
index 75e7808ea30b..b3b74c2ca9da 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer.ts
@@ -78,13 +78,20 @@ export const policyDetailsReducer: ImmutableReducer<PolicyDetailsState, AppActio
     const isCurrentlyOnDetailsPage = isOnPolicyDetailsPage(newState);
     const wasPreviouslyOnDetailsPage = isOnPolicyDetailsPage(state);
 
-    // Did user just enter the Detail page? if so, then set the loading indicator and return new state
-    if (isCurrentlyOnDetailsPage && !wasPreviouslyOnDetailsPage) {
-      return {
-        ...newState,
-        isLoading: true,
-      };
+    if (isCurrentlyOnDetailsPage) {
+      // Did user just enter the Detail page? if so, then
+      // set the loading indicator and return new state
+      if (!wasPreviouslyOnDetailsPage) {
+        return {
+          ...newState,
+          isLoading: true,
+        };
+      }
+      // Else, user was already on the details page,
+      // just return the updated state with new location data
+      return newState;
     }
+
     return {
       ...initialPolicyDetailsState(),
       location: action.payload,
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.test.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.test.ts
index 2270c65fb149..818ca49e1e81 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.test.ts
@@ -5,12 +5,14 @@
  */
 
 import {
+  INGEST_API_EPM_PACKAGES,
   sendGetDatasource,
   sendGetEndpointSecurityPackage,
   sendGetEndpointSpecificDatasources,
 } from './ingest';
 import { httpServiceMock } from '../../../../../../../../../../src/core/public/mocks';
 import { DATASOURCE_SAVED_OBJECT_TYPE } from '../../../../../../../../ingest_manager/common';
+import { apiPathMockResponseProviders } from '../test_mock_utils';
 
 describe('ingest service', () => {
   let http: ReturnType<typeof httpServiceMock.createStartContract>;
@@ -59,76 +61,7 @@ describe('ingest service', () => {
 
   describe('sendGetEndpointSecurityPackage()', () => {
     it('should query EPM with category=security', async () => {
-      http.get.mockResolvedValue({
-        response: [
-          {
-            name: 'endpoint',
-            title: 'Elastic Endpoint',
-            version: '0.5.0',
-            description: 'This is the Elastic Endpoint package.',
-            type: 'solution',
-            download: '/epr/endpoint/endpoint-0.5.0.tar.gz',
-            path: '/package/endpoint/0.5.0',
-            icons: [
-              {
-                src: '/package/endpoint/0.5.0/img/logo-endpoint-64-color.svg',
-                size: '16x16',
-                type: 'image/svg+xml',
-              },
-            ],
-            status: 'installed',
-            savedObject: {
-              type: 'epm-packages',
-              id: 'endpoint',
-              attributes: {
-                installed: [
-                  { id: '826759f0-7074-11ea-9bc8-6b38f4d29a16', type: 'dashboard' },
-                  { id: '1cfceda0-728b-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
-                  { id: '1e525190-7074-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
-                  { id: '55387750-729c-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
-                  { id: '92b1edc0-706a-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
-                  { id: 'a3a3bd10-706b-11ea-9bc8-6b38f4d29a16', type: 'map' },
-                  { id: 'logs-endpoint.alerts', type: 'index-template' },
-                  { id: 'events-endpoint', type: 'index-template' },
-                  { id: 'logs-endpoint.events.file', type: 'index-template' },
-                  { id: 'logs-endpoint.events.library', type: 'index-template' },
-                  { id: 'metrics-endpoint.metadata', type: 'index-template' },
-                  { id: 'metrics-endpoint.metadata_mirror', type: 'index-template' },
-                  { id: 'logs-endpoint.events.network', type: 'index-template' },
-                  { id: 'metrics-endpoint.policy', type: 'index-template' },
-                  { id: 'logs-endpoint.events.process', type: 'index-template' },
-                  { id: 'logs-endpoint.events.registry', type: 'index-template' },
-                  { id: 'logs-endpoint.events.security', type: 'index-template' },
-                  { id: 'metrics-endpoint.telemetry', type: 'index-template' },
-                ],
-                es_index_patterns: {
-                  alerts: 'logs-endpoint.alerts-*',
-                  events: 'events-endpoint-*',
-                  file: 'logs-endpoint.events.file-*',
-                  library: 'logs-endpoint.events.library-*',
-                  metadata: 'metrics-endpoint.metadata-*',
-                  metadata_mirror: 'metrics-endpoint.metadata_mirror-*',
-                  network: 'logs-endpoint.events.network-*',
-                  policy: 'metrics-endpoint.policy-*',
-                  process: 'logs-endpoint.events.process-*',
-                  registry: 'logs-endpoint.events.registry-*',
-                  security: 'logs-endpoint.events.security-*',
-                  telemetry: 'metrics-endpoint.telemetry-*',
-                },
-                name: 'endpoint',
-                version: '0.5.0',
-                internal: false,
-                removable: false,
-              },
-              references: [],
-              updated_at: '2020-06-24T14:41:23.098Z',
-              version: 'Wzc0LDFd',
-              score: 0,
-            },
-          },
-        ],
-        success: true,
-      });
+      http.get.mockReturnValue(apiPathMockResponseProviders[INGEST_API_EPM_PACKAGES]());
       await sendGetEndpointSecurityPackage(http);
       expect(http.get).toHaveBeenCalledWith('/api/ingest_manager/epm/packages', {
         query: { category: 'security' },
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts
index 0f0d1cb1b559..46f84d296bd4 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts
@@ -16,6 +16,82 @@ import {
 
 const generator = new EndpointDocGenerator('policy-list');
 
+/**
+ * a list of API paths response mock providers
+ */
+export const apiPathMockResponseProviders = {
+  [INGEST_API_EPM_PACKAGES]: () =>
+    Promise.resolve<GetPackagesResponse>({
+      response: [
+        {
+          name: 'endpoint',
+          title: 'Elastic Endpoint',
+          version: '0.5.0',
+          description: 'This is the Elastic Endpoint package.',
+          type: 'solution',
+          download: '/epr/endpoint/endpoint-0.5.0.tar.gz',
+          path: '/package/endpoint/0.5.0',
+          icons: [
+            {
+              src: '/package/endpoint/0.5.0/img/logo-endpoint-64-color.svg',
+              size: '16x16',
+              type: 'image/svg+xml',
+            },
+          ],
+          status: 'installed' as InstallationStatus,
+          savedObject: {
+            type: 'epm-packages',
+            id: 'endpoint',
+            attributes: {
+              installed: [
+                { id: '826759f0-7074-11ea-9bc8-6b38f4d29a16', type: 'dashboard' },
+                { id: '1cfceda0-728b-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                { id: '1e525190-7074-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                { id: '55387750-729c-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                { id: '92b1edc0-706a-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
+                { id: 'a3a3bd10-706b-11ea-9bc8-6b38f4d29a16', type: 'map' },
+                { id: 'logs-endpoint.alerts', type: 'index-template' },
+                { id: 'events-endpoint', type: 'index-template' },
+                { id: 'logs-endpoint.events.file', type: 'index-template' },
+                { id: 'logs-endpoint.events.library', type: 'index-template' },
+                { id: 'metrics-endpoint.metadata', type: 'index-template' },
+                { id: 'metrics-endpoint.metadata_mirror', type: 'index-template' },
+                { id: 'logs-endpoint.events.network', type: 'index-template' },
+                { id: 'metrics-endpoint.policy', type: 'index-template' },
+                { id: 'logs-endpoint.events.process', type: 'index-template' },
+                { id: 'logs-endpoint.events.registry', type: 'index-template' },
+                { id: 'logs-endpoint.events.security', type: 'index-template' },
+                { id: 'metrics-endpoint.telemetry', type: 'index-template' },
+              ] as AssetReference[],
+              es_index_patterns: {
+                alerts: 'logs-endpoint.alerts-*',
+                events: 'events-endpoint-*',
+                file: 'logs-endpoint.events.file-*',
+                library: 'logs-endpoint.events.library-*',
+                metadata: 'metrics-endpoint.metadata-*',
+                metadata_mirror: 'metrics-endpoint.metadata_mirror-*',
+                network: 'logs-endpoint.events.network-*',
+                policy: 'metrics-endpoint.policy-*',
+                process: 'logs-endpoint.events.process-*',
+                registry: 'logs-endpoint.events.registry-*',
+                security: 'logs-endpoint.events.security-*',
+                telemetry: 'metrics-endpoint.telemetry-*',
+              },
+              name: 'endpoint',
+              version: '0.5.0',
+              internal: false,
+              removable: false,
+            },
+            references: [],
+            updated_at: '2020-06-24T14:41:23.098Z',
+            version: 'Wzc0LDFd',
+          },
+        },
+      ],
+      success: true,
+    }),
+};
+
 /**
  * It sets the mock implementation on the necessary http methods to support the policy list view
  * @param mockedHttpService
@@ -38,76 +114,8 @@ export const setPolicyListApiMockImplementation = (
         });
       }
 
-      if (path === INGEST_API_EPM_PACKAGES) {
-        return Promise.resolve<GetPackagesResponse>({
-          response: [
-            {
-              name: 'endpoint',
-              title: 'Elastic Endpoint',
-              version: '0.5.0',
-              description: 'This is the Elastic Endpoint package.',
-              type: 'solution',
-              download: '/epr/endpoint/endpoint-0.5.0.tar.gz',
-              path: '/package/endpoint/0.5.0',
-              icons: [
-                {
-                  src: '/package/endpoint/0.5.0/img/logo-endpoint-64-color.svg',
-                  size: '16x16',
-                  type: 'image/svg+xml',
-                },
-              ],
-              status: 'installed' as InstallationStatus,
-              savedObject: {
-                type: 'epm-packages',
-                id: 'endpoint',
-                attributes: {
-                  installed: [
-                    { id: '826759f0-7074-11ea-9bc8-6b38f4d29a16', type: 'dashboard' },
-                    { id: '1cfceda0-728b-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
-                    { id: '1e525190-7074-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
-                    { id: '55387750-729c-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
-                    { id: '92b1edc0-706a-11ea-9bc8-6b38f4d29a16', type: 'visualization' },
-                    { id: 'a3a3bd10-706b-11ea-9bc8-6b38f4d29a16', type: 'map' },
-                    { id: 'logs-endpoint.alerts', type: 'index-template' },
-                    { id: 'events-endpoint', type: 'index-template' },
-                    { id: 'logs-endpoint.events.file', type: 'index-template' },
-                    { id: 'logs-endpoint.events.library', type: 'index-template' },
-                    { id: 'metrics-endpoint.metadata', type: 'index-template' },
-                    { id: 'metrics-endpoint.metadata_mirror', type: 'index-template' },
-                    { id: 'logs-endpoint.events.network', type: 'index-template' },
-                    { id: 'metrics-endpoint.policy', type: 'index-template' },
-                    { id: 'logs-endpoint.events.process', type: 'index-template' },
-                    { id: 'logs-endpoint.events.registry', type: 'index-template' },
-                    { id: 'logs-endpoint.events.security', type: 'index-template' },
-                    { id: 'metrics-endpoint.telemetry', type: 'index-template' },
-                  ] as AssetReference[],
-                  es_index_patterns: {
-                    alerts: 'logs-endpoint.alerts-*',
-                    events: 'events-endpoint-*',
-                    file: 'logs-endpoint.events.file-*',
-                    library: 'logs-endpoint.events.library-*',
-                    metadata: 'metrics-endpoint.metadata-*',
-                    metadata_mirror: 'metrics-endpoint.metadata_mirror-*',
-                    network: 'logs-endpoint.events.network-*',
-                    policy: 'metrics-endpoint.policy-*',
-                    process: 'logs-endpoint.events.process-*',
-                    registry: 'logs-endpoint.events.registry-*',
-                    security: 'logs-endpoint.events.security-*',
-                    telemetry: 'metrics-endpoint.telemetry-*',
-                  },
-                  name: 'endpoint',
-                  version: '0.5.0',
-                  internal: false,
-                  removable: false,
-                },
-                references: [],
-                updated_at: '2020-06-24T14:41:23.098Z',
-                version: 'Wzc0LDFd',
-              },
-            },
-          ],
-          success: true,
-        });
+      if (apiPathMockResponseProviders[path]) {
+        return apiPathMockResponseProviders[path]();
       }
     }
     return Promise.reject(new Error(`MOCK: unknown policy list api: ${path}`));
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.test.tsx
index 315e3d29b6df..984639f0f599 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.test.tsx
@@ -9,8 +9,9 @@ import { mount } from 'enzyme';
 
 import { PolicyDetails } from './policy_details';
 import { EndpointDocGenerator } from '../../../../../common/endpoint/generate_data';
-import { createAppRootMockRenderer } from '../../../../common/mock/endpoint';
+import { AppContextTestRender, createAppRootMockRenderer } from '../../../../common/mock/endpoint';
 import { getPolicyDetailPath, getPoliciesPath } from '../../../common/routing';
+import { apiPathMockResponseProviders } from '../store/policy_list/test_mock_utils';
 
 describe('Policy Details', () => {
   type FindReactWrapperResponse = ReturnType<ReturnType<typeof render>['find']>;
@@ -19,29 +20,50 @@ describe('Policy Details', () => {
   const policyListPathUrl = getPoliciesPath();
   const sleep = (ms = 100) => new Promise((wakeup) => setTimeout(wakeup, ms));
   const generator = new EndpointDocGenerator();
-  const { history, AppWrapper, coreStart } = createAppRootMockRenderer();
-  const http = coreStart.http;
-  const render = (ui: Parameters<typeof mount>[0]) => mount(ui, { wrappingComponent: AppWrapper });
+  let history: AppContextTestRender['history'];
+  let coreStart: AppContextTestRender['coreStart'];
+  let middlewareSpy: AppContextTestRender['middlewareSpy'];
+  let http: typeof coreStart.http;
+  let render: (ui: Parameters<typeof mount>[0]) => ReturnType<typeof mount>;
   let policyDatasource: ReturnType<typeof generator.generatePolicyDatasource>;
   let policyView: ReturnType<typeof render>;
 
-  beforeEach(() => jest.clearAllMocks());
+  beforeEach(() => {
+    const appContextMockRenderer = createAppRootMockRenderer();
+    const AppWrapper = appContextMockRenderer.AppWrapper;
+
+    ({ history, coreStart, middlewareSpy } = appContextMockRenderer);
+    render = (ui) => mount(ui, { wrappingComponent: AppWrapper });
+    http = coreStart.http;
+  });
 
   afterEach(() => {
     if (policyView) {
       policyView.unmount();
     }
+    jest.clearAllMocks();
   });
 
   describe('when displayed with invalid id', () => {
+    let releaseApiFailure: () => void;
     beforeEach(() => {
-      http.get.mockReturnValue(Promise.reject(new Error('policy not found')));
+      http.get.mockImplementationOnce(async () => {
+        await new Promise((_, reject) => {
+          releaseApiFailure = reject.bind(null, new Error('policy not found'));
+        });
+      });
       history.push(policyDetailsPathUrl);
       policyView = render(<PolicyDetails />);
     });
 
-    it('should show loader followed by error message', () => {
+    it('should NOT display timeline', async () => {
+      expect(policyView.find('flyoutOverlay')).toHaveLength(0);
+    });
+
+    it('should show loader followed by error message', async () => {
       expect(policyView.find('EuiLoadingSpinner').length).toBe(1);
+      releaseApiFailure();
+      await middlewareSpy.waitForAction('serverFailedToReturnPolicyDetailsData');
       policyView.update();
       const callout = policyView.find('EuiCallOut');
       expect(callout).toHaveLength(1);
@@ -76,14 +98,25 @@ describe('Policy Details', () => {
               success: true,
             });
           }
+
+          // Get package data
+          // Used in tests that route back to the list
+          if (apiPathMockResponseProviders[path]) {
+            asyncActions = asyncActions.then(async () => sleep());
+            return apiPathMockResponseProviders[path]();
+          }
         }
 
-        return Promise.reject(new Error('unknown API call!'));
+        return Promise.reject(new Error(`unknown API call (not MOCKED): ${path}`));
       });
       history.push(policyDetailsPathUrl);
       policyView = render(<PolicyDetails />);
     });
 
+    it('should NOT display timeline', async () => {
+      expect(policyView.find('flyoutOverlay')).toHaveLength(0);
+    });
+
     it('should display back to list button and policy title', () => {
       policyView.update();
       const pageHeaderLeft = policyView.find(
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.test.tsx
index acce5c8f7835..32de3c93ac98 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.test.tsx
@@ -23,6 +23,12 @@ describe('when on the policies page', () => {
     render = () => mockedContext.render(<PolicyList />);
   });
 
+  it('should NOT display timeline', async () => {
+    const renderResult = render();
+    const timelineFlyout = await renderResult.queryByTestId('flyoutOverlay');
+    expect(timelineFlyout).toBeNull();
+  });
+
   it('should show the empty state', async () => {
     const renderResult = render();
     const table = await renderResult.findByTestId('emptyPolicyTable');

From e4aaed6926390aece0a4d5114fbe9a3e3e543f51 Mon Sep 17 00:00:00 2001
From: Brian Seeders <seeders@gmail.com>
Date: Fri, 26 Jun 2020 15:06:49 -0400
Subject: [PATCH 62/78] skip failing suite (#70104) (#70103)

---
 .../plugins/lens/public/indexpattern_datasource/loader.test.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
index 5e59627d8c33..d8d8ebcf12de 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
@@ -177,7 +177,8 @@ function mockClient() {
   } as unknown) as Pick<SavedObjectsClientContract, 'find' | 'bulkGet'>;
 }
 
-describe('loader', () => {
+// Failing: See https://github.com/elastic/kibana/issues/70104
+describe.skip('loader', () => {
   describe('loadIndexPatterns', () => {
     it('should not load index patterns that are already loaded', async () => {
       const cache = await loadIndexPatterns({

From 938733e8628387f34d7197883a1bd4fe77ad94cd Mon Sep 17 00:00:00 2001
From: Chris Cowan <chris@chriscowan.us>
Date: Fri, 26 Jun 2020 12:55:36 -0700
Subject: [PATCH 63/78] [Metrics UI] Fix EuiTheme type issue (#69735)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../components/autocomplete_field/suggestion_item.tsx  | 10 +++++-----
 .../public/components/logging/log_highlights_menu.tsx  |  2 +-
 .../inventory_view/components/dropdown_button.tsx      | 10 +++++-----
 .../waffle/metric_control/custom_metric_form.tsx       | 10 +++++-----
 .../waffle/metric_control/metrics_edit_mode.tsx        |  4 ++--
 .../components/waffle/metric_control/mode_switcher.tsx |  4 ++--
 .../metrics/inventory_view/components/waffle/node.tsx  |  4 ++--
 .../components/waffle/waffle_sort_controls.tsx         |  6 +++---
 .../components/waffle/waffle_time_controls.tsx         |  8 ++++----
 .../infra/public/pages/metrics/metric_detail/index.tsx |  2 +-
 10 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/x-pack/plugins/infra/public/components/autocomplete_field/suggestion_item.tsx b/x-pack/plugins/infra/public/components/autocomplete_field/suggestion_item.tsx
index f14494a8abc4..4bcb7a7ec8a0 100644
--- a/x-pack/plugins/infra/public/components/autocomplete_field/suggestion_item.tsx
+++ b/x-pack/plugins/infra/public/components/autocomplete_field/suggestion_item.tsx
@@ -104,15 +104,15 @@ const getEuiIconType = (suggestionType: QuerySuggestionTypes) => {
 const getEuiIconColor = (theme: any, suggestionType: QuerySuggestionTypes): string => {
   switch (suggestionType) {
     case QuerySuggestionTypes.Field:
-      return theme.eui.euiColorVis7;
+      return theme?.eui.euiColorVis7;
     case QuerySuggestionTypes.Value:
-      return theme.eui.euiColorVis0;
+      return theme?.eui.euiColorVis0;
     case QuerySuggestionTypes.Operator:
-      return theme.eui.euiColorVis1;
+      return theme?.eui.euiColorVis1;
     case QuerySuggestionTypes.Conjunction:
-      return theme.eui.euiColorVis2;
+      return theme?.eui.euiColorVis2;
     case QuerySuggestionTypes.RecentSearch:
     default:
-      return theme.eui.euiColorMediumShade;
+      return theme?.eui.euiColorMediumShade;
   }
 };
diff --git a/x-pack/plugins/infra/public/components/logging/log_highlights_menu.tsx b/x-pack/plugins/infra/public/components/logging/log_highlights_menu.tsx
index 608a22a79c47..7beead461cb2 100644
--- a/x-pack/plugins/infra/public/components/logging/log_highlights_menu.tsx
+++ b/x-pack/plugins/infra/public/components/logging/log_highlights_menu.tsx
@@ -166,7 +166,7 @@ const goToNextHighlightLabel = i18n.translate(
 const ActiveHighlightsIndicator = euiStyled(EuiIcon).attrs(({ theme }) => ({
   type: 'checkInCircleFilled',
   size: 'm',
-  color: theme.eui.euiColorAccent,
+  color: theme?.eui.euiColorAccent,
 }))`
   padding-left: ${(props) => props.theme.eui.paddingSizes.xs};
 `;
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/dropdown_button.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/dropdown_button.tsx
index f0bc404dc379..6e3ebee2dcb4 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/dropdown_button.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/dropdown_button.tsx
@@ -11,7 +11,7 @@ import { withTheme, EuiTheme } from '../../../../../../observability/public';
 interface Props {
   label: string;
   onClick: () => void;
-  theme: EuiTheme;
+  theme: EuiTheme | undefined;
   children: ReactNode;
 }
 
@@ -21,18 +21,18 @@ export const DropdownButton = withTheme(({ onClick, label, theme, children }: Pr
       alignItems="center"
       gutterSize="none"
       style={{
-        border: theme.eui.euiFormInputGroupBorder,
-        boxShadow: `0px 3px 2px ${theme.eui.euiTableActionsBorderColor}, 0px 1px 1px ${theme.eui.euiTableActionsBorderColor}`,
+        border: theme?.eui.euiFormInputGroupBorder,
+        boxShadow: `0px 3px 2px ${theme?.eui.euiTableActionsBorderColor}, 0px 1px 1px ${theme?.eui.euiTableActionsBorderColor}`,
       }}
     >
       <EuiFlexItem
         grow={false}
         style={{
           padding: 12,
-          background: theme.eui.euiFormInputGroupLabelBackground,
+          background: theme?.eui.euiFormInputGroupLabelBackground,
           fontSize: '0.75em',
           fontWeight: 600,
-          color: theme.eui.euiTitleColor,
+          color: theme?.eui.euiTitleColor,
         }}
       >
         {label}
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx
index 4e7bdeddd624..a785cb31c3cf 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx
@@ -52,7 +52,7 @@ const AGGREGATION_LABELS = {
 };
 
 interface Props {
-  theme: EuiTheme;
+  theme: EuiTheme | undefined;
   metric?: SnapshotCustomMetricInput;
   fields: IFieldType[];
   customMetrics: SnapshotCustomMetricInput[];
@@ -158,8 +158,8 @@ export const CustomMetricForm = withTheme(
           </EuiPopoverTitle>
           <div
             style={{
-              padding: theme.eui.paddingSizes.m,
-              borderBottom: `${theme.eui.euiBorderWidthThin} solid ${theme.eui.euiBorderColor}`,
+              padding: theme?.eui.paddingSizes.m,
+              borderBottom: `${theme?.eui.euiBorderWidthThin} solid ${theme?.eui.euiBorderColor}`,
             }}
           >
             <EuiFormRow
@@ -219,11 +219,11 @@ export const CustomMetricForm = withTheme(
               />
             </EuiFormRow>
           </div>
-          <div style={{ padding: theme.eui.paddingSizes.m, textAlign: 'right' }}>
+          <div style={{ padding: theme?.eui.paddingSizes.m, textAlign: 'right' }}>
             <EuiButtonEmpty
               onClick={onCancel}
               size="s"
-              style={{ paddingRight: theme.eui.paddingSizes.xl }}
+              style={{ paddingRight: theme?.eui.paddingSizes.xl }}
             >
               <FormattedMessage
                 id="xpack.infra.waffle.customMetrics.cancelLabel"
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/metrics_edit_mode.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/metrics_edit_mode.tsx
index 89edaacdb8a1..649dcc4282d6 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/metrics_edit_mode.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/metrics_edit_mode.tsx
@@ -14,7 +14,7 @@ import {
 } from '../../../../../../../../../legacy/common/eui_styled_components';
 
 interface Props {
-  theme: EuiTheme;
+  theme: EuiTheme | undefined;
   customMetrics: SnapshotCustomMetricInput[];
   options: Array<{ text: string; value: string }>;
   onEdit: (metric: SnapshotCustomMetricInput) => void;
@@ -28,7 +28,7 @@ export const MetricsEditMode = withTheme(
       <div style={{ width: 256 }}>
         {options.map((option) => (
           <div key={option.value} style={{ padding: '14px 14px 13px 36px' }}>
-            <span style={{ color: theme.eui.euiButtonColorDisabled }}>{option.text}</span>
+            <span style={{ color: theme?.eui.euiButtonColorDisabled }}>{option.text}</span>
           </div>
         ))}
         {customMetrics.map((metric) => (
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/mode_switcher.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/mode_switcher.tsx
index acb740f1750c..d1abcade5d66 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/mode_switcher.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/mode_switcher.tsx
@@ -15,7 +15,7 @@ import {
 } from '../../../../../../../../../legacy/common/eui_styled_components';
 
 interface Props {
-  theme: EuiTheme;
+  theme: EuiTheme | undefined;
   onEdit: () => void;
   onAdd: () => void;
   onSave: () => void;
@@ -32,7 +32,7 @@ export const ModeSwitcher = withTheme(
     return (
       <div
         style={{
-          borderTop: `${theme.eui.euiBorderWidthThin} solid ${theme.eui.euiBorderColor}`,
+          borderTop: `${theme?.eui.euiBorderWidthThin} solid ${theme?.eui.euiBorderColor}`,
           padding: 12,
         }}
       >
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node.tsx
index 5f526197cbfb..e7bee82a9f0f 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node.tsx
@@ -152,8 +152,8 @@ const ValueInner = euiStyled.button`
   border: none;
   &:focus {
     outline: none !important;
-    border: ${(params) => params.theme.eui.euiFocusRingSize} solid
-      ${(params) => params.theme.eui.euiFocusRingColor};
+    border: ${(params) => params.theme?.eui.euiFocusRingSize} solid
+      ${(params) => params.theme?.eui.euiFocusRingColor};
     box-shadow: none;
   }
 `;
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_sort_controls.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_sort_controls.tsx
index b5e6aacd0e6f..a45ac0cee72d 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_sort_controls.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_sort_controls.tsx
@@ -107,7 +107,7 @@ export const WaffleSortControls = ({ sort, onChange }: Props) => {
 };
 
 interface SwitchContainerProps {
-  theme: EuiTheme;
+  theme: EuiTheme | undefined;
   children: ReactNode;
 }
 
@@ -115,8 +115,8 @@ const SwitchContainer = withTheme(({ children, theme }: SwitchContainerProps) =>
   return (
     <div
       style={{
-        padding: theme.eui.paddingSizes.m,
-        borderTop: `1px solid ${theme.eui.euiBorderColor}`,
+        padding: theme?.eui.paddingSizes.m,
+        borderTop: `1px solid ${theme?.eui.euiBorderColor}`,
       }}
     >
       {children}
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_time_controls.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_time_controls.tsx
index fac1e086101e..da044b1cf99e 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_time_controls.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_time_controls.tsx
@@ -12,7 +12,7 @@ import { withTheme, EuiTheme } from '../../../../../../../observability/public';
 import { useWaffleTimeContext } from '../../hooks/use_waffle_time';
 
 interface Props {
-  theme: EuiTheme;
+  theme: EuiTheme | undefined;
 }
 
 export const WaffleTimeControls = withTheme(({ theme }: Props) => {
@@ -56,9 +56,9 @@ export const WaffleTimeControls = withTheme(({ theme }: Props) => {
       <EuiFlexItem
         grow={false}
         style={{
-          border: theme.eui.euiFormInputGroupBorder,
-          boxShadow: `0px 3px 2px ${theme.eui.euiTableActionsBorderColor}, 0px 1px 1px ${theme.eui.euiTableActionsBorderColor}`,
-          marginRight: theme.eui.paddingSizes.m,
+          border: theme?.eui.euiFormInputGroupBorder,
+          boxShadow: `0px 3px 2px ${theme?.eui.euiTableActionsBorderColor}, 0px 1px 1px ${theme?.eui.euiTableActionsBorderColor}`,
+          marginRight: theme?.eui.paddingSizes.m,
         }}
         data-test-subj="waffleDatePicker"
       >
diff --git a/x-pack/plugins/infra/public/pages/metrics/metric_detail/index.tsx b/x-pack/plugins/infra/public/pages/metrics/metric_detail/index.tsx
index 4ae96f733382..60c8041fb5ef 100644
--- a/x-pack/plugins/infra/public/pages/metrics/metric_detail/index.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/metric_detail/index.tsx
@@ -27,7 +27,7 @@ const DetailPageContent = euiStyled(PageContent)`
 `;
 
 interface Props {
-  theme: EuiTheme;
+  theme: EuiTheme | undefined;
   match: {
     params: {
       type: string;

From 59925daff5b8bdedbe1a45fc316b771c2e506d21 Mon Sep 17 00:00:00 2001
From: Andrea Del Rio <delrio.andre@gmail.com>
Date: Fri, 26 Jun 2020 13:21:51 -0700
Subject: [PATCH 64/78] [Discover] Improve styling of graphs in sidebar
 (#69440)

---
 .../sidebar/discover_field_bucket.scss        |  4 ++
 .../sidebar/discover_field_bucket.tsx         | 41 +++++++++++++++----
 .../sidebar/discover_field_details.tsx        |  3 +-
 .../components/sidebar/discover_sidebar.scss  |  8 ----
 .../sidebar/string_progress_bar.tsx           | 29 +++----------
 5 files changed, 43 insertions(+), 42 deletions(-)
 create mode 100644 src/plugins/discover/public/application/components/sidebar/discover_field_bucket.scss

diff --git a/src/plugins/discover/public/application/components/sidebar/discover_field_bucket.scss b/src/plugins/discover/public/application/components/sidebar/discover_field_bucket.scss
new file mode 100644
index 000000000000..90b645f70084
--- /dev/null
+++ b/src/plugins/discover/public/application/components/sidebar/discover_field_bucket.scss
@@ -0,0 +1,4 @@
+.dscFieldDetails__barContainer {
+  // Constrains value to the flex item, and allows for truncation when necessary
+  min-width: 0;
+}
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_field_bucket.tsx b/src/plugins/discover/public/application/components/sidebar/discover_field_bucket.tsx
index 398a945e0f87..281fc9a392d7 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_field_bucket.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_field_bucket.tsx
@@ -17,11 +17,12 @@
  * under the License.
  */
 import React from 'react';
-import { EuiButtonIcon, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
+import { EuiText, EuiButtonIcon, EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { StringFieldProgressBar } from './string_progress_bar';
 import { Bucket } from './types';
 import { IndexPatternField } from '../../../../../data/public';
+import './discover_field_bucket.scss';
 
 interface Props {
   bucket: Bucket;
@@ -47,18 +48,40 @@ export function DiscoverFieldBucket({ field, bucket, onAddFilter }: Props) {
 
   return (
     <>
-      <EuiFlexGroup gutterSize="xs" responsive={false}>
-        <EuiFlexItem className="eui-textTruncate">
-          <EuiText size="xs" className="eui-textTruncate">
-            {bucket.display === '' ? emptyTxt : bucket.display}
-          </EuiText>
+      <EuiFlexGroup justifyContent="spaceBetween" responsive={false} gutterSize="s">
+        <EuiFlexItem className="dscFieldDetails__barContainer" grow={1}>
+          <EuiFlexGroup justifyContent="spaceBetween" gutterSize="xs" responsive={false}>
+            <EuiFlexItem grow={1} className="eui-textTruncate">
+              <EuiText
+                title={
+                  bucket.display === ''
+                    ? emptyTxt
+                    : `${bucket.display}: ${bucket.count} (${bucket.percent}%)`
+                }
+                size="xs"
+                className="eui-textTruncate"
+              >
+                {bucket.display === '' ? emptyTxt : bucket.display}
+              </EuiText>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false} className="eui-textTruncate">
+              <EuiText color="secondary" size="xs" className="eui-textTruncate">
+                {bucket.percent}%
+              </EuiText>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+          <StringFieldProgressBar
+            value={bucket.value}
+            percent={bucket.percent}
+            count={bucket.count}
+          />
         </EuiFlexItem>
         {field.filterable && (
           <EuiFlexItem grow={false}>
             <div>
               <EuiButtonIcon
                 iconSize="s"
-                iconType="magnifyWithPlus"
+                iconType="plusInCircle"
                 onClick={() => onAddFilter(field, bucket.value, '+')}
                 aria-label={addLabel}
                 data-test-subj={`plus-${field.name}-${bucket.value}`}
@@ -73,7 +96,7 @@ export function DiscoverFieldBucket({ field, bucket, onAddFilter }: Props) {
               />
               <EuiButtonIcon
                 iconSize="s"
-                iconType="magnifyWithMinus"
+                iconType="minusInCircle"
                 onClick={() => onAddFilter(field, bucket.value, '-')}
                 aria-label={removeLabel}
                 data-test-subj={`minus-${field.name}-${bucket.value}`}
@@ -90,7 +113,7 @@ export function DiscoverFieldBucket({ field, bucket, onAddFilter }: Props) {
           </EuiFlexItem>
         )}
       </EuiFlexGroup>
-      <StringFieldProgressBar percent={bucket.percent} count={bucket.count} />
+      <EuiSpacer size="s" />
     </>
   );
 }
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_field_details.tsx b/src/plugins/discover/public/application/components/sidebar/discover_field_details.tsx
index b56f7ba8a852..dd95a45f7162 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_field_details.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_field_details.tsx
@@ -17,7 +17,7 @@
  * under the License.
  */
 import React from 'react';
-import { EuiLink, EuiSpacer, EuiIconTip, EuiText } from '@elastic/eui';
+import { EuiLink, EuiIconTip, EuiText } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { DiscoverFieldBucket } from './discover_field_bucket';
 import { getWarnings } from './lib/get_warnings';
@@ -78,7 +78,6 @@ export function DiscoverFieldDetails({
 
       {details.visualizeUrl && (
         <>
-          <EuiSpacer size={'s'} />
           <EuiLink
             onClick={() => {
               getServices().core.application.navigateToApp(details.visualizeUrl.app, {
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss
index 9f7700c7f395..ae7e915f0977 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss
+++ b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss
@@ -121,14 +121,6 @@
   }
 }
 
-/*
-  Fixes EUI known issue https://github.com/elastic/eui/issues/1749
-*/
-.dscProgressBarTooltip__anchor {
-  display: block;
-}
-
-
 .dscFieldSearch {
   padding: $euiSizeS;
 }
diff --git a/src/plugins/discover/public/application/components/sidebar/string_progress_bar.tsx b/src/plugins/discover/public/application/components/sidebar/string_progress_bar.tsx
index 7ea41aa4bf27..c8693727b072 100644
--- a/src/plugins/discover/public/application/components/sidebar/string_progress_bar.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/string_progress_bar.tsx
@@ -17,35 +17,18 @@
  * under the License.
  */
 import React from 'react';
-import { EuiFlexGroup, EuiFlexItem, EuiProgress, EuiText, EuiToolTip } from '@elastic/eui';
+import { EuiProgress } from '@elastic/eui';
 
 interface Props {
   percent: number;
   count: number;
+  value: string;
 }
 
-export function StringFieldProgressBar(props: Props) {
+export function StringFieldProgressBar({ value, percent, count }: Props) {
+  const ariaLabel = `${value}: ${count} (${percent}%)`;
+
   return (
-    <EuiToolTip
-      anchorClassName="dscProgressBarTooltip__anchor"
-      content={props.count}
-      delay="regular"
-      position="right"
-    >
-      <EuiFlexGroup alignItems="center" responsive={false}>
-        <EuiFlexItem>
-          <EuiProgress
-            value={props.percent}
-            max={100}
-            color="secondary"
-            aria-hidden={true}
-            size="l"
-          />
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiText size="xs">{props.percent}%</EuiText>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiToolTip>
+    <EuiProgress value={percent} max={100} color="secondary" aria-label={ariaLabel} size="s" />
   );
 }

From 295ac7ef121ee16e875e6f83c8abada85ca39483 Mon Sep 17 00:00:00 2001
From: Andrew Goldstein <andrew-goldstein@users.noreply.github.com>
Date: Fri, 26 Jun 2020 15:36:51 -0600
Subject: [PATCH 65/78] [Security] `Investigate in Resolver` Timeline
 Integration (#70111)

## [Security] `Investigate in Resolver` Timeline Integration

This PR adds a new `Investigate in Resolver` action to the Timeline, and all timeline-based views, including:

- Timeline
- Alert list (i.e. Signals)
- Hosts > Events
- Hosts > External alerts
- Network > External alerts

![investigate-in-resolver-action](https://user-images.githubusercontent.com/4459398/85886173-c40d1c80-b7a2-11ea-8011-0221fef95d51.png)

### Resolver Overlay

When the `Investigate in Resolver` action is clicked, Resolver is displayed in an overlay over the events. The screenshot below has placeholder text where Resolver will be rendered:

![resolver-overlay](https://user-images.githubusercontent.com/4459398/85886309-10f0f300-b7a3-11ea-95cb-0117207e4890.png)

The Resolver overlay is closed by clicking the `< Back to events` button shown in the screenshot above.

The state of the timeline is restored when the overlay is closed. The scroll position (within the events), any expanded events, etc, will appear exactly as they were before the Resolver overlay was displayed.

### Case Integration

Users may link directly to a Timeline Resolver view from cases via the `Attach to new case` and `Attach to existing case...` actions show in the screenshot below:

![case-integration](https://user-images.githubusercontent.com/4459398/85886773-e3587980-b7a3-11ea-87b6-b098ea14bc5f.png)

![investigate-in-resolver](https://user-images.githubusercontent.com/4459398/85885618-daff3f00-b7a1-11ea-9356-2e8a1291f213.gif)

When users click the link in a case, Timeline will automatically open to the Resolver view in the link.

### URL State

Users can directly share Resolver views (in saved Timelines) with other users by copying the Kibana URL to the clipboard when Resolver is open.

When another user pastes the URL in their browser, Timeline will automatically open and display the Resolver view in the URL.

### Enabling the `Investigate in Resolver` action

In this PR, the `Investigate in Resolver` action is only enabled for events where all of the following are true:

- `agent.type` is `endpoint`
- `process.entity_id` exists

### Context passed to Resolver

The only context passed to `Resolver` is the `_id` of the event (when the user clicks `Investigate in Resolver`)

### What's next?

- @oatkiller will replace the placeholder text shown in the screenshots above with the actual call to Resolver in a separate PR
- I will follow-up this PR with additional tests
- The action text `Investigate in Resolver` may be changed in a future PR
- Hide the `Add to case` action in timeline-based views (it's currently visible, but disabled)
---
 .../alerts_table/default_config.tsx           |   24 +-
 .../components/alerts_table/index.test.tsx    |   53 +-
 .../alerts/components/alerts_table/index.tsx  |    7 +-
 .../components/alerts_viewer/alerts_table.tsx |   10 +-
 .../events_viewer/events_viewer.tsx           |   14 +-
 .../navigation/breadcrumbs/index.test.ts      |    1 +
 .../components/navigation/index.test.tsx      |    4 +-
 .../navigation/tab_navigation/index.test.tsx  |    2 +
 .../common/components/url_state/helpers.ts    |    3 +-
 .../url_state/initialize_redux_by_url.tsx     |    1 +
 .../public/graphql/introspection.json         |   35 +
 .../security_solution/public/graphql/types.ts |   18 +
 .../fields_browser/categories_pane.tsx        |    6 +-
 .../fields_browser/field_browser.tsx          |    6 +-
 .../components/fields_browser/index.tsx       |    1 +
 .../components/flyout/header/index.tsx        |    6 +-
 .../components/graph_overlay/index.tsx        |  150 ++
 .../components/graph_overlay/translations.ts  |   14 +
 .../components/open_timeline/helpers.ts       |    3 +
 .../__snapshots__/timeline.test.tsx.snap      | 1778 +++++++++--------
 .../timeline/body/actions/index.tsx           |   40 +-
 .../__snapshots__/index.test.tsx.snap         |    4 +-
 .../timeline/body/column_headers/index.tsx    |   35 +-
 .../components/timeline/body/constants.ts     |    6 +-
 .../body/events/event_column_view.tsx         |   17 +-
 .../components/timeline/body/helpers.ts       |   36 +-
 .../components/timeline/body/index.test.tsx   |    6 +
 .../components/timeline/body/index.tsx        |   19 +-
 .../timeline/body/stateful_body.tsx           |   13 +-
 .../components/timeline/body/translations.ts  |    7 +
 .../components/timeline/header/index.tsx      |   41 +-
 .../timelines/components/timeline/helpers.tsx |    2 +
 .../components/timeline/index.test.tsx        |    1 +
 .../timelines/components/timeline/index.tsx   |    5 +
 .../insert_timeline_popover/index.test.tsx    |    6 +-
 .../insert_timeline_popover/index.tsx         |   12 +-
 .../use_insert_timeline.tsx                   |   21 +-
 .../timeline/properties/helpers.test.tsx      |    1 +
 .../timeline/properties/helpers.tsx           |   49 +-
 .../timeline/properties/index.test.tsx        |   12 +-
 .../components/timeline/properties/index.tsx  |   14 +-
 .../timeline/properties/properties_right.tsx  |    3 +
 .../timeline/properties/translations.ts       |   16 +-
 .../timeline/selectable_timeline/index.tsx    |    9 +-
 .../timelines/components/timeline/styles.tsx  |   23 +-
 .../components/timeline/timeline.test.tsx     |    6 +-
 .../components/timeline/timeline.tsx          |   11 +
 .../timelines/containers/index.gql_query.ts   |    4 +
 .../timelines/store/timeline/actions.ts       |    4 +
 .../timelines/store/timeline/helpers.ts       |   20 +
 .../public/timelines/store/timeline/model.ts  |    4 +
 .../timelines/store/timeline/reducer.test.ts  |    2 +-
 .../timelines/store/timeline/reducer.ts       |    6 +
 .../public/timelines/store/timeline/types.ts  |    1 +
 .../server/graphql/ecs/schema.gql.ts          |    6 +
 .../security_solution/server/graphql/types.ts |   35 +
 .../server/lib/ecs_fields/index.ts            |    6 +
 57 files changed, 1615 insertions(+), 1024 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
 create mode 100644 x-pack/plugins/security_solution/public/timelines/components/graph_overlay/translations.ts

diff --git a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/default_config.tsx b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/default_config.tsx
index 2029c5169c2c..6d82897aaf01 100644
--- a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/default_config.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/default_config.tsx
@@ -8,6 +8,7 @@
 
 import React from 'react';
 import ApolloClient from 'apollo-client';
+import { Dispatch } from 'redux';
 
 import { EuiText } from '@elastic/eui';
 import { Status } from '../../../../common/detection_engine/schemas/common/schemas';
@@ -17,10 +18,12 @@ import {
   TimelineRowActionOnClick,
 } from '../../../timelines/components/timeline/body/actions';
 import { defaultColumnHeaderType } from '../../../timelines/components/timeline/body/column_headers/default_headers';
+import { getInvestigateInResolverAction } from '../../../timelines/components/timeline/body/helpers';
 import {
   DEFAULT_COLUMN_MIN_WIDTH,
   DEFAULT_DATE_COLUMN_MIN_WIDTH,
 } from '../../../timelines/components/timeline/body/constants';
+import { DEFAULT_ICON_BUTTON_WIDTH } from '../../../timelines/components/timeline/helpers';
 import { ColumnHeaderOptions, SubsetTimelineModel } from '../../../timelines/store/timeline/model';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 
@@ -174,23 +177,27 @@ export const getAlertActions = ({
   apolloClient,
   canUserCRUD,
   createTimeline,
+  dispatch,
   hasIndexWrite,
   onAlertStatusUpdateFailure,
   onAlertStatusUpdateSuccess,
   setEventsDeleted,
   setEventsLoading,
   status,
+  timelineId,
   updateTimelineIsLoading,
 }: {
   apolloClient?: ApolloClient<{}>;
   canUserCRUD: boolean;
   createTimeline: CreateTimeline;
+  dispatch: Dispatch;
   hasIndexWrite: boolean;
   onAlertStatusUpdateFailure: (status: Status, error: Error) => void;
   onAlertStatusUpdateSuccess: (count: number, status: Status) => void;
   setEventsDeleted: ({ eventIds, isDeleted }: SetEventsDeletedProps) => void;
   setEventsLoading: ({ eventIds, isLoading }: SetEventsLoadingProps) => void;
   status: Status;
+  timelineId: string;
   updateTimelineIsLoading: UpdateTimelineLoading;
 }): TimelineRowAction[] => {
   const openAlertActionComponent: TimelineRowAction = {
@@ -199,7 +206,7 @@ export const getAlertActions = ({
     dataTestSubj: 'open-alert-status',
     displayType: 'contextMenu',
     id: FILTER_OPEN,
-    isActionDisabled: !canUserCRUD || !hasIndexWrite,
+    isActionDisabled: () => !canUserCRUD || !hasIndexWrite,
     onClick: ({ eventId }: TimelineRowActionOnClick) =>
       updateAlertStatusAction({
         alertIds: [eventId],
@@ -210,7 +217,7 @@ export const getAlertActions = ({
         status,
         selectedStatus: FILTER_OPEN,
       }),
-    width: 26,
+    width: DEFAULT_ICON_BUTTON_WIDTH,
   };
 
   const closeAlertActionComponent: TimelineRowAction = {
@@ -219,7 +226,7 @@ export const getAlertActions = ({
     dataTestSubj: 'close-alert-status',
     displayType: 'contextMenu',
     id: FILTER_CLOSED,
-    isActionDisabled: !canUserCRUD || !hasIndexWrite,
+    isActionDisabled: () => !canUserCRUD || !hasIndexWrite,
     onClick: ({ eventId }: TimelineRowActionOnClick) =>
       updateAlertStatusAction({
         alertIds: [eventId],
@@ -230,7 +237,7 @@ export const getAlertActions = ({
         status,
         selectedStatus: FILTER_CLOSED,
       }),
-    width: 26,
+    width: DEFAULT_ICON_BUTTON_WIDTH,
   };
 
   const inProgressAlertActionComponent: TimelineRowAction = {
@@ -239,7 +246,7 @@ export const getAlertActions = ({
     dataTestSubj: 'in-progress-alert-status',
     displayType: 'contextMenu',
     id: FILTER_IN_PROGRESS,
-    isActionDisabled: !canUserCRUD || !hasIndexWrite,
+    isActionDisabled: () => !canUserCRUD || !hasIndexWrite,
     onClick: ({ eventId }: TimelineRowActionOnClick) =>
       updateAlertStatusAction({
         alertIds: [eventId],
@@ -250,10 +257,13 @@ export const getAlertActions = ({
         status,
         selectedStatus: FILTER_IN_PROGRESS,
       }),
-    width: 26,
+    width: DEFAULT_ICON_BUTTON_WIDTH,
   };
 
   return [
+    {
+      ...getInvestigateInResolverAction({ dispatch, timelineId }),
+    },
     {
       ariaLabel: 'Send alert to timeline',
       content: i18n.ACTION_INVESTIGATE_IN_TIMELINE,
@@ -268,7 +278,7 @@ export const getAlertActions = ({
           ecsData,
           updateTimelineIsLoading,
         }),
-      width: 26,
+      width: DEFAULT_ICON_BUTTON_WIDTH,
     },
     // Context menu items
     ...(FILTER_OPEN !== status ? [openAlertActionComponent] : []),
diff --git a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.test.tsx b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.test.tsx
index f843bf688184..9ff368aff2bf 100644
--- a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.test.tsx
@@ -7,37 +7,40 @@
 import React from 'react';
 import { shallow } from 'enzyme';
 
+import { TestProviders } from '../../../common/mock/test_providers';
 import { TimelineId } from '../../../../common/types/timeline';
 import { AlertsTableComponent } from './index';
 
 describe('AlertsTableComponent', () => {
   it('renders correctly', () => {
     const wrapper = shallow(
-      <AlertsTableComponent
-        timelineId={TimelineId.test}
-        canUserCRUD
-        hasIndexWrite
-        from={0}
-        loading
-        signalsIndex="index"
-        to={1}
-        globalQuery={{
-          query: 'query',
-          language: 'language',
-        }}
-        globalFilters={[]}
-        deletedEventIds={[]}
-        loadingEventIds={[]}
-        selectedEventIds={{}}
-        isSelectAllChecked={false}
-        clearSelected={jest.fn()}
-        setEventsLoading={jest.fn()}
-        clearEventsLoading={jest.fn()}
-        setEventsDeleted={jest.fn()}
-        clearEventsDeleted={jest.fn()}
-        updateTimelineIsLoading={jest.fn()}
-        updateTimeline={jest.fn()}
-      />
+      <TestProviders>
+        <AlertsTableComponent
+          timelineId={TimelineId.test}
+          canUserCRUD
+          hasIndexWrite
+          from={0}
+          loading
+          signalsIndex="index"
+          to={1}
+          globalQuery={{
+            query: 'query',
+            language: 'language',
+          }}
+          globalFilters={[]}
+          deletedEventIds={[]}
+          loadingEventIds={[]}
+          selectedEventIds={{}}
+          isSelectAllChecked={false}
+          clearSelected={jest.fn()}
+          setEventsLoading={jest.fn()}
+          clearEventsLoading={jest.fn()}
+          setEventsDeleted={jest.fn()}
+          clearEventsDeleted={jest.fn()}
+          updateTimelineIsLoading={jest.fn()}
+          updateTimeline={jest.fn()}
+        />
+      </TestProviders>
     );
 
     expect(wrapper.find('[title="Alerts"]')).toBeTruthy();
diff --git a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx
index ba6102312fef..ec088c111e3b 100644
--- a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx
@@ -7,7 +7,7 @@
 import { EuiPanel, EuiLoadingContent } from '@elastic/eui';
 import { isEmpty } from 'lodash/fp';
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
-import { connect, ConnectedProps } from 'react-redux';
+import { connect, ConnectedProps, useDispatch } from 'react-redux';
 import { Dispatch } from 'redux';
 
 import { Status } from '../../../../common/detection_engine/schemas/common/schemas';
@@ -84,6 +84,7 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   updateTimeline,
   updateTimelineIsLoading,
 }) => {
+  const dispatch = useDispatch();
   const [selectAll, setSelectAll] = useState(false);
   const apolloClient = useApolloClient();
 
@@ -292,11 +293,13 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
       getAlertActions({
         apolloClient,
         canUserCRUD,
+        dispatch,
         hasIndexWrite,
         createTimeline: createTimelineCallback,
         setEventsLoading: setEventsLoadingCallback,
         setEventsDeleted: setEventsDeletedCallback,
         status: filterGroup,
+        timelineId,
         updateTimelineIsLoading,
         onAlertStatusUpdateSuccess,
         onAlertStatusUpdateFailure,
@@ -305,10 +308,12 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
       apolloClient,
       canUserCRUD,
       createTimelineCallback,
+      dispatch,
       hasIndexWrite,
       filterGroup,
       setEventsLoadingCallback,
       setEventsDeletedCallback,
+      timelineId,
       updateTimelineIsLoading,
       onAlertStatusUpdateSuccess,
       onAlertStatusUpdateFailure,
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
index 251e0278b11b..6d5471404ab4 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
@@ -5,13 +5,16 @@
  */
 
 import React, { useEffect, useMemo } from 'react';
+import { useDispatch } from 'react-redux';
 
 import { Filter } from '../../../../../../../src/plugins/data/public';
 import { TimelineIdLiteral } from '../../../../common/types/timeline';
 import { StatefulEventsViewer } from '../events_viewer';
 import { alertsDefaultModel } from './default_headers';
 import { useManageTimeline } from '../../../timelines/components/manage_timeline';
+import { getInvestigateInResolverAction } from '../../../timelines/components/timeline/body/helpers';
 import * as i18n from './translations';
+
 export interface OwnProps {
   end: number;
   id: string;
@@ -64,8 +67,9 @@ const AlertsTableComponent: React.FC<Props> = ({
   startDate,
   pageFilters = [],
 }) => {
+  const dispatch = useDispatch();
   const alertsFilter = useMemo(() => [...defaultAlertsFilters, ...pageFilters], [pageFilters]);
-  const { initializeTimeline } = useManageTimeline();
+  const { initializeTimeline, setTimelineRowActions } = useManageTimeline();
 
   useEffect(() => {
     initializeTimeline({
@@ -75,6 +79,10 @@ const AlertsTableComponent: React.FC<Props> = ({
       title: i18n.ALERTS_TABLE_TITLE,
       unit: i18n.UNIT,
     });
+    setTimelineRowActions({
+      id: timelineId,
+      timelineRowActions: [getInvestigateInResolverAction({ dispatch, timelineId })],
+    });
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
   return (
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
index 6b4baac0ff26..9e38b14c4334 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
@@ -7,6 +7,7 @@
 import { EuiPanel } from '@elastic/eui';
 import { getOr, isEmpty, union } from 'lodash/fp';
 import React, { useEffect, useMemo, useState } from 'react';
+import { useDispatch } from 'react-redux';
 import styled from 'styled-components';
 import deepEqual from 'fast-deep-equal';
 
@@ -34,6 +35,7 @@ import {
 } from '../../../../../../../src/plugins/data/public';
 import { inputsModel } from '../../store';
 import { useManageTimeline } from '../../../timelines/components/manage_timeline';
+import { getInvestigateInResolverAction } from '../../../timelines/components/timeline/body/helpers';
 
 const DEFAULT_EVENTS_VIEWER_HEIGHT = 500;
 
@@ -91,6 +93,7 @@ const EventsViewerComponent: React.FC<Props> = ({
   toggleColumn,
   utilityBar,
 }) => {
+  const dispatch = useDispatch();
   const columnsHeader = isEmpty(columns) ? defaultHeaders : columns;
   const kibana = useKibana();
   const { filterManager } = useKibana().services.data.query;
@@ -100,7 +103,16 @@ const EventsViewerComponent: React.FC<Props> = ({
     getManageTimelineById,
     setIsTimelineLoading,
     setTimelineFilterManager,
+    setTimelineRowActions,
   } = useManageTimeline();
+
+  useEffect(() => {
+    setTimelineRowActions({
+      id,
+      timelineRowActions: [getInvestigateInResolverAction({ dispatch, timelineId: id })],
+    });
+  }, [setTimelineRowActions, id, dispatch]);
+
   useEffect(() => {
     setIsTimelineLoading({ id, isLoading: isQueryLoading });
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -179,9 +191,7 @@ const EventsViewerComponent: React.FC<Props> = ({
                   <HeaderSection id={id} subtitle={utilityBar ? undefined : subtitle} title={title}>
                     {headerFilterGroup}
                   </HeaderSection>
-
                   {utilityBar?.(refetch, totalCountMinusDeleted)}
-
                   <EventsContainerLoading data-test-subj={`events-container-loading-${loading}`}>
                     <TimelineRefetch
                       id={id}
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/breadcrumbs/index.test.ts b/x-pack/plugins/security_solution/public/common/components/navigation/breadcrumbs/index.test.ts
index 2c30f9a2e4ac..ade76f8e2433 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/breadcrumbs/index.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/breadcrumbs/index.test.ts
@@ -74,6 +74,7 @@ const getMockObject = (
   timeline: {
     id: '',
     isOpen: false,
+    graphEventId: '',
   },
   timerange: {
     global: {
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/index.test.tsx
index cab4ef8ead63..c2c94e192d9f 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/index.test.tsx
@@ -81,6 +81,7 @@ describe('SIEM Navigation', () => {
       [CONSTANTS.timeline]: {
         id: '',
         isOpen: false,
+        graphEventId: '',
       },
     },
   };
@@ -160,6 +161,7 @@ describe('SIEM Navigation', () => {
         timeline: {
           id: '',
           isOpen: false,
+          graphEventId: '',
         },
         timerange: {
           global: {
@@ -266,7 +268,7 @@ describe('SIEM Navigation', () => {
         search: '',
         state: undefined,
         tabName: 'authentications',
-        timeline: { id: '', isOpen: false },
+        timeline: { id: '', isOpen: false, graphEventId: '' },
         timerange: {
           global: {
             linkTo: ['timeline'],
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/index.test.tsx
index 977c7808b6c8..f345346d620c 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/index.test.tsx
@@ -71,6 +71,7 @@ describe('Tab Navigation', () => {
       [CONSTANTS.timeline]: {
         id: '',
         isOpen: false,
+        graphEventId: '',
       },
     };
     test('it mounts with correct tab highlighted', () => {
@@ -128,6 +129,7 @@ describe('Tab Navigation', () => {
       [CONSTANTS.timeline]: {
         id: '',
         isOpen: false,
+        graphEventId: '',
       },
     };
     test('it mounts with correct tab highlighted', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts b/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts
index c270a99d3c51..7f4267bc5e2b 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts
@@ -126,8 +126,9 @@ export const makeMapStateToProps = () => {
         ? {
             id: flyoutTimeline.savedObjectId != null ? flyoutTimeline.savedObjectId : '',
             isOpen: flyoutTimeline.show,
+            graphEventId: flyoutTimeline.graphEventId ?? '',
           }
-        : { id: '', isOpen: false };
+        : { id: '', isOpen: false, graphEventId: '' };
 
     let searchAttr: {
       [CONSTANTS.appQuery]?: Query;
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx b/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
index efd6221bbfbd..ab03e2199474 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
@@ -81,6 +81,7 @@ export const dispatchSetInitialStateFromUrl = (
         queryTimelineById({
           apolloClient,
           duplicate: false,
+          graphEventId: timeline.graphEventId,
           timelineId: timeline.id,
           openTimeline: timeline.isOpen,
           updateIsLoading: updateTimelineIsLoading,
diff --git a/x-pack/plugins/security_solution/public/graphql/introspection.json b/x-pack/plugins/security_solution/public/graphql/introspection.json
index 3c8c7c21d72a..48547212bb6c 100644
--- a/x-pack/plugins/security_solution/public/graphql/introspection.json
+++ b/x-pack/plugins/security_solution/public/graphql/introspection.json
@@ -3570,6 +3570,14 @@
             "isDeprecated": false,
             "deprecationReason": null
           },
+          {
+            "name": "agent",
+            "description": "",
+            "args": [],
+            "type": { "kind": "OBJECT", "name": "AgentEcsField", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
           {
             "name": "auditd",
             "description": "",
@@ -3760,6 +3768,25 @@
         "enumValues": null,
         "possibleTypes": null
       },
+      {
+        "kind": "OBJECT",
+        "name": "AgentEcsField",
+        "description": "",
+        "fields": [
+          {
+            "name": "type",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
+          }
+        ],
+        "inputFields": null,
+        "interfaces": [],
+        "enumValues": null,
+        "possibleTypes": null
+      },
       {
         "kind": "OBJECT",
         "name": "AuditdEcsFields",
@@ -5728,6 +5755,14 @@
             "isDeprecated": false,
             "deprecationReason": null
           },
+          {
+            "name": "entity_id",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
           {
             "name": "executable",
             "description": "",
diff --git a/x-pack/plugins/security_solution/public/graphql/types.ts b/x-pack/plugins/security_solution/public/graphql/types.ts
index dc4a8ae78bf4..b5088fe51b44 100644
--- a/x-pack/plugins/security_solution/public/graphql/types.ts
+++ b/x-pack/plugins/security_solution/public/graphql/types.ts
@@ -763,6 +763,8 @@ export interface Ecs {
 
   _index?: Maybe<string>;
 
+  agent?: Maybe<AgentEcsField>;
+
   auditd?: Maybe<AuditdEcsFields>;
 
   destination?: Maybe<DestinationEcsFields>;
@@ -810,6 +812,10 @@ export interface Ecs {
   system?: Maybe<SystemEcsField>;
 }
 
+export interface AgentEcsField {
+  type?: Maybe<string[]>;
+}
+
 export interface AuditdEcsFields {
   result?: Maybe<string[]>;
 
@@ -1265,6 +1271,8 @@ export interface ProcessEcsFields {
 
   args?: Maybe<string[]>;
 
+  entity_id?: Maybe<string[]>;
+
   executable?: Maybe<string[]>;
 
   title?: Maybe<string[]>;
@@ -4605,6 +4613,8 @@ export namespace GetTimelineQuery {
 
     event: Maybe<Event>;
 
+    agent: Maybe<Agent>;
+
     auditd: Maybe<Auditd>;
 
     file: Maybe<File>;
@@ -4730,6 +4740,12 @@ export namespace GetTimelineQuery {
     type: Maybe<string[]>;
   };
 
+  export type Agent = {
+    __typename?: 'AgentEcsField';
+
+    type: Maybe<string[]>;
+  };
+
   export type Auditd = {
     __typename?: 'AuditdEcsFields';
 
@@ -5155,6 +5171,8 @@ export namespace GetTimelineQuery {
 
     args: Maybe<string[]>;
 
+    entity_id: Maybe<string[]>;
+
     executable: Maybe<string[]>;
 
     title: Maybe<string[]>;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/categories_pane.tsx b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/categories_pane.tsx
index 480070fda959..7addfaaf7c5f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/categories_pane.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/categories_pane.tsx
@@ -32,6 +32,10 @@ const Title = styled(EuiTitle)`
   padding-left: 5px;
 `;
 
+const H5 = styled.h5`
+  text-align: left;
+`;
+
 Title.displayName = 'Title';
 
 type Props = Pick<FieldBrowserProps, 'browserFields' | 'timelineId' | 'onUpdateColumns'> & {
@@ -64,7 +68,7 @@ export const CategoriesPane = React.memo<Props>(
   }) => (
     <>
       <Title size="xxs">
-        <h5 data-test-subj="categories-pane-title">{i18n.CATEGORIES}</h5>
+        <H5 data-test-subj="categories-pane-title">{i18n.CATEGORIES}</H5>
       </Title>
 
       <CategoryNames
diff --git a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_browser.tsx b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_browser.tsx
index 8f538e03835f..07c4893e4550 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_browser.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_browser.tsx
@@ -29,11 +29,11 @@ const FieldsBrowserContainer = styled.div<{ width: number }>`
   border: ${({ theme }) => theme.eui.euiBorderWidthThin} solid
     ${({ theme }) => theme.eui.euiColorMediumShade};
   border-radius: ${({ theme }) => theme.eui.euiBorderRadius};
-  left: 0;
+  left: 8px;
   padding: ${({ theme }) => theme.eui.paddingSizes.s} ${({ theme }) => theme.eui.paddingSizes.s}
-    ${({ theme }) => theme.eui.paddingSizes.m};
+    ${({ theme }) => theme.eui.paddingSizes.s};
   position: absolute;
-  top: calc(100% + ${({ theme }) => theme.eui.euiSize});
+  top: calc(100% + 4px);
   width: ${({ width }) => width}px;
   z-index: 9990;
 `;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/index.tsx
index a3e93ff3c90e..a3937107936b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/index.tsx
@@ -26,6 +26,7 @@ export const INPUT_TIMEOUT = 250;
 
 const FieldsBrowserButtonContainer = styled.div`
   position: relative;
+  width: 24px;
 `;
 
 FieldsBrowserButtonContainer.displayName = 'FieldsBrowserButtonContainer';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
index 8ad32d6e2cad..9fe48cd2f019 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
@@ -33,6 +33,7 @@ const StatefulFlyoutHeader = React.memo<Props>(
     associateNote,
     createTimeline,
     description,
+    graphEventId,
     isDataInTimeline,
     isDatepickerLocked,
     isFavorite,
@@ -58,6 +59,7 @@ const StatefulFlyoutHeader = React.memo<Props>(
         createTimeline={createTimeline}
         description={description}
         getNotesByIds={getNotesByIds}
+        graphEventId={graphEventId}
         isDataInTimeline={isDataInTimeline}
         isDatepickerLocked={isDatepickerLocked}
         isFavorite={isFavorite}
@@ -92,6 +94,7 @@ const makeMapStateToProps = () => {
     const {
       dataProviders,
       description = '',
+      graphEventId,
       isFavorite = false,
       kqlQuery,
       title = '',
@@ -103,13 +106,14 @@ const makeMapStateToProps = () => {
 
     return {
       description,
-      notesById: getNotesByIds(state),
+      graphEventId,
       history,
       isDataInTimeline:
         !isEmpty(dataProviders) || !isEmpty(get('filterQuery.kuery.expression', kqlQuery)),
       isFavorite,
       isDatepickerLocked: globalInput.linkTo.includes('timeline'),
       noteIds,
+      notesById: getNotesByIds(state),
       status,
       title,
     };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
new file mode 100644
index 000000000000..fe38dd79176a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
@@ -0,0 +1,150 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  EuiButtonEmpty,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiHorizontalRule,
+  EuiTitle,
+} from '@elastic/eui';
+import { noop } from 'lodash/fp';
+import React, { useCallback, useState } from 'react';
+import { connect, ConnectedProps, useDispatch, useSelector } from 'react-redux';
+import styled from 'styled-components';
+
+import { SecurityPageName } from '../../../app/types';
+import { AllCasesModal } from '../../../cases/components/all_cases_modal';
+import { getCaseDetailsUrl } from '../../../common/components/link_to';
+import { APP_ID } from '../../../../common/constants';
+import { useKibana } from '../../../common/lib/kibana';
+import { State } from '../../../common/store';
+import { timelineSelectors } from '../../store/timeline';
+import { timelineDefaults } from '../../store/timeline/defaults';
+import { TimelineModel } from '../../store/timeline/model';
+import { NewCase, ExistingCase } from '../timeline/properties/helpers';
+import { UNTITLED_TIMELINE } from '../timeline/properties/translations';
+import {
+  setInsertTimeline,
+  updateTimelineGraphEventId,
+} from '../../../timelines/store/timeline/actions';
+
+import * as i18n from './translations';
+
+const OverlayContainer = styled.div<{ bodyHeight?: number }>`
+  height: ${({ bodyHeight }) => (bodyHeight ? `${bodyHeight}px` : 'auto')};
+  width: 100%;
+`;
+
+interface OwnProps {
+  bodyHeight?: number;
+  graphEventId?: string;
+  timelineId: string;
+}
+
+const GraphOverlayComponent = ({
+  bodyHeight,
+  graphEventId,
+  status,
+  timelineId,
+  title,
+}: OwnProps & PropsFromRedux) => {
+  const dispatch = useDispatch();
+  const { navigateToApp } = useKibana().services.application;
+  const onCloseOverlay = useCallback(() => {
+    dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: '' }));
+  }, [dispatch, timelineId]);
+  const [showCaseModal, setShowCaseModal] = useState<boolean>(false);
+  const onOpenCaseModal = useCallback(() => setShowCaseModal(true), []);
+  const onCloseCaseModal = useCallback(() => setShowCaseModal(false), [setShowCaseModal]);
+  const currentTimeline = useSelector((state: State) =>
+    timelineSelectors.selectTimeline(state, timelineId)
+  );
+  const onRowClick = useCallback(
+    (id: string) => {
+      onCloseCaseModal();
+
+      dispatch(
+        setInsertTimeline({
+          graphEventId,
+          timelineId,
+          timelineSavedObjectId: currentTimeline.savedObjectId,
+          timelineTitle: title.length > 0 ? title : UNTITLED_TIMELINE,
+        })
+      );
+
+      navigateToApp(`${APP_ID}:${SecurityPageName.case}`, {
+        path: getCaseDetailsUrl({ id }),
+      });
+    },
+    [currentTimeline, dispatch, graphEventId, navigateToApp, onCloseCaseModal, timelineId, title]
+  );
+
+  return (
+    <OverlayContainer bodyHeight={bodyHeight}>
+      <EuiHorizontalRule margin="none" />
+      <EuiFlexGroup gutterSize="none" justifyContent="spaceBetween">
+        <EuiFlexItem grow={false}>
+          <EuiButtonEmpty onClick={onCloseOverlay} size="xs">
+            {i18n.BACK_TO_EVENTS}
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiFlexGroup gutterSize="none">
+            <EuiFlexItem grow={false}>
+              <NewCase
+                compact={true}
+                graphEventId={graphEventId}
+                onClosePopover={noop}
+                timelineId={timelineId}
+                timelineTitle={title}
+                timelineStatus={status}
+              />
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <ExistingCase
+                compact={true}
+                onClosePopover={noop}
+                onOpenCaseModal={onOpenCaseModal}
+                timelineStatus={status}
+              />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+
+      <EuiHorizontalRule margin="none" />
+      <EuiTitle>
+        <>{`Resolver graph for event _id ${graphEventId}`}</>
+      </EuiTitle>
+      <AllCasesModal
+        onCloseCaseModal={onCloseCaseModal}
+        showCaseModal={showCaseModal}
+        onRowClick={onRowClick}
+      />
+    </OverlayContainer>
+  );
+};
+
+const makeMapStateToProps = () => {
+  const getTimeline = timelineSelectors.getTimelineByIdSelector();
+  const mapStateToProps = (state: State, { timelineId }: OwnProps) => {
+    const timeline: TimelineModel = getTimeline(state, timelineId) ?? timelineDefaults;
+    const { status, title = '' } = timeline;
+
+    return {
+      status,
+      title,
+    };
+  };
+  return mapStateToProps;
+};
+
+const connector = connect(makeMapStateToProps);
+
+type PropsFromRedux = ConnectedProps<typeof connector>;
+
+export const GraphOverlay = connector(GraphOverlayComponent);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/translations.ts
new file mode 100644
index 000000000000..c7cd9253de03
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/translations.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const BACK_TO_EVENTS = i18n.translate(
+  'xpack.securitySolution.timeline.graphOverlay.backToEventsButton',
+  {
+    defaultMessage: '< Back to events',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
index c8a47798f169..520215cde486 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
@@ -190,6 +190,7 @@ export const formatTimelineResultToModel = (
 export interface QueryTimelineById<TCache> {
   apolloClient: ApolloClient<TCache> | ApolloClient<{}> | undefined;
   duplicate?: boolean;
+  graphEventId?: string;
   timelineId: string;
   onOpenTimeline?: (timeline: TimelineModel) => void;
   openTimeline?: boolean;
@@ -206,6 +207,7 @@ export interface QueryTimelineById<TCache> {
 export const queryTimelineById = <TCache>({
   apolloClient,
   duplicate = false,
+  graphEventId = '',
   timelineId,
   onOpenTimeline,
   openTimeline = true,
@@ -238,6 +240,7 @@ export const queryTimelineById = <TCache>({
             notes,
             timeline: {
               ...timeline,
+              graphEventId,
               show: openTimeline,
             },
             to: getOr(to, 'dateRange.end', timeline),
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap
index 4e6cce618880..927822527193 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap
@@ -1,882 +1,942 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`Timeline rendering renders correctly against snapshot 1`] = `
-<styled.div
-  data-test-subj="timeline"
->
-  <Styled(EuiFlyoutHeader)
-    data-test-subj="eui-flyout-header"
-    hasBorder={false}
-  >
-    <FlyoutHeaderWithCloseButton
-      onClose={[MockFunction]}
-      timelineId="foo"
-      usersViewing={
-        Array [
-          "elastic",
-        ]
-      }
-    />
-    <TimelineHeaderContainer
-      data-test-subj="timelineHeader"
-    >
-      <Memo(TimelineHeaderComponent)
-        browserFields={
-          Object {
-            "agent": Object {
-              "fields": Object {
-                "agent.ephemeral_id": Object {
-                  "aggregatable": true,
-                  "category": "agent",
-                  "description": "Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but \`agent.id\` does not.",
-                  "example": "8a4f500f",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "agent.ephemeral_id",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "agent.hostname": Object {
-                  "aggregatable": true,
-                  "category": "agent",
-                  "description": null,
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "agent.hostname",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "agent.id": Object {
-                  "aggregatable": true,
-                  "category": "agent",
-                  "description": "Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id.",
-                  "example": "8a4f500d",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "agent.id",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "agent.name": Object {
-                  "aggregatable": true,
-                  "category": "agent",
-                  "description": "Name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty.",
-                  "example": "foo",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "agent.name",
-                  "searchable": true,
-                  "type": "string",
-                },
-              },
+<I18nProvider>
+  <Component>
+    <ApolloProvider
+      client={
+        ApolloClient {
+          "cache": InMemoryCache {
+            "addTypename": true,
+            "cacheKeyRoot": KeyTrie {
+              "weakness": true,
             },
-            "auditd": Object {
-              "fields": Object {
-                "auditd.data.a0": Object {
-                  "aggregatable": true,
-                  "category": "auditd",
-                  "description": null,
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                  ],
-                  "name": "auditd.data.a0",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "auditd.data.a1": Object {
-                  "aggregatable": true,
-                  "category": "auditd",
-                  "description": null,
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                  ],
-                  "name": "auditd.data.a1",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "auditd.data.a2": Object {
-                  "aggregatable": true,
-                  "category": "auditd",
-                  "description": null,
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                  ],
-                  "name": "auditd.data.a2",
-                  "searchable": true,
-                  "type": "string",
-                },
-              },
+            "config": Object {
+              "addTypename": true,
+              "dataIdFromObject": [Function],
+              "fragmentMatcher": HeuristicFragmentMatcher {},
+              "freezeResults": false,
+              "resultCaching": true,
             },
-            "base": Object {
-              "fields": Object {
-                "@timestamp": Object {
-                  "aggregatable": true,
-                  "category": "base",
-                  "description": "Date/time when the event originated. For log events this is the date/time when the event was generated, and not when it was read. Required field for all events.",
-                  "example": "2016-05-23T08:05:34.853Z",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "@timestamp",
-                  "searchable": true,
-                  "type": "date",
-                },
-              },
+            "data": DepTrackingCache {
+              "data": Object {},
+              "depend": [Function],
             },
-            "client": Object {
-              "fields": Object {
-                "client.address": Object {
-                  "aggregatable": true,
-                  "category": "client",
-                  "description": "Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the \`.address\` field. Then it should be duplicated to \`.ip\` or \`.domain\`, depending on which one it is.",
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "client.address",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "client.bytes": Object {
-                  "aggregatable": true,
-                  "category": "client",
-                  "description": "Bytes sent from the client to the server.",
-                  "example": "184",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "client.bytes",
-                  "searchable": true,
-                  "type": "number",
-                },
-                "client.domain": Object {
-                  "aggregatable": true,
-                  "category": "client",
-                  "description": "Client domain.",
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "client.domain",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "client.geo.country_iso_code": Object {
-                  "aggregatable": true,
-                  "category": "client",
-                  "description": "Country ISO code.",
-                  "example": "CA",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "client.geo.country_iso_code",
-                  "searchable": true,
-                  "type": "string",
-                },
-              },
+            "maybeBroadcastWatch": [Function],
+            "optimisticData": DepTrackingCache {
+              "data": Object {},
+              "depend": [Function],
             },
-            "cloud": Object {
-              "fields": Object {
-                "cloud.account.id": Object {
-                  "aggregatable": true,
-                  "category": "cloud",
-                  "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
-                  "example": "666777888999",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "cloud.account.id",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "cloud.availability_zone": Object {
-                  "aggregatable": true,
-                  "category": "cloud",
-                  "description": "Availability zone in which this host is running.",
-                  "example": "us-east-1c",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "cloud.availability_zone",
-                  "searchable": true,
-                  "type": "string",
-                },
-              },
+            "silenceBroadcast": false,
+            "storeReader": StoreReader {
+              "executeSelectionSet": [Function],
+              "executeStoreQuery": [Function],
+              "executeSubSelectedArray": [Function],
+              "freezeResults": false,
             },
-            "container": Object {
-              "fields": Object {
-                "container.id": Object {
-                  "aggregatable": true,
-                  "category": "container",
-                  "description": "Unique container id.",
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "container.id",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "container.image.name": Object {
-                  "aggregatable": true,
-                  "category": "container",
-                  "description": "Name of the image the container was built on.",
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "container.image.name",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "container.image.tag": Object {
-                  "aggregatable": true,
-                  "category": "container",
-                  "description": "Container image tag.",
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "container.image.tag",
-                  "searchable": true,
-                  "type": "string",
-                },
-              },
-            },
-            "destination": Object {
-              "fields": Object {
-                "destination.address": Object {
-                  "aggregatable": true,
-                  "category": "destination",
-                  "description": "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the \`.address\` field. Then it should be duplicated to \`.ip\` or \`.domain\`, depending on which one it is.",
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "destination.address",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "destination.bytes": Object {
-                  "aggregatable": true,
-                  "category": "destination",
-                  "description": "Bytes sent from the destination to the source.",
-                  "example": "184",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "destination.bytes",
-                  "searchable": true,
-                  "type": "number",
-                },
-                "destination.domain": Object {
-                  "aggregatable": true,
-                  "category": "destination",
-                  "description": "Destination domain.",
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "destination.domain",
-                  "searchable": true,
-                  "type": "string",
-                },
-                "destination.ip": Object {
-                  "aggregatable": true,
-                  "category": "destination",
-                  "description": "IP address of the destination. Can be one or multiple IPv4 or IPv6 addresses.",
-                  "example": "",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "destination.ip",
-                  "searchable": true,
-                  "type": "ip",
-                },
-                "destination.port": Object {
-                  "aggregatable": true,
-                  "category": "destination",
-                  "description": "Port of the destination.",
-                  "example": "",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "destination.port",
-                  "searchable": true,
-                  "type": "long",
-                },
-              },
-            },
-            "event": Object {
-              "fields": Object {
-                "event.end": Object {
-                  "aggregatable": true,
-                  "category": "event",
-                  "description": "event.end contains the date when the event ended or when the activity was last observed.",
-                  "example": null,
-                  "format": "",
-                  "indexes": Array [
-                    "apm-*-transaction*",
-                    "auditbeat-*",
-                    "endgame-*",
-                    "filebeat-*",
-                    "packetbeat-*",
-                    "winlogbeat-*",
-                  ],
-                  "name": "event.end",
-                  "searchable": true,
-                  "type": "date",
-                },
-              },
-            },
-            "source": Object {
-              "fields": Object {
-                "source.ip": Object {
-                  "aggregatable": true,
-                  "category": "source",
-                  "description": "IP address of the source. Can be one or multiple IPv4 or IPv6 addresses.",
-                  "example": "",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "source.ip",
-                  "searchable": true,
-                  "type": "ip",
-                },
-                "source.port": Object {
-                  "aggregatable": true,
-                  "category": "source",
-                  "description": "Port of the source.",
-                  "example": "",
-                  "format": "",
-                  "indexes": Array [
-                    "auditbeat",
-                    "filebeat",
-                    "packetbeat",
-                  ],
-                  "name": "source.port",
-                  "searchable": true,
-                  "type": "long",
-                },
-              },
+            "storeWriter": StoreWriter {},
+            "typenameDocumentCache": Map {},
+            "watches": Set {},
+          },
+          "defaultOptions": Object {},
+          "disableNetworkFetches": false,
+          "link": ApolloLink {
+            "request": [Function],
+          },
+          "mutate": [Function],
+          "query": [Function],
+          "queryDeduplication": true,
+          "reFetchObservableQueries": [Function],
+          "resetStore": [Function],
+          "resetStoreCallbacks": Array [],
+          "ssrMode": false,
+          "store": DataStore {
+            "cache": InMemoryCache {
+              "addTypename": true,
+              "cacheKeyRoot": KeyTrie {
+                "weakness": true,
+              },
+              "config": Object {
+                "addTypename": true,
+                "dataIdFromObject": [Function],
+                "fragmentMatcher": HeuristicFragmentMatcher {},
+                "freezeResults": false,
+                "resultCaching": true,
+              },
+              "data": DepTrackingCache {
+                "data": Object {},
+                "depend": [Function],
+              },
+              "maybeBroadcastWatch": [Function],
+              "optimisticData": DepTrackingCache {
+                "data": Object {},
+                "depend": [Function],
+              },
+              "silenceBroadcast": false,
+              "storeReader": StoreReader {
+                "executeSelectionSet": [Function],
+                "executeStoreQuery": [Function],
+                "executeSubSelectedArray": [Function],
+                "freezeResults": false,
+              },
+              "storeWriter": StoreWriter {},
+              "typenameDocumentCache": Map {},
+              "watches": Set {},
             },
+          },
+          "version": "2.3.8",
+          "watchQuery": [Function],
+        }
+      }
+    >
+      <Provider
+        store={
+          Object {
+            "dispatch": [Function],
+            "getState": [Function],
+            "replaceReducer": [Function],
+            "subscribe": [Function],
+            Symbol(observable): [Function],
           }
         }
-        dataProviders={
-          Array [
-            Object {
-              "and": Array [
+      >
+        <ThemeProvider
+          theme={[Function]}
+        >
+          <DragDropContext
+            onDragEnd={[MockFunction]}
+          >
+            <TimelineComponent
+              browserFields={
                 Object {
-                  "and": Array [],
-                  "enabled": true,
-                  "excluded": false,
-                  "id": "id-Provider 2",
-                  "kqlQuery": "",
-                  "name": "Provider 2",
-                  "queryMatch": Object {
-                    "field": "name",
-                    "operator": ":",
-                    "value": "Provider 2",
+                  "agent": Object {
+                    "fields": Object {
+                      "agent.ephemeral_id": Object {
+                        "aggregatable": true,
+                        "category": "agent",
+                        "description": "Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but \`agent.id\` does not.",
+                        "example": "8a4f500f",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "agent.ephemeral_id",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "agent.hostname": Object {
+                        "aggregatable": true,
+                        "category": "agent",
+                        "description": null,
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "agent.hostname",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "agent.id": Object {
+                        "aggregatable": true,
+                        "category": "agent",
+                        "description": "Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id.",
+                        "example": "8a4f500d",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "agent.id",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "agent.name": Object {
+                        "aggregatable": true,
+                        "category": "agent",
+                        "description": "Name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty.",
+                        "example": "foo",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "agent.name",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                    },
                   },
-                },
-                Object {
-                  "and": Array [],
-                  "enabled": true,
-                  "excluded": false,
-                  "id": "id-Provider 3",
-                  "kqlQuery": "",
-                  "name": "Provider 3",
-                  "queryMatch": Object {
-                    "field": "name",
-                    "operator": ":",
-                    "value": "Provider 3",
+                  "auditd": Object {
+                    "fields": Object {
+                      "auditd.data.a0": Object {
+                        "aggregatable": true,
+                        "category": "auditd",
+                        "description": null,
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                        ],
+                        "name": "auditd.data.a0",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "auditd.data.a1": Object {
+                        "aggregatable": true,
+                        "category": "auditd",
+                        "description": null,
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                        ],
+                        "name": "auditd.data.a1",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "auditd.data.a2": Object {
+                        "aggregatable": true,
+                        "category": "auditd",
+                        "description": null,
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                        ],
+                        "name": "auditd.data.a2",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                    },
                   },
-                },
-              ],
-              "enabled": true,
-              "excluded": false,
-              "id": "id-Provider 1",
-              "kqlQuery": "",
-              "name": "Provider 1",
-              "queryMatch": Object {
-                "field": "name",
-                "operator": ":",
-                "value": "Provider 1",
-              },
-            },
-            Object {
-              "and": Array [],
-              "enabled": true,
-              "excluded": false,
-              "id": "id-Provider 2",
-              "kqlQuery": "",
-              "name": "Provider 2",
-              "queryMatch": Object {
-                "field": "name",
-                "operator": ":",
-                "value": "Provider 2",
-              },
-            },
-            Object {
-              "and": Array [],
-              "enabled": true,
-              "excluded": false,
-              "id": "id-Provider 3",
-              "kqlQuery": "",
-              "name": "Provider 3",
-              "queryMatch": Object {
-                "field": "name",
-                "operator": ":",
-                "value": "Provider 3",
-              },
-            },
-            Object {
-              "and": Array [],
-              "enabled": true,
-              "excluded": false,
-              "id": "id-Provider 4",
-              "kqlQuery": "",
-              "name": "Provider 4",
-              "queryMatch": Object {
-                "field": "name",
-                "operator": ":",
-                "value": "Provider 4",
-              },
-            },
-            Object {
-              "and": Array [],
-              "enabled": true,
-              "excluded": false,
-              "id": "id-Provider 5",
-              "kqlQuery": "",
-              "name": "Provider 5",
-              "queryMatch": Object {
-                "field": "name",
-                "operator": ":",
-                "value": "Provider 5",
-              },
-            },
-            Object {
-              "and": Array [],
-              "enabled": true,
-              "excluded": false,
-              "id": "id-Provider 6",
-              "kqlQuery": "",
-              "name": "Provider 6",
-              "queryMatch": Object {
-                "field": "name",
-                "operator": ":",
-                "value": "Provider 6",
-              },
-            },
-            Object {
-              "and": Array [],
-              "enabled": true,
-              "excluded": false,
-              "id": "id-Provider 7",
-              "kqlQuery": "",
-              "name": "Provider 7",
-              "queryMatch": Object {
-                "field": "name",
-                "operator": ":",
-                "value": "Provider 7",
-              },
-            },
-            Object {
-              "and": Array [],
-              "enabled": true,
-              "excluded": false,
-              "id": "id-Provider 8",
-              "kqlQuery": "",
-              "name": "Provider 8",
-              "queryMatch": Object {
-                "field": "name",
-                "operator": ":",
-                "value": "Provider 8",
-              },
-            },
-            Object {
-              "and": Array [],
-              "enabled": true,
-              "excluded": false,
-              "id": "id-Provider 9",
-              "kqlQuery": "",
-              "name": "Provider 9",
-              "queryMatch": Object {
-                "field": "name",
-                "operator": ":",
-                "value": "Provider 9",
-              },
-            },
-            Object {
-              "and": Array [],
-              "enabled": true,
-              "excluded": false,
-              "id": "id-Provider 10",
-              "kqlQuery": "",
-              "name": "Provider 10",
-              "queryMatch": Object {
-                "field": "name",
-                "operator": ":",
-                "value": "Provider 10",
-              },
-            },
-          ]
-        }
-        filterManager={
-          FilterManager {
-            "fetch$": Subject {
-              "_isScalar": false,
-              "closed": false,
-              "hasError": false,
-              "isStopped": false,
-              "observers": Array [],
-              "thrownError": null,
-            },
-            "filters": Array [],
-            "uiSettings": Object {
-              "get": [MockFunction] {
-                "calls": Array [
-                  Array [
-                    "query:allowLeadingWildcards",
-                  ],
-                  Array [
-                    "query:queryString:options",
-                  ],
-                  Array [
-                    "courier:ignoreFilterIfFieldNotInIndex",
-                  ],
-                  Array [
-                    "dateFormat:tz",
-                  ],
-                ],
-                "results": Array [
+                  "base": Object {
+                    "fields": Object {
+                      "@timestamp": Object {
+                        "aggregatable": true,
+                        "category": "base",
+                        "description": "Date/time when the event originated. For log events this is the date/time when the event was generated, and not when it was read. Required field for all events.",
+                        "example": "2016-05-23T08:05:34.853Z",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "@timestamp",
+                        "searchable": true,
+                        "type": "date",
+                      },
+                    },
+                  },
+                  "client": Object {
+                    "fields": Object {
+                      "client.address": Object {
+                        "aggregatable": true,
+                        "category": "client",
+                        "description": "Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the \`.address\` field. Then it should be duplicated to \`.ip\` or \`.domain\`, depending on which one it is.",
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "client.address",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "client.bytes": Object {
+                        "aggregatable": true,
+                        "category": "client",
+                        "description": "Bytes sent from the client to the server.",
+                        "example": "184",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "client.bytes",
+                        "searchable": true,
+                        "type": "number",
+                      },
+                      "client.domain": Object {
+                        "aggregatable": true,
+                        "category": "client",
+                        "description": "Client domain.",
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "client.domain",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "client.geo.country_iso_code": Object {
+                        "aggregatable": true,
+                        "category": "client",
+                        "description": "Country ISO code.",
+                        "example": "CA",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "client.geo.country_iso_code",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                    },
+                  },
+                  "cloud": Object {
+                    "fields": Object {
+                      "cloud.account.id": Object {
+                        "aggregatable": true,
+                        "category": "cloud",
+                        "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
+                        "example": "666777888999",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "cloud.account.id",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "cloud.availability_zone": Object {
+                        "aggregatable": true,
+                        "category": "cloud",
+                        "description": "Availability zone in which this host is running.",
+                        "example": "us-east-1c",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "cloud.availability_zone",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                    },
+                  },
+                  "container": Object {
+                    "fields": Object {
+                      "container.id": Object {
+                        "aggregatable": true,
+                        "category": "container",
+                        "description": "Unique container id.",
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "container.id",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "container.image.name": Object {
+                        "aggregatable": true,
+                        "category": "container",
+                        "description": "Name of the image the container was built on.",
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "container.image.name",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "container.image.tag": Object {
+                        "aggregatable": true,
+                        "category": "container",
+                        "description": "Container image tag.",
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "container.image.tag",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                    },
+                  },
+                  "destination": Object {
+                    "fields": Object {
+                      "destination.address": Object {
+                        "aggregatable": true,
+                        "category": "destination",
+                        "description": "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the \`.address\` field. Then it should be duplicated to \`.ip\` or \`.domain\`, depending on which one it is.",
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "destination.address",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "destination.bytes": Object {
+                        "aggregatable": true,
+                        "category": "destination",
+                        "description": "Bytes sent from the destination to the source.",
+                        "example": "184",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "destination.bytes",
+                        "searchable": true,
+                        "type": "number",
+                      },
+                      "destination.domain": Object {
+                        "aggregatable": true,
+                        "category": "destination",
+                        "description": "Destination domain.",
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "destination.domain",
+                        "searchable": true,
+                        "type": "string",
+                      },
+                      "destination.ip": Object {
+                        "aggregatable": true,
+                        "category": "destination",
+                        "description": "IP address of the destination. Can be one or multiple IPv4 or IPv6 addresses.",
+                        "example": "",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "destination.ip",
+                        "searchable": true,
+                        "type": "ip",
+                      },
+                      "destination.port": Object {
+                        "aggregatable": true,
+                        "category": "destination",
+                        "description": "Port of the destination.",
+                        "example": "",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "destination.port",
+                        "searchable": true,
+                        "type": "long",
+                      },
+                    },
+                  },
+                  "event": Object {
+                    "fields": Object {
+                      "event.end": Object {
+                        "aggregatable": true,
+                        "category": "event",
+                        "description": "event.end contains the date when the event ended or when the activity was last observed.",
+                        "example": null,
+                        "format": "",
+                        "indexes": Array [
+                          "apm-*-transaction*",
+                          "auditbeat-*",
+                          "endgame-*",
+                          "filebeat-*",
+                          "packetbeat-*",
+                          "winlogbeat-*",
+                        ],
+                        "name": "event.end",
+                        "searchable": true,
+                        "type": "date",
+                      },
+                    },
+                  },
+                  "source": Object {
+                    "fields": Object {
+                      "source.ip": Object {
+                        "aggregatable": true,
+                        "category": "source",
+                        "description": "IP address of the source. Can be one or multiple IPv4 or IPv6 addresses.",
+                        "example": "",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "source.ip",
+                        "searchable": true,
+                        "type": "ip",
+                      },
+                      "source.port": Object {
+                        "aggregatable": true,
+                        "category": "source",
+                        "description": "Port of the source.",
+                        "example": "",
+                        "format": "",
+                        "indexes": Array [
+                          "auditbeat",
+                          "filebeat",
+                          "packetbeat",
+                        ],
+                        "name": "source.port",
+                        "searchable": true,
+                        "type": "long",
+                      },
+                    },
+                  },
+                }
+              }
+              columns={
+                Array [
                   Object {
-                    "type": "return",
-                    "value": undefined,
+                    "aggregatable": true,
+                    "category": "base",
+                    "columnHeaderType": "not-filtered",
+                    "description": "Date/time when the event originated.
+For log events this is the date/time when the event was generated, and not when it was read.
+Required field for all events.",
+                    "example": "2016-05-23T08:05:34.853Z",
+                    "id": "@timestamp",
+                    "type": "date",
+                    "width": 190,
                   },
                   Object {
-                    "type": "return",
-                    "value": undefined,
+                    "aggregatable": true,
+                    "category": "event",
+                    "columnHeaderType": "not-filtered",
+                    "description": "Severity describes the severity of the event. What the different severity values mean can very different between use cases. It's up to the implementer to make sure severities are consistent across events.",
+                    "example": "7",
+                    "id": "event.severity",
+                    "type": "long",
+                    "width": 180,
                   },
                   Object {
-                    "type": "return",
-                    "value": undefined,
+                    "aggregatable": true,
+                    "category": "event",
+                    "columnHeaderType": "not-filtered",
+                    "description": "Event category.
+This contains high-level information about the contents of the event. It is more generic than \`event.action\`, in the sense that typically a category contains multiple actions. Warning: In future versions of ECS, we plan to provide a list of acceptable values for this field, please use with caution.",
+                    "example": "user-management",
+                    "id": "event.category",
+                    "type": "keyword",
+                    "width": 180,
                   },
                   Object {
-                    "type": "return",
-                    "value": undefined,
+                    "aggregatable": true,
+                    "category": "event",
+                    "columnHeaderType": "not-filtered",
+                    "description": "The action captured by the event.
+This describes the information in the event. It is more specific than \`event.category\`. Examples are \`group-add\`, \`process-started\`, \`file-created\`. The value is normally defined by the implementer.",
+                    "example": "user-password-change",
+                    "id": "event.action",
+                    "type": "keyword",
+                    "width": 180,
                   },
-                ],
-              },
-            },
-            "updated$": Subject {
-              "_isScalar": false,
-              "closed": false,
-              "hasError": false,
-              "isStopped": false,
-              "observers": Array [],
-              "thrownError": null,
-            },
-          }
-        }
-        id="foo"
-        indexPattern={
-          Object {
-            "fields": Array [
-              Object {
-                "aggregatable": true,
-                "name": "@timestamp",
-                "searchable": true,
-                "type": "date",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "@version",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.ephemeral_id",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.hostname",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.id",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.test1",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.test2",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.test3",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.test4",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.test5",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.test6",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.test7",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "agent.test8",
-                "searchable": true,
-                "type": "string",
-              },
-              Object {
-                "aggregatable": true,
-                "name": "host.name",
-                "searchable": true,
-                "type": "string",
-              },
-            ],
-            "title": "filebeat-*,auditbeat-*,packetbeat-*",
-          }
-        }
-        onDataProviderEdited={[MockFunction]}
-        onDataProviderRemoved={[MockFunction]}
-        onToggleDataProviderEnabled={[MockFunction]}
-        onToggleDataProviderExcluded={[MockFunction]}
-        show={true}
-        showCallOutUnauthorizedMsg={false}
-      />
-    </TimelineHeaderContainer>
-  </Styled(EuiFlyoutHeader)>
-  <Connect(Component)
-    id="foo"
-    indexPattern={
-      Object {
-        "fields": Array [
-          Object {
-            "aggregatable": true,
-            "name": "@timestamp",
-            "searchable": true,
-            "type": "date",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "@version",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.ephemeral_id",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.hostname",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.id",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.test1",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.test2",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.test3",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.test4",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.test5",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.test6",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.test7",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "agent.test8",
-            "searchable": true,
-            "type": "string",
-          },
-          Object {
-            "aggregatable": true,
-            "name": "host.name",
-            "searchable": true,
-            "type": "string",
-          },
-        ],
-        "title": "filebeat-*,auditbeat-*,packetbeat-*",
-      }
-    }
-    inputId="timeline"
-  />
-  <Connect(EnhancedType)
-    eventType="raw"
-    fields={
-      Array [
-        "@timestamp",
-        "event.severity",
-        "event.category",
-        "event.action",
-        "host.name",
-        "source.ip",
-        "destination.ip",
-        "destination.bytes",
-        "user.name",
-        "_id",
-        "message",
-      ]
-    }
-    filterQuery="{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"bool\\":{\\"filter\\":[{\\"bool\\":{\\"should\\":[{\\"bool\\":{\\"filter\\":[{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 1\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"filter\\":[{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 2\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 3\\"}}],\\"minimum_should_match\\":1}}]}}]}},{\\"bool\\":{\\"should\\":[{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 2\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 3\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 4\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 5\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 6\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 7\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 8\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 9\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"match_phrase\\":{\\"name\\":\\"Provider 10\\"}}],\\"minimum_should_match\\":1}}],\\"minimum_should_match\\":1}}],\\"minimum_should_match\\":1}}],\\"minimum_should_match\\":1}}],\\"minimum_should_match\\":1}}],\\"minimum_should_match\\":1}}],\\"minimum_should_match\\":1}}],\\"minimum_should_match\\":1}}],\\"minimum_should_match\\":1}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"filter\\":[{\\"bool\\":{\\"should\\":[{\\"range\\":{\\"@timestamp\\":{\\"gte\\":1521830963132}}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"range\\":{\\"@timestamp\\":{\\"lte\\":1521862432253}}}],\\"minimum_should_match\\":1}}]}}]}}],\\"should\\":[],\\"must_not\\":[]}}"
-    id="foo"
-    indexToAdd={Array []}
-    limit={5}
-    sortField={
-      Object {
-        "direction": "desc",
-        "sortFieldId": "@timestamp",
-      }
-    }
-    sourceId="default"
-  >
-    <Component />
-  </Connect(EnhancedType)>
-</styled.div>
+                  Object {
+                    "aggregatable": true,
+                    "category": "host",
+                    "columnHeaderType": "not-filtered",
+                    "description": "Name of the host.
+It can contain what \`hostname\` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.",
+                    "example": "",
+                    "id": "host.name",
+                    "type": "keyword",
+                    "width": 180,
+                  },
+                  Object {
+                    "aggregatable": true,
+                    "category": "source",
+                    "columnHeaderType": "not-filtered",
+                    "description": "IP address of the source.
+Can be one or multiple IPv4 or IPv6 addresses.",
+                    "example": "",
+                    "id": "source.ip",
+                    "type": "ip",
+                    "width": 180,
+                  },
+                  Object {
+                    "aggregatable": true,
+                    "category": "destination",
+                    "columnHeaderType": "not-filtered",
+                    "description": "IP address of the destination.
+Can be one or multiple IPv4 or IPv6 addresses.",
+                    "example": "",
+                    "id": "destination.ip",
+                    "type": "ip",
+                    "width": 180,
+                  },
+                  Object {
+                    "aggregatable": true,
+                    "category": "destination",
+                    "columnHeaderType": "not-filtered",
+                    "description": "Bytes sent from the source to the destination",
+                    "example": "123",
+                    "format": "bytes",
+                    "id": "destination.bytes",
+                    "type": "number",
+                    "width": 180,
+                  },
+                  Object {
+                    "aggregatable": true,
+                    "category": "user",
+                    "columnHeaderType": "not-filtered",
+                    "description": "Short name or login of the user.",
+                    "example": "albert",
+                    "id": "user.name",
+                    "type": "keyword",
+                    "width": 180,
+                  },
+                  Object {
+                    "aggregatable": true,
+                    "category": "base",
+                    "columnHeaderType": "not-filtered",
+                    "description": "Each document has an _id that uniquely identifies it",
+                    "example": "Y-6TfmcB0WOhS6qyMv3s",
+                    "id": "_id",
+                    "type": "keyword",
+                    "width": 180,
+                  },
+                  Object {
+                    "aggregatable": false,
+                    "category": "base",
+                    "columnHeaderType": "not-filtered",
+                    "description": "For log events the message field contains the log message.
+In other use cases the message field can be used to concatenate different values which are then freely searchable. If multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World",
+                    "id": "message",
+                    "type": "text",
+                    "width": 180,
+                  },
+                ]
+              }
+              dataProviders={
+                Array [
+                  Object {
+                    "and": Array [
+                      Object {
+                        "and": Array [],
+                        "enabled": true,
+                        "excluded": false,
+                        "id": "id-Provider 2",
+                        "kqlQuery": "",
+                        "name": "Provider 2",
+                        "queryMatch": Object {
+                          "field": "name",
+                          "operator": ":",
+                          "value": "Provider 2",
+                        },
+                      },
+                      Object {
+                        "and": Array [],
+                        "enabled": true,
+                        "excluded": false,
+                        "id": "id-Provider 3",
+                        "kqlQuery": "",
+                        "name": "Provider 3",
+                        "queryMatch": Object {
+                          "field": "name",
+                          "operator": ":",
+                          "value": "Provider 3",
+                        },
+                      },
+                    ],
+                    "enabled": true,
+                    "excluded": false,
+                    "id": "id-Provider 1",
+                    "kqlQuery": "",
+                    "name": "Provider 1",
+                    "queryMatch": Object {
+                      "field": "name",
+                      "operator": ":",
+                      "value": "Provider 1",
+                    },
+                  },
+                  Object {
+                    "and": Array [],
+                    "enabled": true,
+                    "excluded": false,
+                    "id": "id-Provider 2",
+                    "kqlQuery": "",
+                    "name": "Provider 2",
+                    "queryMatch": Object {
+                      "field": "name",
+                      "operator": ":",
+                      "value": "Provider 2",
+                    },
+                  },
+                  Object {
+                    "and": Array [],
+                    "enabled": true,
+                    "excluded": false,
+                    "id": "id-Provider 3",
+                    "kqlQuery": "",
+                    "name": "Provider 3",
+                    "queryMatch": Object {
+                      "field": "name",
+                      "operator": ":",
+                      "value": "Provider 3",
+                    },
+                  },
+                  Object {
+                    "and": Array [],
+                    "enabled": true,
+                    "excluded": false,
+                    "id": "id-Provider 4",
+                    "kqlQuery": "",
+                    "name": "Provider 4",
+                    "queryMatch": Object {
+                      "field": "name",
+                      "operator": ":",
+                      "value": "Provider 4",
+                    },
+                  },
+                  Object {
+                    "and": Array [],
+                    "enabled": true,
+                    "excluded": false,
+                    "id": "id-Provider 5",
+                    "kqlQuery": "",
+                    "name": "Provider 5",
+                    "queryMatch": Object {
+                      "field": "name",
+                      "operator": ":",
+                      "value": "Provider 5",
+                    },
+                  },
+                  Object {
+                    "and": Array [],
+                    "enabled": true,
+                    "excluded": false,
+                    "id": "id-Provider 6",
+                    "kqlQuery": "",
+                    "name": "Provider 6",
+                    "queryMatch": Object {
+                      "field": "name",
+                      "operator": ":",
+                      "value": "Provider 6",
+                    },
+                  },
+                  Object {
+                    "and": Array [],
+                    "enabled": true,
+                    "excluded": false,
+                    "id": "id-Provider 7",
+                    "kqlQuery": "",
+                    "name": "Provider 7",
+                    "queryMatch": Object {
+                      "field": "name",
+                      "operator": ":",
+                      "value": "Provider 7",
+                    },
+                  },
+                  Object {
+                    "and": Array [],
+                    "enabled": true,
+                    "excluded": false,
+                    "id": "id-Provider 8",
+                    "kqlQuery": "",
+                    "name": "Provider 8",
+                    "queryMatch": Object {
+                      "field": "name",
+                      "operator": ":",
+                      "value": "Provider 8",
+                    },
+                  },
+                  Object {
+                    "and": Array [],
+                    "enabled": true,
+                    "excluded": false,
+                    "id": "id-Provider 9",
+                    "kqlQuery": "",
+                    "name": "Provider 9",
+                    "queryMatch": Object {
+                      "field": "name",
+                      "operator": ":",
+                      "value": "Provider 9",
+                    },
+                  },
+                  Object {
+                    "and": Array [],
+                    "enabled": true,
+                    "excluded": false,
+                    "id": "id-Provider 10",
+                    "kqlQuery": "",
+                    "name": "Provider 10",
+                    "queryMatch": Object {
+                      "field": "name",
+                      "operator": ":",
+                      "value": "Provider 10",
+                    },
+                  },
+                ]
+              }
+              end={1521862432253}
+              eventType="raw"
+              filters={Array []}
+              id="foo"
+              indexPattern={
+                Object {
+                  "fields": Array [
+                    Object {
+                      "aggregatable": true,
+                      "name": "@timestamp",
+                      "searchable": true,
+                      "type": "date",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "@version",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.ephemeral_id",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.hostname",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.id",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.test1",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.test2",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.test3",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.test4",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.test5",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.test6",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.test7",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "agent.test8",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                    Object {
+                      "aggregatable": true,
+                      "name": "host.name",
+                      "searchable": true,
+                      "type": "string",
+                    },
+                  ],
+                  "title": "filebeat-*,auditbeat-*,packetbeat-*",
+                }
+              }
+              indexToAdd={Array []}
+              isLive={false}
+              itemsPerPage={5}
+              itemsPerPageOptions={
+                Array [
+                  5,
+                  10,
+                  20,
+                ]
+              }
+              kqlMode="search"
+              kqlQueryExpression=""
+              loadingIndexName={false}
+              onChangeItemsPerPage={[MockFunction]}
+              onClose={[MockFunction]}
+              onDataProviderEdited={[MockFunction]}
+              onDataProviderRemoved={[MockFunction]}
+              onToggleDataProviderEnabled={[MockFunction]}
+              onToggleDataProviderExcluded={[MockFunction]}
+              show={true}
+              showCallOutUnauthorizedMsg={false}
+              sort={
+                Object {
+                  "columnId": "@timestamp",
+                  "sortDirection": "desc",
+                }
+              }
+              start={1521830963132}
+              toggleColumn={[MockFunction]}
+              usersViewing={
+                Array [
+                  "elastic",
+                ]
+              }
+            />
+          </DragDropContext>
+        </ThemeProvider>
+      </Provider>
+    </ApolloProvider>
+  </Component>
+</I18nProvider>
 `;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
index ef744ab562e7..b478070b3157 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
@@ -15,6 +15,7 @@ import { eventHasNotes, getPinTooltip } from '../helpers';
 import * as i18n from '../translations';
 import { OnRowSelected } from '../../events';
 import { Ecs } from '../../../../../graphql/types';
+import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
 
 export interface TimelineRowActionOnClick {
   eventId: string;
@@ -27,7 +28,7 @@ export interface TimelineRowAction {
   displayType: 'icon' | 'contextMenu';
   iconType?: string;
   id: string;
-  isActionDisabled?: boolean;
+  isActionDisabled?: (ecsData?: Ecs) => boolean;
   onClick: ({ eventId, ecsData }: TimelineRowActionOnClick) => void;
   content: string | JSX.Element;
   width?: number;
@@ -83,24 +84,9 @@ export const Actions = React.memo<Props>(
       actionsColumnWidth={actionsColumnWidth}
       data-test-subj="event-actions-container"
     >
-      <EventsTd>
-        <EventsTdContent textAlign="center">
-          {loading && <EventsLoading />}
-
-          {!loading && (
-            <EuiButtonIcon
-              aria-label={expanded ? i18n.COLLAPSE : i18n.EXPAND}
-              data-test-subj="expand-event"
-              iconType={expanded ? 'arrowDown' : 'arrowRight'}
-              id={eventId}
-              onClick={onEventToggled}
-            />
-          )}
-        </EventsTdContent>
-      </EventsTd>
       {showCheckboxes && (
         <EventsTd data-test-subj="select-event-container">
-          <EventsTdContent textAlign="center">
+          <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
             {loadingEventIds.includes(eventId) ? (
               <EuiLoadingSpinner size="m" data-test-subj="event-loader" />
             ) : (
@@ -120,12 +106,28 @@ export const Actions = React.memo<Props>(
         </EventsTd>
       )}
 
+      <EventsTd>
+        <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
+          {loading && <EventsLoading />}
+
+          {!loading && (
+            <EuiButtonIcon
+              aria-label={expanded ? i18n.COLLAPSE : i18n.EXPAND}
+              data-test-subj="expand-event"
+              iconType={expanded ? 'arrowDown' : 'arrowRight'}
+              id={eventId}
+              onClick={onEventToggled}
+            />
+          )}
+        </EventsTdContent>
+      </EventsTd>
+
       <>{additionalActions}</>
 
       {!isEventViewer && (
         <>
           <EventsTd>
-            <EventsTdContent textAlign="center">
+            <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
               <EuiToolTip
                 data-test-subj="timeline-action-pin-tool-tip"
                 content={getPinTooltip({
@@ -144,7 +146,7 @@ export const Actions = React.memo<Props>(
           </EventsTd>
 
           <EventsTd>
-            <EventsTdContent textAlign="center">
+            <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
               <NotesButton
                 animate={false}
                 associateNote={associateNote}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
index 03e4f4b5f0f2..9508e3f18a34 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
@@ -6,13 +6,13 @@ exports[`ColumnHeaders rendering renders correctly against snapshot 1`] = `
 >
   <styled.div>
     <styled.div
-      actionsColumnWidth={115}
+      actionsColumnWidth={76}
       data-test-subj="actions-container"
-      justifyContent="space-between"
     >
       <styled.div>
         <styled.div
           textAlign="center"
+          width={24}
         >
           <Connect(Component)
             browserFields={
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx
index 2bb78c0dcb0a..aa0b8d770f60 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx
@@ -28,6 +28,7 @@ import {
   OnSelectAll,
   OnUpdateColumns,
 } from '../../events';
+import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
 import {
   EventsTh,
   EventsThContent,
@@ -168,11 +169,26 @@ export const ColumnHeadersComponent = ({
       <EventsTrHeader>
         <EventsThGroupActions
           actionsColumnWidth={actionsColumnWidth}
-          justifyContent={showSelectAllCheckbox ? 'flexStart' : 'space-between'}
           data-test-subj="actions-container"
         >
+          {showSelectAllCheckbox && (
+            <EventsTh>
+              <EventsThContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
+                <EuiCheckbox
+                  data-test-subj="select-all-events"
+                  id={'select-all-events'}
+                  checked={isSelectAllChecked}
+                  onChange={handleSelectAllChange}
+                />
+              </EventsThContent>
+            </EventsTh>
+          )}
+
           <EventsTh>
-            <EventsThContent textAlign={showSelectAllCheckbox ? 'left' : 'center'}>
+            <EventsThContent
+              textAlign={showSelectAllCheckbox ? 'left' : 'center'}
+              width={DEFAULT_ICON_BUTTON_WIDTH}
+            >
               <StatefulFieldsBrowser
                 browserFields={browserFields}
                 columnHeaders={columnHeaders}
@@ -186,25 +202,14 @@ export const ColumnHeadersComponent = ({
               />
             </EventsThContent>
           </EventsTh>
+
           {showEventsSelect && (
             <EventsTh>
-              <EventsThContent textAlign="center">
+              <EventsThContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
                 <EventsSelect checkState="unchecked" timelineId={timelineId} />
               </EventsThContent>
             </EventsTh>
           )}
-          {showSelectAllCheckbox && (
-            <EventsTh>
-              <EventsThContent textAlign="center">
-                <EuiCheckbox
-                  data-test-subj="select-all-events"
-                  id={'select-all-events'}
-                  checked={isSelectAllChecked}
-                  onChange={handleSelectAllChange}
-                />
-              </EventsThContent>
-            </EventsTh>
-          )}
         </EventsThGroupActions>
 
         <Droppable
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/constants.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/constants.ts
index 2aeb033c50d6..5f3fb4fa5113 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/constants.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/constants.ts
@@ -5,14 +5,14 @@
  */
 
 /** The (fixed) width of the Actions column */
-export const DEFAULT_ACTIONS_COLUMN_WIDTH = 115; // px;
+export const DEFAULT_ACTIONS_COLUMN_WIDTH = 76; // px;
 /**
  * The (fixed) width of the Actions column when the timeline body is used as
  * an events viewer, which has fewer actions than a regular events viewer
  */
-export const EVENTS_VIEWER_ACTIONS_COLUMN_WIDTH = 32; // px;
+export const EVENTS_VIEWER_ACTIONS_COLUMN_WIDTH = 26; // px;
 /** Additional column width to include when checkboxes are shown **/
-export const SHOW_CHECK_BOXES_COLUMN_WIDTH = 32; // px;
+export const SHOW_CHECK_BOXES_COLUMN_WIDTH = 24; // px;
 /** The default minimum width of a column (when a width for the column type is not specified) */
 export const DEFAULT_COLUMN_MIN_WIDTH = 180; // px
 /** The default minimum width of a column of type `date` */
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
index 767164967a3f..03a964bbd444 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
@@ -16,6 +16,7 @@ import {
 } from '@elastic/eui';
 import styled from 'styled-components';
 import { TimelineNonEcsData, Ecs } from '../../../../../graphql/types';
+import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
 import { Note } from '../../../../../common/lib/note';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 import { AssociateNote, UpdateNote } from '../../../notes/helpers';
@@ -131,7 +132,7 @@ export const EventColumnView = React.memo<Props>(
               ...acc,
               icon: [
                 ...acc.icon,
-                <EventsTdContent key={action.id} textAlign="center">
+                <EventsTdContent key={action.id} textAlign="center" width={action.width}>
                   <EuiToolTip
                     data-test-subj={`${action.dataTestSubj}-tool-tip`}
                     content={action.content}
@@ -140,7 +141,9 @@ export const EventColumnView = React.memo<Props>(
                       aria-label={action.ariaLabel}
                       data-test-subj={`${action.dataTestSubj}-button`}
                       iconType={action.iconType}
-                      isDisabled={action.isActionDisabled ?? false}
+                      isDisabled={
+                        action.isActionDisabled != null ? action.isActionDisabled(ecsData) : false
+                      }
                       onClick={() => action.onClick({ eventId: id, ecsData })}
                     />
                   </EuiToolTip>
@@ -155,7 +158,9 @@ export const EventColumnView = React.memo<Props>(
               <EuiContextMenuItem
                 aria-label={action.ariaLabel}
                 data-test-subj={action.dataTestSubj}
-                disabled={action.isActionDisabled ?? false}
+                disabled={
+                  action.isActionDisabled != null ? action.isActionDisabled(ecsData) : false
+                }
                 icon={action.iconType}
                 key={action.id}
                 onClick={() => onClickCb(() => action.onClick({ eventId: id, ecsData }))}
@@ -170,7 +175,11 @@ export const EventColumnView = React.memo<Props>(
       return grouped.contextMenu.length > 0
         ? [
             ...grouped.icon,
-            <EventsTdContent key="actions-context-menu" textAlign="center">
+            <EventsTdContent
+              key="actions-context-menu"
+              textAlign="center"
+              width={DEFAULT_ICON_BUTTON_WIDTH}
+            >
               <EuiPopover
                 id="singlePanel"
                 button={button}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts
index 4c0dc28b56d3..bdc8c66ec3aa 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts
@@ -3,12 +3,17 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { isEmpty, noop } from 'lodash/fp';
+import { get, isEmpty, noop } from 'lodash/fp';
+import { Dispatch } from 'redux';
 
 import { Ecs, TimelineItem, TimelineNonEcsData } from '../../../../graphql/types';
+import { DEFAULT_ICON_BUTTON_WIDTH } from '../helpers';
+import { updateTimelineGraphEventId } from '../../../store/timeline/actions';
 import { EventType } from '../../../../timelines/store/timeline/model';
 import { OnPinEvent, OnUnPinEvent } from '../events';
 
+import { TimelineRowAction, TimelineRowActionOnClick } from './actions';
+
 import * as i18n from './translations';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -87,3 +92,32 @@ export const getEventType = (event: Ecs): Omit<EventType, 'all'> => {
   }
   return 'raw';
 };
+
+export const showGraphView = (graphEventId?: string) =>
+  graphEventId != null && graphEventId.length > 0;
+
+export const isInvestigateInResolverActionEnabled = (ecsData?: Ecs) => {
+  return (
+    get(['agent', 'type', 0], ecsData) === 'endpoint' &&
+    get(['process', 'entity_id'], ecsData)?.length > 0
+  );
+};
+
+export const getInvestigateInResolverAction = ({
+  dispatch,
+  timelineId,
+}: {
+  dispatch: Dispatch;
+  timelineId: string;
+}): TimelineRowAction => ({
+  ariaLabel: i18n.ACTION_INVESTIGATE_IN_RESOLVER,
+  content: i18n.ACTION_INVESTIGATE_IN_RESOLVER,
+  dataTestSubj: 'investigate-in-resolver',
+  displayType: 'icon',
+  iconType: 'node',
+  id: 'investigateInResolver',
+  isActionDisabled: (ecsData?: Ecs) => !isInvestigateInResolverActionEnabled(ecsData),
+  onClick: ({ eventId }: TimelineRowActionOnClick) =>
+    dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: eventId })),
+  width: DEFAULT_ICON_BUTTON_WIDTH,
+});
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
index 775c26e82d27..9b96e0c49c73 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
@@ -70,6 +70,7 @@ describe('Body', () => {
             pinnedEventIds={{}}
             rowRenderers={rowRenderers}
             selectedEventIds={{}}
+            show={true}
             sort={mockSort}
             showCheckboxes={false}
             toggleColumn={jest.fn()}
@@ -108,6 +109,7 @@ describe('Body', () => {
             pinnedEventIds={{}}
             rowRenderers={rowRenderers}
             selectedEventIds={{}}
+            show={true}
             sort={mockSort}
             showCheckboxes={false}
             toggleColumn={jest.fn()}
@@ -146,6 +148,7 @@ describe('Body', () => {
             pinnedEventIds={{}}
             rowRenderers={rowRenderers}
             selectedEventIds={{}}
+            show={true}
             sort={mockSort}
             showCheckboxes={false}
             toggleColumn={jest.fn()}
@@ -186,6 +189,7 @@ describe('Body', () => {
             pinnedEventIds={{}}
             rowRenderers={rowRenderers}
             selectedEventIds={{}}
+            show={true}
             sort={mockSort}
             showCheckboxes={false}
             toggleColumn={jest.fn()}
@@ -271,6 +275,7 @@ describe('Body', () => {
             pinnedEventIds={{}}
             rowRenderers={rowRenderers}
             selectedEventIds={{}}
+            show={true}
             sort={mockSort}
             showCheckboxes={false}
             toggleColumn={jest.fn()}
@@ -316,6 +321,7 @@ describe('Body', () => {
           pinnedEventIds={{}}
           rowRenderers={rowRenderers}
           selectedEventIds={{}}
+          show={true}
           sort={mockSort}
           showCheckboxes={false}
           toggleColumn={jest.fn()}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
index da8835d5903e..46895c86de08 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
@@ -26,10 +26,13 @@ import { EventsTable, TimelineBody, TimelineBodyGlobalStyle } from '../styles';
 import { ColumnHeaders } from './column_headers';
 import { getActionsColumnWidth } from './column_headers/helpers';
 import { Events } from './events';
+import { showGraphView } from './helpers';
 import { ColumnRenderer } from './renderers/column_renderer';
 import { RowRenderer } from './renderers/row_renderer';
 import { Sort } from './sort';
 import { useManageTimeline } from '../../manage_timeline';
+import { GraphOverlay } from '../../graph_overlay';
+import { DEFAULT_ICON_BUTTON_WIDTH } from '../helpers';
 
 export interface BodyProps {
   addNoteToEvent: AddNoteToEvent;
@@ -38,6 +41,7 @@ export interface BodyProps {
   columnRenderers: ColumnRenderer[];
   data: TimelineItem[];
   getNotesByIds: (noteIds: string[]) => Note[];
+  graphEventId?: string;
   height?: number;
   id: string;
   isEventViewer?: boolean;
@@ -56,6 +60,7 @@ export interface BodyProps {
   pinnedEventIds: Readonly<Record<string, boolean>>;
   rowRenderers: RowRenderer[];
   selectedEventIds: Readonly<Record<string, TimelineNonEcsData[]>>;
+  show: boolean;
   showCheckboxes: boolean;
   sort: Sort;
   toggleColumn: (column: ColumnHeaderOptions) => void;
@@ -72,6 +77,7 @@ export const Body = React.memo<BodyProps>(
     data,
     eventIdToNoteIds,
     getNotesByIds,
+    graphEventId,
     height,
     id,
     isEventViewer = false,
@@ -89,6 +95,7 @@ export const Body = React.memo<BodyProps>(
     pinnedEventIds,
     rowRenderers,
     selectedEventIds,
+    show,
     showCheckboxes,
     sort,
     toggleColumn,
@@ -108,7 +115,7 @@ export const Body = React.memo<BodyProps>(
           if (v.displayType === 'icon') {
             return acc + (v.width ?? 0);
           }
-          const addWidth = hasContextMenu ? 0 : 26;
+          const addWidth = hasContextMenu ? 0 : DEFAULT_ICON_BUTTON_WIDTH;
           hasContextMenu = true;
           return acc + addWidth;
         }, 0) ?? 0
@@ -127,7 +134,15 @@ export const Body = React.memo<BodyProps>(
 
     return (
       <>
-        <TimelineBody data-test-subj="timeline-body" bodyHeight={height} ref={containerElementRef}>
+        {showGraphView(graphEventId) && (
+          <GraphOverlay bodyHeight={height} graphEventId={graphEventId} timelineId={id} />
+        )}
+        <TimelineBody
+          data-test-subj="timeline-body"
+          bodyHeight={height}
+          ref={containerElementRef}
+          visible={show && !showGraphView(graphEventId)}
+        >
           <EventsTable data-test-subj="events-table" columnWidths={columnWidths}>
             <ColumnHeaders
               actionsColumnWidth={actionsColumnWidth}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx
index 2d5e64fb09ff..0587da9f6150 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx
@@ -10,11 +10,13 @@ import React, { useCallback, useEffect, useMemo } from 'react';
 import { connect, ConnectedProps } from 'react-redux';
 import deepEqual from 'fast-deep-equal';
 
+import { ACTIVE_TIMELINE_REDUX_ID } from '../../../../common/components/top_n';
 import { BrowserFields } from '../../../../common/containers/source';
 import { TimelineItem } from '../../../../graphql/types';
 import { Note } from '../../../../common/lib/note';
 import { appSelectors, State } from '../../../../common/store';
 import { appActions } from '../../../../common/store/actions';
+import { useManageTimeline } from '../../manage_timeline';
 import { ColumnHeaderOptions, TimelineModel } from '../../../store/timeline/model';
 import { timelineDefaults } from '../../../store/timeline/defaults';
 import { timelineActions, timelineSelectors } from '../../../store/timeline';
@@ -35,7 +37,6 @@ import { Body } from './index';
 import { columnRenderers, rowRenderers } from './renderers';
 import { Sort } from './sort';
 import { plainRowRenderer } from './renderers/plain_row_renderer';
-import { useManageTimeline } from '../../manage_timeline';
 
 interface OwnProps {
   browserFields: BrowserFields;
@@ -71,8 +72,10 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
     selectedEventIds,
     setSelected,
     clearSelected,
+    show,
     showCheckboxes,
     showRowRenderers,
+    graphEventId,
     sort,
     toggleColumn,
     unPinEvent,
@@ -180,6 +183,7 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
         data={data}
         eventIdToNoteIds={eventIdToNoteIds}
         getNotesByIds={getNotesByIds}
+        graphEventId={graphEventId}
         height={height}
         id={id}
         isEventViewer={isEventViewer}
@@ -197,6 +201,7 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
         pinnedEventIds={pinnedEventIds}
         rowRenderers={showRowRenderers ? rowRenderers : [plainRowRenderer]}
         selectedEventIds={selectedEventIds}
+        show={id === ACTIVE_TIMELINE_REDUX_ID ? show : true}
         showCheckboxes={showCheckboxes}
         sort={sort}
         toggleColumn={toggleColumn}
@@ -209,6 +214,7 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
     deepEqual(prevProps.columnHeaders, nextProps.columnHeaders) &&
     deepEqual(prevProps.data, nextProps.data) &&
     prevProps.eventIdToNoteIds === nextProps.eventIdToNoteIds &&
+    prevProps.graphEventId === nextProps.graphEventId &&
     deepEqual(prevProps.notesById, nextProps.notesById) &&
     prevProps.height === nextProps.height &&
     prevProps.id === nextProps.id &&
@@ -216,6 +222,7 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
     prevProps.isSelectAllChecked === nextProps.isSelectAllChecked &&
     prevProps.loadingEventIds === nextProps.loadingEventIds &&
     prevProps.pinnedEventIds === nextProps.pinnedEventIds &&
+    prevProps.show === nextProps.show &&
     prevProps.selectedEventIds === nextProps.selectedEventIds &&
     prevProps.showCheckboxes === nextProps.showCheckboxes &&
     prevProps.showRowRenderers === nextProps.showRowRenderers &&
@@ -238,10 +245,12 @@ const makeMapStateToProps = () => {
       columns,
       eventIdToNoteIds,
       eventType,
+      graphEventId,
       isSelectAllChecked,
       loadingEventIds,
       pinnedEventIds,
       selectedEventIds,
+      show,
       showCheckboxes,
       showRowRenderers,
     } = timeline;
@@ -250,12 +259,14 @@ const makeMapStateToProps = () => {
       columnHeaders: memoizedColumnHeaders(columns, browserFields),
       eventIdToNoteIds,
       eventType,
+      graphEventId,
       isSelectAllChecked,
       loadingEventIds,
       notesById: getNotesByIds(state),
       id,
       pinnedEventIds,
       selectedEventIds,
+      show,
       showCheckboxes,
       showRowRenderers,
     };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/translations.ts
index 98f544f30ae8..63b92d6b316c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/translations.ts
@@ -51,3 +51,10 @@ export const COLLAPSE = i18n.translate(
     defaultMessage: 'Collapse',
   }
 );
+
+export const ACTION_INVESTIGATE_IN_RESOLVER = i18n.translate(
+  'xpack.securitySolution.timeline.body.actions.investigateInResolverTooltip',
+  {
+    defaultMessage: 'Investigate in Resolver',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.tsx
index fb47eb331fdb..e8f1e7371923 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.tsx
@@ -9,6 +9,7 @@ import React from 'react';
 import { FilterManager, IIndexPattern } from 'src/plugins/data/public';
 import deepEqual from 'fast-deep-equal';
 
+import { showGraphView } from '../body/helpers';
 import { DataProviders } from '../data_providers';
 import { DataProvider } from '../data_providers/data_provider';
 import {
@@ -26,6 +27,7 @@ interface Props {
   browserFields: BrowserFields;
   dataProviders: DataProvider[];
   filterManager: FilterManager;
+  graphEventId?: string;
   id: string;
   indexPattern: IIndexPattern;
   onDataProviderEdited: OnDataProviderEdited;
@@ -42,6 +44,7 @@ const TimelineHeaderComponent: React.FC<Props> = ({
   indexPattern,
   dataProviders,
   filterManager,
+  graphEventId,
   onDataProviderEdited,
   onDataProviderRemoved,
   onToggleDataProviderEnabled,
@@ -59,24 +62,27 @@ const TimelineHeaderComponent: React.FC<Props> = ({
         size="s"
       />
     )}
-    {show && (
-      <DataProviders
-        browserFields={browserFields}
-        id={id}
-        dataProviders={dataProviders}
-        onDataProviderEdited={onDataProviderEdited}
-        onDataProviderRemoved={onDataProviderRemoved}
-        onToggleDataProviderEnabled={onToggleDataProviderEnabled}
-        onToggleDataProviderExcluded={onToggleDataProviderExcluded}
-      />
-    )}
 
-    <StatefulSearchOrFilter
-      browserFields={browserFields}
-      filterManager={filterManager}
-      indexPattern={indexPattern}
-      timelineId={id}
-    />
+    {show && !showGraphView(graphEventId) && (
+      <>
+        <DataProviders
+          browserFields={browserFields}
+          id={id}
+          dataProviders={dataProviders}
+          onDataProviderEdited={onDataProviderEdited}
+          onDataProviderRemoved={onDataProviderRemoved}
+          onToggleDataProviderEnabled={onToggleDataProviderEnabled}
+          onToggleDataProviderExcluded={onToggleDataProviderExcluded}
+        />
+
+        <StatefulSearchOrFilter
+          browserFields={browserFields}
+          filterManager={filterManager}
+          indexPattern={indexPattern}
+          timelineId={id}
+        />
+      </>
+    )}
   </>
 );
 
@@ -88,6 +94,7 @@ export const TimelineHeader = React.memo(
     deepEqual(prevProps.indexPattern, nextProps.indexPattern) &&
     deepEqual(prevProps.dataProviders, nextProps.dataProviders) &&
     prevProps.filterManager === nextProps.filterManager &&
+    prevProps.graphEventId === nextProps.graphEventId &&
     prevProps.onDataProviderEdited === nextProps.onDataProviderEdited &&
     prevProps.onDataProviderRemoved === nextProps.onDataProviderRemoved &&
     prevProps.onToggleDataProviderEnabled === nextProps.onToggleDataProviderEnabled &&
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
index b5481e9d4eee..a3fc692c3a8a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
@@ -153,3 +153,5 @@ export const combineQueries = ({
  * the `Timeline` and the `Events Viewer` widget
  */
 export const STATEFUL_EVENT_CSS_CLASS_NAME = 'event-column-view';
+
+export const DEFAULT_ICON_BUTTON_WIDTH = 24;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
index 5ccc8911d197..83ac1a421958 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
@@ -72,6 +72,7 @@ describe('StatefulTimeline', () => {
       eventType: 'raw',
       end: endDate,
       filters: [],
+      graphEventId: undefined,
       id: 'foo',
       isLive: false,
       isTimelineExists: false,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
index df76eb350ace..a66c01d0b5d0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
@@ -41,6 +41,7 @@ const StatefulTimelineComponent = React.memo<Props>(
     eventType,
     end,
     filters,
+    graphEventId,
     id,
     isLive,
     isTimelineExists,
@@ -168,6 +169,7 @@ const StatefulTimelineComponent = React.memo<Props>(
         end={end}
         eventType={eventType}
         filters={filters}
+        graphEventId={graphEventId}
         id={id}
         indexPattern={indexPattern}
         indexToAdd={indexToAdd}
@@ -196,6 +198,7 @@ const StatefulTimelineComponent = React.memo<Props>(
     return (
       prevProps.eventType === nextProps.eventType &&
       prevProps.end === nextProps.end &&
+      prevProps.graphEventId === nextProps.graphEventId &&
       prevProps.id === nextProps.id &&
       prevProps.isLive === nextProps.isLive &&
       prevProps.itemsPerPage === nextProps.itemsPerPage &&
@@ -229,6 +232,7 @@ const makeMapStateToProps = () => {
       dataProviders,
       eventType,
       filters,
+      graphEventId,
       itemsPerPage,
       itemsPerPageOptions,
       kqlMode,
@@ -245,6 +249,7 @@ const makeMapStateToProps = () => {
       eventType,
       end: input.timerange.to,
       filters: timelineFilter,
+      graphEventId,
       id,
       isLive: input.policy.kind === 'interval',
       isTimelineExists: getTimeline(state, id) != null,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.test.tsx
index 2ffbae1f7eb5..5e6f35e8397e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.test.tsx
@@ -50,7 +50,11 @@ describe('Insert timeline popover ', () => {
       payload: { id: 'timeline-id', show: false },
       type: 'x-pack/security_solution/local/timeline/SHOW_TIMELINE',
     });
-    expect(onTimelineChange).toBeCalledWith('Timeline title', '34578-3497-5893-47589-34759');
+    expect(onTimelineChange).toBeCalledWith(
+      'Timeline title',
+      '34578-3497-5893-47589-34759',
+      undefined
+    );
     expect(mockDispatch.mock.calls[1][0]).toEqual({
       payload: null,
       type: 'x-pack/security_solution/local/timeline/SET_INSERT_TIMELINE',
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.tsx
index de199d9a1cc2..83417cdb51b6 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.tsx
@@ -19,7 +19,11 @@ import { setInsertTimeline } from '../../../store/timeline/actions';
 interface InsertTimelinePopoverProps {
   isDisabled: boolean;
   hideUntitled?: boolean;
-  onTimelineChange: (timelineTitle: string, timelineId: string | null) => void;
+  onTimelineChange: (
+    timelineTitle: string,
+    timelineId: string | null,
+    graphEventId?: string
+  ) => void;
 }
 
 type Props = InsertTimelinePopoverProps;
@@ -38,7 +42,11 @@ export const InsertTimelinePopoverComponent: React.FC<Props> = ({
   useEffect(() => {
     if (insertTimeline != null) {
       dispatch(timelineActions.showTimeline({ id: insertTimeline.timelineId, show: false }));
-      onTimelineChange(insertTimeline.timelineTitle, insertTimeline.timelineSavedObjectId);
+      onTimelineChange(
+        insertTimeline.timelineTitle,
+        insertTimeline.timelineSavedObjectId,
+        insertTimeline.graphEventId
+      );
       dispatch(setInsertTimeline(null));
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
index c3def9c4cbb2..c3bcd1c0ebe5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isEmpty } from 'lodash/fp';
 import { useCallback, useState } from 'react';
 import { useBasePath } from '../../../../common/lib/kibana';
 import { CursorPosition } from '../../../../common/components/markdown_editor';
@@ -16,8 +17,10 @@ export const useInsertTimeline = <T extends FormData>(form: FormHook<T>, fieldNa
     end: 0,
   });
   const handleOnTimelineChange = useCallback(
-    (title: string, id: string | null) => {
-      const builtLink = `${basePath}/app/security/timelines?timeline=(id:'${id}',isOpen:!t)`;
+    (title: string, id: string | null, graphEventId?: string) => {
+      const builtLink = `${basePath}/app/security/timelines?timeline=(id:'${id}'${
+        !isEmpty(graphEventId) ? `,graphEventId:'${graphEventId}'` : ''
+      },isOpen:!t)`;
       const currentValue = form.getFormData()[fieldName];
       const newValue: string = [
         currentValue.slice(0, cursorPosition.start),
@@ -28,16 +31,12 @@ export const useInsertTimeline = <T extends FormData>(form: FormHook<T>, fieldNa
       ].join('');
       form.setFieldValue(fieldName, newValue);
     },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [form]
-  );
-  const handleCursorChange = useCallback(
-    (cp: CursorPosition) => {
-      setCursorPosition(cp);
-    },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [cursorPosition]
+    [basePath, cursorPosition, fieldName, form]
   );
+  const handleCursorChange = useCallback((cp: CursorPosition) => {
+    setCursorPosition(cp);
+  }, []);
+
   return {
     cursorPosition,
     handleCursorChange,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.test.tsx
index d8c9d2ed02cc..aec09a95b4b1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.test.tsx
@@ -17,6 +17,7 @@ jest.mock('../../../../common/lib/kibana', () => {
     useKibana: jest.fn().mockReturnValue({
       services: {
         application: {
+          navigateToApp: jest.fn(),
           capabilities: {
             siem: {
               crud: true,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
index f2e7d26c9e85..528af23191ee 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
@@ -20,7 +20,6 @@ import {
 import React, { useCallback } from 'react';
 import uuid from 'uuid';
 import styled from 'styled-components';
-import { useHistory } from 'react-router-dom';
 import { useDispatch, useSelector } from 'react-redux';
 
 import { APP_ID } from '../../../../../common/constants';
@@ -28,11 +27,10 @@ import {
   TimelineTypeLiteral,
   TimelineStatus,
   TimelineType,
+  TimelineId,
 } from '../../../../../common/types/timeline';
-import { navTabs } from '../../../../app/home/home_navigations';
 import { SecurityPageName } from '../../../../app/types';
 import { timelineSelectors } from '../../../../timelines/store/timeline';
-import { useGetUrlSearch } from '../../../../common/components/navigation/use_get_url_search';
 import { getCreateCaseUrl } from '../../../../common/components/link_to';
 import { State } from '../../../../common/store';
 import { useKibana } from '../../../../common/lib/kibana';
@@ -44,7 +42,7 @@ import { AssociateNote, UpdateNote } from '../../notes/helpers';
 import { NOTES_PANEL_WIDTH } from './notes_size';
 import { ButtonContainer, DescriptionContainer, LabelText, NameField, StyledStar } from './styles';
 import * as i18n from './translations';
-import { setInsertTimeline } from '../../../store/timeline/actions';
+import { setInsertTimeline, showTimeline } from '../../../store/timeline/actions';
 import { useCreateTimelineButton } from './use_create_timeline';
 
 export const historyToolTip = 'The chronological history of actions related to this timeline';
@@ -139,6 +137,8 @@ export const Name = React.memo<NameProps>(({ timelineId, title, updateTitle }) =
 Name.displayName = 'Name';
 
 interface NewCaseProps {
+  compact?: boolean;
+  graphEventId?: string;
   onClosePopover: () => void;
   timelineId: string;
   timelineStatus: TimelineStatus;
@@ -146,44 +146,50 @@ interface NewCaseProps {
 }
 
 export const NewCase = React.memo<NewCaseProps>(
-  ({ onClosePopover, timelineId, timelineStatus, timelineTitle }) => {
-    const history = useHistory();
-    const urlSearch = useGetUrlSearch(navTabs.case);
+  ({ compact, graphEventId, onClosePopover, timelineId, timelineStatus, timelineTitle }) => {
     const dispatch = useDispatch();
     const { savedObjectId } = useSelector((state: State) =>
       timelineSelectors.selectTimeline(state, timelineId)
     );
     const { navigateToApp } = useKibana().services.application;
+    const buttonText = compact ? i18n.ATTACH_TO_NEW_CASE : i18n.ATTACH_TIMELINE_TO_NEW_CASE;
 
     const handleClick = useCallback(() => {
       onClosePopover();
       dispatch(
         setInsertTimeline({
+          graphEventId,
           timelineId,
           timelineSavedObjectId: savedObjectId,
           timelineTitle: timelineTitle.length > 0 ? timelineTitle : i18n.UNTITLED_TIMELINE,
         })
       );
+      dispatch(showTimeline({ id: TimelineId.active, show: false }));
+
       navigateToApp(`${APP_ID}:${SecurityPageName.case}`, {
-        path: getCreateCaseUrl(urlSearch),
-      });
-      history.push({
-        pathname: `/${SecurityPageName.case}/create`,
+        path: getCreateCaseUrl(),
       });
-
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [dispatch, navigateToApp, onClosePopover, history, timelineId, timelineTitle, urlSearch]);
+    }, [
+      dispatch,
+      graphEventId,
+      navigateToApp,
+      onClosePopover,
+      savedObjectId,
+      timelineId,
+      timelineTitle,
+    ]);
 
     return (
       <EuiButtonEmpty
         data-test-subj="attach-timeline-case"
-        color="text"
+        color={compact ? undefined : 'text'}
         iconSide="left"
         iconType="paperClip"
         disabled={timelineStatus === TimelineStatus.draft}
         onClick={handleClick}
+        size={compact ? 'xs' : undefined}
       >
-        {i18n.ATTACH_TIMELINE_TO_NEW_CASE}
+        {buttonText}
       </EuiButtonEmpty>
     );
   }
@@ -191,28 +197,33 @@ export const NewCase = React.memo<NewCaseProps>(
 NewCase.displayName = 'NewCase';
 
 interface ExistingCaseProps {
+  compact?: boolean;
   onClosePopover: () => void;
   onOpenCaseModal: () => void;
   timelineStatus: TimelineStatus;
 }
 export const ExistingCase = React.memo<ExistingCaseProps>(
-  ({ onClosePopover, onOpenCaseModal, timelineStatus }) => {
+  ({ compact, onClosePopover, onOpenCaseModal, timelineStatus }) => {
     const handleClick = useCallback(() => {
       onClosePopover();
       onOpenCaseModal();
     }, [onOpenCaseModal, onClosePopover]);
+    const buttonText = compact
+      ? i18n.ATTACH_TO_EXISTING_CASE
+      : i18n.ATTACH_TIMELINE_TO_EXISTING_CASE;
 
     return (
       <>
         <EuiButtonEmpty
           data-test-subj="attach-timeline-existing-case"
-          color="text"
+          color={compact ? undefined : 'text'}
           iconSide="left"
           iconType="paperClip"
           disabled={timelineStatus === TimelineStatus.draft}
           onClick={handleClick}
+          size={compact ? 'xs' : undefined}
         >
-          {i18n.ATTACH_TIMELINE_TO_EXISTING_CASE}
+          {buttonText}
         </EuiButtonEmpty>
       </>
     );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx
index 3078700a29d7..1b76db409484 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx
@@ -17,7 +17,6 @@ import {
 import { createStore, State } from '../../../../common/store';
 import { useThrottledResizeObserver } from '../../../../common/components/utils';
 import { Properties, showDescriptionThreshold, showNotesThreshold } from '.';
-import { SecurityPageName } from '../../../../app/types';
 import { setInsertTimeline } from '../../../store/timeline/actions';
 export { nextTick } from '../../../../../../../test_utils';
 
@@ -25,12 +24,13 @@ import { act } from 'react-dom/test-utils';
 
 jest.mock('../../../../common/components/link_to');
 
+const mockNavigateToApp = jest.fn();
 jest.mock('../../../../common/lib/kibana', () => {
   const original = jest.requireActual('../../../../common/lib/kibana');
 
   return {
     ...original,
-    useKibana: jest.fn().mockReturnValue({
+    useKibana: () => ({
       services: {
         application: {
           capabilities: {
@@ -38,7 +38,7 @@ jest.mock('../../../../common/lib/kibana', () => {
               crud: true,
             },
           },
-          navigateToApp: jest.fn(),
+          navigateToApp: mockNavigateToApp,
         },
       },
     }),
@@ -63,7 +63,6 @@ jest.mock('react-redux', () => {
     useSelector: jest.fn().mockReturnValue({ savedObjectId: '1', urlState: {} }),
   };
 });
-const mockHistoryPush = jest.fn();
 
 jest.mock('react-router-dom', () => {
   const original = jest.requireActual('react-router-dom');
@@ -71,7 +70,7 @@ jest.mock('react-router-dom', () => {
   return {
     ...original,
     useHistory: () => ({
-      push: mockHistoryPush,
+      push: jest.fn(),
     }),
   };
 });
@@ -342,8 +341,7 @@ describe('Properties', () => {
     );
     wrapper.find('[data-test-subj="settings-gear"]').at(0).simulate('click');
     wrapper.find('[data-test-subj="attach-timeline-case"]').first().simulate('click');
-
-    expect(mockHistoryPush).toBeCalledWith({ pathname: `/${SecurityPageName.case}/create` });
+    expect(mockNavigateToApp).toBeCalledWith('securitySolution:case', { path: '/create' });
     expect(mockDispatch).toBeCalledWith(
       setInsertTimeline({
         timelineId: defaultProps.timelineId,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.tsx
index 602a7c8191c7..8029d166a688 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.tsx
@@ -46,6 +46,7 @@ interface Props {
   createTimeline: CreateTimeline;
   description: string;
   getNotesByIds: (noteIds: string[]) => Note[];
+  graphEventId?: string;
   isDataInTimeline: boolean;
   isDatepickerLocked: boolean;
   isFavorite: boolean;
@@ -79,6 +80,7 @@ export const Properties = React.memo<Props>(
     createTimeline,
     description,
     getNotesByIds,
+    graphEventId,
     isDataInTimeline,
     isDatepickerLocked,
     isFavorite,
@@ -120,18 +122,21 @@ export const Properties = React.memo<Props>(
     const onRowClick = useCallback(
       (id: string) => {
         onCloseCaseModal();
-        navigateToApp(`${APP_ID}:${SecurityPageName.case}`, {
-          path: getCaseDetailsUrl({ id }),
-        });
+
         dispatch(
           setInsertTimeline({
+            graphEventId,
             timelineId,
             timelineSavedObjectId: currentTimeline.savedObjectId,
             timelineTitle: title.length > 0 ? title : i18n.UNTITLED_TIMELINE,
           })
         );
+
+        navigateToApp(`${APP_ID}:${SecurityPageName.case}`, {
+          path: getCaseDetailsUrl({ id }),
+        });
       },
-      [navigateToApp, onCloseCaseModal, currentTimeline, dispatch, timelineId, title]
+      [currentTimeline, dispatch, graphEventId, navigateToApp, onCloseCaseModal, timelineId, title]
     );
 
     const datePickerWidth = useMemo(
@@ -174,6 +179,7 @@ export const Properties = React.memo<Props>(
           associateNote={associateNote}
           description={description}
           getNotesByIds={getNotesByIds}
+          graphEventId={graphEventId}
           isDataInTimeline={isDataInTimeline}
           noteIds={noteIds}
           onButtonClick={onButtonClick}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.tsx
index 7d176d57b5d8..e20a3db80d88 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.tsx
@@ -68,6 +68,7 @@ interface PropertiesRightComponentProps {
   associateNote: AssociateNote;
   description: string;
   getNotesByIds: (noteIds: string[]) => Note[];
+  graphEventId?: string;
   isDataInTimeline: boolean;
   noteIds: string[];
   onButtonClick: () => void;
@@ -94,6 +95,7 @@ const PropertiesRightComponent: React.FC<PropertiesRightComponentProps> = ({
   associateNote,
   description,
   getNotesByIds,
+  graphEventId,
   isDataInTimeline,
   noteIds,
   onButtonClick,
@@ -166,6 +168,7 @@ const PropertiesRightComponent: React.FC<PropertiesRightComponentProps> = ({
 
               <EuiFlexItem grow={false}>
                 <NewCase
+                  graphEventId={graphEventId}
                   onClosePopover={onClosePopover}
                   timelineId={timelineId}
                   timelineTitle={title}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/translations.ts
index 1621afc91cdb..2568f4127540 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/translations.ts
@@ -123,10 +123,24 @@ export const ATTACH_TIMELINE_TO_NEW_CASE = i18n.translate(
   }
 );
 
+export const ATTACH_TO_NEW_CASE = i18n.translate(
+  'xpack.securitySolution.timeline.properties.attachToNewCaseButtonLabel',
+  {
+    defaultMessage: 'Attach to new case',
+  }
+);
+
 export const ATTACH_TIMELINE_TO_EXISTING_CASE = i18n.translate(
   'xpack.securitySolution.timeline.properties.existingCaseButtonLabel',
   {
-    defaultMessage: 'Attach timeline to existing case',
+    defaultMessage: 'Attach timeline to existing case...',
+  }
+);
+
+export const ATTACH_TO_EXISTING_CASE = i18n.translate(
+  'xpack.securitySolution.timeline.properties.attachToExistingCaseButtonLabel',
+  {
+    defaultMessage: 'Attach to existing case...',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx
index 76c3a647a943..56c7c3dcfeb7 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx
@@ -88,7 +88,11 @@ export interface SelectableTimelineProps {
     searchTimelineValue,
   }: GetSelectableOptions) => EuiSelectableOption[];
   onClosePopover: () => void;
-  onTimelineChange: (timelineTitle: string, timelineId: string | null) => void;
+  onTimelineChange: (
+    timelineTitle: string,
+    timelineId: string | null,
+    graphEventId?: string
+  ) => void;
   timelineType: TimelineTypeLiteral;
 }
 
@@ -202,7 +206,8 @@ const SelectableTimelineComponent: React.FC<SelectableTimelineProps> = ({
           isEmpty(selectedTimeline[0].title)
             ? i18nTimeline.UNTITLED_TIMELINE
             : selectedTimeline[0].title,
-          selectedTimeline[0].id === '-1' ? null : selectedTimeline[0].id
+          selectedTimeline[0].id === '-1' ? null : selectedTimeline[0].id,
+          selectedTimeline[0].graphEventId ?? ''
         );
       }
       onClosePopover();
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/styles.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/styles.tsx
index aad80cbdfe33..55bcbbecda26 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/styles.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/styles.tsx
@@ -24,11 +24,12 @@ export const TimelineBodyGlobalStyle = createGlobalStyle`
 
 export const TimelineBody = styled.div.attrs(({ className = '' }) => ({
   className: `siemTimeline__body ${className}`,
-}))<{ bodyHeight?: number }>`
+}))<{ bodyHeight?: number; visible: boolean }>`
   height: ${({ bodyHeight }) => (bodyHeight ? `${bodyHeight}px` : 'auto')};
   overflow: auto;
   scrollbar-width: thin;
   flex: 1;
+  visibility: ${({ visible }) => (visible ? 'visible' : 'hidden')};
 
   &::-webkit-scrollbar {
     height: ${({ theme }) => theme.eui.euiScrollBar};
@@ -89,10 +90,9 @@ export const EventsTrHeader = styled.div.attrs(({ className }) => ({
 
 export const EventsThGroupActions = styled.div.attrs(({ className = '' }) => ({
   className: `siemEventsTable__thGroupActions ${className}`,
-}))<{ actionsColumnWidth: number; justifyContent: string }>`
+}))<{ actionsColumnWidth: number }>`
   display: flex;
   flex: 0 0 ${({ actionsColumnWidth }) => `${actionsColumnWidth}px`};
-  justify-content: ${({ justifyContent }) => justifyContent};
   min-width: 0;
 `;
 
@@ -139,14 +139,17 @@ export const EventsTh = styled.div.attrs(({ className = '' }) => ({
 
 export const EventsThContent = styled.div.attrs(({ className = '' }) => ({
   className: `siemEventsTable__thContent ${className}`,
-}))<{ textAlign?: string }>`
+}))<{ textAlign?: string; width?: number }>`
   font-size: ${({ theme }) => theme.eui.euiFontSizeXS};
   font-weight: ${({ theme }) => theme.eui.euiFontWeightSemiBold};
   line-height: ${({ theme }) => theme.eui.euiLineHeight};
   min-width: 0;
   padding: ${({ theme }) => theme.eui.paddingSizes.xs};
   text-align: ${({ textAlign }) => textAlign};
-  width: 100%; /* Using width: 100% instead of flex: 1 and max-width: 100% for IE11 */
+  width: ${({ width }) =>
+    width != null
+      ? `${width}px`
+      : '100%'}; /* Using width: 100% instead of flex: 1 and max-width: 100% for IE11 */
 `;
 
 /* EVENTS BODY */
@@ -202,7 +205,6 @@ export const EventsTdGroupActions = styled.div.attrs(({ className = '' }) => ({
   className: `siemEventsTable__tdGroupActions ${className}`,
 }))<{ actionsColumnWidth: number }>`
   display: flex;
-  justify-content: space-between;
   flex: 0 0 ${({ actionsColumnWidth }) => `${actionsColumnWidth}px`};
   min-width: 0;
 `;
@@ -234,14 +236,17 @@ export const EventsTd = styled.div.attrs<WidthProp>(({ className = '', width })
 `;
 
 export const EventsTdContent = styled.div.attrs(({ className }) => ({
-  className: `siemEventsTable__tdContent ${className}`,
-}))<{ textAlign?: string }>`
+  className: `siemEventsTable__tdContent ${className != null ? className : ''}`,
+}))<{ textAlign?: string; width?: number }>`
   font-size: ${({ theme }) => theme.eui.euiFontSizeXS};
   line-height: ${({ theme }) => theme.eui.euiLineHeight};
   min-width: 0;
   padding: ${({ theme }) => theme.eui.paddingSizes.xs};
   text-align: ${({ textAlign }) => textAlign};
-  width: 100%; /* Using width: 100% instead of flex: 1 and max-width: 100% for IE11 */
+  width: ${({ width }) =>
+    width != null
+      ? `${width}px`
+      : '100%'}; /* Using width: 100% instead of flex: 1 and max-width: 100% for IE11 */
 `;
 
 /**
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx
index 96703941f616..79ec58711e06 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx
@@ -103,7 +103,11 @@ describe('Timeline', () => {
 
   describe('rendering', () => {
     test('renders correctly against snapshot', () => {
-      const wrapper = shallow(<TimelineComponent {...props} />);
+      const wrapper = shallow(
+        <TestProviders>
+          <TimelineComponent {...props} />
+        </TestProviders>
+      );
 
       expect(wrapper).toMatchSnapshot();
     });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
index 884d693ca6ad..85e3d5d9478b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
@@ -7,6 +7,7 @@
 import { EuiFlyoutHeader, EuiFlyoutBody, EuiFlyoutFooter } from '@elastic/eui';
 import { getOr, isEmpty } from 'lodash/fp';
 import React, { useState, useMemo, useEffect } from 'react';
+import { useDispatch } from 'react-redux';
 import styled from 'styled-components';
 
 import { FlyoutHeaderWithCloseButton } from '../flyout/header_with_close_button';
@@ -16,6 +17,7 @@ import { Direction } from '../../../graphql/types';
 import { useKibana } from '../../../common/lib/kibana';
 import { ColumnHeaderOptions, KqlMode, EventType } from '../../../timelines/store/timeline/model';
 import { defaultHeaders } from './body/column_headers/default_headers';
+import { getInvestigateInResolverAction } from './body/helpers';
 import { Sort } from './body/sort';
 import { StatefulBody } from './body/stateful_body';
 import { DataProvider } from './data_providers/data_provider';
@@ -88,6 +90,7 @@ export interface Props {
   end: number;
   eventType?: EventType;
   filters: Filter[];
+  graphEventId?: string;
   id: string;
   indexPattern: IIndexPattern;
   indexToAdd: string[];
@@ -119,6 +122,7 @@ export const TimelineComponent: React.FC<Props> = ({
   end,
   eventType,
   filters,
+  graphEventId,
   id,
   indexPattern,
   indexToAdd,
@@ -141,6 +145,7 @@ export const TimelineComponent: React.FC<Props> = ({
   toggleColumn,
   usersViewing,
 }) => {
+  const dispatch = useDispatch();
   const kibana = useKibana();
   const [filterManager] = useState<FilterManager>(new FilterManager(kibana.services.uiSettings));
   const combinedQueries = combineQueries({
@@ -168,9 +173,14 @@ export const TimelineComponent: React.FC<Props> = ({
     initializeTimeline,
     setIsTimelineLoading,
     setTimelineFilterManager,
+    setTimelineRowActions,
   } = useManageTimeline();
   useEffect(() => {
     initializeTimeline({ id, indexToAdd });
+    setTimelineRowActions({
+      id,
+      timelineRowActions: [getInvestigateInResolverAction({ dispatch, timelineId: id })],
+    });
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
   useEffect(() => {
@@ -197,6 +207,7 @@ export const TimelineComponent: React.FC<Props> = ({
             indexPattern={indexPattern}
             dataProviders={dataProviders}
             filterManager={filterManager}
+            graphEventId={graphEventId}
             onDataProviderEdited={onDataProviderEdited}
             onDataProviderRemoved={onDataProviderRemoved}
             onToggleDataProviderEnabled={onToggleDataProviderEnabled}
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/index.gql_query.ts b/x-pack/plugins/security_solution/public/timelines/containers/index.gql_query.ts
index 53d0b98570bc..e2a268e750b4 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/index.gql_query.ts
+++ b/x-pack/plugins/security_solution/public/timelines/containers/index.gql_query.ts
@@ -89,6 +89,9 @@ export const timelineQuery = gql`
                 timezone
                 type
               }
+              agent {
+                type
+              }
               auditd {
                 result
                 session
@@ -285,6 +288,7 @@ export const timelineQuery = gql`
                 name
                 ppid
                 args
+                entity_id
                 executable
                 title
                 working_directory
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
index c5df017604b0..55e6849fdb6c 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
@@ -87,6 +87,10 @@ export const removeProvider = actionCreator<{
 
 export const showTimeline = actionCreator<{ id: string; show: boolean }>('SHOW_TIMELINE');
 
+export const updateTimelineGraphEventId = actionCreator<{ id: string; graphEventId: string }>(
+  'UPDATE_TIMELINE_GRAPH_EVENT_ID'
+);
+
 export const unPinEvent = actionCreator<{ id: string; eventId: string }>('UN_PIN_EVENT');
 
 export const updateTimeline = actionCreator<{
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
index 15f956fa79d3..c0615d36f7a2 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
@@ -228,6 +228,26 @@ export const updateTimelineShowTimeline = ({
   };
 };
 
+export const updateGraphEventId = ({
+  id,
+  graphEventId,
+  timelineById,
+}: {
+  id: string;
+  graphEventId: string;
+  timelineById: TimelineById;
+}): TimelineById => {
+  const timeline = timelineById[id];
+
+  return {
+    ...timelineById,
+    [id]: {
+      ...timeline,
+      graphEventId,
+    },
+  };
+};
+
 interface ApplyDeltaToCurrentWidthParams {
   id: string;
   delta: number;
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
index caad70226365..e8ea3c8d16e3 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
@@ -55,6 +55,8 @@ export interface TimelineModel {
   /** A map of events in this timeline to the chronologically ordered notes (in this timeline) associated with the event */
   eventIdToNoteIds: Record<string, string[]>;
   filters?: Filter[];
+  /** When non-empty, display a graph view for this event */
+  graphEventId?: string;
   /** The chronological history of actions related to this timeline */
   historyIds: string[];
   /** The chronological history of actions related to this timeline */
@@ -129,6 +131,7 @@ export type SubsetTimelineModel = Readonly<
     | 'description'
     | 'eventType'
     | 'eventIdToNoteIds'
+    | 'graphEventId'
     | 'highlightedDropAndProviderId'
     | 'historyIds'
     | 'isFavorite'
@@ -165,4 +168,5 @@ export type SubsetTimelineModel = Readonly<
 export interface TimelineUrl {
   id: string;
   isOpen: boolean;
+  graphEventId?: string;
 }
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts
index 3bdb16be7993..6e7a36079a0c 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts
@@ -1788,6 +1788,7 @@ describe('Timeline', () => {
           isLoading: false,
           id: 'foo',
           savedObjectId: null,
+          showRowRenderers: true,
           kqlMode: 'filter',
           kqlQuery: { filterQuery: null, filterQueryDraft: null },
           loadingEventIds: [],
@@ -1802,7 +1803,6 @@ describe('Timeline', () => {
           },
           selectedEventIds: {},
           show: true,
-          showRowRenderers: true,
           showCheckboxes: false,
           sort: {
             columnId: '@timestamp',
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts
index 5e314f159745..30b7f73c839d 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts
@@ -53,6 +53,7 @@ import {
   updateRange,
   updateSort,
   updateTimeline,
+  updateTimelineGraphEventId,
   updateTitle,
   upsertColumn,
 } from './actions';
@@ -94,6 +95,7 @@ import {
   updateTimelineTitle,
   upsertTimelineColumn,
   updateSavedQuery,
+  updateGraphEventId,
   updateFilters,
   updateTimelineEventType,
 } from './helpers';
@@ -194,6 +196,10 @@ export const timelineReducer = reducerWithInitialState(initialTimelineState)
     ...state,
     timelineById: updateTimelineShowTimeline({ id, show, timelineById: state.timelineById }),
   }))
+  .case(updateTimelineGraphEventId, (state, { id, graphEventId }) => ({
+    ...state,
+    timelineById: updateGraphEventId({ id, graphEventId, timelineById: state.timelineById }),
+  }))
   .case(applyDeltaToColumnWidth, (state, { id, columnId, delta }) => ({
     ...state,
     timelineById: applyDeltaToTimelineColumnWidth({
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
index 5262c72a6140..65798648f92c 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
@@ -23,6 +23,7 @@ export interface TimelineById {
 }
 
 export interface InsertTimeline {
+  graphEventId?: string;
   timelineId: string;
   timelineSavedObjectId: string | null;
   timelineTitle: string;
diff --git a/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts
index 9bf55cfe1ed2..52011e141671 100644
--- a/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts
+++ b/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts
@@ -60,6 +60,10 @@ export const ecsSchema = gql`
     sequence: ToStringArray
   }
 
+  type AgentEcsField {
+    type: ToStringArray
+  }
+
   type AuditdData {
     acct: ToStringArray
     terminal: ToStringArray
@@ -110,6 +114,7 @@ export const ecsSchema = gql`
     name: ToStringArray
     ppid: ToNumberArray
     args: ToStringArray
+    entity_id: ToStringArray
     executable: ToStringArray
     title: ToStringArray
     thread: Thread
@@ -425,6 +430,7 @@ export const ecsSchema = gql`
   type ECS {
     _id: String!
     _index: String
+    agent: AgentEcsField
     auditd: AuditdEcsFields
     destination: DestinationEcsFields
     dns: DnsEcsFields
diff --git a/x-pack/plugins/security_solution/server/graphql/types.ts b/x-pack/plugins/security_solution/server/graphql/types.ts
index 4a063647a183..40666b619392 100644
--- a/x-pack/plugins/security_solution/server/graphql/types.ts
+++ b/x-pack/plugins/security_solution/server/graphql/types.ts
@@ -765,6 +765,8 @@ export interface Ecs {
 
   _index?: Maybe<string>;
 
+  agent?: Maybe<AgentEcsField>;
+
   auditd?: Maybe<AuditdEcsFields>;
 
   destination?: Maybe<DestinationEcsFields>;
@@ -812,6 +814,10 @@ export interface Ecs {
   system?: Maybe<SystemEcsField>;
 }
 
+export interface AgentEcsField {
+  type?: Maybe<string[] | string>;
+}
+
 export interface AuditdEcsFields {
   result?: Maybe<string[] | string>;
 
@@ -1267,6 +1273,8 @@ export interface ProcessEcsFields {
 
   args?: Maybe<string[] | string>;
 
+  entity_id?: Maybe<string[] | string>;
+
   executable?: Maybe<string[] | string>;
 
   title?: Maybe<string[] | string>;
@@ -4083,6 +4091,8 @@ export namespace EcsResolvers {
 
     _index?: _IndexResolver<Maybe<string>, TypeParent, TContext>;
 
+    agent?: AgentResolver<Maybe<AgentEcsField>, TypeParent, TContext>;
+
     auditd?: AuditdResolver<Maybe<AuditdEcsFields>, TypeParent, TContext>;
 
     destination?: DestinationResolver<Maybe<DestinationEcsFields>, TypeParent, TContext>;
@@ -4140,6 +4150,11 @@ export namespace EcsResolvers {
     Parent,
     TContext
   >;
+  export type AgentResolver<
+    R = Maybe<AgentEcsField>,
+    Parent = Ecs,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
   export type AuditdResolver<
     R = Maybe<AuditdEcsFields>,
     Parent = Ecs,
@@ -4257,6 +4272,18 @@ export namespace EcsResolvers {
   > = Resolver<R, Parent, TContext>;
 }
 
+export namespace AgentEcsFieldResolvers {
+  export interface Resolvers<TContext = SiemContext, TypeParent = AgentEcsField> {
+    type?: TypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
+  }
+
+  export type TypeResolver<
+    R = Maybe<string[] | string>,
+    Parent = AgentEcsField,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
+}
+
 export namespace AuditdEcsFieldsResolvers {
   export interface Resolvers<TContext = SiemContext, TypeParent = AuditdEcsFields> {
     result?: ResultResolver<Maybe<string[] | string>, TypeParent, TContext>;
@@ -5761,6 +5788,8 @@ export namespace ProcessEcsFieldsResolvers {
 
     args?: ArgsResolver<Maybe<string[] | string>, TypeParent, TContext>;
 
+    entity_id?: EntityIdResolver<Maybe<string[] | string>, TypeParent, TContext>;
+
     executable?: ExecutableResolver<Maybe<string[] | string>, TypeParent, TContext>;
 
     title?: TitleResolver<Maybe<string[] | string>, TypeParent, TContext>;
@@ -5795,6 +5824,11 @@ export namespace ProcessEcsFieldsResolvers {
     Parent = ProcessEcsFields,
     TContext = SiemContext
   > = Resolver<R, Parent, TContext>;
+  export type EntityIdResolver<
+    R = Maybe<string[] | string>,
+    Parent = ProcessEcsFields,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
   export type ExecutableResolver<
     R = Maybe<string[] | string>,
     Parent = ProcessEcsFields,
@@ -9110,6 +9144,7 @@ export type IResolvers<TContext = SiemContext> = {
   TimelineItem?: TimelineItemResolvers.Resolvers<TContext>;
   TimelineNonEcsData?: TimelineNonEcsDataResolvers.Resolvers<TContext>;
   Ecs?: EcsResolvers.Resolvers<TContext>;
+  AgentEcsField?: AgentEcsFieldResolvers.Resolvers<TContext>;
   AuditdEcsFields?: AuditdEcsFieldsResolvers.Resolvers<TContext>;
   AuditdData?: AuditdDataResolvers.Resolvers<TContext>;
   Summary?: SummaryResolvers.Resolvers<TContext>;
diff --git a/x-pack/plugins/security_solution/server/lib/ecs_fields/index.ts b/x-pack/plugins/security_solution/server/lib/ecs_fields/index.ts
index f2662c79d339..ff474c4a841f 100644
--- a/x-pack/plugins/security_solution/server/lib/ecs_fields/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/ecs_fields/index.ts
@@ -76,12 +76,17 @@ export const processFieldsMap: Readonly<Record<string, string>> = {
   'process.name': 'process.name',
   'process.ppid': 'process.ppid',
   'process.args': 'process.args',
+  'process.entity_id': 'process.entity_id',
   'process.executable': 'process.executable',
   'process.title': 'process.title',
   'process.thread': 'process.thread',
   'process.working_directory': 'process.working_directory',
 };
 
+export const agentFieldsMap: Readonly<Record<string, string>> = {
+  'agent.type': 'agent.type',
+};
+
 export const userFieldsMap: Readonly<Record<string, string>> = {
   'user.domain': 'user.domain',
   'user.id': 'user.id',
@@ -327,6 +332,7 @@ export const eventFieldsMap: Readonly<Record<string, string>> = {
   timestamp: '@timestamp',
   '@timestamp': '@timestamp',
   message: 'message',
+  ...{ ...agentFieldsMap },
   ...{ ...auditdMap },
   ...{ ...destinationFieldsMap },
   ...{ ...dnsFieldsMap },

From 5c8df21ca0dc034d8f19f6a7936a9360f6e14e46 Mon Sep 17 00:00:00 2001
From: Michael Olorunnisola <michael.olorunnisola@elastic.co>
Date: Fri, 26 Jun 2020 17:38:02 -0400
Subject: [PATCH 66/78] Hide unused resolver buttons (#70112)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../public/resolver/store/actions.ts          | 10 ------
 .../public/resolver/view/index.tsx            |  4 +--
 .../resolver/view/process_event_dot.tsx       | 33 ++++++-------------
 .../public/resolver/view/submenu.tsx          |  5 ---
 4 files changed, 12 insertions(+), 40 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/resolver/store/actions.ts b/x-pack/plugins/security_solution/public/resolver/store/actions.ts
index c633d791e8bf..ae302d0e6091 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/actions.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/actions.ts
@@ -141,15 +141,6 @@ interface UserSelectedRelatedEventCategory {
   };
 }
 
-/**
- * This action should dispatch to indicate that the user chose to focus
- * on examining alerts related to a particular ResolverEvent
- */
-interface UserSelectedRelatedAlerts {
-  readonly type: 'userSelectedRelatedAlerts';
-  readonly payload: ResolverEvent;
-}
-
 export type ResolverAction =
   | CameraAction
   | DataAction
@@ -160,7 +151,6 @@ export type ResolverAction =
   | UserSelectedResolverNode
   | UserRequestedRelatedEventData
   | UserSelectedRelatedEventCategory
-  | UserSelectedRelatedAlerts
   | AppDetectedNewIdFromQueryParams
   | AppDisplayedDifferentPanel
   | AppDetectedMissingEventData;
diff --git a/x-pack/plugins/security_solution/public/resolver/view/index.tsx b/x-pack/plugins/security_solution/public/resolver/view/index.tsx
index 9b7114b56495..5c188fdc7115 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/index.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/index.tsx
@@ -136,7 +136,7 @@ export const Resolver = React.memo(function Resolver({
               projectionMatrix={projectionMatrix}
             />
           ))}
-          {[...processNodePositions].map(([processEvent, position], index) => {
+          {[...processNodePositions].map(([processEvent, position]) => {
             const adjacentNodeMap = processToAdjacencyMap.get(processEvent);
             const processEntityId = entityId(processEvent);
             if (!adjacentNodeMap) {
@@ -145,7 +145,7 @@ export const Resolver = React.memo(function Resolver({
             }
             return (
               <ProcessEventDot
-                key={index}
+                key={processEntityId}
                 position={position}
                 projectionMatrix={projectionMatrix}
                 event={processEvent}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
index e7c9960f7805..a2249e1920bc 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
@@ -414,13 +414,6 @@ const ProcessEventDotComponents = React.memo(
       });
     }, [dispatch, selfId]);
 
-    const handleRelatedAlertsRequest = useCallback(() => {
-      dispatch({
-        type: 'userSelectedRelatedAlerts',
-        payload: event,
-      });
-    }, [dispatch, event]);
-
     const history = useHistory();
     const urlSearch = history.location.search;
 
@@ -637,22 +630,16 @@ const ProcessEventDotComponents = React.memo(
             }}
           >
             <EuiFlexItem grow={false} className="related-dropdown">
-              <NodeSubMenu
-                count={grandTotal}
-                buttonBorderColor={labelButtonFill}
-                buttonFill={colorMap.resolverBackground}
-                menuAction={handleRelatedEventRequest}
-                menuTitle={subMenuAssets.relatedEvents.title}
-                optionsWithActions={relatedEventStatusOrOptions}
-              />
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <NodeSubMenu
-                buttonBorderColor={labelButtonFill}
-                buttonFill={colorMap.resolverBackground}
-                menuTitle={subMenuAssets.relatedAlerts.title}
-                menuAction={handleRelatedAlertsRequest}
-              />
+              {grandTotal > 0 && (
+                <NodeSubMenu
+                  count={grandTotal}
+                  buttonBorderColor={labelButtonFill}
+                  buttonFill={colorMap.resolverBackground}
+                  menuAction={handleRelatedEventRequest}
+                  menuTitle={subMenuAssets.relatedEvents.title}
+                  optionsWithActions={relatedEventStatusOrOptions}
+                />
+              )}
             </EuiFlexItem>
           </EuiFlexGroup>
         </StyledActionsContainer>
diff --git a/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx b/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
index 8f972dd737af..d3bb6123ce04 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
@@ -31,11 +31,6 @@ export const subMenuAssets = {
   menuError: i18n.translate('xpack.securitySolution.endpoint.resolver.relatedRetrievalError', {
     defaultMessage: 'There was an error retrieving related events.',
   }),
-  relatedAlerts: {
-    title: i18n.translate('xpack.securitySolution.endpoint.resolver.relatedAlerts', {
-      defaultMessage: 'Related Alerts',
-    }),
-  },
   relatedEvents: {
     title: i18n.translate('xpack.securitySolution.endpoint.resolver.relatedEvents', {
       defaultMessage: 'Events',

From 5236335d63575e5c5c988e7f2bbd3b14270567cd Mon Sep 17 00:00:00 2001
From: Kevin Logan <56395104+kevinlog@users.noreply.github.com>
Date: Fri, 26 Jun 2020 18:08:07 -0400
Subject: [PATCH 67/78] [Endpoint] Add Endpoint empty states for onboarding
 (#69626)

---
 .../hooks/use_intra_app_state.tsx             |   6 +-
 .../agent_config/components/actions_menu.tsx  | 184 ++++++------
 .../agent_config/details_page/index.tsx       |  27 +-
 .../types/intra_app_route_state.ts            |  12 +-
 .../components/management_empty_state.tsx     | 277 ++++++++++++++++++
 .../pages/endpoint_hosts/store/action.ts      |  42 ++-
 .../pages/endpoint_hosts/store/index.test.ts  |   4 +
 .../pages/endpoint_hosts/store/middleware.ts  |  77 ++++-
 .../pages/endpoint_hosts/store/reducer.ts     |  40 +++
 .../pages/endpoint_hosts/store/selectors.ts   |  13 +
 .../management/pages/endpoint_hosts/types.ts  |  10 +
 .../pages/endpoint_hosts/view/index.test.tsx  |  52 +++-
 .../pages/endpoint_hosts/view/index.tsx       | 150 ++++++++--
 .../pages/policy/view/policy_list.tsx         | 118 +-------
 14 files changed, 783 insertions(+), 229 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx

diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_intra_app_state.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_intra_app_state.tsx
index 565c5b364893..7bccd3a4b1f5 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_intra_app_state.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_intra_app_state.tsx
@@ -28,10 +28,11 @@ export const IntraAppStateProvider = memo<{
 }>(({ kibanaScopedHistory, children }) => {
   const internalAppToAppState = useMemo<IntraAppState>(() => {
     return {
-      forRoute: kibanaScopedHistory.location.hash.substr(1),
+      forRoute: new URL(`${kibanaScopedHistory.location.hash.substr(1)}`, 'http://localhost')
+        .pathname,
       routeState: kibanaScopedHistory.location.state as AnyIntraAppRouteState,
     };
-  }, [kibanaScopedHistory.location.hash, kibanaScopedHistory.location.state]);
+  }, [kibanaScopedHistory.location.state, kibanaScopedHistory.location.hash]);
   return (
     <IntraAppStateContext.Provider value={internalAppToAppState}>
       {children}
@@ -57,6 +58,7 @@ export function useIntraAppState<S = AnyIntraAppRouteState>():
     // once so that it does not impact navigation to the page from within the
     // ingest app. side affect is that the browser back button would not work
     // consistently either.
+
     if (location.pathname === intraAppState.forRoute && !wasHandled.has(intraAppState)) {
       wasHandled.add(intraAppState);
       return intraAppState.routeState as S;
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/components/actions_menu.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/components/actions_menu.tsx
index 39fe090e5008..86d191d4ff90 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/components/actions_menu.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/components/actions_menu.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { memo, useState } from 'react';
+import React, { memo, useState, useMemo } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiContextMenuItem, EuiPortal } from '@elastic/eui';
 import { AgentConfig } from '../../../types';
@@ -17,86 +17,106 @@ export const AgentConfigActionMenu = memo<{
   config: AgentConfig;
   onCopySuccess?: (newAgentConfig: AgentConfig) => void;
   fullButton?: boolean;
-}>(({ config, onCopySuccess, fullButton = false }) => {
-  const hasWriteCapabilities = useCapabilities().write;
-  const [isYamlFlyoutOpen, setIsYamlFlyoutOpen] = useState<boolean>(false);
-  const [isEnrollmentFlyoutOpen, setIsEnrollmentFlyoutOpen] = useState<boolean>(false);
+  enrollmentFlyoutOpenByDefault?: boolean;
+  onCancelEnrollment?: () => void;
+}>(
+  ({
+    config,
+    onCopySuccess,
+    fullButton = false,
+    enrollmentFlyoutOpenByDefault = false,
+    onCancelEnrollment,
+  }) => {
+    const hasWriteCapabilities = useCapabilities().write;
+    const [isYamlFlyoutOpen, setIsYamlFlyoutOpen] = useState<boolean>(false);
+    const [isEnrollmentFlyoutOpen, setIsEnrollmentFlyoutOpen] = useState<boolean>(
+      enrollmentFlyoutOpenByDefault
+    );
 
-  return (
-    <AgentConfigCopyProvider>
-      {(copyAgentConfigPrompt) => {
-        return (
-          <>
-            {isYamlFlyoutOpen ? (
-              <EuiPortal>
-                <ConfigYamlFlyout configId={config.id} onClose={() => setIsYamlFlyoutOpen(false)} />
-              </EuiPortal>
-            ) : null}
-            {isEnrollmentFlyoutOpen && (
-              <EuiPortal>
-                <AgentEnrollmentFlyout
-                  agentConfigs={[config]}
-                  onClose={() => setIsEnrollmentFlyoutOpen(false)}
-                />
-              </EuiPortal>
-            )}
-            <ContextMenuActions
-              button={
-                fullButton
-                  ? {
-                      props: {
-                        iconType: 'arrowDown',
-                        iconSide: 'right',
-                      },
-                      children: (
-                        <FormattedMessage
-                          id="xpack.ingestManager.agentConfigActionMenu.buttonText"
-                          defaultMessage="Actions"
-                        />
-                      ),
-                    }
-                  : undefined
-              }
-              items={[
-                <EuiContextMenuItem
-                  disabled={!hasWriteCapabilities}
-                  icon="plusInCircle"
-                  onClick={() => setIsEnrollmentFlyoutOpen(true)}
-                  key="enrollAgents"
-                >
-                  <FormattedMessage
-                    id="xpack.ingestManager.agentConfigActionMenu.enrollAgentActionText"
-                    defaultMessage="Enroll agent"
-                  />
-                </EuiContextMenuItem>,
-                <EuiContextMenuItem
-                  icon="inspect"
-                  onClick={() => setIsYamlFlyoutOpen(!isYamlFlyoutOpen)}
-                  key="viewConfig"
-                >
-                  <FormattedMessage
-                    id="xpack.ingestManager.agentConfigActionMenu.viewConfigText"
-                    defaultMessage="View config"
-                  />
-                </EuiContextMenuItem>,
-                <EuiContextMenuItem
-                  disabled={!hasWriteCapabilities}
-                  icon="copy"
-                  onClick={() => {
-                    copyAgentConfigPrompt(config, onCopySuccess);
-                  }}
-                  key="copyConfig"
-                >
-                  <FormattedMessage
-                    id="xpack.ingestManager.agentConfigActionMenu.copyConfigActionText"
-                    defaultMessage="Copy config"
+    const onClose = useMemo(() => {
+      if (onCancelEnrollment) {
+        return onCancelEnrollment;
+      } else {
+        return () => setIsEnrollmentFlyoutOpen(false);
+      }
+    }, [onCancelEnrollment, setIsEnrollmentFlyoutOpen]);
+
+    return (
+      <AgentConfigCopyProvider>
+        {(copyAgentConfigPrompt) => {
+          return (
+            <>
+              {isYamlFlyoutOpen ? (
+                <EuiPortal>
+                  <ConfigYamlFlyout
+                    configId={config.id}
+                    onClose={() => setIsYamlFlyoutOpen(false)}
                   />
-                </EuiContextMenuItem>,
-              ]}
-            />
-          </>
-        );
-      }}
-    </AgentConfigCopyProvider>
-  );
-});
+                </EuiPortal>
+              ) : null}
+              {isEnrollmentFlyoutOpen && (
+                <EuiPortal>
+                  <AgentEnrollmentFlyout agentConfigs={[config]} onClose={onClose} />
+                </EuiPortal>
+              )}
+              <ContextMenuActions
+                button={
+                  fullButton
+                    ? {
+                        props: {
+                          iconType: 'arrowDown',
+                          iconSide: 'right',
+                        },
+                        children: (
+                          <FormattedMessage
+                            id="xpack.ingestManager.agentConfigActionMenu.buttonText"
+                            defaultMessage="Actions"
+                          />
+                        ),
+                      }
+                    : undefined
+                }
+                items={[
+                  <EuiContextMenuItem
+                    disabled={!hasWriteCapabilities}
+                    icon="plusInCircle"
+                    onClick={() => setIsEnrollmentFlyoutOpen(true)}
+                    key="enrollAgents"
+                  >
+                    <FormattedMessage
+                      id="xpack.ingestManager.agentConfigActionMenu.enrollAgentActionText"
+                      defaultMessage="Enroll agent"
+                    />
+                  </EuiContextMenuItem>,
+                  <EuiContextMenuItem
+                    icon="inspect"
+                    onClick={() => setIsYamlFlyoutOpen(!isYamlFlyoutOpen)}
+                    key="viewConfig"
+                  >
+                    <FormattedMessage
+                      id="xpack.ingestManager.agentConfigActionMenu.viewConfigText"
+                      defaultMessage="View config"
+                    />
+                  </EuiContextMenuItem>,
+                  <EuiContextMenuItem
+                    disabled={!hasWriteCapabilities}
+                    icon="copy"
+                    onClick={() => {
+                      copyAgentConfigPrompt(config, onCopySuccess);
+                    }}
+                    key="copyConfig"
+                  >
+                    <FormattedMessage
+                      id="xpack.ingestManager.agentConfigActionMenu.copyConfigActionText"
+                      defaultMessage="Copy config"
+                    />
+                  </EuiContextMenuItem>,
+                ]}
+              />
+            </>
+          );
+        }}
+      </AgentConfigCopyProvider>
+    );
+  }
+);
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/index.tsx
index 410c0fcb2d14..eaa161d57bbe 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/index.tsx
@@ -3,8 +3,8 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useMemo, useState } from 'react';
-import { Redirect, useRouteMatch, Switch, Route, useHistory } from 'react-router-dom';
+import React, { useMemo, useState, useCallback } from 'react';
+import { Redirect, useRouteMatch, Switch, Route, useHistory, useLocation } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage, FormattedDate } from '@kbn/i18n/react';
 import {
@@ -21,14 +21,15 @@ import {
 } from '@elastic/eui';
 import { Props as EuiTabProps } from '@elastic/eui/src/components/tabs/tab';
 import styled from 'styled-components';
-import { AgentConfig } from '../../../types';
+import { AgentConfig, AgentConfigDetailsDeployAgentAction } from '../../../types';
 import { PAGE_ROUTING_PATHS } from '../../../constants';
-import { useGetOneAgentConfig, useLink, useBreadcrumbs } from '../../../hooks';
+import { useGetOneAgentConfig, useLink, useBreadcrumbs, useCore } from '../../../hooks';
 import { Loading } from '../../../components';
 import { WithHeaderLayout } from '../../../layouts';
 import { ConfigRefreshContext, useGetAgentStatus, AgentStatusRefreshContext } from './hooks';
 import { LinkedAgentCount, AgentConfigActionMenu } from '../components';
 import { ConfigDatasourcesView, ConfigSettingsView } from './components';
+import { useIntraAppState } from '../../../hooks/use_intra_app_state';
 
 const Divider = styled.div`
   width: 0;
@@ -48,7 +49,13 @@ export const AgentConfigDetailsPage: React.FunctionComponent = () => {
   const [redirectToAgentConfigList] = useState<boolean>(false);
   const agentStatusRequest = useGetAgentStatus(configId);
   const { refreshAgentStatus } = agentStatusRequest;
+  const {
+    application: { navigateToApp },
+  } = useCore();
+  const routeState = useIntraAppState<AgentConfigDetailsDeployAgentAction>();
   const agentStatus = agentStatusRequest.data?.results;
+  const queryParams = new URLSearchParams(useLocation().search);
+  const openEnrollmentFlyoutOpenByDefault = queryParams.get('openEnrollmentFlyout') === 'true';
 
   const headerLeftContent = useMemo(
     () => (
@@ -95,6 +102,12 @@ export const AgentConfigDetailsPage: React.FunctionComponent = () => {
     [getHref, agentConfig, configId]
   );
 
+  const enrollmentCancelClickHandler = useCallback(() => {
+    if (routeState && routeState.onDoneNavigateTo) {
+      navigateToApp(routeState.onDoneNavigateTo[0], routeState.onDoneNavigateTo[1]);
+    }
+  }, [routeState, navigateToApp]);
+
   const headerRightContent = useMemo(
     () => (
       <EuiFlexGroup justifyContent={'flexEnd'} direction="row">
@@ -155,6 +168,12 @@ export const AgentConfigDetailsPage: React.FunctionComponent = () => {
                 onCopySuccess={(newAgentConfig: AgentConfig) => {
                   history.push(getPath('configuration_details', { configId: newAgentConfig.id }));
                 }}
+                enrollmentFlyoutOpenByDefault={openEnrollmentFlyoutOpenByDefault}
+                onCancelEnrollment={
+                  routeState && routeState.onDoneNavigateTo
+                    ? enrollmentCancelClickHandler
+                    : undefined
+                }
               />
             ),
           },
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/intra_app_route_state.ts b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/intra_app_route_state.ts
index 6e85d12f7189..b2948686ff6e 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/intra_app_route_state.ts
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/intra_app_route_state.ts
@@ -21,7 +21,17 @@ export interface CreateDatasourceRouteState {
   onCancelUrl?: string;
 }
 
+/**
+ * Supported routing state for the agent config details page routes with deploy agents action
+ */
+export interface AgentConfigDetailsDeployAgentAction {
+  /** On done, navigate to the given app */
+  onDoneNavigateTo?: Parameters<ApplicationStart['navigateToApp']>;
+}
+
 /**
  * All possible Route states.
  */
-export type AnyIntraAppRouteState = CreateDatasourceRouteState;
+export type AnyIntraAppRouteState =
+  | CreateDatasourceRouteState
+  | AgentConfigDetailsDeployAgentAction;
diff --git a/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx b/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx
new file mode 100644
index 000000000000..5dd47d4e8802
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx
@@ -0,0 +1,277 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useMemo, MouseEvent, CSSProperties } from 'react';
+import {
+  EuiText,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSpacer,
+  EuiButton,
+  EuiSteps,
+  EuiTitle,
+  EuiSelectable,
+  EuiSelectableMessage,
+  EuiSelectableProps,
+  EuiLoadingSpinner,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+const TEXT_ALIGN_CENTER: CSSProperties = Object.freeze({
+  textAlign: 'center',
+});
+
+interface ManagementStep {
+  title: string;
+  children: JSX.Element;
+}
+
+const PolicyEmptyState = React.memo<{
+  loading: boolean;
+  onActionClick: (event: MouseEvent<HTMLAnchorElement | HTMLButtonElement>) => void;
+  actionDisabled?: boolean;
+}>(({ loading, onActionClick, actionDisabled }) => {
+  const policySteps = useMemo(
+    () => [
+      {
+        title: i18n.translate('xpack.securitySolution.endpoint.policyList.stepOneTitle', {
+          defaultMessage: 'Head over to Ingest Manager.',
+        }),
+        children: (
+          <EuiText color="subdued" size="xs">
+            <FormattedMessage
+              id="xpack.securitySolution.endpoint.policyList.stepOne"
+              defaultMessage="Here, you’ll add the Elastic Endpoint Security Integration to your Agent Configuration."
+            />
+          </EuiText>
+        ),
+      },
+      {
+        title: i18n.translate('xpack.securitySolution.endpoint.policyList.stepTwoTitle', {
+          defaultMessage: 'We’ll create a recommended security policy for you.',
+        }),
+        children: (
+          <EuiText color="subdued" size="xs">
+            <FormattedMessage
+              id="xpack.securitySolution.endpoint.policyList.stepTwo"
+              defaultMessage="You can edit this policy in the “Policies” tab after you’ve added the Elastic Endpoint integration."
+            />
+          </EuiText>
+        ),
+      },
+      {
+        title: i18n.translate('xpack.securitySolution.endpoint.policyList.stepThreeTitle', {
+          defaultMessage: 'Enroll your agents through Fleet.',
+        }),
+        children: (
+          <EuiText color="subdued" size="xs">
+            <FormattedMessage
+              id="xpack.securitySolution.endpoint.policyList.stepThree"
+              defaultMessage="If you haven’t already, enroll your agents through Fleet using the same agent configuration."
+            />
+          </EuiText>
+        ),
+      },
+    ],
+    []
+  );
+
+  return (
+    <ManagementEmptyState
+      loading={loading}
+      onActionClick={onActionClick}
+      actionDisabled={actionDisabled}
+      dataTestSubj="emptyPolicyTable"
+      steps={policySteps}
+      headerComponent={
+        <FormattedMessage
+          id="xpack.securitySolution.endpoint.policyList.noPolicyPrompt"
+          defaultMessage="Looks like you're not using the Elastic Endpoint"
+        />
+      }
+      bodyComponent={
+        <FormattedMessage
+          id="xpack.securitySolution.endpoint.policyList.noPolicyInstructions"
+          defaultMessage="Elastic Endpoint Security gives you the power to keep your endpoints safe from attack, as well as unparalleled visibility into any threat in your environment."
+        />
+      }
+    />
+  );
+});
+
+const EndpointsEmptyState = React.memo<{
+  loading: boolean;
+  onActionClick: (event: MouseEvent<HTMLAnchorElement | HTMLButtonElement>) => void;
+  actionDisabled: boolean;
+  handleSelectableOnChange: (o: EuiSelectableProps['options']) => void;
+  selectionOptions: EuiSelectableProps['options'];
+}>(({ loading, onActionClick, actionDisabled, handleSelectableOnChange, selectionOptions }) => {
+  const policySteps = useMemo(
+    () => [
+      {
+        title: i18n.translate('xpack.securitySolution.endpoint.endpointList.stepOneTitle', {
+          defaultMessage: 'Select a policy you created from the list below.',
+        }),
+        children: (
+          <>
+            <EuiText color="subdued" size="xs">
+              <FormattedMessage
+                id="xpack.securitySolution.endpoint.endpointList.stepOne"
+                defaultMessage="These are existing policies."
+              />
+            </EuiText>
+            <EuiSpacer size="m" />
+            <EuiSelectable
+              options={selectionOptions}
+              singleSelection="always"
+              isLoading={loading}
+              height={100}
+              listProps={{ bordered: true, singleSelection: true }}
+              onChange={handleSelectableOnChange}
+              data-test-subj="onboardingPolicySelect"
+            >
+              {(list) => {
+                return loading ? (
+                  <EuiSelectableMessage>
+                    <FormattedMessage
+                      id="xpack.securitySolution.endpoint.endpointList.loadingPolicies"
+                      defaultMessage="Loading policy configs"
+                    />
+                  </EuiSelectableMessage>
+                ) : selectionOptions.length ? (
+                  list
+                ) : (
+                  <FormattedMessage
+                    id="xpack.securitySolution.endpoint.endpointList.noPolicies"
+                    defaultMessage="There are no policies."
+                  />
+                );
+              }}
+            </EuiSelectable>
+          </>
+        ),
+      },
+      {
+        title: i18n.translate('xpack.securitySolution.endpoint.endpointList.stepTwoTitle', {
+          defaultMessage:
+            'Head over to Ingest to deploy your Agent with Endpoint Security enabled.',
+        }),
+        children: (
+          <EuiText color="subdued" size="xs">
+            <FormattedMessage
+              id="xpack.securitySolution.endpoint.endpointList.stepTwo"
+              defaultMessage="You'll be given a command in Ingest to get you started."
+            />
+          </EuiText>
+        ),
+      },
+    ],
+    [selectionOptions, handleSelectableOnChange, loading]
+  );
+
+  return (
+    <ManagementEmptyState
+      loading={loading}
+      onActionClick={onActionClick}
+      actionDisabled={actionDisabled}
+      dataTestSubj="emptyEndpointsTable"
+      steps={policySteps}
+      headerComponent={
+        <FormattedMessage
+          id="xpack.securitySolution.endpoint.endpointList.noEndpointsPrompt"
+          defaultMessage="You have a policy, but no Endpoints are deployed!"
+        />
+      }
+      bodyComponent={
+        <FormattedMessage
+          id="xpack.securitySolution.endpoint.endpointList.noEndpointsInstructions"
+          defaultMessage="Elastic Endpoint Security gives you the power to keep your endpoints safe from attack, as well as unparalleled visibility into any threat in your environment."
+        />
+      }
+    />
+  );
+});
+
+const ManagementEmptyState = React.memo<{
+  loading: boolean;
+  onActionClick?: (event: MouseEvent<HTMLAnchorElement | HTMLButtonElement>) => void;
+  actionDisabled?: boolean;
+  actionButton?: JSX.Element;
+  dataTestSubj: string;
+  steps?: ManagementStep[];
+  headerComponent: JSX.Element;
+  bodyComponent: JSX.Element;
+}>(
+  ({
+    loading,
+    onActionClick,
+    actionDisabled,
+    dataTestSubj,
+    steps,
+    actionButton,
+    headerComponent,
+    bodyComponent,
+  }) => {
+    return (
+      <div data-test-subj={dataTestSubj}>
+        {loading ? (
+          <EuiFlexGroup alignItems="center" justifyContent="center">
+            <EuiFlexItem grow={false}>
+              <EuiLoadingSpinner size="xl" className="essentialAnimation" />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        ) : (
+          <>
+            <EuiSpacer size="xxl" />
+            <EuiTitle size="m">
+              <h2 style={TEXT_ALIGN_CENTER}>{headerComponent}</h2>
+            </EuiTitle>
+            <EuiSpacer size="xxl" />
+            <EuiText textAlign="center" color="subdued" size="s">
+              {bodyComponent}
+            </EuiText>
+            <EuiSpacer size="xxl" />
+            {steps && (
+              <EuiFlexGroup alignItems="center" justifyContent="center">
+                <EuiFlexItem grow={false}>
+                  <EuiSteps steps={steps} data-test-subj={'onboardingSteps'} />
+                </EuiFlexItem>
+              </EuiFlexGroup>
+            )}
+            <EuiFlexGroup alignItems="center" justifyContent="center">
+              <EuiFlexItem grow={false}>
+                <>
+                  {actionButton ? (
+                    actionButton
+                  ) : (
+                    <EuiButton
+                      fill
+                      onClick={onActionClick}
+                      isDisabled={actionDisabled}
+                      data-test-subj="onboardingStartButton"
+                    >
+                      <FormattedMessage
+                        id="xpack.securitySolution.endpoint.policyList.emptyCreateNewButton"
+                        defaultMessage="Click here to get started"
+                      />
+                    </EuiButton>
+                  )}
+                </>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </>
+        )}
+      </div>
+    );
+  }
+);
+
+PolicyEmptyState.displayName = 'PolicyEmptyState';
+EndpointsEmptyState.displayName = 'EndpointsEmptyState';
+ManagementEmptyState.displayName = 'ManagementEmptyState';
+
+export { PolicyEmptyState, EndpointsEmptyState, ManagementEmptyState };
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
index 62a2d9e3205c..4c01b3644cf6 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
@@ -10,6 +10,8 @@ import {
   GetHostPolicyResponse,
 } from '../../../../../common/endpoint/types';
 import { ServerApiError } from '../../../../common/types';
+import { GetPolicyListResponse } from '../../policy/types';
+import { GetPackagesResponse } from '../../../../../../ingest_manager/common';
 
 interface ServerReturnedHostList {
   type: 'serverReturnedHostList';
@@ -41,10 +43,48 @@ interface ServerFailedToReturnHostPolicyResponse {
   payload: ServerApiError;
 }
 
+interface ServerReturnedPoliciesForOnboarding {
+  type: 'serverReturnedPoliciesForOnboarding';
+  payload: {
+    policyItems: GetPolicyListResponse['items'];
+  };
+}
+
+interface ServerFailedToReturnPoliciesForOnboarding {
+  type: 'serverFailedToReturnPoliciesForOnboarding';
+  payload: ServerApiError;
+}
+
+interface UserSelectedEndpointPolicy {
+  type: 'userSelectedEndpointPolicy';
+  payload: {
+    selectedPolicyId: string;
+  };
+}
+
+interface ServerCancelledHostListLoading {
+  type: 'serverCancelledHostListLoading';
+}
+
+interface ServerCancelledPolicyItemsLoading {
+  type: 'serverCancelledPolicyItemsLoading';
+}
+
+interface ServerReturnedEndpointPackageInfo {
+  type: 'serverReturnedEndpointPackageInfo';
+  payload: GetPackagesResponse['response'][0];
+}
+
 export type HostAction =
   | ServerReturnedHostList
   | ServerFailedToReturnHostList
   | ServerReturnedHostDetails
   | ServerFailedToReturnHostDetails
   | ServerReturnedHostPolicyResponse
-  | ServerFailedToReturnHostPolicyResponse;
+  | ServerFailedToReturnHostPolicyResponse
+  | ServerReturnedPoliciesForOnboarding
+  | ServerFailedToReturnPoliciesForOnboarding
+  | UserSelectedEndpointPolicy
+  | ServerCancelledHostListLoading
+  | ServerCancelledPolicyItemsLoading
+  | ServerReturnedEndpointPackageInfo;
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts
index 71452993abf0..f2c205661b32 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts
@@ -46,6 +46,10 @@ describe('HostList store concerns', () => {
         policyResponseLoading: false,
         policyResponseError: undefined,
         location: undefined,
+        policyItems: [],
+        selectedPolicyId: undefined,
+        policyItemsLoading: false,
+        endpointPackageInfo: undefined,
       });
     });
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
index 85667c9f9fc3..ce164318fdad 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
@@ -5,9 +5,20 @@
  */
 
 import { HostResultList } from '../../../../../common/endpoint/types';
+import { GetPolicyListResponse } from '../../policy/types';
 import { ImmutableMiddlewareFactory } from '../../../../common/store';
-import { isOnHostPage, hasSelectedHost, uiQueryParams, listData } from './selectors';
+import {
+  isOnHostPage,
+  hasSelectedHost,
+  uiQueryParams,
+  listData,
+  endpointPackageInfo,
+} from './selectors';
 import { HostState } from '../types';
+import {
+  sendGetEndpointSpecificDatasources,
+  sendGetEndpointSecurityPackage,
+} from '../../policy/store/policy_list/services/ingest';
 
 export const hostMiddlewareFactory: ImmutableMiddlewareFactory<HostState> = (coreStart) => {
   return ({ getState, dispatch }) => (next) => async (action) => {
@@ -18,17 +29,34 @@ export const hostMiddlewareFactory: ImmutableMiddlewareFactory<HostState> = (cor
       isOnHostPage(state) &&
       hasSelectedHost(state) !== true
     ) {
+      if (!endpointPackageInfo(state)) {
+        sendGetEndpointSecurityPackage(coreStart.http)
+          .then((packageInfo) => {
+            dispatch({
+              type: 'serverReturnedEndpointPackageInfo',
+              payload: packageInfo,
+            });
+          })
+          .catch((error) => {
+            // eslint-disable-next-line no-console
+            console.error(error);
+          });
+      }
+
       const { page_index: pageIndex, page_size: pageSize } = uiQueryParams(state);
+      let hostResponse;
+
       try {
-        const response = await coreStart.http.post<HostResultList>('/api/endpoint/metadata', {
+        hostResponse = await coreStart.http.post<HostResultList>('/api/endpoint/metadata', {
           body: JSON.stringify({
             paging_properties: [{ page_index: pageIndex }, { page_size: pageSize }],
           }),
         });
-        response.request_page_index = Number(pageIndex);
+        hostResponse.request_page_index = Number(pageIndex);
+
         dispatch({
           type: 'serverReturnedHostList',
-          payload: response,
+          payload: hostResponse,
         });
       } catch (error) {
         dispatch({
@@ -36,8 +64,45 @@ export const hostMiddlewareFactory: ImmutableMiddlewareFactory<HostState> = (cor
           payload: error,
         });
       }
+
+      // No hosts, so we should check to see if there are policies for onboarding
+      if (hostResponse && hostResponse.hosts.length === 0) {
+        const http = coreStart.http;
+        try {
+          const policyDataResponse: GetPolicyListResponse = await sendGetEndpointSpecificDatasources(
+            http,
+            {
+              query: {
+                perPage: 50, // Since this is an oboarding flow, we'll cap at 50 policies.
+                page: 1,
+              },
+            }
+          );
+
+          dispatch({
+            type: 'serverReturnedPoliciesForOnboarding',
+            payload: {
+              policyItems: policyDataResponse.items,
+            },
+          });
+        } catch (error) {
+          dispatch({
+            type: 'serverFailedToReturnPoliciesForOnboarding',
+            payload: error.body ?? error,
+          });
+          return;
+        }
+      } else {
+        dispatch({
+          type: 'serverCancelledPolicyItemsLoading',
+        });
+      }
     }
     if (action.type === 'userChangedUrl' && hasSelectedHost(state) === true) {
+      dispatch({
+        type: 'serverCancelledPolicyItemsLoading',
+      });
+
       // If user navigated directly to a host details page, load the host list
       if (listData(state).length === 0) {
         const { page_index: pageIndex, page_size: pageSize } = uiQueryParams(state);
@@ -59,6 +124,10 @@ export const hostMiddlewareFactory: ImmutableMiddlewareFactory<HostState> = (cor
           });
           return;
         }
+      } else {
+        dispatch({
+          type: 'serverCancelledHostListLoading',
+        });
       }
 
       // call the host details api
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts
index 23682544ec42..993267cf1a70 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts
@@ -24,8 +24,13 @@ export const initialHostListState: Immutable<HostState> = {
   policyResponseLoading: false,
   policyResponseError: undefined,
   location: undefined,
+  policyItems: [],
+  selectedPolicyId: undefined,
+  policyItemsLoading: false,
+  endpointPackageInfo: undefined,
 };
 
+/* eslint-disable-next-line complexity */
 export const hostListReducer: ImmutableReducer<HostState, AppAction> = (
   state = initialHostListState,
   action
@@ -65,6 +70,18 @@ export const hostListReducer: ImmutableReducer<HostState, AppAction> = (
       detailsError: action.payload,
       detailsLoading: false,
     };
+  } else if (action.type === 'serverReturnedPoliciesForOnboarding') {
+    return {
+      ...state,
+      policyItems: action.payload.policyItems,
+      policyItemsLoading: false,
+    };
+  } else if (action.type === 'serverFailedToReturnPoliciesForOnboarding') {
+    return {
+      ...state,
+      error: action.payload,
+      policyItemsLoading: false,
+    };
   } else if (action.type === 'serverReturnedHostPolicyResponse') {
     return {
       ...state,
@@ -78,6 +95,27 @@ export const hostListReducer: ImmutableReducer<HostState, AppAction> = (
       policyResponseError: action.payload,
       policyResponseLoading: false,
     };
+  } else if (action.type === 'userSelectedEndpointPolicy') {
+    return {
+      ...state,
+      selectedPolicyId: action.payload.selectedPolicyId,
+      policyResponseLoading: false,
+    };
+  } else if (action.type === 'serverCancelledHostListLoading') {
+    return {
+      ...state,
+      loading: false,
+    };
+  } else if (action.type === 'serverCancelledPolicyItemsLoading') {
+    return {
+      ...state,
+      policyItemsLoading: false,
+    };
+  } else if (action.type === 'serverReturnedEndpointPackageInfo') {
+    return {
+      ...state,
+      endpointPackageInfo: action.payload,
+    };
   } else if (action.type === 'userChangedUrl') {
     const newState: Immutable<HostState> = {
       ...state,
@@ -95,6 +133,7 @@ export const hostListReducer: ImmutableReducer<HostState, AppAction> = (
           ...state,
           location: action.payload,
           loading: true,
+          policyItemsLoading: true,
           error: undefined,
           detailsError: undefined,
         };
@@ -122,6 +161,7 @@ export const hostListReducer: ImmutableReducer<HostState, AppAction> = (
           error: undefined,
           detailsError: undefined,
           policyResponseError: undefined,
+          policyItemsLoading: true,
         };
       }
     }
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts
index 20365b3fe100..e75d2129f61a 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts
@@ -37,6 +37,19 @@ export const detailsLoading = (state: Immutable<HostState>): boolean => state.de
 
 export const detailsError = (state: Immutable<HostState>) => state.detailsError;
 
+export const policyItems = (state: Immutable<HostState>) => state.policyItems;
+
+export const policyItemsLoading = (state: Immutable<HostState>) => state.policyItemsLoading;
+
+export const selectedPolicyId = (state: Immutable<HostState>) => state.selectedPolicyId;
+
+export const endpointPackageInfo = (state: Immutable<HostState>) => state.endpointPackageInfo;
+
+export const endpointPackageVersion = createSelector(
+  endpointPackageInfo,
+  (info) => info?.version ?? undefined
+);
+
 /**
  * Returns the full policy response from the endpoint after a user modifies a policy.
  */
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
index 4881342c0657..a5f37a0b49e8 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
@@ -10,8 +10,10 @@ import {
   HostMetadata,
   HostPolicyResponse,
   AppLocation,
+  PolicyData,
 } from '../../../../common/endpoint/types';
 import { ServerApiError } from '../../../common/types';
+import { GetPackagesResponse } from '../../../../../ingest_manager/common';
 
 export interface HostState {
   /** list of host **/
@@ -40,6 +42,14 @@ export interface HostState {
   policyResponseError?: ServerApiError;
   /** current location info */
   location?: Immutable<AppLocation>;
+  /** policies */
+  policyItems: PolicyData[];
+  /** policies are loading */
+  policyItemsLoading: boolean;
+  /** the selected policy ID in the onboarding flow */
+  selectedPolicyId?: string;
+  /** Endpoint package info */
+  endpointPackageInfo?: GetPackagesResponse['response'][0];
 }
 
 /**
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
index 7bc101b89147..9690ac5c1b9b 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
@@ -40,12 +40,60 @@ describe('when on the hosts page', () => {
     expect(timelineFlyout).toBeNull();
   });
 
-  it('should show a table', async () => {
+  it('should show the empty state when there are no hosts or polices', async () => {
     const renderResult = render();
-    const table = await renderResult.findByTestId('hostListTable');
+    // Initially, there are no endpoints or policies, so we prompt to add policies first.
+    const table = await renderResult.findByTestId('emptyPolicyTable');
     expect(table).not.toBeNull();
   });
 
+  describe('when there are policies, but no hosts', () => {
+    beforeEach(() => {
+      reactTestingLibrary.act(() => {
+        const hostListData = mockHostResultList({ total: 0 });
+        coreStart.http.get.mockReturnValue(Promise.resolve(hostListData));
+        const hostAction: AppAction = {
+          type: 'serverReturnedHostList',
+          payload: hostListData,
+        };
+        store.dispatch(hostAction);
+
+        jest.clearAllMocks();
+
+        const policyListData = mockPolicyResultList({ total: 3 });
+        coreStart.http.get.mockReturnValue(Promise.resolve(policyListData));
+        const policyAction: AppAction = {
+          type: 'serverReturnedPoliciesForOnboarding',
+          payload: {
+            policyItems: policyListData.items,
+          },
+        };
+        store.dispatch(policyAction);
+      });
+    });
+    afterEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('should show the no hosts empty state', async () => {
+      const renderResult = render();
+      const emptyEndpointsTable = await renderResult.findByTestId('emptyEndpointsTable');
+      expect(emptyEndpointsTable).not.toBeNull();
+    });
+
+    it('should display the onboarding steps', async () => {
+      const renderResult = render();
+      const onboardingSteps = await renderResult.findByTestId('onboardingSteps');
+      expect(onboardingSteps).not.toBeNull();
+    });
+
+    it('should show policy selection', async () => {
+      const renderResult = render();
+      const onboardingPolicySelect = await renderResult.findByTestId('onboardingPolicySelect');
+      expect(onboardingPolicySelect).not.toBeNull();
+    });
+  });
+
   describe('when there is no selected host in the url', () => {
     it('should not show the flyout', () => {
       const renderResult = render();
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx
index 45a33f76ee0c..3601b8db5ee5 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx
@@ -13,12 +13,13 @@ import {
   EuiLink,
   EuiHealth,
   EuiToolTip,
+  EuiSelectableProps,
 } from '@elastic/eui';
 import { useHistory } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { createStructuredSelector } from 'reselect';
-
+import { useDispatch } from 'react-redux';
 import { HostDetailsFlyout } from './details';
 import * as selectors from '../store/selectors';
 import { useHostSelector } from './hooks';
@@ -32,7 +33,13 @@ import { CreateStructuredSelector } from '../../../../common/store';
 import { Immutable, HostInfo } from '../../../../../common/endpoint/types';
 import { SpyRoute } from '../../../../common/utils/route/spy_routes';
 import { ManagementPageView } from '../../../components/management_page_view';
+import { PolicyEmptyState, EndpointsEmptyState } from '../../../components/management_empty_state';
 import { FormattedDate } from '../../../../common/components/formatted_date';
+import { useNavigateToAppEventHandler } from '../../../../common/hooks/endpoint/use_navigate_to_app_event_handler';
+import {
+  CreateDatasourceRouteState,
+  AgentConfigDetailsDeployAgentAction,
+} from '../../../../../../ingest_manager/public';
 import { SecurityPageName } from '../../../../app/types';
 import {
   getEndpointListPath,
@@ -40,6 +47,7 @@ import {
   getPolicyDetailPath,
 } from '../../../common/routing';
 import { useFormatUrl } from '../../../../common/components/link_to';
+import { HostAction } from '../store/action';
 
 const HostListNavLink = memo<{
   name: string;
@@ -75,9 +83,15 @@ export const HostList = () => {
     listError,
     uiQueryParams: queryParams,
     hasSelectedHost,
+    policyItems,
+    selectedPolicyId,
+    policyItemsLoading,
+    endpointPackageVersion,
   } = useHostSelector(selector);
   const { formatUrl, search } = useFormatUrl(SecurityPageName.management);
 
+  const dispatch = useDispatch<(a: HostAction) => void>();
+
   const paginationSetup = useMemo(() => {
     return {
       pageIndex,
@@ -104,6 +118,67 @@ export const HostList = () => {
     [history, queryParams]
   );
 
+  const handleCreatePolicyClick = useNavigateToAppEventHandler<CreateDatasourceRouteState>(
+    'ingestManager',
+    {
+      path: `#/integrations${
+        endpointPackageVersion ? `/endpoint-${endpointPackageVersion}/add-datasource` : ''
+      }`,
+      state: {
+        onCancelNavigateTo: [
+          'securitySolution:management',
+          { path: getEndpointListPath({ name: 'endpointList' }) },
+        ],
+        onCancelUrl: formatUrl(getEndpointListPath({ name: 'endpointList' })),
+        onSaveNavigateTo: [
+          'securitySolution:management',
+          { path: getEndpointListPath({ name: 'endpointList' }) },
+        ],
+      },
+    }
+  );
+
+  const handleDeployEndpointsClick = useNavigateToAppEventHandler<
+    AgentConfigDetailsDeployAgentAction
+  >('ingestManager', {
+    path: `#/configs/${selectedPolicyId}?openEnrollmentFlyout=true`,
+    state: {
+      onDoneNavigateTo: [
+        'securitySolution:management',
+        { path: getEndpointListPath({ name: 'endpointList' }) },
+      ],
+    },
+  });
+
+  const selectionOptions = useMemo<EuiSelectableProps['options']>(() => {
+    return policyItems.map((item) => {
+      return {
+        key: item.config_id,
+        label: item.name,
+        checked: selectedPolicyId === item.config_id ? 'on' : undefined,
+      };
+    });
+  }, [policyItems, selectedPolicyId]);
+
+  const handleSelectableOnChange = useCallback<(o: EuiSelectableProps['options']) => void>(
+    (changedOptions) => {
+      return changedOptions.some((option) => {
+        if ('checked' in option && option.checked === 'on') {
+          dispatch({
+            type: 'userSelectedEndpointPolicy',
+            payload: {
+              selectedPolicyId: option.key as string,
+            },
+          });
+          return true;
+        } else {
+          return false;
+        }
+      });
+    },
+    [dispatch]
+  );
+
   const columns: Array<EuiBasicTableColumn<Immutable<HostInfo>>> = useMemo(() => {
     const lastActiveColumnName = i18n.translate('xpack.securitySolution.endpointList.lastActive', {
       defaultMessage: 'Last Active',
@@ -252,6 +327,49 @@ export const HostList = () => {
     ];
   }, [formatUrl, queryParams, search]);
 
+  const renderTableOrEmptyState = useMemo(() => {
+    if (!loading && listData && listData.length > 0) {
+      return (
+        <EuiBasicTable
+          data-test-subj="hostListTable"
+          items={[...listData]}
+          columns={columns}
+          error={listError?.message}
+          pagination={paginationSetup}
+          onChange={onTableChange}
+        />
+      );
+    } else if (!policyItemsLoading && policyItems && policyItems.length > 0) {
+      return (
+        <EndpointsEmptyState
+          loading={loading}
+          onActionClick={handleDeployEndpointsClick}
+          actionDisabled={selectedPolicyId === undefined}
+          handleSelectableOnChange={handleSelectableOnChange}
+          selectionOptions={selectionOptions}
+        />
+      );
+    } else {
+      return (
+        <PolicyEmptyState loading={policyItemsLoading} onActionClick={handleCreatePolicyClick} />
+      );
+    }
+  }, [
+    listData,
+    policyItems,
+    columns,
+    loading,
+    paginationSetup,
+    onTableChange,
+    listError?.message,
+    handleCreatePolicyClick,
+    handleDeployEndpointsClick,
+    handleSelectableOnChange,
+    selectedPolicyId,
+    selectionOptions,
+    policyItemsLoading,
+  ]);
+
   return (
     <ManagementPageView
       viewType="list"
@@ -261,23 +379,19 @@ export const HostList = () => {
       })}
     >
       {hasSelectedHost && <HostDetailsFlyout />}
-      <EuiText color="subdued" size="xs" data-test-subj="hostListTableTotal">
-        <FormattedMessage
-          id="xpack.securitySolution.endpointList.totalCount"
-          defaultMessage="{totalItemCount, plural, one {# Host} other {# Hosts}}"
-          values={{ totalItemCount }}
-        />
-      </EuiText>
-      <EuiHorizontalRule margin="xs" />
-      <EuiBasicTable
-        data-test-subj="hostListTable"
-        items={useMemo(() => [...listData], [listData])}
-        columns={columns}
-        loading={loading}
-        error={listError?.message}
-        pagination={paginationSetup}
-        onChange={onTableChange}
-      />
+      {listData && listData.length > 0 && (
+        <>
+          <EuiText color="subdued" size="xs" data-test-subj="hostListTableTotal">
+            <FormattedMessage
+              id="xpack.securitySolution.endpointList.totalCount"
+              defaultMessage="{totalItemCount, plural, one {# Host} other {# Hosts}}"
+              values={{ totalItemCount }}
+            />
+          </EuiText>
+          <EuiHorizontalRule margin="xs" />
+        </>
+      )}
+      {renderTableOrEmptyState}
       <SpyRoute pageName={SecurityPageName.management} />
     </ManagementPageView>
   );
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx
index 26b6ecb540cd..8a760334c53a 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useCallback, useEffect, useMemo, CSSProperties, useState, MouseEvent } from 'react';
+import React, { useCallback, useEffect, useMemo, CSSProperties, useState } from 'react';
 import {
   EuiBasicTable,
   EuiText,
@@ -22,9 +22,6 @@ import {
   EuiCallOut,
   EuiSpacer,
   EuiButton,
-  EuiSteps,
-  EuiTitle,
-  EuiProgress,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -41,6 +38,7 @@ import { Immutable, PolicyData } from '../../../../../common/endpoint/types';
 import { useNavigateByRouterEventHandler } from '../../../../common/hooks/endpoint/use_navigate_by_router_event_handler';
 import { LinkToApp } from '../../../../common/components/endpoint/link_to_app';
 import { ManagementPageView } from '../../../components/management_page_view';
+import { PolicyEmptyState } from '../../../components/management_empty_state';
 import { SpyRoute } from '../../../../common/utils/route/spy_routes';
 import { FormattedDateAndTime } from '../../../../common/components/endpoint/formatted_date_time';
 import { SecurityPageName } from '../../../../app/types';
@@ -65,10 +63,6 @@ const NO_WRAP_TRUNCATE_STYLE: CSSProperties = Object.freeze({
   whiteSpace: 'nowrap',
 });
 
-const TEXT_ALIGN_CENTER: CSSProperties = Object.freeze({
-  textAlign: 'center',
-});
-
 const DangerEuiContextMenuItem = styled(EuiContextMenuItem)`
   color: ${(props) => props.theme.eui.textColors.danger};
 `;
@@ -437,12 +431,7 @@ export const PolicyList = React.memo(() => {
                   hasActions={false}
                 />
               ) : (
-                <EmptyPolicyTable
-                  loading={loading}
-                  onActionClick={handleCreatePolicyClick}
-                  actionDisabled={false}
-                  dataTestSubj="emptyPolicyTable"
-                />
+                <PolicyEmptyState loading={loading} onActionClick={handleCreatePolicyClick} />
               )}
             </>
           );
@@ -462,107 +451,6 @@ export const PolicyList = React.memo(() => {
 
 PolicyList.displayName = 'PolicyList';
 
-const EmptyPolicyTable = React.memo<{
-  loading: boolean;
-  onActionClick: (event: MouseEvent<HTMLAnchorElement | HTMLButtonElement>) => void;
-  actionDisabled: boolean;
-  dataTestSubj: string;
-}>(({ loading, onActionClick, actionDisabled, dataTestSubj }) => {
-  const policySteps = useMemo(
-    () => [
-      {
-        title: i18n.translate('xpack.securitySolution.endpoint.policyList.stepOneTitle', {
-          defaultMessage: 'Head over to Ingest Manager.',
-        }),
-        children: (
-          <EuiText color="subdued" size="xs">
-            <FormattedMessage
-              id="xpack.securitySolution.endpoint.policyList.stepOne"
-              defaultMessage="Here, you’ll add the Elastic Endpoint Security Integration to your Agent Configuration."
-            />
-          </EuiText>
-        ),
-      },
-      {
-        title: i18n.translate('xpack.securitySolution.endpoint.policyList.stepTwoTitle', {
-          defaultMessage: 'We’ll create a recommended security policy for you.',
-        }),
-        children: (
-          <EuiText color="subdued" size="xs">
-            <FormattedMessage
-              id="xpack.securitySolution.endpoint.policyList.stepTwo"
-              defaultMessage="You can edit this policy in the “Policies” tab after you’ve added the Elastic Endpoint integration."
-            />
-          </EuiText>
-        ),
-      },
-      {
-        title: i18n.translate('xpack.securitySolution.endpoint.policyList.stepThreeTitle', {
-          defaultMessage: 'Enroll your agents through Fleet.',
-        }),
-        children: (
-          <EuiText color="subdued" size="xs">
-            <FormattedMessage
-              id="xpack.securitySolution.endpoint.policyList.stepThree"
-              defaultMessage="If you haven’t already, enroll your agents through Fleet using the same agent configuration."
-            />
-          </EuiText>
-        ),
-      },
-    ],
-    []
-  );
-  return (
-    <div data-test-subj={dataTestSubj}>
-      {loading ? (
-        <EuiProgress size="xs" color="accent" className="essentialAnimation" />
-      ) : (
-        <>
-          <EuiSpacer size="xxl" />
-          <EuiTitle size="m">
-            <h2 style={TEXT_ALIGN_CENTER}>
-              <FormattedMessage
-                id="xpack.securitySolution.endpoint.policyList.noPoliciesPrompt"
-                defaultMessage="Looks like you're not using Elastic Endpoint"
-              />
-            </h2>
-          </EuiTitle>
-          <EuiSpacer size="xxl" />
-          <EuiText textAlign="center" color="subdued" size="s">
-            <FormattedMessage
-              id="xpack.securitySolution.endpoint.policyList.noPoliciesInstructions"
-              defaultMessage="Elastic Endpoint Security gives you the power to keep your endpoints safe from attack, as well as unparalleled visibility into any threat in your environment."
-            />
-          </EuiText>
-          <EuiSpacer size="xxl" />
-          <EuiFlexGroup alignItems="center" justifyContent="center">
-            <EuiFlexItem grow={false}>
-              <EuiSteps steps={policySteps} data-test-subj={'onboardingSteps'} />
-            </EuiFlexItem>
-          </EuiFlexGroup>
-          <EuiFlexGroup alignItems="center" justifyContent="center">
-            <EuiFlexItem grow={false}>
-              <EuiButton
-                fill
-                onClick={onActionClick}
-                isDisabled={actionDisabled}
-                data-test-subj="onboardingStartButton"
-              >
-                <FormattedMessage
-                  id="xpack.securitySolution.endpoint.policyList.emptyCreateNewButton"
-                  defaultMessage="Click here to get started"
-                />
-              </EuiButton>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </>
-      )}
-    </div>
-  );
-});
-
-EmptyPolicyTable.displayName = 'EmptyPolicyTable';
-
 const ConfirmDelete = React.memo<{
   hostCount: number;
   isDeleting: boolean;

From 266f853b0bde6169fbe6622aca2146380bb8cbe9 Mon Sep 17 00:00:00 2001
From: Ahmad Bamieh <ahmadbamieh@gmail.com>
Date: Sat, 27 Jun 2020 02:52:26 +0300
Subject: [PATCH 68/78] [Telemetry] Collector Schema (#64942)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .github/CODEOWNERS                            |   6 +
 .telemetryrc.json                             |  25 ++
 package.json                                  |   1 +
 packages/kbn-telemetry-tools/README.md        |  89 +++++++
 packages/kbn-telemetry-tools/babel.config.js  |  23 ++
 packages/kbn-telemetry-tools/package.json     |  22 ++
 .../src/cli/run_telemetry_check.ts            | 109 ++++++++
 .../src/cli/run_telemetry_extract.ts          |  75 ++++++
 packages/kbn-telemetry-tools/src/index.ts     |  21 ++
 .../src/tools/__fixture__/mock_schema.json    |  24 ++
 .../parsed_externally_defined_collector.ts    |  68 +++++
 .../__fixture__/parsed_imported_schema.ts     |  46 ++++
 .../parsed_imported_usage_interface.ts        |  46 ++++
 .../__fixture__/parsed_nested_collector.ts    |  44 ++++
 .../__fixture__/parsed_working_collector.ts   |  69 +++++
 .../extract_collectors.test.ts.snap           | 163 ++++++++++++
 .../__snapshots__/ts_parser.test.ts.snap      |   6 +
 .../tools/check_collector__integrity.test.ts  | 125 +++++++++
 .../src/tools/check_collector_integrity.ts    | 103 ++++++++
 .../src/tools/config.test.ts                  |  40 +++
 .../kbn-telemetry-tools/src/tools/config.ts   |  60 +++++
 .../src/tools/constants.ts                    |  20 ++
 .../src/tools/extract_collectors.test.ts      |  40 +++
 .../src/tools/extract_collectors.ts           |  75 ++++++
 .../src/tools/manage_schema.test.ts           |  39 +++
 .../src/tools/manage_schema.ts                |  86 ++++++
 .../src/tools/serializer.test.ts              | 105 ++++++++
 .../src/tools/serializer.ts                   | 169 ++++++++++++
 .../tasks/check_compatible_types_task.ts      |  43 +++
 .../tasks/check_matching_schemas_task.ts      |  40 +++
 .../src/tools/tasks/error_reporter.ts         |  34 +++
 .../tools/tasks/extract_collectors_task.ts    |  58 ++++
 .../src/tools/tasks/generate_schemas_task.ts  |  35 +++
 .../src/tools/tasks/index.ts                  |  28 ++
 .../src/tools/tasks/parse_configs_task.ts     |  46 ++++
 .../src/tools/tasks/task_context.ts           |  41 +++
 .../src/tools/tasks/write_to_file_task.ts     |  35 +++
 .../src/tools/ts_parser.test.ts               |  94 +++++++
 .../src/tools/ts_parser.ts                    | 210 +++++++++++++++
 .../kbn-telemetry-tools/src/tools/utils.ts    | 238 +++++++++++++++++
 packages/kbn-telemetry-tools/tsconfig.json    |   6 +
 scripts/telemetry_check.js                    |  21 ++
 scripts/telemetry_extract.js                  |  21 ++
 .../telemetry_collectors/.telemetryrc.json    |   7 +
 .../telemetry_collectors/constants.ts         |  53 ++++
 .../externally_defined_collector.ts           |  71 +++++
 .../file_with_no_collector.ts                 |  20 ++
 .../telemetry_collectors/imported_schema.ts   |  41 +++
 .../imported_usage_interface.ts               |  41 +++
 .../telemetry_collectors/nested_collector.ts  |  49 ++++
 .../unmapped_collector.ts                     |  39 +++
 .../telemetry_collectors/working_collector.ts |  81 ++++++
 .../csp_usage_collector/csp_collector.test.ts |  15 +-
 .../lib/csp_usage_collector/csp_collector.ts  |  27 +-
 .../kql_telemetry/usage_collector/fetch.ts    |  10 +-
 .../make_kql_usage_collector.ts               |  12 +-
 .../services/sample_data/usage/collector.ts   |  12 +-
 .../sample_data/usage/collector_fetch.ts      |   2 +-
 .../common/constants.ts                       |  21 --
 .../telemetry_application_usage_collector.ts  |   3 +-
 .../kibana/kibana_usage_collector.ts          |   4 +-
 .../telemetry_management_collector.ts         |   3 +-
 .../telemetry_ui_metric_collector.ts          |   3 +-
 src/plugins/telemetry/common/constants.ts     |   5 -
 .../telemetry/schema/legacy_oss_plugins.json  |  17 ++
 src/plugins/telemetry/schema/oss_plugins.json |  59 +++++
 .../telemetry_plugin_collector.ts             |  10 +-
 src/plugins/usage_collection/README.md        |  67 ++++-
 .../server/collector/collector.ts             |  24 ++
 .../server/collector/collector_set.ts         |   2 +-
 .../server/collector/index.ts                 |   8 +-
 src/plugins/usage_collection/server/index.ts  |   7 +
 .../validation_telemetry_service.ts           |   8 +-
 tasks/config/run.js                           |   6 +
 tasks/jenkins.js                              |   1 +
 x-pack/.telemetryrc.json                      |  14 +
 .../server/usage/actions_usage_collector.ts   |   4 +-
 .../server/usage/alerts_usage_collector.ts    |   4 +-
 x-pack/plugins/canvas/common/lib/constants.ts |   1 -
 .../canvas/server/collectors/collector.ts     |  13 +-
 x-pack/plugins/cloud/common/constants.ts      |   1 -
 .../collectors/cloud_usage_collector.ts       |  12 +-
 .../telemetry/file_upload_usage_collector.ts  |  20 +-
 .../infra/server/usage/usage_collector.ts     |   4 +-
 .../lib/telemetry/ml_usage_collector.ts       |  22 +-
 .../ml/server/lib/telemetry/telemetry.ts      |   2 +-
 x-pack/plugins/reporting/common/constants.ts  |   6 -
 .../server/usage/reporting_usage_collector.ts |  17 +-
 .../rollup/server/collectors/register.ts      |  35 ++-
 x-pack/plugins/spaces/common/constants.ts     |   6 -
 .../spaces_usage_collector.ts                 |  57 +++-
 .../schema/xpack_plugins.json                 | 247 ++++++++++++++++++
 .../server/lib/telemetry/usage_collector.ts   |  24 +-
 .../telemetry/kibana_telemetry_adapter.ts     |  32 ++-
 .../server/lib/adapters/telemetry/types.ts    |   6 +
 95 files changed, 3766 insertions(+), 138 deletions(-)
 create mode 100644 .telemetryrc.json
 create mode 100644 packages/kbn-telemetry-tools/README.md
 create mode 100644 packages/kbn-telemetry-tools/babel.config.js
 create mode 100644 packages/kbn-telemetry-tools/package.json
 create mode 100644 packages/kbn-telemetry-tools/src/cli/run_telemetry_check.ts
 create mode 100644 packages/kbn-telemetry-tools/src/cli/run_telemetry_extract.ts
 create mode 100644 packages/kbn-telemetry-tools/src/index.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/__fixture__/mock_schema.json
 create mode 100644 packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_externally_defined_collector.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_imported_schema.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_imported_usage_interface.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_nested_collector.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_working_collector.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/__snapshots__/extract_collectors.test.ts.snap
 create mode 100644 packages/kbn-telemetry-tools/src/tools/__snapshots__/ts_parser.test.ts.snap
 create mode 100644 packages/kbn-telemetry-tools/src/tools/check_collector__integrity.test.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/check_collector_integrity.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/config.test.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/config.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/constants.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/extract_collectors.test.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/extract_collectors.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/manage_schema.test.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/manage_schema.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/serializer.test.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/serializer.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/tasks/check_compatible_types_task.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/tasks/check_matching_schemas_task.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/tasks/error_reporter.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/tasks/extract_collectors_task.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/tasks/generate_schemas_task.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/tasks/index.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/tasks/parse_configs_task.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/tasks/task_context.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/tasks/write_to_file_task.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/ts_parser.test.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/ts_parser.ts
 create mode 100644 packages/kbn-telemetry-tools/src/tools/utils.ts
 create mode 100644 packages/kbn-telemetry-tools/tsconfig.json
 create mode 100644 scripts/telemetry_check.js
 create mode 100644 scripts/telemetry_extract.js
 create mode 100644 src/fixtures/telemetry_collectors/.telemetryrc.json
 create mode 100644 src/fixtures/telemetry_collectors/constants.ts
 create mode 100644 src/fixtures/telemetry_collectors/externally_defined_collector.ts
 create mode 100644 src/fixtures/telemetry_collectors/file_with_no_collector.ts
 create mode 100644 src/fixtures/telemetry_collectors/imported_schema.ts
 create mode 100644 src/fixtures/telemetry_collectors/imported_usage_interface.ts
 create mode 100644 src/fixtures/telemetry_collectors/nested_collector.ts
 create mode 100644 src/fixtures/telemetry_collectors/unmapped_collector.ts
 create mode 100644 src/fixtures/telemetry_collectors/working_collector.ts
 create mode 100644 src/plugins/telemetry/schema/legacy_oss_plugins.json
 create mode 100644 src/plugins/telemetry/schema/oss_plugins.json
 create mode 100644 x-pack/.telemetryrc.json
 create mode 100644 x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index e6f6e83253c8..47f9942162f7 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -170,6 +170,7 @@
 
 # Kibana Telemetry
 /packages/kbn-analytics/ @elastic/kibana-telemetry
+/packages/kbn-telemetry-tools/ @elastic/kibana-telemetry
 /src/plugins/kibana_usage_collection/ @elastic/kibana-telemetry
 /src/plugins/newsfeed/ @elastic/kibana-telemetry
 /src/plugins/telemetry/ @elastic/kibana-telemetry
@@ -177,6 +178,11 @@
 /src/plugins/telemetry_management_section/ @elastic/kibana-telemetry
 /src/plugins/usage_collection/ @elastic/kibana-telemetry
 /x-pack/plugins/telemetry_collection_xpack/ @elastic/kibana-telemetry
+/.telemetryrc.json @elastic/kibana-telemetry
+/x-pack/.telemetryrc.json @elastic/kibana-telemetry
+src/plugins/telemetry/schema/legacy_oss_plugins.json @elastic/kibana-telemetry
+src/plugins/telemetry/schema/oss_plugins.json @elastic/kibana-telemetry
+x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json @elastic/kibana-telemetry
 
 # Kibana Alerting Services
 /x-pack/plugins/alerts/ @elastic/kibana-alerting-services
diff --git a/.telemetryrc.json b/.telemetryrc.json
new file mode 100644
index 000000000000..30643a104c1c
--- /dev/null
+++ b/.telemetryrc.json
@@ -0,0 +1,25 @@
+[
+  {
+    "output": "src/plugins/telemetry/schema/legacy_oss_plugins.json",
+    "root": "src/legacy/core_plugins/",
+    "exclude": [
+      "src/legacy/core_plugins/testbed",
+      "src/legacy/core_plugins/elasticsearch",
+      "src/legacy/core_plugins/tests_bundle"
+    ]
+  },
+  {
+    "output": "src/plugins/telemetry/schema/oss_plugins.json",
+    "root": "src/plugins/",
+    "exclude": [
+      "src/plugins/kibana_react/",
+      "src/plugins/testbed/",
+      "src/plugins/kibana_utils/",
+      "src/plugins/kibana_usage_collection/server/collectors/kibana/kibana_usage_collector.ts",
+      "src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.ts",
+      "src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.ts",
+      "src/plugins/kibana_usage_collection/server/collectors/ui_metric/telemetry_ui_metric_collector.ts",
+      "src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.ts"
+    ]
+  }
+]
diff --git a/package.json b/package.json
index 10eaef8ed5dc..b1202631a0c0 100644
--- a/package.json
+++ b/package.json
@@ -139,6 +139,7 @@
     "@kbn/babel-preset": "1.0.0",
     "@kbn/config-schema": "1.0.0",
     "@kbn/i18n": "1.0.0",
+    "@kbn/telemetry-tools": "1.0.0",
     "@kbn/interpreter": "1.0.0",
     "@kbn/pm": "1.0.0",
     "@kbn/test-subj-selector": "0.2.1",
diff --git a/packages/kbn-telemetry-tools/README.md b/packages/kbn-telemetry-tools/README.md
new file mode 100644
index 000000000000..ccd092c76a17
--- /dev/null
+++ b/packages/kbn-telemetry-tools/README.md
@@ -0,0 +1,89 @@
+# Telemetry Tools
+
+## Schema extraction tool
+
+### Description
+
+The tool is used to extract telemetry collectors schema from all `*.{ts}` files in provided plugins directories to JSON files. The tool looks for `.telemetryrc.json` files in the root of the project and in the `x-pack` dir for its runtime configurations.
+
+It uses typescript parser to build an AST for each file. The tool is able to validate, extract and match collector schemas.
+
+### Examples and restrictions
+
+**Global restrictions**:
+
+The `id` can be only a string literal, it cannot be a template literals w/o expressions or string-only concatenation expressions or anything else.
+
+```
+export const myCollector = makeUsageCollector<Usage>({
+  type: 'string_literal_only',
+  ...
+});
+```
+
+### Usage
+
+```bash
+node scripts/telemetry_extract.js
+```
+
+This command has no additional flags or arguments. The `.telemetryrc.json` files specify the path to the directory where searching should start, output json files, and files to exclude.
+
+
+### Output
+
+
+The generated JSON files contain an ES mapping for each schema. This mapping is used to verify changes in the collectors and as the basis to map those fields into the external telemetry cluster.
+
+**Example**:
+
+```json
+{
+  "properties": {
+    "cloud": {
+      "properties": {
+        "isCloudEnabled": {
+          "type": "boolean"
+        }
+      }
+    }
+  }
+}
+```
+
+## Schema validation tool
+
+### Description
+
+The tool performs a number of checks on all telemetry collectors and verifies the following:
+
+1. Verifies the collector structure, fields, and returned values are using the appropriate types.
+2. Verifies that the collector `fetch` function Type matches the specified `schema` in the collector.
+3. Verifies that the collector `schema` matches the stored json schema .
+
+### Notes
+
+We don't catch every possible misuse of the collectors, but only the most common and critical ones.
+
+What will not be caught by the validator:
+
+* Mistyped SavedObject/CallCluster return value. Since the hits returned from ES can be typed to anything without any checks. It is advised to add functional tests that grabs the schema json file and checks that the returned usage matches the types exactly. 
+
+* Fields in the schema that are never collected. If you are trying to report a field from ES but that value is never stored in ES, the check will not be able to detect if that field is ever collected in the first palce. It is advised to add unit/functional tests to check that all the fields are being reported as expected.
+
+The tool looks for `.telemetryrc.json` files in the root of the project and in the `x-pack` dir for its runtime configurations.
+
+Currently auto-fixer (`--fix`) can automatically fix the json files with the following errors:
+
+* incompatible schema - this error means that the collector schema was changed but the stored json schema file was not updated.
+
+* unused schemas - this error means that a collector was removed or its `type` renamed, the json schema file contains a schema that does not have a corrisponding collector.
+
+### Usage
+
+```bash
+node scripts/telemetry_check --fix
+```
+
+* `--path` specifies a collector path instead of checking all collectors specified in the `.telemetryrc.json` files. Accepts a `.ts` file. The file must be discoverable by at least one rc file.
+* `--fix` tells the tool to try to fix as many violations as possible. All errors that tool won't be able to fix will be reported.
diff --git a/packages/kbn-telemetry-tools/babel.config.js b/packages/kbn-telemetry-tools/babel.config.js
new file mode 100644
index 000000000000..3b09c7d74ccb
--- /dev/null
+++ b/packages/kbn-telemetry-tools/babel.config.js
@@ -0,0 +1,23 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+module.exports = {
+  presets: ['@kbn/babel-preset/node_preset'],
+  ignore: ['**/*.test.ts', '**/__fixture__/**'],
+};
diff --git a/packages/kbn-telemetry-tools/package.json b/packages/kbn-telemetry-tools/package.json
new file mode 100644
index 000000000000..5593a72ecd96
--- /dev/null
+++ b/packages/kbn-telemetry-tools/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "@kbn/telemetry-tools",
+  "version": "1.0.0",
+  "license": "Apache-2.0",
+  "main": "./target/index.js",
+  "private": true,
+  "scripts": {
+    "build": "babel src --out-dir target --delete-dir-on-start --extensions .ts --source-maps=inline",
+    "kbn:bootstrap": "yarn build",
+    "kbn:watch": "yarn build --watch"
+  },
+  "devDependencies": {
+    "lodash": "npm:@elastic/lodash@3.10.1-kibana4",
+    "@kbn/dev-utils": "1.0.0",
+    "@kbn/utility-types": "1.0.0",
+    "@types/normalize-path": "^3.0.0",
+    "normalize-path": "^3.0.0",
+    "@types/lodash": "^3.10.1",
+    "moment": "^2.24.0",
+    "typescript": "3.9.5"
+  }
+}
diff --git a/packages/kbn-telemetry-tools/src/cli/run_telemetry_check.ts b/packages/kbn-telemetry-tools/src/cli/run_telemetry_check.ts
new file mode 100644
index 000000000000..116c484a5c36
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/cli/run_telemetry_check.ts
@@ -0,0 +1,109 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import Listr from 'listr';
+import chalk from 'chalk';
+import { createFailError, run } from '@kbn/dev-utils';
+
+import {
+  createTaskContext,
+  ErrorReporter,
+  parseConfigsTask,
+  extractCollectorsTask,
+  checkMatchingSchemasTask,
+  generateSchemasTask,
+  checkCompatibleTypesTask,
+  writeToFileTask,
+  TaskContext,
+} from '../tools/tasks';
+
+export function runTelemetryCheck() {
+  run(
+    async ({ flags: { fix = false, path }, log }) => {
+      if (typeof fix !== 'boolean') {
+        throw createFailError(`${chalk.white.bgRed(' TELEMETRY ERROR ')} --fix can't have a value`);
+      }
+
+      if (typeof path === 'boolean') {
+        throw createFailError(`${chalk.white.bgRed(' TELEMETRY ERROR ')} --path require a value`);
+      }
+
+      if (fix && typeof path !== 'undefined') {
+        throw createFailError(
+          `${chalk.white.bgRed(' TELEMETRY ERROR ')} --fix is incompatible with --path flag.`
+        );
+      }
+
+      const list = new Listr([
+        {
+          title: 'Checking .telemetryrc.json files',
+          task: () => new Listr(parseConfigsTask(), { exitOnError: true }),
+        },
+        {
+          title: 'Extracting Collectors',
+          task: (context) => new Listr(extractCollectorsTask(context, path), { exitOnError: true }),
+        },
+        {
+          title: 'Checking Compatible collector.schema with collector.fetch type',
+          task: (context) => new Listr(checkCompatibleTypesTask(context), { exitOnError: true }),
+        },
+        {
+          title: 'Checking Matching collector.schema against stored json files',
+          task: (context) => new Listr(checkMatchingSchemasTask(context), { exitOnError: true }),
+        },
+        {
+          enabled: (_) => fix,
+          skip: ({ roots }: TaskContext) => {
+            return roots.every(({ esMappingDiffs }) => !esMappingDiffs || !esMappingDiffs.length);
+          },
+          title: 'Generating new telemetry mappings',
+          task: (context) => new Listr(generateSchemasTask(context), { exitOnError: true }),
+        },
+        {
+          enabled: (_) => fix,
+          skip: ({ roots }: TaskContext) => {
+            return roots.every(({ esMappingDiffs }) => !esMappingDiffs || !esMappingDiffs.length);
+          },
+          title: 'Updating telemetry mapping files',
+          task: (context) => new Listr(writeToFileTask(context), { exitOnError: true }),
+        },
+      ]);
+
+      try {
+        const context = createTaskContext();
+        await list.run(context);
+      } catch (error) {
+        process.exitCode = 1;
+        if (error instanceof ErrorReporter) {
+          error.errors.forEach((e: string | Error) => log.error(e));
+        } else {
+          log.error('Unhandled exception!');
+          log.error(error);
+        }
+      }
+      process.exit();
+    },
+    {
+      flags: {
+        allowUnexpected: true,
+        guessTypesForUnexpectedFlags: true,
+      },
+    }
+  );
+}
diff --git a/packages/kbn-telemetry-tools/src/cli/run_telemetry_extract.ts b/packages/kbn-telemetry-tools/src/cli/run_telemetry_extract.ts
new file mode 100644
index 000000000000..27a406a4e216
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/cli/run_telemetry_extract.ts
@@ -0,0 +1,75 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import Listr from 'listr';
+import { run } from '@kbn/dev-utils';
+
+import {
+  createTaskContext,
+  ErrorReporter,
+  parseConfigsTask,
+  extractCollectorsTask,
+  generateSchemasTask,
+  writeToFileTask,
+} from '../tools/tasks';
+
+export function runTelemetryExtract() {
+  run(
+    async ({ flags: {}, log }) => {
+      const list = new Listr([
+        {
+          title: 'Parsing .telemetryrc.json files',
+          task: () => new Listr(parseConfigsTask(), { exitOnError: true }),
+        },
+        {
+          title: 'Extracting Telemetry Collectors',
+          task: (context) => new Listr(extractCollectorsTask(context), { exitOnError: true }),
+        },
+        {
+          title: 'Generating Schema files',
+          task: (context) => new Listr(generateSchemasTask(context), { exitOnError: true }),
+        },
+        {
+          title: 'Writing to file',
+          task: (context) => new Listr(writeToFileTask(context), { exitOnError: true }),
+        },
+      ]);
+
+      try {
+        const context = createTaskContext();
+        await list.run(context);
+      } catch (error) {
+        process.exitCode = 1;
+        if (error instanceof ErrorReporter) {
+          error.errors.forEach((e: string | Error) => log.error(e));
+        } else {
+          log.error('Unhandled exception');
+          log.error(error);
+        }
+      }
+      process.exit();
+    },
+    {
+      flags: {
+        allowUnexpected: true,
+        guessTypesForUnexpectedFlags: true,
+      },
+    }
+  );
+}
diff --git a/packages/kbn-telemetry-tools/src/index.ts b/packages/kbn-telemetry-tools/src/index.ts
new file mode 100644
index 000000000000..3a018a9b3002
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/index.ts
@@ -0,0 +1,21 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { runTelemetryCheck } from './cli/run_telemetry_check';
+export { runTelemetryExtract } from './cli/run_telemetry_extract';
diff --git a/packages/kbn-telemetry-tools/src/tools/__fixture__/mock_schema.json b/packages/kbn-telemetry-tools/src/tools/__fixture__/mock_schema.json
new file mode 100644
index 000000000000..885fe0e38dac
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/__fixture__/mock_schema.json
@@ -0,0 +1,24 @@
+{
+  "properties": {
+    "my_working_collector": {
+      "properties": {
+        "flat": {
+          "type": "keyword"
+        },
+        "my_str": {
+          "type": "text"
+        },
+        "my_objects": {
+          "properties": {
+            "total": {
+              "type": "number"
+            },
+            "type": {
+              "type": "boolean"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_externally_defined_collector.ts b/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_externally_defined_collector.ts
new file mode 100644
index 000000000000..fe45f6b7f304
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_externally_defined_collector.ts
@@ -0,0 +1,68 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SyntaxKind } from 'typescript';
+import { ParsedUsageCollection } from '../ts_parser';
+
+export const parsedExternallyDefinedCollector: ParsedUsageCollection[] = [
+  [
+    'src/fixtures/telemetry_collectors/externally_defined_collector.ts',
+    {
+      collectorName: 'from_variable_collector',
+      schema: {
+        value: {
+          locale: {
+            type: 'keyword',
+          },
+        },
+      },
+      fetch: {
+        typeName: 'Usage',
+        typeDescriptor: {
+          locale: {
+            kind: SyntaxKind.StringKeyword,
+            type: 'StringKeyword',
+          },
+        },
+      },
+    },
+  ],
+  [
+    'src/fixtures/telemetry_collectors/externally_defined_collector.ts',
+    {
+      collectorName: 'from_fn_collector',
+      schema: {
+        value: {
+          locale: {
+            type: 'keyword',
+          },
+        },
+      },
+      fetch: {
+        typeName: 'Usage',
+        typeDescriptor: {
+          locale: {
+            kind: SyntaxKind.StringKeyword,
+            type: 'StringKeyword',
+          },
+        },
+      },
+    },
+  ],
+];
diff --git a/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_imported_schema.ts b/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_imported_schema.ts
new file mode 100644
index 000000000000..487025208295
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_imported_schema.ts
@@ -0,0 +1,46 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SyntaxKind } from 'typescript';
+import { ParsedUsageCollection } from '../ts_parser';
+
+export const parsedImportedSchemaCollector: ParsedUsageCollection[] = [
+  [
+    'src/fixtures/telemetry_collectors/imported_schema.ts',
+    {
+      collectorName: 'with_imported_schema',
+      schema: {
+        value: {
+          locale: {
+            type: 'keyword',
+          },
+        },
+      },
+      fetch: {
+        typeName: 'Usage',
+        typeDescriptor: {
+          locale: {
+            kind: SyntaxKind.StringKeyword,
+            type: 'StringKeyword',
+          },
+        },
+      },
+    },
+  ],
+];
diff --git a/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_imported_usage_interface.ts b/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_imported_usage_interface.ts
new file mode 100644
index 000000000000..42ed2140b520
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_imported_usage_interface.ts
@@ -0,0 +1,46 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SyntaxKind } from 'typescript';
+import { ParsedUsageCollection } from '../ts_parser';
+
+export const parsedImportedUsageInterface: ParsedUsageCollection[] = [
+  [
+    'src/fixtures/telemetry_collectors/imported_usage_interface.ts',
+    {
+      collectorName: 'imported_usage_interface_collector',
+      schema: {
+        value: {
+          locale: {
+            type: 'keyword',
+          },
+        },
+      },
+      fetch: {
+        typeName: 'Usage',
+        typeDescriptor: {
+          locale: {
+            kind: SyntaxKind.StringKeyword,
+            type: 'StringKeyword',
+          },
+        },
+      },
+    },
+  ],
+];
diff --git a/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_nested_collector.ts b/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_nested_collector.ts
new file mode 100644
index 000000000000..ed727c15b7c8
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_nested_collector.ts
@@ -0,0 +1,44 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SyntaxKind } from 'typescript';
+import { ParsedUsageCollection } from '../ts_parser';
+
+export const parsedNestedCollector: ParsedUsageCollection = [
+  'src/fixtures/telemetry_collectors/nested_collector.ts',
+  {
+    collectorName: 'my_nested_collector',
+    schema: {
+      value: {
+        locale: {
+          type: 'keyword',
+        },
+      },
+    },
+    fetch: {
+      typeName: 'Usage',
+      typeDescriptor: {
+        locale: {
+          kind: SyntaxKind.StringKeyword,
+          type: 'StringKeyword',
+        },
+      },
+    },
+  },
+];
diff --git a/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_working_collector.ts b/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_working_collector.ts
new file mode 100644
index 000000000000..25e49ea221c9
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/__fixture__/parsed_working_collector.ts
@@ -0,0 +1,69 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SyntaxKind } from 'typescript';
+import { ParsedUsageCollection } from '../ts_parser';
+
+export const parsedWorkingCollector: ParsedUsageCollection = [
+  'src/fixtures/telemetry_collectors/working_collector.ts',
+  {
+    collectorName: 'my_working_collector',
+    schema: {
+      value: {
+        flat: {
+          type: 'keyword',
+        },
+        my_str: {
+          type: 'text',
+        },
+        my_objects: {
+          total: {
+            type: 'number',
+          },
+          type: {
+            type: 'boolean',
+          },
+        },
+      },
+    },
+    fetch: {
+      typeName: 'Usage',
+      typeDescriptor: {
+        flat: {
+          kind: SyntaxKind.StringKeyword,
+          type: 'StringKeyword',
+        },
+        my_str: {
+          kind: SyntaxKind.StringKeyword,
+          type: 'StringKeyword',
+        },
+        my_objects: {
+          total: {
+            kind: SyntaxKind.NumberKeyword,
+            type: 'NumberKeyword',
+          },
+          type: {
+            kind: SyntaxKind.BooleanKeyword,
+            type: 'BooleanKeyword',
+          },
+        },
+      },
+    },
+  },
+];
diff --git a/packages/kbn-telemetry-tools/src/tools/__snapshots__/extract_collectors.test.ts.snap b/packages/kbn-telemetry-tools/src/tools/__snapshots__/extract_collectors.test.ts.snap
new file mode 100644
index 000000000000..44a12dfa9030
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/__snapshots__/extract_collectors.test.ts.snap
@@ -0,0 +1,163 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`extractCollectors extracts collectors given rc file 1`] = `
+Array [
+  Array [
+    "src/fixtures/telemetry_collectors/externally_defined_collector.ts",
+    Object {
+      "collectorName": "from_variable_collector",
+      "fetch": Object {
+        "typeDescriptor": Object {
+          "locale": Object {
+            "kind": 143,
+            "type": "StringKeyword",
+          },
+        },
+        "typeName": "Usage",
+      },
+      "schema": Object {
+        "value": Object {
+          "locale": Object {
+            "type": "keyword",
+          },
+        },
+      },
+    },
+  ],
+  Array [
+    "src/fixtures/telemetry_collectors/externally_defined_collector.ts",
+    Object {
+      "collectorName": "from_fn_collector",
+      "fetch": Object {
+        "typeDescriptor": Object {
+          "locale": Object {
+            "kind": 143,
+            "type": "StringKeyword",
+          },
+        },
+        "typeName": "Usage",
+      },
+      "schema": Object {
+        "value": Object {
+          "locale": Object {
+            "type": "keyword",
+          },
+        },
+      },
+    },
+  ],
+  Array [
+    "src/fixtures/telemetry_collectors/imported_schema.ts",
+    Object {
+      "collectorName": "with_imported_schema",
+      "fetch": Object {
+        "typeDescriptor": Object {
+          "locale": Object {
+            "kind": 143,
+            "type": "StringKeyword",
+          },
+        },
+        "typeName": "Usage",
+      },
+      "schema": Object {
+        "value": Object {
+          "locale": Object {
+            "type": "keyword",
+          },
+        },
+      },
+    },
+  ],
+  Array [
+    "src/fixtures/telemetry_collectors/imported_usage_interface.ts",
+    Object {
+      "collectorName": "imported_usage_interface_collector",
+      "fetch": Object {
+        "typeDescriptor": Object {
+          "locale": Object {
+            "kind": 143,
+            "type": "StringKeyword",
+          },
+        },
+        "typeName": "Usage",
+      },
+      "schema": Object {
+        "value": Object {
+          "locale": Object {
+            "type": "keyword",
+          },
+        },
+      },
+    },
+  ],
+  Array [
+    "src/fixtures/telemetry_collectors/nested_collector.ts",
+    Object {
+      "collectorName": "my_nested_collector",
+      "fetch": Object {
+        "typeDescriptor": Object {
+          "locale": Object {
+            "kind": 143,
+            "type": "StringKeyword",
+          },
+        },
+        "typeName": "Usage",
+      },
+      "schema": Object {
+        "value": Object {
+          "locale": Object {
+            "type": "keyword",
+          },
+        },
+      },
+    },
+  ],
+  Array [
+    "src/fixtures/telemetry_collectors/working_collector.ts",
+    Object {
+      "collectorName": "my_working_collector",
+      "fetch": Object {
+        "typeDescriptor": Object {
+          "flat": Object {
+            "kind": 143,
+            "type": "StringKeyword",
+          },
+          "my_objects": Object {
+            "total": Object {
+              "kind": 140,
+              "type": "NumberKeyword",
+            },
+            "type": Object {
+              "kind": 128,
+              "type": "BooleanKeyword",
+            },
+          },
+          "my_str": Object {
+            "kind": 143,
+            "type": "StringKeyword",
+          },
+        },
+        "typeName": "Usage",
+      },
+      "schema": Object {
+        "value": Object {
+          "flat": Object {
+            "type": "keyword",
+          },
+          "my_objects": Object {
+            "total": Object {
+              "type": "number",
+            },
+            "type": Object {
+              "type": "boolean",
+            },
+          },
+          "my_str": Object {
+            "type": "text",
+          },
+        },
+      },
+    },
+  ],
+]
+`;
diff --git a/packages/kbn-telemetry-tools/src/tools/__snapshots__/ts_parser.test.ts.snap b/packages/kbn-telemetry-tools/src/tools/__snapshots__/ts_parser.test.ts.snap
new file mode 100644
index 000000000000..5b1b3d9d3529
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/__snapshots__/ts_parser.test.ts.snap
@@ -0,0 +1,6 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`parseUsageCollection throws when mapping fields is not defined 1`] = `
+"Error extracting collector in src/fixtures/telemetry_collectors/unmapped_collector.ts
+Error: usageCollector.schema must be defined."
+`;
diff --git a/packages/kbn-telemetry-tools/src/tools/check_collector__integrity.test.ts b/packages/kbn-telemetry-tools/src/tools/check_collector__integrity.test.ts
new file mode 100644
index 000000000000..6083593431d9
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/check_collector__integrity.test.ts
@@ -0,0 +1,125 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as _ from 'lodash';
+import * as ts from 'typescript';
+import { parsedWorkingCollector } from './__fixture__/parsed_working_collector';
+import { checkCompatibleTypeDescriptor, checkMatchingMapping } from './check_collector_integrity';
+import * as path from 'path';
+import { readFile } from 'fs';
+import { promisify } from 'util';
+const read = promisify(readFile);
+
+async function parseJsonFile(relativePath: string) {
+  const schemaPath = path.resolve(__dirname, '__fixture__', relativePath);
+  const fileContent = await read(schemaPath, 'utf8');
+  return JSON.parse(fileContent);
+}
+
+describe('checkMatchingMapping', () => {
+  it('returns no diff on matching parsedCollections and stored mapping', async () => {
+    const mockSchema = await parseJsonFile('mock_schema.json');
+    const diffs = checkMatchingMapping([parsedWorkingCollector], mockSchema);
+    expect(diffs).toEqual({});
+  });
+
+  describe('Collector change', () => {
+    it('returns diff on mismatching parsedCollections and stored mapping', async () => {
+      const mockSchema = await parseJsonFile('mock_schema.json');
+      const malformedParsedCollector = _.cloneDeep(parsedWorkingCollector);
+      const fieldMapping = { type: 'number' };
+      malformedParsedCollector[1].schema.value.flat = fieldMapping;
+
+      const diffs = checkMatchingMapping([malformedParsedCollector], mockSchema);
+      expect(diffs).toEqual({
+        properties: {
+          my_working_collector: {
+            properties: { flat: fieldMapping },
+          },
+        },
+      });
+    });
+
+    it('returns diff on unknown parsedCollections', async () => {
+      const mockSchema = await parseJsonFile('mock_schema.json');
+      const malformedParsedCollector = _.cloneDeep(parsedWorkingCollector);
+      const collectorName = 'New Collector in town!';
+      const collectorMapping = { some_usage: { type: 'number' } };
+      malformedParsedCollector[1].collectorName = collectorName;
+      malformedParsedCollector[1].schema.value = { some_usage: { type: 'number' } };
+
+      const diffs = checkMatchingMapping([malformedParsedCollector], mockSchema);
+      expect(diffs).toEqual({
+        properties: {
+          [collectorName]: {
+            properties: collectorMapping,
+          },
+        },
+      });
+    });
+  });
+});
+
+describe('checkCompatibleTypeDescriptor', () => {
+  it('returns no diff on compatible type descriptor with mapping', () => {
+    const incompatibles = checkCompatibleTypeDescriptor([parsedWorkingCollector]);
+    expect(incompatibles).toHaveLength(0);
+  });
+
+  describe('Interface Change', () => {
+    it('returns diff on incompatible type descriptor with mapping', () => {
+      const malformedParsedCollector = _.cloneDeep(parsedWorkingCollector);
+      malformedParsedCollector[1].fetch.typeDescriptor.flat.kind = ts.SyntaxKind.BooleanKeyword;
+      const incompatibles = checkCompatibleTypeDescriptor([malformedParsedCollector]);
+      expect(incompatibles).toHaveLength(1);
+      const { diff, message } = incompatibles[0];
+      expect(diff).toEqual({ 'flat.kind': 'boolean' });
+      expect(message).toHaveLength(1);
+      expect(message).toEqual([
+        'incompatible Type key (Usage.flat): expected ("string") got ("boolean").',
+      ]);
+    });
+
+    it.todo('returns diff when missing type descriptor');
+  });
+
+  describe('Mapping change', () => {
+    it('returns no diff when mapping change between text and keyword', () => {
+      const malformedParsedCollector = _.cloneDeep(parsedWorkingCollector);
+      malformedParsedCollector[1].schema.value.flat.type = 'text';
+      const incompatibles = checkCompatibleTypeDescriptor([malformedParsedCollector]);
+      expect(incompatibles).toHaveLength(0);
+    });
+
+    it('returns diff on incompatible type descriptor with mapping', () => {
+      const malformedParsedCollector = _.cloneDeep(parsedWorkingCollector);
+      malformedParsedCollector[1].schema.value.flat.type = 'boolean';
+      const incompatibles = checkCompatibleTypeDescriptor([malformedParsedCollector]);
+      expect(incompatibles).toHaveLength(1);
+      const { diff, message } = incompatibles[0];
+      expect(diff).toEqual({ 'flat.kind': 'string' });
+      expect(message).toHaveLength(1);
+      expect(message).toEqual([
+        'incompatible Type key (Usage.flat): expected ("boolean") got ("string").',
+      ]);
+    });
+
+    it.todo('returns diff when missing mapping');
+  });
+});
diff --git a/packages/kbn-telemetry-tools/src/tools/check_collector_integrity.ts b/packages/kbn-telemetry-tools/src/tools/check_collector_integrity.ts
new file mode 100644
index 000000000000..824132b05732
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/check_collector_integrity.ts
@@ -0,0 +1,103 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as _ from 'lodash';
+import { difference, flattenKeys, pickDeep } from './utils';
+import { ParsedUsageCollection } from './ts_parser';
+import { generateMapping, compatibleSchemaTypes } from './manage_schema';
+import { kindToDescriptorName } from './serializer';
+
+export function checkMatchingMapping(
+  UsageCollections: ParsedUsageCollection[],
+  esMapping: any
+): any {
+  const generatedMapping = generateMapping(UsageCollections);
+  return difference(generatedMapping, esMapping);
+}
+
+interface IncompatibleDescriptor {
+  diff: Record<string, number>;
+  collectorPath: string;
+  message: string[];
+}
+export function checkCompatibleTypeDescriptor(
+  usageCollections: ParsedUsageCollection[]
+): IncompatibleDescriptor[] {
+  const results: Array<IncompatibleDescriptor | false> = usageCollections.map(
+    ([collectorPath, collectorDetails]) => {
+      const typeDescriptorTypes = flattenKeys(
+        pickDeep(collectorDetails.fetch.typeDescriptor, 'kind')
+      );
+      const typeDescriptorKinds = _.reduce(
+        typeDescriptorTypes,
+        (acc: any, type: number, key: string) => {
+          try {
+            acc[key] = kindToDescriptorName(type);
+          } catch (err) {
+            throw Error(`Unrecognized type (${key}: ${type}) in ${collectorPath}`);
+          }
+          return acc;
+        },
+        {} as any
+      );
+
+      const schemaTypes = flattenKeys(pickDeep(collectorDetails.schema.value, 'type'));
+      const transformedMappingKinds = _.reduce(
+        schemaTypes,
+        (acc: any, type: string, key: string) => {
+          try {
+            acc[key.replace(/.type$/, '.kind')] = compatibleSchemaTypes(type as any);
+          } catch (err) {
+            throw Error(`Unrecognized type (${key}: ${type}) in ${collectorPath}`);
+          }
+          return acc;
+        },
+        {} as any
+      );
+
+      const diff: any = difference(typeDescriptorKinds, transformedMappingKinds);
+      const diffEntries = Object.entries(diff);
+
+      if (!diffEntries.length) {
+        return false;
+      }
+
+      return {
+        diff,
+        collectorPath,
+        message: diffEntries.map(([key]) => {
+          const interfaceKey = key.replace('.kind', '');
+          try {
+            const expectedDescriptorType = JSON.stringify(transformedMappingKinds[key], null, 2);
+            const actualDescriptorType = JSON.stringify(typeDescriptorKinds[key], null, 2);
+            return `incompatible Type key (${collectorDetails.fetch.typeName}.${interfaceKey}): expected (${expectedDescriptorType}) got (${actualDescriptorType}).`;
+          } catch (err) {
+            throw Error(`Error converting ${key} in ${collectorPath}.\n${err}`);
+          }
+        }),
+      };
+    }
+  );
+
+  return results.filter((entry): entry is IncompatibleDescriptor => entry !== false);
+}
+
+export function checkCollectorIntegrity(UsageCollections: ParsedUsageCollection[], esMapping: any) {
+  return UsageCollections;
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/config.test.ts b/packages/kbn-telemetry-tools/src/tools/config.test.ts
new file mode 100644
index 000000000000..51ca0493cbb5
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/config.test.ts
@@ -0,0 +1,40 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as path from 'path';
+import { parseTelemetryRC } from './config';
+
+describe('parseTelemetryRC', () => {
+  it('throw if config path is not absolute', async () => {
+    const fixtureDir = './__fixture__/';
+    await expect(parseTelemetryRC(fixtureDir)).rejects.toThrowError();
+  });
+
+  it('returns parsed rc file', async () => {
+    const configRoot = path.join(process.cwd(), 'src', 'fixtures', 'telemetry_collectors');
+    const config = await parseTelemetryRC(configRoot);
+    expect(config).toStrictEqual([
+      {
+        root: configRoot,
+        output: configRoot,
+        exclude: [path.resolve(configRoot, './unmapped_collector.ts')],
+      },
+    ]);
+  });
+});
diff --git a/packages/kbn-telemetry-tools/src/tools/config.ts b/packages/kbn-telemetry-tools/src/tools/config.ts
new file mode 100644
index 000000000000..5724b869e8f5
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/config.ts
@@ -0,0 +1,60 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as path from 'path';
+import { readFileAsync } from './utils';
+import { TELEMETRY_RC } from './constants';
+
+export interface TelemetryRC {
+  root: string;
+  output: string;
+  exclude: string[];
+}
+
+export async function readRcFile(rcRoot: string) {
+  if (!path.isAbsolute(rcRoot)) {
+    throw Error(`config root (${rcRoot}) must be an absolute path.`);
+  }
+
+  const rcFile = path.resolve(rcRoot, TELEMETRY_RC);
+  const configString = await readFileAsync(rcFile, 'utf8');
+  return JSON.parse(configString);
+}
+
+export async function parseTelemetryRC(rcRoot: string): Promise<TelemetryRC[]> {
+  const parsedRc = await readRcFile(rcRoot);
+  const configs = Array.isArray(parsedRc) ? parsedRc : [parsedRc];
+  return configs.map(({ root, output, exclude = [] }) => {
+    if (typeof root !== 'string') {
+      throw Error('config.root must be a string.');
+    }
+    if (typeof output !== 'string') {
+      throw Error('config.output must be a string.');
+    }
+    if (!Array.isArray(exclude)) {
+      throw Error('config.exclude must be an array of strings.');
+    }
+
+    return {
+      root: path.join(rcRoot, root),
+      output: path.join(rcRoot, output),
+      exclude: exclude.map((excludedPath) => path.resolve(rcRoot, excludedPath)),
+    };
+  });
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/constants.ts b/packages/kbn-telemetry-tools/src/tools/constants.ts
new file mode 100644
index 000000000000..8635b1a2e252
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/constants.ts
@@ -0,0 +1,20 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export const TELEMETRY_RC = '.telemetryrc.json';
diff --git a/packages/kbn-telemetry-tools/src/tools/extract_collectors.test.ts b/packages/kbn-telemetry-tools/src/tools/extract_collectors.test.ts
new file mode 100644
index 000000000000..1b4ed21a1635
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/extract_collectors.test.ts
@@ -0,0 +1,40 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as ts from 'typescript';
+import * as path from 'path';
+import { extractCollectors, getProgramPaths } from './extract_collectors';
+import { parseTelemetryRC } from './config';
+
+describe('extractCollectors', () => {
+  it('extracts collectors given rc file', async () => {
+    const configRoot = path.join(process.cwd(), 'src', 'fixtures', 'telemetry_collectors');
+    const tsConfig = ts.findConfigFile('./', ts.sys.fileExists, 'tsconfig.json');
+    if (!tsConfig) {
+      throw new Error('Could not find a valid tsconfig.json.');
+    }
+    const configs = await parseTelemetryRC(configRoot);
+    expect(configs).toHaveLength(1);
+    const programPaths = await getProgramPaths(configs[0]);
+
+    const results = [...extractCollectors(programPaths, tsConfig)];
+    expect(results).toHaveLength(6);
+    expect(results).toMatchSnapshot();
+  });
+});
diff --git a/packages/kbn-telemetry-tools/src/tools/extract_collectors.ts b/packages/kbn-telemetry-tools/src/tools/extract_collectors.ts
new file mode 100644
index 000000000000..a638fde02145
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/extract_collectors.ts
@@ -0,0 +1,75 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as ts from 'typescript';
+import * as path from 'path';
+import { parseUsageCollection } from './ts_parser';
+import { globAsync } from './utils';
+import { TelemetryRC } from './config';
+
+export async function getProgramPaths({
+  root,
+  exclude,
+}: Pick<TelemetryRC, 'root' | 'exclude'>): Promise<string[]> {
+  const filePaths = await globAsync('**/*.ts', {
+    cwd: root,
+    ignore: [
+      '**/node_modules/**',
+      '**/*.test.*',
+      '**/*.mock.*',
+      '**/mocks.*',
+      '**/__fixture__/**',
+      '**/__tests__/**',
+      '**/public/**',
+      '**/dist/**',
+      '**/target/**',
+      '**/*.d.ts',
+    ],
+  });
+
+  if (filePaths.length === 0) {
+    throw Error(`No files found in ${root}`);
+  }
+
+  const fullPaths = filePaths
+    .map((filePath) => path.join(root, filePath))
+    .filter((fullPath) => !exclude.some((excludedPath) => fullPath.startsWith(excludedPath)));
+
+  if (fullPaths.length === 0) {
+    throw Error(`No paths covered from ${root} by the .telemetryrc.json`);
+  }
+
+  return fullPaths;
+}
+
+export function* extractCollectors(fullPaths: string[], tsConfig: any) {
+  const program = ts.createProgram(fullPaths, tsConfig);
+  program.getTypeChecker();
+  const sourceFiles = fullPaths.map((fullPath) => {
+    const sourceFile = program.getSourceFile(fullPath);
+    if (!sourceFile) {
+      throw Error(`Unable to get sourceFile ${fullPath}.`);
+    }
+    return sourceFile;
+  });
+
+  for (const sourceFile of sourceFiles) {
+    yield* parseUsageCollection(sourceFile, program);
+  }
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/manage_schema.test.ts b/packages/kbn-telemetry-tools/src/tools/manage_schema.test.ts
new file mode 100644
index 000000000000..8f4bfc66b32a
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/manage_schema.test.ts
@@ -0,0 +1,39 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { generateMapping } from './manage_schema';
+import { parsedWorkingCollector } from './__fixture__/parsed_working_collector';
+import * as path from 'path';
+import { readFile } from 'fs';
+import { promisify } from 'util';
+const read = promisify(readFile);
+
+async function parseJsonFile(relativePath: string) {
+  const schemaPath = path.resolve(__dirname, '__fixture__', relativePath);
+  const fileContent = await read(schemaPath, 'utf8');
+  return JSON.parse(fileContent);
+}
+
+describe('generateMapping', () => {
+  it('generates a mapping file', async () => {
+    const mockSchema = await parseJsonFile('mock_schema.json');
+    const result = generateMapping([parsedWorkingCollector]);
+    expect(result).toEqual(mockSchema);
+  });
+});
diff --git a/packages/kbn-telemetry-tools/src/tools/manage_schema.ts b/packages/kbn-telemetry-tools/src/tools/manage_schema.ts
new file mode 100644
index 000000000000..d422837140d8
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/manage_schema.ts
@@ -0,0 +1,86 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ParsedUsageCollection } from './ts_parser';
+
+export type AllowedSchemaTypes =
+  | 'keyword'
+  | 'text'
+  | 'number'
+  | 'boolean'
+  | 'long'
+  | 'date'
+  | 'float';
+
+export function compatibleSchemaTypes(type: AllowedSchemaTypes) {
+  switch (type) {
+    case 'keyword':
+    case 'text':
+    case 'date':
+      return 'string';
+    case 'boolean':
+      return 'boolean';
+    case 'number':
+    case 'float':
+    case 'long':
+      return 'number';
+    default:
+      throw new Error(`Unknown schema type ${type}`);
+  }
+}
+
+export function isObjectMapping(entity: any) {
+  if (typeof entity === 'object') {
+    // 'type' is explicitly specified to be an object.
+    if (typeof entity.type === 'string' && entity.type === 'object') {
+      return true;
+    }
+
+    // 'type' is not set; ES defaults to object mapping for when type is unspecified.
+    if (typeof entity.type === 'undefined') {
+      return true;
+    }
+
+    // 'type' is a field in the mapping and is not the type of the mapping.
+    if (typeof entity.type === 'object') {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+function transformToEsMapping(usageMappingValue: any) {
+  const fieldMapping: any = { properties: {} };
+  for (const [key, value] of Object.entries(usageMappingValue)) {
+    fieldMapping.properties[key] = isObjectMapping(value) ? transformToEsMapping(value) : value;
+  }
+  return fieldMapping;
+}
+
+export function generateMapping(usageCollections: ParsedUsageCollection[]) {
+  const esMapping: any = { properties: {} };
+  for (const [, collecionDetails] of usageCollections) {
+    esMapping.properties[collecionDetails.collectorName] = transformToEsMapping(
+      collecionDetails.schema.value
+    );
+  }
+
+  return esMapping;
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/serializer.test.ts b/packages/kbn-telemetry-tools/src/tools/serializer.test.ts
new file mode 100644
index 000000000000..9475574a4421
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/serializer.test.ts
@@ -0,0 +1,105 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as ts from 'typescript';
+import * as path from 'path';
+import { getDescriptor, TelemetryKinds } from './serializer';
+import { traverseNodes } from './ts_parser';
+
+export function loadFixtureProgram(fixtureName: string) {
+  const fixturePath = path.resolve(
+    process.cwd(),
+    'src',
+    'fixtures',
+    'telemetry_collectors',
+    `${fixtureName}.ts`
+  );
+  const tsConfig = ts.findConfigFile('./', ts.sys.fileExists, 'tsconfig.json');
+  if (!tsConfig) {
+    throw new Error('Could not find a valid tsconfig.json.');
+  }
+  const program = ts.createProgram([fixturePath], tsConfig as any);
+  const checker = program.getTypeChecker();
+  const sourceFile = program.getSourceFile(fixturePath);
+  if (!sourceFile) {
+    throw Error('sourceFile is undefined!');
+  }
+  return { program, checker, sourceFile };
+}
+
+describe('getDescriptor', () => {
+  const usageInterfaces = new Map<string, ts.InterfaceDeclaration>();
+  let tsProgram: ts.Program;
+  beforeAll(() => {
+    const { program, sourceFile } = loadFixtureProgram('constants');
+    tsProgram = program;
+    for (const node of traverseNodes(sourceFile)) {
+      if (ts.isInterfaceDeclaration(node)) {
+        const interfaceName = node.name.getText();
+        usageInterfaces.set(interfaceName, node);
+      }
+    }
+  });
+
+  it('serializes flat types', () => {
+    const usageInterface = usageInterfaces.get('Usage');
+    const descriptor = getDescriptor(usageInterface!, tsProgram);
+    expect(descriptor).toEqual({
+      locale: { kind: ts.SyntaxKind.StringKeyword, type: 'StringKeyword' },
+    });
+  });
+
+  it('serializes union types', () => {
+    const usageInterface = usageInterfaces.get('WithUnion');
+    const descriptor = getDescriptor(usageInterface!, tsProgram);
+
+    expect(descriptor).toEqual({
+      prop1: { kind: ts.SyntaxKind.StringKeyword, type: 'StringKeyword' },
+      prop2: { kind: ts.SyntaxKind.StringKeyword, type: 'StringKeyword' },
+      prop3: { kind: ts.SyntaxKind.StringKeyword, type: 'StringKeyword' },
+      prop4: { kind: ts.SyntaxKind.StringLiteral, type: 'StringLiteral' },
+      prop5: { kind: ts.SyntaxKind.FirstLiteralToken, type: 'FirstLiteralToken' },
+    });
+  });
+
+  it('serializes Moment Dates', () => {
+    const usageInterface = usageInterfaces.get('WithMoment');
+    const descriptor = getDescriptor(usageInterface!, tsProgram);
+    expect(descriptor).toEqual({
+      prop1: { kind: TelemetryKinds.MomentDate, type: 'MomentDate' },
+      prop2: { kind: TelemetryKinds.MomentDate, type: 'MomentDate' },
+      prop3: { kind: TelemetryKinds.MomentDate, type: 'MomentDate' },
+      prop4: { kind: TelemetryKinds.Date, type: 'Date' },
+    });
+  });
+
+  it('throws error on conflicting union types', () => {
+    const usageInterface = usageInterfaces.get('WithConflictingUnion');
+    expect(() => getDescriptor(usageInterface!, tsProgram)).toThrowError(
+      'Mapping does not support conflicting union types.'
+    );
+  });
+
+  it('throws error on unsupported union types', () => {
+    const usageInterface = usageInterfaces.get('WithUnsupportedUnion');
+    expect(() => getDescriptor(usageInterface!, tsProgram)).toThrowError(
+      'Mapping does not support conflicting union types.'
+    );
+  });
+});
diff --git a/packages/kbn-telemetry-tools/src/tools/serializer.ts b/packages/kbn-telemetry-tools/src/tools/serializer.ts
new file mode 100644
index 000000000000..bce5dd7f5864
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/serializer.ts
@@ -0,0 +1,169 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as ts from 'typescript';
+import { uniq } from 'lodash';
+import {
+  getResolvedModuleSourceFile,
+  getIdentifierDeclarationFromSource,
+  getModuleSpecifier,
+} from './utils';
+
+export enum TelemetryKinds {
+  MomentDate = 1000,
+  Date = 10001,
+}
+
+interface DescriptorValue {
+  kind: ts.SyntaxKind | TelemetryKinds;
+  type: keyof typeof ts.SyntaxKind | keyof typeof TelemetryKinds;
+}
+
+export interface Descriptor {
+  [name: string]: Descriptor | DescriptorValue;
+}
+
+export function isObjectDescriptor(value: any) {
+  if (typeof value === 'object') {
+    if (typeof value.type === 'string' && value.type === 'object') {
+      return true;
+    }
+
+    if (typeof value.type === 'undefined') {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+export function kindToDescriptorName(kind: number) {
+  switch (kind) {
+    case ts.SyntaxKind.StringKeyword:
+    case ts.SyntaxKind.StringLiteral:
+    case ts.SyntaxKind.SetKeyword:
+    case TelemetryKinds.Date:
+    case TelemetryKinds.MomentDate:
+      return 'string';
+    case ts.SyntaxKind.BooleanKeyword:
+      return 'boolean';
+    case ts.SyntaxKind.NumberKeyword:
+    case ts.SyntaxKind.NumericLiteral:
+      return 'number';
+    default:
+      throw new Error(`Unknown kind ${kind}`);
+  }
+}
+
+export function getDescriptor(node: ts.Node, program: ts.Program): Descriptor | DescriptorValue {
+  if (ts.isMethodSignature(node) || ts.isPropertySignature(node)) {
+    if (node.type) {
+      return getDescriptor(node.type, program);
+    }
+  }
+  if (ts.isTypeLiteralNode(node) || ts.isInterfaceDeclaration(node)) {
+    return node.members.reduce((acc, m) => {
+      acc[m.name?.getText() || ''] = getDescriptor(m, program);
+      return acc;
+    }, {} as any);
+  }
+
+  if (ts.SyntaxKind.FirstNode === node.kind) {
+    return getDescriptor((node as any).right, program);
+  }
+
+  if (ts.isIdentifier(node)) {
+    const identifierName = node.getText();
+    if (identifierName === 'Date') {
+      return { kind: TelemetryKinds.Date, type: 'Date' };
+    }
+    if (identifierName === 'Moment') {
+      return { kind: TelemetryKinds.MomentDate, type: 'MomentDate' };
+    }
+    throw new Error(`Unsupported Identifier ${identifierName}.`);
+  }
+
+  if (ts.isTypeReferenceNode(node)) {
+    const typeChecker = program.getTypeChecker();
+    const symbol = typeChecker.getSymbolAtLocation(node.typeName);
+    const symbolName = symbol?.getName();
+    if (symbolName === 'Moment') {
+      return { kind: TelemetryKinds.MomentDate, type: 'MomentDate' };
+    }
+    if (symbolName === 'Date') {
+      return { kind: TelemetryKinds.Date, type: 'Date' };
+    }
+    const declaration = (symbol?.getDeclarations() || [])[0];
+    if (declaration) {
+      return getDescriptor(declaration, program);
+    }
+    return getDescriptor(node.typeName, program);
+  }
+
+  if (ts.isImportSpecifier(node)) {
+    const source = node.getSourceFile();
+    const importedModuleName = getModuleSpecifier(node);
+
+    const declarationSource = getResolvedModuleSourceFile(source, program, importedModuleName);
+    const declarationNode = getIdentifierDeclarationFromSource(node.name, declarationSource);
+    return getDescriptor(declarationNode, program);
+  }
+
+  if (ts.isArrayTypeNode(node)) {
+    return getDescriptor(node.elementType, program);
+  }
+
+  if (ts.isLiteralTypeNode(node)) {
+    return {
+      kind: node.literal.kind,
+      type: ts.SyntaxKind[node.literal.kind] as keyof typeof ts.SyntaxKind,
+    };
+  }
+
+  if (ts.isUnionTypeNode(node)) {
+    const types = node.types.filter((typeNode) => {
+      return (
+        typeNode.kind !== ts.SyntaxKind.NullKeyword &&
+        typeNode.kind !== ts.SyntaxKind.UndefinedKeyword
+      );
+    });
+
+    const kinds = types.map((typeNode) => getDescriptor(typeNode, program));
+
+    const uniqueKinds = uniq(kinds, 'kind');
+
+    if (uniqueKinds.length !== 1) {
+      throw Error('Mapping does not support conflicting union types.');
+    }
+
+    return uniqueKinds[0];
+  }
+
+  switch (node.kind) {
+    case ts.SyntaxKind.NumberKeyword:
+    case ts.SyntaxKind.BooleanKeyword:
+    case ts.SyntaxKind.StringKeyword:
+    case ts.SyntaxKind.SetKeyword:
+      return { kind: node.kind, type: ts.SyntaxKind[node.kind] as keyof typeof ts.SyntaxKind };
+    case ts.SyntaxKind.UnionType:
+    case ts.SyntaxKind.AnyKeyword:
+    default:
+      throw new Error(`Unknown type ${ts.SyntaxKind[node.kind]}; ${node.getText()}`);
+  }
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/tasks/check_compatible_types_task.ts b/packages/kbn-telemetry-tools/src/tools/tasks/check_compatible_types_task.ts
new file mode 100644
index 000000000000..dae4d0f1ad16
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/tasks/check_compatible_types_task.ts
@@ -0,0 +1,43 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { TaskContext } from './task_context';
+import { checkCompatibleTypeDescriptor } from '../check_collector_integrity';
+
+export function checkCompatibleTypesTask({ reporter, roots }: TaskContext) {
+  return roots.map((root) => ({
+    task: async () => {
+      if (root.parsedCollections) {
+        const differences = checkCompatibleTypeDescriptor(root.parsedCollections);
+        const reporterWithContext = reporter.withContext({ name: root.config.root });
+        if (differences.length) {
+          reporterWithContext.report(
+            `${JSON.stringify(
+              differences,
+              null,
+              2
+            )}. \nPlease fix the collectors and run the check again.`
+          );
+          throw reporter;
+        }
+      }
+    },
+    title: `Checking in ${root.config.root}`,
+  }));
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/tasks/check_matching_schemas_task.ts b/packages/kbn-telemetry-tools/src/tools/tasks/check_matching_schemas_task.ts
new file mode 100644
index 000000000000..a1f23bcd44c7
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/tasks/check_matching_schemas_task.ts
@@ -0,0 +1,40 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as path from 'path';
+import { TaskContext } from './task_context';
+import { checkMatchingMapping } from '../check_collector_integrity';
+import { readFileAsync } from '../utils';
+
+export function checkMatchingSchemasTask({ roots }: TaskContext) {
+  return roots.map((root) => ({
+    task: async () => {
+      const fullPath = path.resolve(process.cwd(), root.config.output);
+      const esMappingString = await readFileAsync(fullPath, 'utf-8');
+      const esMapping = JSON.parse(esMappingString);
+
+      if (root.parsedCollections) {
+        const differences = checkMatchingMapping(root.parsedCollections, esMapping);
+
+        root.esMappingDiffs = Object.keys(differences);
+      }
+    },
+    title: `Checking in ${root.config.root}`,
+  }));
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/tasks/error_reporter.ts b/packages/kbn-telemetry-tools/src/tools/tasks/error_reporter.ts
new file mode 100644
index 000000000000..246d65966728
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/tasks/error_reporter.ts
@@ -0,0 +1,34 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import chalk from 'chalk';
+import { normalizePath } from '../utils';
+
+export class ErrorReporter {
+  errors: string[] = [];
+
+  withContext(context: any) {
+    return { report: (error: any) => this.report(error, context) };
+  }
+  report(error: any, context: any) {
+    this.errors.push(
+      `${chalk.white.bgRed(' TELEMETRY ERROR ')} Error in ${normalizePath(context.name)}\n${error}`
+    );
+  }
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/tasks/extract_collectors_task.ts b/packages/kbn-telemetry-tools/src/tools/tasks/extract_collectors_task.ts
new file mode 100644
index 000000000000..834ec71e2203
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/tasks/extract_collectors_task.ts
@@ -0,0 +1,58 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as ts from 'typescript';
+import * as path from 'path';
+import { TaskContext } from './task_context';
+import { extractCollectors, getProgramPaths } from '../extract_collectors';
+
+export function extractCollectorsTask(
+  { roots }: TaskContext,
+  restrictProgramToPath?: string | string[]
+) {
+  return roots.map((root) => ({
+    task: async () => {
+      const tsConfig = ts.findConfigFile('./', ts.sys.fileExists, 'tsconfig.json');
+      if (!tsConfig) {
+        throw new Error('Could not find a valid tsconfig.json.');
+      }
+      const programPaths = await getProgramPaths(root.config);
+
+      if (typeof restrictProgramToPath !== 'undefined') {
+        const restrictProgramToPaths = Array.isArray(restrictProgramToPath)
+          ? restrictProgramToPath
+          : [restrictProgramToPath];
+
+        const fullRestrictedPaths = restrictProgramToPaths.map((collectorPath) =>
+          path.resolve(process.cwd(), collectorPath)
+        );
+        const restrictedProgramPaths = programPaths.filter((programPath) =>
+          fullRestrictedPaths.includes(programPath)
+        );
+        if (restrictedProgramPaths.length) {
+          root.parsedCollections = [...extractCollectors(restrictedProgramPaths, tsConfig)];
+        }
+        return;
+      }
+
+      root.parsedCollections = [...extractCollectors(programPaths, tsConfig)];
+    },
+    title: `Extracting collectors in ${root.config.root}`,
+  }));
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/tasks/generate_schemas_task.ts b/packages/kbn-telemetry-tools/src/tools/tasks/generate_schemas_task.ts
new file mode 100644
index 000000000000..f6d15c7127d4
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/tasks/generate_schemas_task.ts
@@ -0,0 +1,35 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as _ from 'lodash';
+import { TaskContext } from './task_context';
+import { generateMapping } from '../manage_schema';
+
+export function generateSchemasTask({ roots }: TaskContext) {
+  return roots.map((root) => ({
+    task: () => {
+      if (!root.parsedCollections || !root.parsedCollections.length) {
+        return;
+      }
+      const mapping = generateMapping(root.parsedCollections);
+      root.mapping = mapping;
+    },
+    title: `Generating mapping for ${root.config.root}`,
+  }));
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/tasks/index.ts b/packages/kbn-telemetry-tools/src/tools/tasks/index.ts
new file mode 100644
index 000000000000..cbe74aeb483e
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/tasks/index.ts
@@ -0,0 +1,28 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { ErrorReporter } from './error_reporter';
+export { TaskContext, createTaskContext } from './task_context';
+
+export { parseConfigsTask } from './parse_configs_task';
+export { extractCollectorsTask } from './extract_collectors_task';
+export { generateSchemasTask } from './generate_schemas_task';
+export { writeToFileTask } from './write_to_file_task';
+export { checkMatchingSchemasTask } from './check_matching_schemas_task';
+export { checkCompatibleTypesTask } from './check_compatible_types_task';
diff --git a/packages/kbn-telemetry-tools/src/tools/tasks/parse_configs_task.ts b/packages/kbn-telemetry-tools/src/tools/tasks/parse_configs_task.ts
new file mode 100644
index 000000000000..00b319006e2e
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/tasks/parse_configs_task.ts
@@ -0,0 +1,46 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as path from 'path';
+import { parseTelemetryRC } from '../config';
+import { TaskContext } from './task_context';
+
+export function parseConfigsTask() {
+  const kibanaRoot = process.cwd();
+  const xpackRoot = path.join(kibanaRoot, 'x-pack');
+
+  const configRoots = [kibanaRoot, xpackRoot];
+
+  return configRoots.map((configRoot) => ({
+    task: async (context: TaskContext) => {
+      try {
+        const configs = await parseTelemetryRC(configRoot);
+        configs.forEach((config) => {
+          context.roots.push({ config });
+        });
+      } catch (err) {
+        const { reporter } = context;
+        const reporterWithContext = reporter.withContext({ name: configRoot });
+        reporterWithContext.report(err);
+        throw reporter;
+      }
+    },
+    title: `Parsing configs in ${configRoot}`,
+  }));
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/tasks/task_context.ts b/packages/kbn-telemetry-tools/src/tools/tasks/task_context.ts
new file mode 100644
index 000000000000..78d0b7fbd6c2
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/tasks/task_context.ts
@@ -0,0 +1,41 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { TelemetryRC } from '../config';
+import { ErrorReporter } from './error_reporter';
+import { ParsedUsageCollection } from '../ts_parser';
+export interface TelemetryRoot {
+  config: TelemetryRC;
+  parsedCollections?: ParsedUsageCollection[];
+  mapping?: any;
+  esMappingDiffs?: string[];
+}
+
+export interface TaskContext {
+  reporter: ErrorReporter;
+  roots: TelemetryRoot[];
+}
+
+export function createTaskContext(): TaskContext {
+  const reporter = new ErrorReporter();
+  return {
+    roots: [],
+    reporter,
+  };
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/tasks/write_to_file_task.ts b/packages/kbn-telemetry-tools/src/tools/tasks/write_to_file_task.ts
new file mode 100644
index 000000000000..fcfc09db6542
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/tasks/write_to_file_task.ts
@@ -0,0 +1,35 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as path from 'path';
+import { writeFileAsync } from '../utils';
+import { TaskContext } from './task_context';
+
+export function writeToFileTask({ roots }: TaskContext) {
+  return roots.map((root) => ({
+    task: async () => {
+      const fullPath = path.resolve(process.cwd(), root.config.output);
+      if (root.mapping && Object.keys(root.mapping.properties).length > 0) {
+        const serializedMapping = JSON.stringify(root.mapping, null, 2).concat('\n');
+        await writeFileAsync(fullPath, serializedMapping);
+      }
+    },
+    title: `Writing mapping for ${root.config.root}`,
+  }));
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/ts_parser.test.ts b/packages/kbn-telemetry-tools/src/tools/ts_parser.test.ts
new file mode 100644
index 000000000000..b7ca33a7bcd7
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/ts_parser.test.ts
@@ -0,0 +1,94 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { parseUsageCollection } from './ts_parser';
+import * as ts from 'typescript';
+import * as path from 'path';
+import { parsedWorkingCollector } from './__fixture__/parsed_working_collector';
+import { parsedNestedCollector } from './__fixture__/parsed_nested_collector';
+import { parsedExternallyDefinedCollector } from './__fixture__/parsed_externally_defined_collector';
+import { parsedImportedUsageInterface } from './__fixture__/parsed_imported_usage_interface';
+import { parsedImportedSchemaCollector } from './__fixture__/parsed_imported_schema';
+
+export function loadFixtureProgram(fixtureName: string) {
+  const fixturePath = path.resolve(
+    process.cwd(),
+    'src',
+    'fixtures',
+    'telemetry_collectors',
+    `${fixtureName}.ts`
+  );
+  const tsConfig = ts.findConfigFile('./', ts.sys.fileExists, 'tsconfig.json');
+  if (!tsConfig) {
+    throw new Error('Could not find a valid tsconfig.json.');
+  }
+  const program = ts.createProgram([fixturePath], tsConfig as any);
+  const checker = program.getTypeChecker();
+  const sourceFile = program.getSourceFile(fixturePath);
+  if (!sourceFile) {
+    throw Error('sourceFile is undefined!');
+  }
+  return { program, checker, sourceFile };
+}
+
+describe('parseUsageCollection', () => {
+  it.todo('throws when a function is returned from fetch');
+  it.todo('throws when an object is not returned from fetch');
+
+  it('throws when mapping fields is not defined', () => {
+    const { program, sourceFile } = loadFixtureProgram('unmapped_collector');
+    expect(() => [...parseUsageCollection(sourceFile, program)]).toThrowErrorMatchingSnapshot();
+  });
+
+  it('parses root level defined collector', () => {
+    const { program, sourceFile } = loadFixtureProgram('working_collector');
+    const result = [...parseUsageCollection(sourceFile, program)];
+    expect(result).toEqual([parsedWorkingCollector]);
+  });
+
+  it('parses nested collectors', () => {
+    const { program, sourceFile } = loadFixtureProgram('nested_collector');
+    const result = [...parseUsageCollection(sourceFile, program)];
+    expect(result).toEqual([parsedNestedCollector]);
+  });
+
+  it('parses imported schema property', () => {
+    const { program, sourceFile } = loadFixtureProgram('imported_schema');
+    const result = [...parseUsageCollection(sourceFile, program)];
+    expect(result).toEqual(parsedImportedSchemaCollector);
+  });
+
+  it('parses externally defined collectors', () => {
+    const { program, sourceFile } = loadFixtureProgram('externally_defined_collector');
+    const result = [...parseUsageCollection(sourceFile, program)];
+    expect(result).toEqual(parsedExternallyDefinedCollector);
+  });
+
+  it('parses imported Usage interface', () => {
+    const { program, sourceFile } = loadFixtureProgram('imported_usage_interface');
+    const result = [...parseUsageCollection(sourceFile, program)];
+    expect(result).toEqual(parsedImportedUsageInterface);
+  });
+
+  it('skips files that do not define a collector', () => {
+    const { program, sourceFile } = loadFixtureProgram('file_with_no_collector');
+    const result = [...parseUsageCollection(sourceFile, program)];
+    expect(result).toEqual([]);
+  });
+});
diff --git a/packages/kbn-telemetry-tools/src/tools/ts_parser.ts b/packages/kbn-telemetry-tools/src/tools/ts_parser.ts
new file mode 100644
index 000000000000..6af8450f5a2e
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/ts_parser.ts
@@ -0,0 +1,210 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as ts from 'typescript';
+import { createFailError } from '@kbn/dev-utils';
+import * as path from 'path';
+import { getProperty, getPropertyValue } from './utils';
+import { getDescriptor, Descriptor } from './serializer';
+
+export function* traverseNodes(maybeNodes: ts.Node | ts.Node[]): Generator<ts.Node> {
+  const nodes: ts.Node[] = Array.isArray(maybeNodes) ? maybeNodes : [maybeNodes];
+
+  for (const node of nodes) {
+    const children: ts.Node[] = [];
+    yield node;
+    ts.forEachChild(node, (child) => {
+      children.push(child);
+    });
+    for (const child of children) {
+      yield* traverseNodes(child);
+    }
+  }
+}
+
+export function isMakeUsageCollectorFunction(
+  node: ts.Node,
+  sourceFile: ts.SourceFile
+): node is ts.CallExpression {
+  if (ts.isCallExpression(node)) {
+    const isMakeUsageCollector = /makeUsageCollector$/.test(node.expression.getText(sourceFile));
+    if (isMakeUsageCollector) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+export interface CollectorDetails {
+  collectorName: string;
+  fetch: { typeName: string; typeDescriptor: Descriptor };
+  schema: { value: any };
+}
+
+function getCollectionConfigNode(
+  collectorNode: ts.CallExpression,
+  sourceFile: ts.SourceFile
+): ts.Expression {
+  if (collectorNode.arguments.length > 1) {
+    throw Error(`makeUsageCollector does not accept more than one argument.`);
+  }
+  const collectorConfig = collectorNode.arguments[0];
+
+  if (ts.isObjectLiteralExpression(collectorConfig)) {
+    return collectorConfig;
+  }
+
+  const variableDefintionName = collectorConfig.getText();
+  for (const node of traverseNodes(sourceFile)) {
+    if (ts.isVariableDeclaration(node)) {
+      const declarationName = node.name.getText();
+      if (declarationName === variableDefintionName) {
+        if (!node.initializer) {
+          throw Error(`Unable to parse collector configs.`);
+        }
+        if (ts.isObjectLiteralExpression(node.initializer)) {
+          return node.initializer;
+        }
+        if (ts.isCallExpression(node.initializer)) {
+          const functionName = node.initializer.expression.getText(sourceFile);
+          for (const sfNode of traverseNodes(sourceFile)) {
+            if (ts.isFunctionDeclaration(sfNode)) {
+              const fnDeclarationName = sfNode.name?.getText();
+              if (fnDeclarationName === functionName) {
+                const returnStatements: ts.ReturnStatement[] = [];
+                for (const fnNode of traverseNodes(sfNode)) {
+                  if (ts.isReturnStatement(fnNode) && fnNode.parent === sfNode.body) {
+                    returnStatements.push(fnNode);
+                  }
+                }
+
+                if (returnStatements.length > 1) {
+                  throw Error(`Collector function cannot have multiple return statements.`);
+                }
+                if (returnStatements.length === 0) {
+                  throw Error(`Collector function must have a return statement.`);
+                }
+                if (!returnStatements[0].expression) {
+                  throw Error(`Collector function return statement must be an expression.`);
+                }
+
+                return returnStatements[0].expression;
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  throw Error(`makeUsageCollector argument must be an object.`);
+}
+
+function extractCollectorDetails(
+  collectorNode: ts.CallExpression,
+  program: ts.Program,
+  sourceFile: ts.SourceFile
+): CollectorDetails {
+  if (collectorNode.arguments.length > 1) {
+    throw Error(`makeUsageCollector does not accept more than one argument.`);
+  }
+
+  const collectorConfig = getCollectionConfigNode(collectorNode, sourceFile);
+
+  const typeProperty = getProperty(collectorConfig, 'type');
+  if (!typeProperty) {
+    throw Error(`usageCollector.type must be defined.`);
+  }
+  const typePropertyValue = getPropertyValue(typeProperty, program);
+  if (!typePropertyValue || typeof typePropertyValue !== 'string') {
+    throw Error(`usageCollector.type must be be a non-empty string literal.`);
+  }
+
+  const fetchProperty = getProperty(collectorConfig, 'fetch');
+  if (!fetchProperty) {
+    throw Error(`usageCollector.fetch must be defined.`);
+  }
+  const schemaProperty = getProperty(collectorConfig, 'schema');
+  if (!schemaProperty) {
+    throw Error(`usageCollector.schema must be defined.`);
+  }
+
+  const schemaPropertyValue = getPropertyValue(schemaProperty, program, { chaseImport: true });
+  if (!schemaPropertyValue || typeof schemaPropertyValue !== 'object') {
+    throw Error(`usageCollector.schema must be be an object.`);
+  }
+
+  const collectorNodeType = collectorNode.typeArguments;
+  if (!collectorNodeType || collectorNodeType?.length === 0) {
+    throw Error(`makeUsageCollector requires a Usage type makeUsageCollector<Usage>({ ... }).`);
+  }
+
+  const usageTypeNode = collectorNodeType[0];
+  const usageTypeName = usageTypeNode.getText();
+  const usageType = getDescriptor(usageTypeNode, program) as Descriptor;
+
+  return {
+    collectorName: typePropertyValue,
+    schema: {
+      value: schemaPropertyValue,
+    },
+    fetch: {
+      typeName: usageTypeName,
+      typeDescriptor: usageType,
+    },
+  };
+}
+
+export function sourceHasUsageCollector(sourceFile: ts.SourceFile) {
+  if (sourceFile.isDeclarationFile === true || (sourceFile as any).identifierCount === 0) {
+    return false;
+  }
+
+  const identifiers = (sourceFile as any).identifiers;
+  if (
+    (!identifiers.get('makeUsageCollector') && !identifiers.get('type')) ||
+    !identifiers.get('fetch')
+  ) {
+    return false;
+  }
+
+  return true;
+}
+
+export type ParsedUsageCollection = [string, CollectorDetails];
+
+export function* parseUsageCollection(
+  sourceFile: ts.SourceFile,
+  program: ts.Program
+): Generator<ParsedUsageCollection> {
+  const relativePath = path.relative(process.cwd(), sourceFile.fileName);
+  if (sourceHasUsageCollector(sourceFile)) {
+    for (const node of traverseNodes(sourceFile)) {
+      if (isMakeUsageCollectorFunction(node, sourceFile)) {
+        try {
+          const collectorDetails = extractCollectorDetails(node, program, sourceFile);
+          yield [relativePath, collectorDetails];
+        } catch (err) {
+          throw createFailError(`Error extracting collector in ${relativePath}\n${err}`);
+        }
+      }
+    }
+  }
+}
diff --git a/packages/kbn-telemetry-tools/src/tools/utils.ts b/packages/kbn-telemetry-tools/src/tools/utils.ts
new file mode 100644
index 000000000000..f5cf74ae35e4
--- /dev/null
+++ b/packages/kbn-telemetry-tools/src/tools/utils.ts
@@ -0,0 +1,238 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as ts from 'typescript';
+import * as _ from 'lodash';
+import * as path from 'path';
+import glob from 'glob';
+import { readFile, writeFile } from 'fs';
+import { promisify } from 'util';
+import normalize from 'normalize-path';
+import { Optional } from '@kbn/utility-types';
+
+export const readFileAsync = promisify(readFile);
+export const writeFileAsync = promisify(writeFile);
+export const globAsync = promisify(glob);
+
+export function isPropertyWithKey(property: ts.Node, identifierName: string) {
+  if (ts.isPropertyAssignment(property) || ts.isMethodDeclaration(property)) {
+    if (ts.isIdentifier(property.name)) {
+      return property.name.text === identifierName;
+    }
+  }
+
+  return false;
+}
+
+export function getProperty(objectNode: any, propertyName: string): ts.Node | null {
+  let foundProperty = null;
+  ts.visitNodes(objectNode?.properties || [], (node) => {
+    if (isPropertyWithKey(node, propertyName)) {
+      foundProperty = node;
+      return node;
+    }
+  });
+
+  return foundProperty;
+}
+
+export function getModuleSpecifier(node: ts.Node): string {
+  if ((node as any).moduleSpecifier) {
+    return (node as any).moduleSpecifier.text;
+  }
+  return getModuleSpecifier(node.parent);
+}
+
+export function getIdentifierDeclarationFromSource(node: ts.Node, source: ts.SourceFile) {
+  if (!ts.isIdentifier(node)) {
+    throw new Error(`node is not an identifier ${node.getText()}`);
+  }
+
+  const identifierName = node.getText();
+  const identifierDefinition: ts.Node = (source as any).locals.get(identifierName);
+  if (!identifierDefinition) {
+    throw new Error(`Unable to fine identifier in source ${identifierName}`);
+  }
+  const declarations = (identifierDefinition as any).declarations as ts.Node[];
+
+  const latestDeclaration: ts.Node | false | undefined =
+    Array.isArray(declarations) && declarations[declarations.length - 1];
+  if (!latestDeclaration) {
+    throw new Error(`Unable to fine declaration for identifier ${identifierName}`);
+  }
+
+  return latestDeclaration;
+}
+
+export function getIdentifierDeclaration(node: ts.Node) {
+  const source = node.getSourceFile();
+  if (!source) {
+    throw new Error('Unable to get source from node; check program configs.');
+  }
+
+  return getIdentifierDeclarationFromSource(node, source);
+}
+
+export function getVariableValue(node: ts.Node): string | Record<string, any> {
+  if (ts.isStringLiteral(node) || ts.isNumericLiteral(node)) {
+    return node.text;
+  }
+
+  if (ts.isObjectLiteralExpression(node)) {
+    return serializeObject(node);
+  }
+
+  throw Error(`Unsuppored Node: cannot get value of node (${node.getText()}) of kind ${node.kind}`);
+}
+
+export function serializeObject(node: ts.Node) {
+  if (!ts.isObjectLiteralExpression(node)) {
+    throw new Error(`Expecting Object literal Expression got ${node.getText()}`);
+  }
+
+  const value: Record<string, any> = {};
+  for (const property of node.properties) {
+    const propertyName = property.name?.getText();
+    if (typeof propertyName === 'undefined') {
+      throw new Error(`Unable to get property name ${property.getText()}`);
+    }
+    if (ts.isPropertyAssignment(property)) {
+      value[propertyName] = getVariableValue(property.initializer);
+    } else {
+      value[propertyName] = getVariableValue(property);
+    }
+  }
+
+  return value;
+}
+
+export function getResolvedModuleSourceFile(
+  originalSource: ts.SourceFile,
+  program: ts.Program,
+  importedModuleName: string
+) {
+  const resolvedModule = (originalSource as any).resolvedModules.get(importedModuleName);
+  const resolvedModuleSourceFile = program.getSourceFile(resolvedModule.resolvedFileName);
+  if (!resolvedModuleSourceFile) {
+    throw new Error(`Unable to find resolved module ${importedModuleName}`);
+  }
+  return resolvedModuleSourceFile;
+}
+
+export function getPropertyValue(
+  node: ts.Node,
+  program: ts.Program,
+  config: Optional<{ chaseImport: boolean }> = {}
+) {
+  const { chaseImport = false } = config;
+
+  if (ts.isPropertyAssignment(node)) {
+    const { initializer } = node;
+
+    if (ts.isIdentifier(initializer)) {
+      const identifierName = initializer.getText();
+      const declaration = getIdentifierDeclaration(initializer);
+      if (ts.isImportSpecifier(declaration)) {
+        if (!chaseImport) {
+          throw new Error(
+            `Value of node ${identifierName} is imported from another file. Chasing imports is not allowed.`
+          );
+        }
+
+        const importedModuleName = getModuleSpecifier(declaration);
+
+        const source = node.getSourceFile();
+        const declarationSource = getResolvedModuleSourceFile(source, program, importedModuleName);
+        const declarationNode = getIdentifierDeclarationFromSource(initializer, declarationSource);
+        if (!ts.isVariableDeclaration(declarationNode)) {
+          throw new Error(`Expected ${identifierName} to be variable declaration.`);
+        }
+        if (!declarationNode.initializer) {
+          throw new Error(`Expected ${identifierName} to be initialized.`);
+        }
+        const serializedObject = serializeObject(declarationNode.initializer);
+        return serializedObject;
+      }
+
+      return getVariableValue(declaration);
+    }
+
+    return getVariableValue(initializer);
+  }
+}
+
+export function pickDeep(collection: any, identity: any, thisArg?: any) {
+  const picked: any = _.pick(collection, identity, thisArg);
+  const collections = _.pick(collection, _.isObject, thisArg);
+
+  _.each(collections, function (item, key) {
+    let object;
+    if (_.isArray(item)) {
+      object = _.reduce(
+        item,
+        function (result, value) {
+          const pickedDeep = pickDeep(value, identity, thisArg);
+          if (!_.isEmpty(pickedDeep)) {
+            result.push(pickedDeep);
+          }
+          return result;
+        },
+        [] as any[]
+      );
+    } else {
+      object = pickDeep(item, identity, thisArg);
+    }
+
+    if (!_.isEmpty(object)) {
+      picked[key || ''] = object;
+    }
+  });
+
+  return picked;
+}
+
+export const flattenKeys = (obj: any, keyPath: any[] = []): any => {
+  if (_.isObject(obj)) {
+    return _.reduce(
+      obj,
+      (cum, next, key) => {
+        const keys = [...keyPath, key];
+        return _.merge(cum, flattenKeys(next, keys));
+      },
+      {}
+    );
+  }
+  return { [keyPath.join('.')]: obj };
+};
+
+export function difference(actual: any, expected: any) {
+  function changes(obj: any, base: any) {
+    return _.transform(obj, function (result, value, key) {
+      if (key && !_.isEqual(value, base[key])) {
+        result[key] =
+          _.isObject(value) && _.isObject(base[key]) ? changes(value, base[key]) : value;
+      }
+    });
+  }
+  return changes(actual, expected);
+}
+
+export function normalizePath(inputPath: string) {
+  return normalize(path.relative('.', inputPath));
+}
diff --git a/packages/kbn-telemetry-tools/tsconfig.json b/packages/kbn-telemetry-tools/tsconfig.json
new file mode 100644
index 000000000000..13ce8ef2bad6
--- /dev/null
+++ b/packages/kbn-telemetry-tools/tsconfig.json
@@ -0,0 +1,6 @@
+{
+  "extends": "../../tsconfig.json",
+  "include": [
+    "src/**/*",
+  ]
+}
diff --git a/scripts/telemetry_check.js b/scripts/telemetry_check.js
new file mode 100644
index 000000000000..06b3ed46bdba
--- /dev/null
+++ b/scripts/telemetry_check.js
@@ -0,0 +1,21 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+require('../src/setup_node_env/prebuilt_dev_only_entry');
+require('@kbn/telemetry-tools').runTelemetryCheck();
diff --git a/scripts/telemetry_extract.js b/scripts/telemetry_extract.js
new file mode 100644
index 000000000000..051bee26537b
--- /dev/null
+++ b/scripts/telemetry_extract.js
@@ -0,0 +1,21 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+require('../src/setup_node_env/prebuilt_dev_only_entry');
+require('@kbn/telemetry-tools').runTelemetryExtract();
diff --git a/src/fixtures/telemetry_collectors/.telemetryrc.json b/src/fixtures/telemetry_collectors/.telemetryrc.json
new file mode 100644
index 000000000000..31203149c9b5
--- /dev/null
+++ b/src/fixtures/telemetry_collectors/.telemetryrc.json
@@ -0,0 +1,7 @@
+{
+  "root": ".",
+  "output": ".",
+  "exclude": [
+    "./unmapped_collector.ts"
+  ]
+}
diff --git a/src/fixtures/telemetry_collectors/constants.ts b/src/fixtures/telemetry_collectors/constants.ts
new file mode 100644
index 000000000000..4aac9e66cdbd
--- /dev/null
+++ b/src/fixtures/telemetry_collectors/constants.ts
@@ -0,0 +1,53 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import moment, { Moment } from 'moment';
+import { MakeSchemaFrom } from '../../plugins/usage_collection/server';
+
+export interface Usage {
+  locale: string;
+}
+
+export interface WithUnion {
+  prop1: string | null;
+  prop2: string | null | undefined;
+  prop3?: string | null;
+  prop4: 'opt1' | 'opt2';
+  prop5: 123 | 431;
+}
+
+export interface WithMoment {
+  prop1: Moment;
+  prop2: moment.Moment;
+  prop3: Moment[];
+  prop4: Date[];
+}
+
+export interface WithConflictingUnion {
+  prop1: 123 | 'str';
+}
+
+export interface WithUnsupportedUnion {
+  prop1: 123 | Moment;
+}
+
+export const externallyDefinedSchema: MakeSchemaFrom<{ locale: string }> = {
+  locale: {
+    type: 'keyword',
+  },
+};
diff --git a/src/fixtures/telemetry_collectors/externally_defined_collector.ts b/src/fixtures/telemetry_collectors/externally_defined_collector.ts
new file mode 100644
index 000000000000..00a8d643e27b
--- /dev/null
+++ b/src/fixtures/telemetry_collectors/externally_defined_collector.ts
@@ -0,0 +1,71 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { CollectorSet, CollectorOptions } from '../../plugins/usage_collection/server/collector';
+import { loggerMock } from '../../core/server/logging/logger.mock';
+
+const collectorSet = new CollectorSet({
+  logger: loggerMock.create(),
+  maximumWaitTimeForAllCollectorsInS: 0,
+});
+
+interface Usage {
+  locale: string;
+}
+
+function createCollector(): CollectorOptions<Usage> {
+  return {
+    type: 'from_fn_collector',
+    isReady: () => true,
+    fetch(): Usage {
+      return {
+        locale: 'en',
+      };
+    },
+    schema: {
+      locale: {
+        type: 'keyword',
+      },
+    },
+  };
+}
+
+export function defineCollectorFromVariable() {
+  const fromVarCollector: CollectorOptions<Usage> = {
+    type: 'from_variable_collector',
+    isReady: () => true,
+    fetch(): Usage {
+      return {
+        locale: 'en',
+      };
+    },
+    schema: {
+      locale: {
+        type: 'keyword',
+      },
+    },
+  };
+
+  collectorSet.makeUsageCollector<Usage>(fromVarCollector);
+}
+
+export function defineCollectorFromFn() {
+  const fromFnCollector = createCollector();
+
+  collectorSet.makeUsageCollector<Usage>(fromFnCollector);
+}
diff --git a/src/fixtures/telemetry_collectors/file_with_no_collector.ts b/src/fixtures/telemetry_collectors/file_with_no_collector.ts
new file mode 100644
index 000000000000..2e1870e48626
--- /dev/null
+++ b/src/fixtures/telemetry_collectors/file_with_no_collector.ts
@@ -0,0 +1,20 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export const SOME_CONST: number = 123;
diff --git a/src/fixtures/telemetry_collectors/imported_schema.ts b/src/fixtures/telemetry_collectors/imported_schema.ts
new file mode 100644
index 000000000000..66d04700642d
--- /dev/null
+++ b/src/fixtures/telemetry_collectors/imported_schema.ts
@@ -0,0 +1,41 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { CollectorSet } from '../../plugins/usage_collection/server/collector';
+import { loggerMock } from '../../core/server/logging/logger.mock';
+import { externallyDefinedSchema } from './constants';
+
+const { makeUsageCollector } = new CollectorSet({
+  logger: loggerMock.create(),
+  maximumWaitTimeForAllCollectorsInS: 0,
+});
+
+interface Usage {
+  locale?: string;
+}
+
+export const myCollector = makeUsageCollector<Usage>({
+  type: 'with_imported_schema',
+  isReady: () => true,
+  schema: externallyDefinedSchema,
+  fetch(): Usage {
+    return {
+      locale: 'en',
+    };
+  },
+});
diff --git a/src/fixtures/telemetry_collectors/imported_usage_interface.ts b/src/fixtures/telemetry_collectors/imported_usage_interface.ts
new file mode 100644
index 000000000000..a4a0f4ae1b3c
--- /dev/null
+++ b/src/fixtures/telemetry_collectors/imported_usage_interface.ts
@@ -0,0 +1,41 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { CollectorSet } from '../../plugins/usage_collection/server/collector';
+import { loggerMock } from '../../core/server/logging/logger.mock';
+import { Usage } from './constants';
+
+const { makeUsageCollector } = new CollectorSet({
+  logger: loggerMock.create(),
+  maximumWaitTimeForAllCollectorsInS: 0,
+});
+
+export const myCollector = makeUsageCollector<Usage>({
+  type: 'imported_usage_interface_collector',
+  isReady: () => true,
+  fetch() {
+    return {
+      locale: 'en',
+    };
+  },
+  schema: {
+    locale: {
+      type: 'keyword',
+    },
+  },
+});
diff --git a/src/fixtures/telemetry_collectors/nested_collector.ts b/src/fixtures/telemetry_collectors/nested_collector.ts
new file mode 100644
index 000000000000..bde89fe4a706
--- /dev/null
+++ b/src/fixtures/telemetry_collectors/nested_collector.ts
@@ -0,0 +1,49 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { CollectorSet, UsageCollector } from '../../plugins/usage_collection/server/collector';
+import { loggerMock } from '../../core/server/logging/logger.mock';
+
+const collectorSet = new CollectorSet({
+  logger: loggerMock.create(),
+  maximumWaitTimeForAllCollectorsInS: 0,
+});
+
+interface Usage {
+  locale?: string;
+}
+
+export class NestedInside {
+  collector?: UsageCollector<Usage, Usage>;
+  createMyCollector() {
+    this.collector = collectorSet.makeUsageCollector<Usage>({
+      type: 'my_nested_collector',
+      isReady: () => true,
+      fetch: async () => {
+        return {
+          locale: 'en',
+        };
+      },
+      schema: {
+        locale: {
+          type: 'keyword',
+        },
+      },
+    });
+  }
+}
diff --git a/src/fixtures/telemetry_collectors/unmapped_collector.ts b/src/fixtures/telemetry_collectors/unmapped_collector.ts
new file mode 100644
index 000000000000..1ea360fcd9e9
--- /dev/null
+++ b/src/fixtures/telemetry_collectors/unmapped_collector.ts
@@ -0,0 +1,39 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { CollectorSet } from '../../plugins/usage_collection/server/collector';
+import { loggerMock } from '../../core/server/logging/logger.mock';
+
+const { makeUsageCollector } = new CollectorSet({
+  logger: loggerMock.create(),
+  maximumWaitTimeForAllCollectorsInS: 0,
+});
+
+interface Usage {
+  locale: string;
+}
+
+export const myCollector = makeUsageCollector<Usage>({
+  type: 'unmapped_collector',
+  isReady: () => true,
+  fetch(): Usage {
+    return {
+      locale: 'en',
+    };
+  },
+});
diff --git a/src/fixtures/telemetry_collectors/working_collector.ts b/src/fixtures/telemetry_collectors/working_collector.ts
new file mode 100644
index 000000000000..d70a247c61e7
--- /dev/null
+++ b/src/fixtures/telemetry_collectors/working_collector.ts
@@ -0,0 +1,81 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { CollectorSet } from '../../plugins/usage_collection/server/collector';
+import { loggerMock } from '../../core/server/logging/logger.mock';
+
+const { makeUsageCollector } = new CollectorSet({
+  logger: loggerMock.create(),
+  maximumWaitTimeForAllCollectorsInS: 0,
+});
+
+interface MyObject {
+  total: number;
+  type: boolean;
+}
+
+interface Usage {
+  flat?: string;
+  my_str?: string;
+  my_objects: MyObject;
+}
+
+const SOME_NUMBER: number = 123;
+
+export const myCollector = makeUsageCollector<Usage>({
+  type: 'my_working_collector',
+  isReady: () => true,
+  fetch() {
+    const testString = '123';
+    // query ES and get some data
+
+    // summarize the data into a model
+    // return the modeled object that includes whatever you want to track
+    try {
+      return {
+        flat: 'hello',
+        my_str: testString,
+        my_objects: {
+          total: SOME_NUMBER,
+          type: true,
+        },
+      };
+    } catch (err) {
+      return {
+        my_objects: {
+          total: 0,
+          type: true,
+        },
+      };
+    }
+  },
+  schema: {
+    flat: {
+      type: 'keyword',
+    },
+    my_str: {
+      type: 'text',
+    },
+    my_objects: {
+      total: {
+        type: 'number',
+      },
+      type: { type: 'boolean' },
+    },
+  },
+});
diff --git a/src/legacy/core_plugins/kibana/server/lib/csp_usage_collector/csp_collector.test.ts b/src/legacy/core_plugins/kibana/server/lib/csp_usage_collector/csp_collector.test.ts
index 395cb6058783..63c2cbec21b5 100644
--- a/src/legacy/core_plugins/kibana/server/lib/csp_usage_collector/csp_collector.test.ts
+++ b/src/legacy/core_plugins/kibana/server/lib/csp_usage_collector/csp_collector.test.ts
@@ -34,6 +34,7 @@ const createMockKbnServer = () => ({
 
 describe('csp collector', () => {
   let kbnServer: ReturnType<typeof createMockKbnServer>;
+  const mockCallCluster = null as any;
 
   function updateCsp(config: Partial<ICspConfig>) {
     kbnServer.newPlatform.setup.core.http.csp = new CspConfig(config);
@@ -46,28 +47,28 @@ describe('csp collector', () => {
   test('fetches whether strict mode is enabled', async () => {
     const collector = createCspCollector(kbnServer as any);
 
-    expect((await collector.fetch()).strict).toEqual(true);
+    expect((await collector.fetch(mockCallCluster)).strict).toEqual(true);
 
     updateCsp({ strict: false });
-    expect((await collector.fetch()).strict).toEqual(false);
+    expect((await collector.fetch(mockCallCluster)).strict).toEqual(false);
   });
 
   test('fetches whether the legacy browser warning is enabled', async () => {
     const collector = createCspCollector(kbnServer as any);
 
-    expect((await collector.fetch()).warnLegacyBrowsers).toEqual(true);
+    expect((await collector.fetch(mockCallCluster)).warnLegacyBrowsers).toEqual(true);
 
     updateCsp({ warnLegacyBrowsers: false });
-    expect((await collector.fetch()).warnLegacyBrowsers).toEqual(false);
+    expect((await collector.fetch(mockCallCluster)).warnLegacyBrowsers).toEqual(false);
   });
 
   test('fetches whether the csp rules have been changed or not', async () => {
     const collector = createCspCollector(kbnServer as any);
 
-    expect((await collector.fetch()).rulesChangedFromDefault).toEqual(false);
+    expect((await collector.fetch(mockCallCluster)).rulesChangedFromDefault).toEqual(false);
 
     updateCsp({ rules: ['not', 'default'] });
-    expect((await collector.fetch()).rulesChangedFromDefault).toEqual(true);
+    expect((await collector.fetch(mockCallCluster)).rulesChangedFromDefault).toEqual(true);
   });
 
   test('does not include raw csp rules under any property names', async () => {
@@ -79,7 +80,7 @@ describe('csp collector', () => {
     //
     // We use a snapshot here to ensure csp.rules isn't finding its way into the
     // payload under some new and unexpected variable name (e.g. cspRules).
-    expect(await collector.fetch()).toMatchInlineSnapshot(`
+    expect(await collector.fetch(mockCallCluster)).toMatchInlineSnapshot(`
       Object {
         "rulesChangedFromDefault": false,
         "strict": true,
diff --git a/src/legacy/core_plugins/kibana/server/lib/csp_usage_collector/csp_collector.ts b/src/legacy/core_plugins/kibana/server/lib/csp_usage_collector/csp_collector.ts
index 6622ed4bef47..9c124a90e66e 100644
--- a/src/legacy/core_plugins/kibana/server/lib/csp_usage_collector/csp_collector.ts
+++ b/src/legacy/core_plugins/kibana/server/lib/csp_usage_collector/csp_collector.ts
@@ -19,9 +19,18 @@
 
 import { Server } from 'hapi';
 import { CspConfig } from '../../../../../../core/server';
-import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/server';
+import {
+  UsageCollectionSetup,
+  CollectorOptions,
+} from '../../../../../../plugins/usage_collection/server';
 
-export function createCspCollector(server: Server) {
+interface Usage {
+  strict: boolean;
+  warnLegacyBrowsers: boolean;
+  rulesChangedFromDefault: boolean;
+}
+
+export function createCspCollector(server: Server): CollectorOptions<Usage> {
   return {
     type: 'csp',
     isReady: () => true,
@@ -37,10 +46,22 @@ export function createCspCollector(server: Server) {
         rulesChangedFromDefault: header !== CspConfig.DEFAULT.header,
       };
     },
+    schema: {
+      strict: {
+        type: 'boolean',
+      },
+      warnLegacyBrowsers: {
+        type: 'boolean',
+      },
+      rulesChangedFromDefault: {
+        type: 'boolean',
+      },
+    },
   };
 }
 
 export function registerCspCollector(usageCollection: UsageCollectionSetup, server: Server): void {
-  const collector = usageCollection.makeUsageCollector(createCspCollector(server));
+  const collectorConfig = createCspCollector(server);
+  const collector = usageCollection.makeUsageCollector<Usage>(collectorConfig);
   usageCollection.registerCollector(collector);
 }
diff --git a/src/plugins/data/server/kql_telemetry/usage_collector/fetch.ts b/src/plugins/data/server/kql_telemetry/usage_collector/fetch.ts
index 157716b38f52..29f9be903a36 100644
--- a/src/plugins/data/server/kql_telemetry/usage_collector/fetch.ts
+++ b/src/plugins/data/server/kql_telemetry/usage_collector/fetch.ts
@@ -23,8 +23,14 @@ import { DEFAULT_QUERY_LANGUAGE, UI_SETTINGS } from '../../../common';
 
 const defaultSearchQueryLanguageSetting = DEFAULT_QUERY_LANGUAGE;
 
+export interface Usage {
+  optInCount: number;
+  optOutCount: number;
+  defaultQueryLanguage: string;
+}
+
 export function fetchProvider(index: string) {
-  return async (callCluster: APICaller) => {
+  return async (callCluster: APICaller): Promise<Usage> => {
     const [response, config] = await Promise.all([
       callCluster('get', {
         index,
@@ -38,7 +44,7 @@ export function fetchProvider(index: string) {
       }),
     ]);
 
-    const queryLanguageConfigValue = get(
+    const queryLanguageConfigValue: string | null | undefined = get(
       config,
       `hits.hits[0]._source.config.${UI_SETTINGS.SEARCH_QUERY_LANGUAGE}`
     );
diff --git a/src/plugins/data/server/kql_telemetry/usage_collector/make_kql_usage_collector.ts b/src/plugins/data/server/kql_telemetry/usage_collector/make_kql_usage_collector.ts
index db4c9a8f0b4c..6d0ca0012201 100644
--- a/src/plugins/data/server/kql_telemetry/usage_collector/make_kql_usage_collector.ts
+++ b/src/plugins/data/server/kql_telemetry/usage_collector/make_kql_usage_collector.ts
@@ -17,18 +17,22 @@
  * under the License.
  */
 
-import { fetchProvider } from './fetch';
+import { fetchProvider, Usage } from './fetch';
 import { UsageCollectionSetup } from '../../../../usage_collection/server';
 
 export async function makeKQLUsageCollector(
   usageCollection: UsageCollectionSetup,
   kibanaIndex: string
 ) {
-  const fetch = fetchProvider(kibanaIndex);
-  const kqlUsageCollector = usageCollection.makeUsageCollector({
+  const kqlUsageCollector = usageCollection.makeUsageCollector<Usage>({
     type: 'kql',
-    fetch,
+    fetch: fetchProvider(kibanaIndex),
     isReady: () => true,
+    schema: {
+      optInCount: { type: 'long' },
+      optOutCount: { type: 'long' },
+      defaultQueryLanguage: { type: 'keyword' },
+    },
   });
 
   usageCollection.registerCollector(kqlUsageCollector);
diff --git a/src/plugins/home/server/services/sample_data/usage/collector.ts b/src/plugins/home/server/services/sample_data/usage/collector.ts
index 19ceceb4cba1..d819d67a8d43 100644
--- a/src/plugins/home/server/services/sample_data/usage/collector.ts
+++ b/src/plugins/home/server/services/sample_data/usage/collector.ts
@@ -19,7 +19,7 @@
 
 import { PluginInitializerContext } from 'kibana/server';
 import { first } from 'rxjs/operators';
-import { fetchProvider } from './collector_fetch';
+import { fetchProvider, TelemetryResponse } from './collector_fetch';
 import { UsageCollectionSetup } from '../../../../../usage_collection/server';
 
 export async function makeSampleDataUsageCollector(
@@ -33,10 +33,18 @@ export async function makeSampleDataUsageCollector(
   } catch (err) {
     return; // kibana plugin is not enabled (test environment)
   }
-  const collector = usageCollection.makeUsageCollector({
+  const collector = usageCollection.makeUsageCollector<TelemetryResponse>({
     type: 'sample-data',
     fetch: fetchProvider(index),
     isReady: () => true,
+    schema: {
+      installed: { type: 'keyword' },
+      last_install_date: { type: 'date' },
+      last_install_set: { type: 'keyword' },
+      last_uninstall_date: { type: 'date' },
+      last_uninstall_set: { type: 'keyword' },
+      uninstalled: { type: 'keyword' },
+    },
   });
 
   usageCollection.registerCollector(collector);
diff --git a/src/plugins/home/server/services/sample_data/usage/collector_fetch.ts b/src/plugins/home/server/services/sample_data/usage/collector_fetch.ts
index 4c7316c85301..d43458cfc64d 100644
--- a/src/plugins/home/server/services/sample_data/usage/collector_fetch.ts
+++ b/src/plugins/home/server/services/sample_data/usage/collector_fetch.ts
@@ -31,7 +31,7 @@ interface SearchHit {
   };
 }
 
-interface TelemetryResponse {
+export interface TelemetryResponse {
   installed: string[];
   uninstalled: string[];
   last_install_date: moment.Moment | null;
diff --git a/src/plugins/kibana_usage_collection/common/constants.ts b/src/plugins/kibana_usage_collection/common/constants.ts
index df0adfc52184..c4e7eaac51cf 100644
--- a/src/plugins/kibana_usage_collection/common/constants.ts
+++ b/src/plugins/kibana_usage_collection/common/constants.ts
@@ -20,27 +20,6 @@
 export const PLUGIN_ID = 'kibanaUsageCollection';
 export const PLUGIN_NAME = 'kibana_usage_collection';
 
-/**
- * UI metric usage type
- */
-export const UI_METRIC_USAGE_TYPE = 'ui_metric';
-
-/**
- * Application Usage type
- */
-export const APPLICATION_USAGE_TYPE = 'application_usage';
-
-/**
- * The type name used within the Monitoring index to publish management stats.
- */
-export const KIBANA_STACK_MANAGEMENT_STATS_TYPE = 'stack_management';
-
-/**
- * The type name used to publish Kibana usage stats.
- * NOTE: this string shows as-is in the stats API as a field name for the kibana usage stats
- */
-export const KIBANA_USAGE_TYPE = 'kibana';
-
 /**
  * The type name used to publish Kibana usage stats in the formatted as bulk.
  */
diff --git a/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.ts
index f52687038bbb..1f22ab010010 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.ts
@@ -20,7 +20,6 @@
 import moment from 'moment';
 import { ISavedObjectsRepository, SavedObjectsServiceSetup } from 'kibana/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { APPLICATION_USAGE_TYPE } from '../../../common/constants';
 import { findAll } from '../find_all';
 import {
   ApplicationUsageTotal,
@@ -62,7 +61,7 @@ export function registerApplicationUsageCollector(
   registerMappings(registerType);
 
   const collector = usageCollection.makeUsageCollector({
-    type: APPLICATION_USAGE_TYPE,
+    type: 'application_usage',
     isReady: () => typeof getSavedObjectsClient() !== 'undefined',
     fetch: async () => {
       const savedObjectsClient = getSavedObjectsClient();
diff --git a/src/plugins/kibana_usage_collection/server/collectors/kibana/kibana_usage_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/kibana/kibana_usage_collector.ts
index d0da6fcc523c..9cc079a9325d 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/kibana/kibana_usage_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/kibana/kibana_usage_collector.ts
@@ -21,7 +21,7 @@ import { Observable } from 'rxjs';
 import { take } from 'rxjs/operators';
 import { SharedGlobalConfig } from 'kibana/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { KIBANA_STATS_TYPE, KIBANA_USAGE_TYPE } from '../../../common/constants';
+import { KIBANA_STATS_TYPE } from '../../../common/constants';
 import { getSavedObjectsCounts } from './get_saved_object_counts';
 
 export function getKibanaUsageCollector(
@@ -29,7 +29,7 @@ export function getKibanaUsageCollector(
   legacyConfig$: Observable<SharedGlobalConfig>
 ) {
   return usageCollection.makeUsageCollector({
-    type: KIBANA_USAGE_TYPE,
+    type: 'kibana',
     isReady: () => true,
     async fetch(callCluster) {
       const {
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.ts
index 39cd35188495..3a777beebd90 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.ts
@@ -19,7 +19,6 @@
 
 import { IUiSettingsClient } from 'kibana/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { KIBANA_STACK_MANAGEMENT_STATS_TYPE } from '../../../common/constants';
 
 export type UsageStats = Record<string, any>;
 
@@ -47,7 +46,7 @@ export function registerManagementUsageCollector(
   getUiSettingsClient: () => IUiSettingsClient | undefined
 ) {
   const collector = usageCollection.makeUsageCollector({
-    type: KIBANA_STACK_MANAGEMENT_STATS_TYPE,
+    type: 'stack_management',
     isReady: () => typeof getUiSettingsClient() !== 'undefined',
     fetch: createCollectorFetch(getUiSettingsClient),
   });
diff --git a/src/plugins/kibana_usage_collection/server/collectors/ui_metric/telemetry_ui_metric_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
index 603742f612a6..ec2f1bfdfc25 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
@@ -23,7 +23,6 @@ import {
   SavedObjectsServiceSetup,
 } from 'kibana/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { UI_METRIC_USAGE_TYPE } from '../../../common/constants';
 import { findAll } from '../find_all';
 
 interface UIMetricsSavedObjects extends SavedObjectAttributes {
@@ -49,7 +48,7 @@ export function registerUiMetricUsageCollector(
   });
 
   const collector = usageCollection.makeUsageCollector({
-    type: UI_METRIC_USAGE_TYPE,
+    type: 'ui_metric',
     fetch: async () => {
       const savedObjectsClient = getSavedObjectsClient();
       if (typeof savedObjectsClient === 'undefined') {
diff --git a/src/plugins/telemetry/common/constants.ts b/src/plugins/telemetry/common/constants.ts
index 53c79b738f75..fc77332c18fc 100644
--- a/src/plugins/telemetry/common/constants.ts
+++ b/src/plugins/telemetry/common/constants.ts
@@ -56,11 +56,6 @@ export const PATH_TO_ADVANCED_SETTINGS = 'management/kibana/settings';
  */
 export const PRIVACY_STATEMENT_URL = `https://www.elastic.co/legal/privacy-statement`;
 
-/**
- * The type name used to publish telemetry plugin stats.
- */
-export const TELEMETRY_STATS_TYPE = 'telemetry';
-
 /**
  * The endpoint version when hitting the remote telemetry service
  */
diff --git a/src/plugins/telemetry/schema/legacy_oss_plugins.json b/src/plugins/telemetry/schema/legacy_oss_plugins.json
new file mode 100644
index 000000000000..e660ccac9dc3
--- /dev/null
+++ b/src/plugins/telemetry/schema/legacy_oss_plugins.json
@@ -0,0 +1,17 @@
+{
+  "properties": {
+    "csp": {
+      "properties": {
+        "strict": {
+          "type": "boolean"
+        },
+        "warnLegacyBrowsers": {
+          "type": "boolean"
+        },
+        "rulesChangedFromDefault": {
+          "type": "boolean"
+        }
+      }
+    }
+  }
+}
diff --git a/src/plugins/telemetry/schema/oss_plugins.json b/src/plugins/telemetry/schema/oss_plugins.json
new file mode 100644
index 000000000000..a5172c01b1da
--- /dev/null
+++ b/src/plugins/telemetry/schema/oss_plugins.json
@@ -0,0 +1,59 @@
+{
+  "properties": {
+    "kql": {
+      "properties": {
+        "optInCount": {
+          "type": "long"
+        },
+        "optOutCount": {
+          "type": "long"
+        },
+        "defaultQueryLanguage": {
+          "type": "keyword"
+        }
+      }
+    },
+    "sample-data": {
+      "properties": {
+        "installed": {
+          "type": "keyword"
+        },
+        "last_install_date": {
+          "type": "date"
+        },
+        "last_install_set": {
+          "type": "keyword"
+        },
+        "last_uninstall_date": {
+          "type": "date"
+        },
+        "last_uninstall_set": {
+          "type": "keyword"
+        },
+        "uninstalled": {
+          "type": "keyword"
+        }
+      }
+    },
+    "telemetry": {
+      "properties": {
+        "opt_in_status": {
+          "type": "boolean"
+        },
+        "usage_fetcher": {
+          "type": "keyword"
+        },
+        "last_reported": {
+          "type": "long"
+        }
+      }
+    },
+    "tsvb-validation": {
+      "properties": {
+        "failed_validations": {
+          "type": "long"
+        }
+      }
+    }
+  }
+}
diff --git a/src/plugins/telemetry/server/collectors/telemetry_plugin/telemetry_plugin_collector.ts b/src/plugins/telemetry/server/collectors/telemetry_plugin/telemetry_plugin_collector.ts
index ab90935266d6..05836b8448a6 100644
--- a/src/plugins/telemetry/server/collectors/telemetry_plugin/telemetry_plugin_collector.ts
+++ b/src/plugins/telemetry/server/collectors/telemetry_plugin/telemetry_plugin_collector.ts
@@ -20,7 +20,6 @@
 import { Observable } from 'rxjs';
 import { take } from 'rxjs/operators';
 import { ISavedObjectsRepository, SavedObjectsClient } from '../../../../../core/server';
-import { TELEMETRY_STATS_TYPE } from '../../../common/constants';
 import { getTelemetrySavedObject, TelemetrySavedObject } from '../../telemetry_repository';
 import { getTelemetryOptIn, getTelemetrySendUsageFrom } from '../../../common/telemetry_config';
 import { UsageCollectionSetup } from '../../../../usage_collection/server';
@@ -81,10 +80,15 @@ export function registerTelemetryPluginUsageCollector(
   usageCollection: UsageCollectionSetup,
   options: TelemetryPluginUsageCollectorOptions
 ) {
-  const collector = usageCollection.makeUsageCollector({
-    type: TELEMETRY_STATS_TYPE,
+  const collector = usageCollection.makeUsageCollector<TelemetryUsageStats>({
+    type: 'telemetry',
     isReady: () => typeof options.getSavedObjectsClient() !== 'undefined',
     fetch: createCollectorFetch(options),
+    schema: {
+      opt_in_status: { type: 'boolean' },
+      usage_fetcher: { type: 'keyword' },
+      last_reported: { type: 'long' },
+    },
   });
 
   usageCollection.registerCollector(collector);
diff --git a/src/plugins/usage_collection/README.md b/src/plugins/usage_collection/README.md
index 99075d5d48f5..9520dfc03cfa 100644
--- a/src/plugins/usage_collection/README.md
+++ b/src/plugins/usage_collection/README.md
@@ -8,7 +8,7 @@ To integrate with the telemetry services for usage collection of your feature, t
 
 ## Creating and Registering Usage Collector
 
-All you need to provide is a `type` for organizing your fields, and a `fetch` method for returning your usage data. Then you need to make the Telemetry service aware of the collector by registering it.
+All you need to provide is a `type` for organizing your fields, `schema` field to define the expected types of usage fields reported, and a `fetch` method for returning your usage data. Then you need to make the Telemetry service aware of the collector by registering it.
 
 ### New Platform
 
@@ -45,6 +45,12 @@ All you need to provide is a `type` for organizing your fields, and a `fetch` me
     import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
     import { APICluster } from 'kibana/server';
 
+    interface Usage {
+      my_objects: {
+        total: number,
+      },
+    }
+
     export function registerMyPluginUsageCollector(usageCollection?: UsageCollectionSetup): void {
       // usageCollection is an optional dependency, so make sure to return if it is not registered.
       if (!usageCollection) {
@@ -52,8 +58,13 @@ All you need to provide is a `type` for organizing your fields, and a `fetch` me
       }
 
       // create usage collector
-      const myCollector = usageCollection.makeUsageCollector({
+      const myCollector = usageCollection.makeUsageCollector<Usage>({
         type: MY_USAGE_TYPE,
+        schema: {
+          my_objects: {
+            total: 'long',
+          },
+        },
         fetch: async (callCluster: APICluster) => {
 
         // query ES and get some data
@@ -98,10 +109,8 @@ class Plugin {
 ```ts
 // server/collectors/register.ts
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { ISavedObjectsRepository } from 'kibana/server';
 
 export function registerMyPluginUsageCollector(
-  getSavedObjectsRepository: () => ISavedObjectsRepository | undefined,
   usageCollection?: UsageCollectionSetup
   ): void {
   // usageCollection is an optional dependency, so make sure to return if it is not registered.
@@ -110,22 +119,52 @@ export function registerMyPluginUsageCollector(
   }
 
   // create usage collector
-  const myCollector = usageCollection.makeUsageCollector({
-    type: MY_USAGE_TYPE,
-    isReady: () => typeof getSavedObjectsRepository() !== 'undefined',
-    fetch: async () => {
-      const savedObjectsRepository = getSavedObjectsRepository()!;
-      // get something from the savedObjects
-
-      return { my_objects };
-    },
-  });
+  const myCollector = usageCollection.makeUsageCollector<Usage>(...)
 
   // register usage collector
   usageCollection.registerCollector(myCollector);
 }
 ```
 
+## Schema Field
+
+The `schema` field is a proscribed data model assists with detecting changes in usage collector payloads. To define the collector schema add a schema field that specifies every possible field reported when registering the collector. Whenever the `schema` field is set or changed please run `node scripts/telemetry_check.js --fix` to update the stored schema json files.
+
+### Allowed Schema Types
+
+The `AllowedSchemaTypes` is the list of allowed schema types for the usage fields getting reported:
+
+```
+'keyword', 'text', 'number', 'boolean', 'long', 'date', 'float'
+```
+
+### Example
+
+```ts
+export const myCollector = makeUsageCollector<Usage>({
+  type: 'my_working_collector',
+  isReady: () => true,
+  fetch() {
+    return {
+      my_greeting: 'hello',
+      some_obj: {
+        total: 123,
+      },
+    };
+  },
+  schema: {
+    my_greeting: {
+      type: 'keyword',
+    },
+    some_obj: {
+      total: {
+        type: 'number',
+      },
+    },
+  },
+});
+```
+
 ## Update the telemetry payload and telemetry cluster field mappings
 
 There is a module in the telemetry service that creates the payload of data that gets sent up to the telemetry cluster.
diff --git a/src/plugins/usage_collection/server/collector/collector.ts b/src/plugins/usage_collection/server/collector/collector.ts
index b4f86f67e798..00d55ef1c06d 100644
--- a/src/plugins/usage_collection/server/collector/collector.ts
+++ b/src/plugins/usage_collection/server/collector/collector.ts
@@ -21,9 +21,33 @@ import { Logger, APICaller } from 'kibana/server';
 
 export type CollectorFormatForBulkUpload<T, U> = (result: T) => { type: string; payload: U };
 
+export type AllowedSchemaTypes =
+  | 'keyword'
+  | 'text'
+  | 'number'
+  | 'boolean'
+  | 'long'
+  | 'date'
+  | 'float';
+
+export interface SchemaField {
+  type: string;
+}
+
+type Purify<T extends string> = { [P in T]: T }[T];
+
+export type MakeSchemaFrom<Base> = {
+  [Key in Purify<Extract<keyof Base, string>>]: Base[Key] extends Array<infer U>
+    ? { type: AllowedSchemaTypes }
+    : Base[Key] extends object
+    ? MakeSchemaFrom<Base[Key]>
+    : { type: AllowedSchemaTypes };
+};
+
 export interface CollectorOptions<T = unknown, U = T> {
   type: string;
   init?: Function;
+  schema?: MakeSchemaFrom<T>;
   fetch: (callCluster: APICaller) => Promise<T> | T;
   /*
    * A hook for allowing the fetched data payload to be organized into a typed
diff --git a/src/plugins/usage_collection/server/collector/collector_set.ts b/src/plugins/usage_collection/server/collector/collector_set.ts
index e8791138c5e2..04ba7452f99e 100644
--- a/src/plugins/usage_collection/server/collector/collector_set.ts
+++ b/src/plugins/usage_collection/server/collector/collector_set.ts
@@ -42,7 +42,7 @@ export class CollectorSet {
   public makeStatsCollector = <T, U>(options: CollectorOptions<T, U>) => {
     return new Collector(this.logger, options);
   };
-  public makeUsageCollector = <T, U>(options: CollectorOptions<T, U>) => {
+  public makeUsageCollector = <T, U = T>(options: CollectorOptions<T, U>) => {
     return new UsageCollector(this.logger, options);
   };
 
diff --git a/src/plugins/usage_collection/server/collector/index.ts b/src/plugins/usage_collection/server/collector/index.ts
index 0d3939e1dc68..1816e845b4d6 100644
--- a/src/plugins/usage_collection/server/collector/index.ts
+++ b/src/plugins/usage_collection/server/collector/index.ts
@@ -18,5 +18,11 @@
  */
 
 export { CollectorSet } from './collector_set';
-export { Collector } from './collector';
+export {
+  Collector,
+  AllowedSchemaTypes,
+  SchemaField,
+  MakeSchemaFrom,
+  CollectorOptions,
+} from './collector';
 export { UsageCollector } from './usage_collector';
diff --git a/src/plugins/usage_collection/server/index.ts b/src/plugins/usage_collection/server/index.ts
index a2769c8b4b40..87761bca9a50 100644
--- a/src/plugins/usage_collection/server/index.ts
+++ b/src/plugins/usage_collection/server/index.ts
@@ -20,6 +20,13 @@
 import { PluginInitializerContext } from 'kibana/server';
 import { UsageCollectionPlugin } from './plugin';
 
+export {
+  AllowedSchemaTypes,
+  MakeSchemaFrom,
+  SchemaField,
+  CollectorOptions,
+  Collector,
+} from './collector';
 export { UsageCollectionSetup } from './plugin';
 export { config } from './config';
 export const plugin = (initializerContext: PluginInitializerContext) =>
diff --git a/src/plugins/vis_type_timeseries/server/validation_telemetry/validation_telemetry_service.ts b/src/plugins/vis_type_timeseries/server/validation_telemetry/validation_telemetry_service.ts
index 505816d48af5..22e427bed24c 100644
--- a/src/plugins/vis_type_timeseries/server/validation_telemetry/validation_telemetry_service.ts
+++ b/src/plugins/vis_type_timeseries/server/validation_telemetry/validation_telemetry_service.ts
@@ -24,6 +24,9 @@ import { tsvbTelemetrySavedObjectType } from '../saved_objects';
 export interface ValidationTelemetryServiceSetup {
   logFailedValidation: () => void;
 }
+export interface Usage {
+  failed_validations: number;
+}
 
 export class ValidationTelemetryService implements Plugin<ValidationTelemetryServiceSetup> {
   private kibanaIndex: string = '';
@@ -43,7 +46,7 @@ export class ValidationTelemetryService implements Plugin<ValidationTelemetrySer
     });
     if (usageCollection) {
       usageCollection.registerCollector(
-        usageCollection.makeUsageCollector({
+        usageCollection.makeUsageCollector<Usage>({
           type: 'tsvb-validation',
           isReady: () => this.kibanaIndex !== '',
           fetch: async (callCluster: APICaller) => {
@@ -63,6 +66,9 @@ export class ValidationTelemetryService implements Plugin<ValidationTelemetrySer
               };
             }
           },
+          schema: {
+            failed_validations: { type: 'long' },
+          },
         })
       );
     }
diff --git a/tasks/config/run.js b/tasks/config/run.js
index 22deead1d380..32adf4f1f87c 100644
--- a/tasks/config/run.js
+++ b/tasks/config/run.js
@@ -149,6 +149,12 @@ module.exports = function (grunt) {
       args: ['scripts/i18n_check', '--ignore-missing'],
     }),
 
+    telemetryCheck: scriptWithGithubChecks({
+      title: 'Telemetry Schema check',
+      cmd: NODE,
+      args: ['scripts/telemetry_check'],
+    }),
+
     // used by the test:quick task
     //    runs all node.js/server mocha tests
     mocha: scriptWithGithubChecks({
diff --git a/tasks/jenkins.js b/tasks/jenkins.js
index 4d92ff406a32..b40bb8156098 100644
--- a/tasks/jenkins.js
+++ b/tasks/jenkins.js
@@ -27,6 +27,7 @@ module.exports = function (grunt) {
     'run:checkDocApiChanges',
     'run:typeCheck',
     'run:i18nCheck',
+    'run:telemetryCheck',
     'run:checkFileCasing',
     'run:checkLockfileSymlinks',
     'run:licenses',
diff --git a/x-pack/.telemetryrc.json b/x-pack/.telemetryrc.json
new file mode 100644
index 000000000000..2c16491c1096
--- /dev/null
+++ b/x-pack/.telemetryrc.json
@@ -0,0 +1,14 @@
+{
+  "output": "plugins/telemetry_collection_xpack/schema/xpack_plugins.json",
+  "root": "plugins/",
+  "exclude": [
+    "plugins/actions/server/usage/actions_usage_collector.ts",
+    "plugins/alerts/server/usage/alerts_usage_collector.ts",
+    "plugins/apm/server/lib/apm_telemetry/index.ts",
+    "plugins/canvas/server/collectors/collector.ts",
+    "plugins/infra/server/usage/usage_collector.ts",
+    "plugins/lens/server/usage/collectors.ts",
+    "plugins/reporting/server/usage/reporting_usage_collector.ts",
+    "plugins/maps/server/maps_telemetry/collectors/register.ts"
+  ]
+}
diff --git a/x-pack/plugins/actions/server/usage/actions_usage_collector.ts b/x-pack/plugins/actions/server/usage/actions_usage_collector.ts
index e298b3ad9d00..5dff06292220 100644
--- a/x-pack/plugins/actions/server/usage/actions_usage_collector.ts
+++ b/x-pack/plugins/actions/server/usage/actions_usage_collector.ts
@@ -13,10 +13,10 @@ export function createActionsUsageCollector(
   usageCollection: UsageCollectionSetup,
   taskManager: TaskManagerStartContract
 ) {
-  return usageCollection.makeUsageCollector({
+  return usageCollection.makeUsageCollector<ActionsUsage>({
     type: 'actions',
     isReady: () => true,
-    fetch: async (): Promise<ActionsUsage> => {
+    fetch: async () => {
       try {
         const doc = await getLatestTaskState(await taskManager);
         // get the accumulated state from the recurring task
diff --git a/x-pack/plugins/alerts/server/usage/alerts_usage_collector.ts b/x-pack/plugins/alerts/server/usage/alerts_usage_collector.ts
index d2cef0f717e9..7491508ee074 100644
--- a/x-pack/plugins/alerts/server/usage/alerts_usage_collector.ts
+++ b/x-pack/plugins/alerts/server/usage/alerts_usage_collector.ts
@@ -13,10 +13,10 @@ export function createAlertsUsageCollector(
   usageCollection: UsageCollectionSetup,
   taskManager: TaskManagerStartContract
 ) {
-  return usageCollection.makeUsageCollector({
+  return usageCollection.makeUsageCollector<AlertsUsage>({
     type: 'alerts',
     isReady: () => true,
-    fetch: async (): Promise<AlertsUsage> => {
+    fetch: async () => {
       try {
         const doc = await getLatestTaskState(await taskManager);
         // get the accumulated state from the recurring task
diff --git a/x-pack/plugins/canvas/common/lib/constants.ts b/x-pack/plugins/canvas/common/lib/constants.ts
index f2155d920293..f42f4095c269 100644
--- a/x-pack/plugins/canvas/common/lib/constants.ts
+++ b/x-pack/plugins/canvas/common/lib/constants.ts
@@ -20,7 +20,6 @@ export const LOCALSTORAGE_PREFIX = `kibana.canvas`;
 export const LOCALSTORAGE_CLIPBOARD = `${LOCALSTORAGE_PREFIX}.clipboard`;
 export const SESSIONSTORAGE_LASTPATH = 'lastPath:canvas';
 export const FETCH_TIMEOUT = 30000; // 30 seconds
-export const CANVAS_USAGE_TYPE = 'canvas';
 export const DEFAULT_WORKPAD_CSS = '.canvasPage {\n\n}';
 export const DEFAULT_ELEMENT_CSS = '.canvasRenderEl{\n\n}';
 export const VALID_IMAGE_TYPES = ['gif', 'jpeg', 'png', 'svg+xml'];
diff --git a/x-pack/plugins/canvas/server/collectors/collector.ts b/x-pack/plugins/canvas/server/collectors/collector.ts
index e266e9826a47..48396d93d13e 100644
--- a/x-pack/plugins/canvas/server/collectors/collector.ts
+++ b/x-pack/plugins/canvas/server/collectors/collector.ts
@@ -6,7 +6,6 @@
 
 import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { CANVAS_USAGE_TYPE } from '../../common/lib/constants';
 import { TelemetryCollector } from '../../types';
 
 import { workpadCollector } from './workpad_collector';
@@ -31,20 +30,16 @@ export function registerCanvasUsageCollector(
   }
 
   const canvasCollector = usageCollection.makeUsageCollector({
-    type: CANVAS_USAGE_TYPE,
+    type: 'canvas',
     isReady: () => true,
     fetch: async (callCluster: CallCluster) => {
       const collectorResults = await Promise.all(
         collectors.map((collector) => collector(kibanaIndex, callCluster))
       );
 
-      return collectorResults.reduce(
-        (reduction, usage) => {
-          return { ...reduction, ...usage };
-        },
-
-        {}
-      );
+      return collectorResults.reduce((reduction, usage) => {
+        return { ...reduction, ...usage };
+      }, {});
     },
   });
 
diff --git a/x-pack/plugins/cloud/common/constants.ts b/x-pack/plugins/cloud/common/constants.ts
index 4fafafb9e421..b72f68247d02 100644
--- a/x-pack/plugins/cloud/common/constants.ts
+++ b/x-pack/plugins/cloud/common/constants.ts
@@ -4,5 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export const KIBANA_CLOUD_STATS_TYPE = 'cloud';
 export const ELASTIC_SUPPORT_LINK = 'https://support.elastic.co/';
diff --git a/x-pack/plugins/cloud/server/collectors/cloud_usage_collector.ts b/x-pack/plugins/cloud/server/collectors/cloud_usage_collector.ts
index f3eb92eeddfb..b0495f06e7ad 100644
--- a/x-pack/plugins/cloud/server/collectors/cloud_usage_collector.ts
+++ b/x-pack/plugins/cloud/server/collectors/cloud_usage_collector.ts
@@ -5,17 +5,23 @@
  */
 
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { KIBANA_CLOUD_STATS_TYPE } from '../../common/constants';
 
 interface Config {
   isCloudEnabled: boolean;
 }
 
+interface CloudUsage {
+  isCloudEnabled: boolean;
+}
+
 export function createCloudUsageCollector(usageCollection: UsageCollectionSetup, config: Config) {
   const { isCloudEnabled } = config;
-  return usageCollection.makeUsageCollector({
-    type: KIBANA_CLOUD_STATS_TYPE,
+  return usageCollection.makeUsageCollector<CloudUsage>({
+    type: 'cloud',
     isReady: () => true,
+    schema: {
+      isCloudEnabled: { type: 'boolean' },
+    },
     fetch: () => {
       return {
         isCloudEnabled,
diff --git a/x-pack/plugins/file_upload/server/telemetry/file_upload_usage_collector.ts b/x-pack/plugins/file_upload/server/telemetry/file_upload_usage_collector.ts
index 2c2b1183fd5b..81b82c141e46 100644
--- a/x-pack/plugins/file_upload/server/telemetry/file_upload_usage_collector.ts
+++ b/x-pack/plugins/file_upload/server/telemetry/file_upload_usage_collector.ts
@@ -5,15 +5,23 @@
  */
 
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { getTelemetry, initTelemetry } from './telemetry';
-
-const TELEMETRY_TYPE = 'fileUploadTelemetry';
+import { getTelemetry, initTelemetry, Telemetry } from './telemetry';
 
 export function registerFileUploadUsageCollector(usageCollection: UsageCollectionSetup): void {
-  const fileUploadUsageCollector = usageCollection.makeUsageCollector({
-    type: TELEMETRY_TYPE,
+  const fileUploadUsageCollector = usageCollection.makeUsageCollector<Telemetry>({
+    type: 'fileUploadTelemetry',
     isReady: () => true,
-    fetch: async () => (await getTelemetry()) || initTelemetry(),
+    fetch: async () => {
+      const fileUploadUsage = await getTelemetry();
+      if (!fileUploadUsage) {
+        return initTelemetry();
+      }
+
+      return fileUploadUsage;
+    },
+    schema: {
+      filesUploadedTotalCount: { type: 'long' },
+    },
   });
 
   usageCollection.registerCollector(fileUploadUsageCollector);
diff --git a/x-pack/plugins/infra/server/usage/usage_collector.ts b/x-pack/plugins/infra/server/usage/usage_collector.ts
index 7be7364c331f..598ee21e6f27 100644
--- a/x-pack/plugins/infra/server/usage/usage_collector.ts
+++ b/x-pack/plugins/infra/server/usage/usage_collector.ts
@@ -7,8 +7,6 @@
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { InventoryItemType } from '../../common/inventory_models/types';
 
-const KIBANA_REPORTING_TYPE = 'infraops';
-
 interface InfraopsSum {
   infraopsHosts: number;
   infraopsDocker: number;
@@ -24,7 +22,7 @@ export class UsageCollector {
 
   public static getUsageCollector(usageCollection: UsageCollectionSetup) {
     return usageCollection.makeUsageCollector({
-      type: KIBANA_REPORTING_TYPE,
+      type: 'infraops',
       isReady: () => true,
       fetch: async () => {
         return this.getReport();
diff --git a/x-pack/plugins/ml/server/lib/telemetry/ml_usage_collector.ts b/x-pack/plugins/ml/server/lib/telemetry/ml_usage_collector.ts
index 21e5dce8e470..35c6936598c4 100644
--- a/x-pack/plugins/ml/server/lib/telemetry/ml_usage_collector.ts
+++ b/x-pack/plugins/ml/server/lib/telemetry/ml_usage_collector.ts
@@ -7,12 +7,10 @@
 import { CoreSetup } from 'kibana/server';
 
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { getTelemetry, initTelemetry } from './telemetry';
+import { getTelemetry, initTelemetry, Telemetry } from './telemetry';
 import { mlTelemetryMappingsType } from './mappings';
 import { setInternalRepository } from './internal_repository';
 
-const TELEMETRY_TYPE = 'mlTelemetry';
-
 export function initMlTelemetry(coreSetup: CoreSetup, usageCollection: UsageCollectionSetup) {
   coreSetup.savedObjects.registerType(mlTelemetryMappingsType);
   registerMlUsageCollector(usageCollection);
@@ -22,10 +20,22 @@ export function initMlTelemetry(coreSetup: CoreSetup, usageCollection: UsageColl
 }
 
 function registerMlUsageCollector(usageCollection: UsageCollectionSetup): void {
-  const mlUsageCollector = usageCollection.makeUsageCollector({
-    type: TELEMETRY_TYPE,
+  const mlUsageCollector = usageCollection.makeUsageCollector<Telemetry>({
+    type: 'mlTelemetry',
     isReady: () => true,
-    fetch: async () => (await getTelemetry()) || initTelemetry(),
+    schema: {
+      file_data_visualizer: {
+        index_creation_count: { type: 'long' },
+      },
+    },
+    fetch: async () => {
+      const mlUsage = await getTelemetry();
+      if (!mlUsage) {
+        return initTelemetry();
+      }
+
+      return mlUsage;
+    },
   });
 
   usageCollection.registerCollector(mlUsageCollector);
diff --git a/x-pack/plugins/ml/server/lib/telemetry/telemetry.ts b/x-pack/plugins/ml/server/lib/telemetry/telemetry.ts
index bc56e8b2a437..f2162ff2c3d3 100644
--- a/x-pack/plugins/ml/server/lib/telemetry/telemetry.ts
+++ b/x-pack/plugins/ml/server/lib/telemetry/telemetry.ts
@@ -11,7 +11,7 @@ import { getInternalRepository } from './internal_repository';
 
 export const TELEMETRY_DOC_ID = 'ml-telemetry';
 
-interface Telemetry {
+export interface Telemetry {
   file_data_visualizer: {
     index_creation_count: number;
   };
diff --git a/x-pack/plugins/reporting/common/constants.ts b/x-pack/plugins/reporting/common/constants.ts
index 48483c79d1af..c461c2de4e2a 100644
--- a/x-pack/plugins/reporting/common/constants.ts
+++ b/x-pack/plugins/reporting/common/constants.ts
@@ -54,12 +54,6 @@ export const KBN_SCREENSHOT_HEADER_BLACKLIST_STARTS_WITH_PATTERN = ['proxy-'];
 
 export const UI_SETTINGS_CUSTOM_PDF_LOGO = 'xpackReporting:customPdfLogo';
 
-/**
- * The type name used within the Monitoring index to publish reporting stats.
- * @type {string}
- */
-export const KIBANA_REPORTING_TYPE = 'reporting';
-
 export const PDF_JOB_TYPE = 'printable_pdf';
 export const PNG_JOB_TYPE = 'PNG';
 export const CSV_JOB_TYPE = 'csv';
diff --git a/x-pack/plugins/reporting/server/usage/reporting_usage_collector.ts b/x-pack/plugins/reporting/server/usage/reporting_usage_collector.ts
index 364f5187f056..100d09a2da7e 100644
--- a/x-pack/plugins/reporting/server/usage/reporting_usage_collector.ts
+++ b/x-pack/plugins/reporting/server/usage/reporting_usage_collector.ts
@@ -8,16 +8,22 @@ import { first, map } from 'rxjs/operators';
 import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { ReportingCore } from '../';
-import { KIBANA_REPORTING_TYPE } from '../../common/constants';
 import { ExportTypesRegistry } from '../lib/export_types_registry';
 import { ReportingSetupDeps } from '../types';
 import { GetLicense } from './';
 import { getReportingUsage } from './get_reporting_usage';
-import { RangeStats } from './types';
+import { ReportingUsageType } from './types';
 
 // places the reporting data as kibana stats
 const METATYPE = 'kibana_stats';
 
+interface XpackBulkUpload {
+  usage: {
+    xpack: {
+      reporting: ReportingUsageType;
+    };
+  };
+}
 /*
  * @return {Object} kibana usage stats type collection object
  */
@@ -28,20 +34,19 @@ export function getReportingUsageCollector(
   exportTypesRegistry: ExportTypesRegistry,
   isReady: () => Promise<boolean>
 ) {
-  return usageCollection.makeUsageCollector({
-    type: KIBANA_REPORTING_TYPE,
+  return usageCollection.makeUsageCollector<ReportingUsageType, XpackBulkUpload>({
+    type: 'reporting',
     fetch: (callCluster: CallCluster) => {
       const config = reporting.getConfig();
       return getReportingUsage(config, getLicense, callCluster, exportTypesRegistry);
     },
     isReady,
-
     /*
      * Format the response data into a model for internal upload
      * 1. Make this data part of the "kibana_stats" type
      * 2. Organize the payload in the usage.xpack.reporting namespace of the data payload
      */
-    formatForBulkUpload: (result: RangeStats) => {
+    formatForBulkUpload: (result: ReportingUsageType) => {
       return {
         type: METATYPE,
         payload: {
diff --git a/x-pack/plugins/rollup/server/collectors/register.ts b/x-pack/plugins/rollup/server/collectors/register.ts
index 629dd8b180fd..c679098bc05b 100644
--- a/x-pack/plugins/rollup/server/collectors/register.ts
+++ b/x-pack/plugins/rollup/server/collectors/register.ts
@@ -12,8 +12,6 @@ interface IdToFlagMap {
   [key: string]: boolean;
 }
 
-const ROLLUP_USAGE_TYPE = 'rollups';
-
 // elasticsearch index.max_result_window default value
 const ES_MAX_RESULT_WINDOW_DEFAULT_VALUE = 1000;
 
@@ -174,13 +172,42 @@ async function fetchRollupVisualizations(
   };
 }
 
+interface Usage {
+  index_patterns: {
+    total: number;
+  };
+  saved_searches: {
+    total: number;
+  };
+  visualizations: {
+    total: number;
+    saved_searches: {
+      total: number;
+    };
+  };
+}
+
 export function registerRollupUsageCollector(
   usageCollection: UsageCollectionSetup,
   kibanaIndex: string
 ): void {
-  const collector = usageCollection.makeUsageCollector({
-    type: ROLLUP_USAGE_TYPE,
+  const collector = usageCollection.makeUsageCollector<Usage>({
+    type: 'rollups',
     isReady: () => true,
+    schema: {
+      index_patterns: {
+        total: { type: 'long' },
+      },
+      saved_searches: {
+        total: { type: 'long' },
+      },
+      visualizations: {
+        saved_searches: {
+          total: { type: 'long' },
+        },
+        total: { type: 'long' },
+      },
+    },
     fetch: async (callCluster: CallCluster) => {
       const rollupIndexPatterns = await fetchRollupIndexPatterns(kibanaIndex, callCluster);
       const rollupIndexPatternToFlagMap = createIdToFlagMap(rollupIndexPatterns);
diff --git a/x-pack/plugins/spaces/common/constants.ts b/x-pack/plugins/spaces/common/constants.ts
index 11882ca2f1b3..33f1aae70ea0 100644
--- a/x-pack/plugins/spaces/common/constants.ts
+++ b/x-pack/plugins/spaces/common/constants.ts
@@ -16,12 +16,6 @@ export const SPACE_SEARCH_COUNT_THRESHOLD = 8;
  */
 export const MAX_SPACE_INITIALS = 2;
 
-/**
- * The type name used within the Monitoring index to publish spaces stats.
- * @type {string}
- */
-export const KIBANA_SPACES_STATS_TYPE = 'spaces';
-
 /**
  * The path to enter a space.
  */
diff --git a/x-pack/plugins/spaces/server/usage_collection/spaces_usage_collector.ts b/x-pack/plugins/spaces/server/usage_collection/spaces_usage_collector.ts
index fa1a81fe080f..9f980df8da1b 100644
--- a/x-pack/plugins/spaces/server/usage_collection/spaces_usage_collector.ts
+++ b/x-pack/plugins/spaces/server/usage_collection/spaces_usage_collector.ts
@@ -9,7 +9,6 @@ import { take } from 'rxjs/operators';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { Observable } from 'rxjs';
 import { KIBANA_STATS_TYPE_MONITORING } from '../../../monitoring/common/constants';
-import { KIBANA_SPACES_STATS_TYPE } from '../../common/constants';
 import { PluginsSetup } from '../plugin';
 
 type CallCluster = <T = unknown>(
@@ -118,8 +117,25 @@ export interface UsageStats {
   enabled: boolean;
   count?: number;
   usesFeatureControls?: boolean;
-  disabledFeatures?: {
-    [featureId: string]: number;
+  disabledFeatures: {
+    indexPatterns?: number;
+    discover?: number;
+    canvas?: number;
+    maps?: number;
+    siem?: number;
+    monitoring?: number;
+    graph?: number;
+    uptime?: number;
+    savedObjectsManagement?: number;
+    timelion?: number;
+    dev_tools?: number;
+    advancedSettings?: number;
+    infrastructure?: number;
+    visualize?: number;
+    logs?: number;
+    dashboard?: number;
+    ml?: number;
+    apm?: number;
   };
 }
 
@@ -129,6 +145,11 @@ interface CollectorDeps {
   licensing: PluginsSetup['licensing'];
 }
 
+interface BulkUpload {
+  usage: {
+    spaces: UsageStats;
+  };
+}
 /*
  * @param {Object} server
  * @return {Object} kibana usage stats type collection object
@@ -137,9 +158,35 @@ export function getSpacesUsageCollector(
   usageCollection: UsageCollectionSetup,
   deps: CollectorDeps
 ) {
-  return usageCollection.makeUsageCollector({
-    type: KIBANA_SPACES_STATS_TYPE,
+  return usageCollection.makeUsageCollector<UsageStats, BulkUpload>({
+    type: 'spaces',
     isReady: () => true,
+    schema: {
+      usesFeatureControls: { type: 'boolean' },
+      disabledFeatures: {
+        indexPatterns: { type: 'long' },
+        discover: { type: 'long' },
+        canvas: { type: 'long' },
+        maps: { type: 'long' },
+        siem: { type: 'long' },
+        monitoring: { type: 'long' },
+        graph: { type: 'long' },
+        uptime: { type: 'long' },
+        savedObjectsManagement: { type: 'long' },
+        timelion: { type: 'long' },
+        dev_tools: { type: 'long' },
+        advancedSettings: { type: 'long' },
+        infrastructure: { type: 'long' },
+        visualize: { type: 'long' },
+        logs: { type: 'long' },
+        dashboard: { type: 'long' },
+        ml: { type: 'long' },
+        apm: { type: 'long' },
+      },
+      available: { type: 'boolean' },
+      enabled: { type: 'boolean' },
+      count: { type: 'long' },
+    },
     fetch: async (callCluster: CallCluster) => {
       const license = await deps.licensing.license$.pipe(take(1)).toPromise();
       const available = license.isAvailable; // some form of spaces is available for all valid licenses
diff --git a/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json b/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
new file mode 100644
index 000000000000..13d7c6231604
--- /dev/null
+++ b/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
@@ -0,0 +1,247 @@
+{
+  "properties": {
+    "cloud": {
+      "properties": {
+        "isCloudEnabled": {
+          "type": "boolean"
+        }
+      }
+    },
+    "fileUploadTelemetry": {
+      "properties": {
+        "filesUploadedTotalCount": {
+          "type": "long"
+        }
+      }
+    },
+    "mlTelemetry": {
+      "properties": {
+        "file_data_visualizer": {
+          "properties": {
+            "index_creation_count": {
+              "type": "long"
+            }
+          }
+        }
+      }
+    },
+    "rollups": {
+      "properties": {
+        "index_patterns": {
+          "properties": {
+            "total": {
+              "type": "long"
+            }
+          }
+        },
+        "saved_searches": {
+          "properties": {
+            "total": {
+              "type": "long"
+            }
+          }
+        },
+        "visualizations": {
+          "properties": {
+            "saved_searches": {
+              "properties": {
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "total": {
+              "type": "long"
+            }
+          }
+        }
+      }
+    },
+    "spaces": {
+      "properties": {
+        "usesFeatureControls": {
+          "type": "boolean"
+        },
+        "disabledFeatures": {
+          "properties": {
+            "indexPatterns": {
+              "type": "long"
+            },
+            "discover": {
+              "type": "long"
+            },
+            "canvas": {
+              "type": "long"
+            },
+            "maps": {
+              "type": "long"
+            },
+            "siem": {
+              "type": "long"
+            },
+            "monitoring": {
+              "type": "long"
+            },
+            "graph": {
+              "type": "long"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "savedObjectsManagement": {
+              "type": "long"
+            },
+            "timelion": {
+              "type": "long"
+            },
+            "dev_tools": {
+              "type": "long"
+            },
+            "advancedSettings": {
+              "type": "long"
+            },
+            "infrastructure": {
+              "type": "long"
+            },
+            "visualize": {
+              "type": "long"
+            },
+            "logs": {
+              "type": "long"
+            },
+            "dashboard": {
+              "type": "long"
+            },
+            "ml": {
+              "type": "long"
+            },
+            "apm": {
+              "type": "long"
+            }
+          }
+        },
+        "available": {
+          "type": "boolean"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "count": {
+          "type": "long"
+        }
+      }
+    },
+    "upgrade-assistant-telemetry": {
+      "properties": {
+        "features": {
+          "properties": {
+            "deprecation_logging": {
+              "properties": {
+                "enabled": {
+                  "type": "boolean"
+                }
+              }
+            }
+          }
+        },
+        "ui_open": {
+          "properties": {
+            "cluster": {
+              "type": "long"
+            },
+            "indices": {
+              "type": "long"
+            },
+            "overview": {
+              "type": "long"
+            }
+          }
+        },
+        "ui_reindex": {
+          "properties": {
+            "close": {
+              "type": "long"
+            },
+            "open": {
+              "type": "long"
+            },
+            "start": {
+              "type": "long"
+            },
+            "stop": {
+              "type": "long"
+            }
+          }
+        }
+      }
+    },
+    "uptime": {
+      "properties": {
+        "last_24_hours": {
+          "properties": {
+            "hits": {
+              "properties": {
+                "autoRefreshEnabled": {
+                  "type": "boolean"
+                },
+                "autorefreshInterval": {
+                  "type": "long"
+                },
+                "dateRangeEnd": {
+                  "type": "date"
+                },
+                "dateRangeStart": {
+                  "type": "date"
+                },
+                "monitor_frequency": {
+                  "type": "long"
+                },
+                "monitor_name_stats": {
+                  "properties": {
+                    "avg_length": {
+                      "type": "float"
+                    },
+                    "max_length": {
+                      "type": "long"
+                    },
+                    "min_length": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "monitor_page": {
+                  "type": "long"
+                },
+                "no_of_unique_monitors": {
+                  "type": "long"
+                },
+                "no_of_unique_observer_locations": {
+                  "type": "long"
+                },
+                "observer_location_name_stats": {
+                  "properties": {
+                    "avg_length": {
+                      "type": "float"
+                    },
+                    "max_length": {
+                      "type": "long"
+                    },
+                    "min_length": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "overview_page": {
+                  "type": "long"
+                },
+                "settings_page": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/telemetry/usage_collector.ts b/x-pack/plugins/upgrade_assistant/server/lib/telemetry/usage_collector.ts
index 0c2e3a1e43f4..e511e27ee0e2 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/telemetry/usage_collector.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/telemetry/usage_collector.ts
@@ -120,9 +120,29 @@ export function registerUpgradeAssistantUsageCollector({
   usageCollection,
   savedObjects,
 }: Dependencies) {
-  const upgradeAssistantUsageCollector = usageCollection.makeUsageCollector({
-    type: UPGRADE_ASSISTANT_TYPE,
+  const upgradeAssistantUsageCollector = usageCollection.makeUsageCollector<
+    UpgradeAssistantTelemetry
+  >({
+    type: 'upgrade-assistant-telemetry',
     isReady: () => true,
+    schema: {
+      features: {
+        deprecation_logging: {
+          enabled: { type: 'boolean' },
+        },
+      },
+      ui_open: {
+        cluster: { type: 'long' },
+        indices: { type: 'long' },
+        overview: { type: 'long' },
+      },
+      ui_reindex: {
+        close: { type: 'long' },
+        open: { type: 'long' },
+        start: { type: 'long' },
+        stop: { type: 'long' },
+      },
+    },
     fetch: async () => fetchUpgradeAssistantMetrics(elasticsearch, savedObjects),
   });
 
diff --git a/x-pack/plugins/uptime/server/lib/adapters/telemetry/kibana_telemetry_adapter.ts b/x-pack/plugins/uptime/server/lib/adapters/telemetry/kibana_telemetry_adapter.ts
index 5d93a4d7f356..44b95515039d 100644
--- a/x-pack/plugins/uptime/server/lib/adapters/telemetry/kibana_telemetry_adapter.ts
+++ b/x-pack/plugins/uptime/server/lib/adapters/telemetry/kibana_telemetry_adapter.ts
@@ -7,7 +7,7 @@
 import moment from 'moment';
 import { ISavedObjectsRepository, SavedObjectsClientContract } from 'kibana/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { PageViewParams, UptimeTelemetry } from './types';
+import { PageViewParams, UptimeTelemetry, Usage } from './types';
 import { APICaller } from '../framework';
 import { savedObjectsAdapter } from '../../saved_objects';
 
@@ -39,8 +39,36 @@ export class KibanaTelemetryAdapter {
     usageCollector: UsageCollectionSetup,
     getSavedObjectsClient: () => ISavedObjectsRepository | undefined
   ) {
-    return usageCollector.makeUsageCollector({
+    return usageCollector.makeUsageCollector<Usage>({
       type: 'uptime',
+      schema: {
+        last_24_hours: {
+          hits: {
+            autoRefreshEnabled: {
+              type: 'boolean',
+            },
+            autorefreshInterval: { type: 'long' },
+            dateRangeEnd: { type: 'date' },
+            dateRangeStart: { type: 'date' },
+            monitor_frequency: { type: 'long' },
+            monitor_name_stats: {
+              avg_length: { type: 'float' },
+              max_length: { type: 'long' },
+              min_length: { type: 'long' },
+            },
+            monitor_page: { type: 'long' },
+            no_of_unique_monitors: { type: 'long' },
+            no_of_unique_observer_locations: { type: 'long' },
+            observer_location_name_stats: {
+              avg_length: { type: 'float' },
+              max_length: { type: 'long' },
+              min_length: { type: 'long' },
+            },
+            overview_page: { type: 'long' },
+            settings_page: { type: 'long' },
+          },
+        },
+      },
       fetch: async (callCluster: APICaller) => {
         const savedObjectsClient = getSavedObjectsClient()!;
         if (savedObjectsClient) {
diff --git a/x-pack/plugins/uptime/server/lib/adapters/telemetry/types.ts b/x-pack/plugins/uptime/server/lib/adapters/telemetry/types.ts
index ee3360ecc41b..f2afeb2b7e50 100644
--- a/x-pack/plugins/uptime/server/lib/adapters/telemetry/types.ts
+++ b/x-pack/plugins/uptime/server/lib/adapters/telemetry/types.ts
@@ -19,6 +19,12 @@ export interface Stats {
   avg_length: number;
 }
 
+export interface Usage {
+  last_24_hours: {
+    hits: UptimeTelemetry;
+  };
+}
+
 export interface UptimeTelemetry {
   overview_page: number;
   monitor_page: number;

From 684289d6e3d27fe0c493f23812c790dca9478bf5 Mon Sep 17 00:00:00 2001
From: Candace Park <56409205+parkiino@users.noreply.github.com>
Date: Fri, 26 Jun 2020 20:25:01 -0400
Subject: [PATCH 69/78] [SECURITY SOLUTION][INGEST] UX update for ingest
 manager edit/create datasource for endpoint (#70079)

[security solution][ingest]UX update for ingest manager edit/create datasource for endpoint
---
 .../components/endpoint/link_to_app.tsx       | 25 +++++--
 .../configure_datasource.tsx                  | 68 ++++++++++++-------
 2 files changed, 63 insertions(+), 30 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/components/endpoint/link_to_app.tsx b/x-pack/plugins/security_solution/public/common/components/endpoint/link_to_app.tsx
index d6d8859b280b..a12611ea2703 100644
--- a/x-pack/plugins/security_solution/public/common/components/endpoint/link_to_app.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/endpoint/link_to_app.tsx
@@ -5,10 +5,10 @@
  */
 
 import React, { memo, MouseEventHandler } from 'react';
-import { EuiLink, EuiLinkProps } from '@elastic/eui';
+import { EuiLink, EuiLinkProps, EuiButton, EuiButtonProps } from '@elastic/eui';
 import { useNavigateToAppEventHandler } from '../../hooks/endpoint/use_navigate_to_app_event_handler';
 
-type LinkToAppProps = EuiLinkProps & {
+type LinkToAppProps = (EuiLinkProps | EuiButtonProps) & {
   /** the app id - normally the value of the `id` in that plugin's `kibana.json`  */
   appId: string;
   /** Any app specific path (route) */
@@ -16,6 +16,8 @@ type LinkToAppProps = EuiLinkProps & {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   appState?: any;
   onClick?: MouseEventHandler<HTMLButtonElement | HTMLAnchorElement>;
+  /** Uses an EuiButton element for styling */
+  asButton?: boolean;
 };
 
 /**
@@ -23,13 +25,22 @@ type LinkToAppProps = EuiLinkProps & {
  * a given app without causing a full browser refresh
  */
 export const LinkToApp = memo<LinkToAppProps>(
-  ({ appId, appPath: path, appState: state, onClick, children, ...otherProps }) => {
+  ({ appId, appPath: path, appState: state, onClick, asButton, children, ...otherProps }) => {
     const handleOnClick = useNavigateToAppEventHandler(appId, { path, state, onClick });
+
     return (
-      // eslint-disable-next-line @elastic/eui/href-or-on-click
-      <EuiLink {...otherProps} onClick={handleOnClick}>
-        {children}
-      </EuiLink>
+      <>
+        {asButton && asButton === true ? (
+          <EuiButton {...(otherProps as EuiButtonProps)} onClick={handleOnClick}>
+            {children}
+          </EuiButton>
+        ) : (
+          // eslint-disable-next-line @elastic/eui/href-or-on-click
+          <EuiLink {...otherProps} onClick={handleOnClick}>
+            {children}
+          </EuiLink>
+        )}
+      </>
     );
   }
 );
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx
index 7b4dc36def13..df1591bf7877 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx
@@ -6,8 +6,8 @@
 
 import React, { memo } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { EuiEmptyPrompt, EuiText } from '@elastic/eui';
-import { useKibana } from '../../../../../../../../../src/plugins/kibana_react/public';
+import { EuiCallOut, EuiText, EuiTitle, EuiSpacer } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 import { LinkToApp } from '../../../../../common/components/endpoint/link_to_app';
 import {
   CustomConfigureDatasourceContent,
@@ -21,43 +21,65 @@ import { getPolicyDetailPath } from '../../../../common/routing';
  */
 export const ConfigureEndpointDatasource = memo<CustomConfigureDatasourceContent>(
   ({ from, datasourceId }: CustomConfigureDatasourceProps) => {
-    const { services } = useKibana();
     let policyUrl = '';
     if (from === 'edit' && datasourceId) {
       policyUrl = getPolicyDetailPath(datasourceId);
     }
 
     return (
-      <EuiEmptyPrompt
-        data-test-subj={`endpointDatasourceConfig_${from === 'edit' ? 'edit' : 'create'}`}
-        body={
-          <EuiText>
+      <>
+        <EuiTitle size="xs">
+          <h4>
+            <FormattedMessage
+              id="xpack.securitySolution.endpoint.ingestManager.policyConfiguration"
+              defaultMessage="Policy Configuration"
+            />
+          </h4>
+        </EuiTitle>
+        <EuiSpacer size="m" />
+        <EuiCallOut
+          data-test-subj={`endpointDatasourceConfig_${from === 'edit' ? 'edit' : 'create'}`}
+          iconType="iInCircle"
+          title={i18n.translate(
+            'xpack.securitySolution.endpoint.ingestManager.policyConfiguration.calloutTitle',
+            {
+              defaultMessage: 'Manage Policy configuration in the Security app',
+            }
+          )}
+        >
+          <EuiText size="s">
             <p>
               {from === 'edit' ? (
-                <LinkToApp
-                  data-test-subj="editLinkToPolicyDetails"
-                  appId="securitySolution:management"
-                  appPath={policyUrl}
-                  // Cannot use formalUrl here since the code is called in Ingest, which does not use redux
-                  href={`${services.application.getUrlForApp(
-                    'securitySolution:management'
-                  )}${policyUrl}`}
-                >
+                <>
                   <FormattedMessage
-                    id="xpack.securitySolution.endpoint.ingestManager.editDatasource.stepConfigure"
-                    defaultMessage="View and configure Security Policy"
+                    id="xpack.securitySolution.endpoint.ingestManager.editDatasource.endpointConfiguration"
+                    defaultMessage="You can make changes to the Policy Configuration in the Security app. Fleet will deploy changes to your agents whenever your Policy changes."
                   />
-                </LinkToApp>
+                  <EuiSpacer />
+                  <LinkToApp
+                    data-test-subj="editLinkToPolicyDetails"
+                    asButton={true}
+                    appId="securitySolution:management"
+                    className="editLinkToPolicyDetails"
+                    appPath={policyUrl}
+                    // Cannot use formalUrl here since the code is called in Ingest, which does not use redux
+                  >
+                    <FormattedMessage
+                      id="xpack.securitySolution.endpoint.ingestManager.editDatasource.configurePolicyLink"
+                      defaultMessage="Configure Policy"
+                    />
+                  </LinkToApp>
+                </>
               ) : (
                 <FormattedMessage
-                  id="xpack.securitySolution.endpoint.ingestManager.createDatasource.stepConfigure"
-                  defaultMessage="The recommended Security Policy has been associated with this data source. The Security Policy can be edited in the Security application once your data source has been saved."
+                  id="xpack.securitySolution.endpoint.ingestManager.createDatasource.endpointConfiguration"
+                  defaultMessage="Any agents that use this agent configuration will use a basic policy. You can make changes to this policy in the Security app, and Fleet will deploy those changes to your agents."
                 />
               )}
             </p>
           </EuiText>
-        }
-      />
+        </EuiCallOut>
+      </>
     );
   }
 );

From f4e7f14ffeb78d3e5cc266d542087bb60a0a5ecb Mon Sep 17 00:00:00 2001
From: Angela Chuang <6295984+angorayc@users.noreply.github.com>
Date: Sat, 27 Jun 2020 04:53:53 +0100
Subject: [PATCH 70/78] [SIEM] Import timeline fix (#65448)

* fix import timeline and clean up

fix unit tests

apply failure checker

clean up error message

fix update template

* add unit tests

* clean up common libs

* rename variables

* add unit tests

* fix types

* Fix imports

* rename file

* poc

* fix unit test

* review

* cleanup fallback values

* cleanup

* check if title exists

* fix unit test

* add unit test

* lint error

* put the flag for disableTemplate into common

* add immutiable

* fix unit

* check templateTimelineVersion only when update via import

* update template timeline via import with response

* add template filter

* add filter count

* add filter numbers

* rename

* enable pin events and note under active status

* disable comment and pinnedEvents for template timelines

* add timelineType for openTimeline

* enable note icon for template

* add timeline type for propertyLeft

* fix types

* duplicate elastic template

* update schema

* fix status check

* fix import

* add templateTimelineType

* disable note for immutable timeline

* fix unit

* fix error message

* fix update

* fix types

* rollback change

* rollback change

* fix create template timeline

* add i18n for error message

* fix unit test

* fix wording and disable delete btn for immutable timeline

* fix unit test provider

* fix types

* fix toaster

* fix notes and pins

* add i18n

* fix selected items

* set disableTemplateto true

* move templateInfo to helper

* review + imporvement

* fix review

* fix types

* fix types

Co-authored-by: Patryk Kopycinski <contact@patrykkopycinski.com>
Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>
---
 .../security_solution/common/constants.ts     |   8 +-
 .../common/types/timeline/index.ts            |  32 +
 .../components/alerts_table/actions.test.tsx  |   4 +-
 .../index.test.tsx                            |  17 +-
 .../error_toast_dispatcher/index.test.tsx     |  17 +-
 .../common/components/inspect/index.test.tsx  |  25 +-
 .../components/stat_items/index.test.tsx      |   9 +-
 .../super_date_picker/index.test.tsx          |  17 +-
 .../common/components/top_n/index.test.tsx    |   9 +-
 .../common/lib/compose/kibana_compose.tsx     |   2 +-
 .../mock/endpoint/app_context_render.tsx      |  25 +-
 .../public/common/mock/kibana_react.ts        |  33 +
 .../public/common/mock/test_providers.tsx     |  19 +-
 .../public/common/store/store.ts              |   3 +
 .../public/common/store/types.ts              |  21 +-
 .../view/test_helpers/render_alert_page.tsx   |   9 +-
 .../public/graphql/introspection.json         |  78 +-
 .../security_solution/public/graphql/types.ts |  32 +
 .../authentications_table/index.test.tsx      |  17 +-
 .../components/hosts_table/index.test.tsx     |  17 +-
 .../public/hosts/pages/hosts.test.tsx         |   9 +-
 .../components/ip_overview/index.test.tsx     |  17 +-
 .../components/kpi_network/index.test.tsx     |  17 +-
 .../network_dns_table/index.test.tsx          |  17 +-
 .../network_http_table/index.test.tsx         |  17 +-
 .../index.test.tsx                            |  17 +-
 .../network_top_n_flow_table/index.test.tsx   |  17 +-
 .../components/tls_table/index.test.tsx       |  17 +-
 .../components/users_table/index.test.tsx     |  17 +-
 .../network/pages/ip_details/index.test.tsx   |  20 +-
 .../public/network/pages/network.test.tsx     |   9 +-
 .../components/overview_host/index.test.tsx   |  17 +-
 .../overview_network/index.test.tsx           |  17 +-
 .../components/recent_timelines/index.tsx     |  39 +-
 .../security_solution/public/plugin.tsx       |  16 +-
 .../components/flyout/header/index.tsx        |   4 +
 .../__snapshots__/index.test.tsx.snap         |   1 +
 .../header_with_close_button/index.test.tsx   |  23 +-
 .../components/flyout/index.test.tsx          |   5 +
 .../components/notes/add_note/index.test.tsx  | 180 ++--
 .../components/notes/add_note/index.tsx       |   1 -
 .../timelines/components/notes/index.tsx      |  21 +-
 .../notes/note_cards/index.test.tsx           |  65 +-
 .../components/notes/note_cards/index.tsx     |   3 +
 .../edit_timeline_batch_actions.tsx           |  11 +-
 .../export_timeline/export_timeline.test.tsx  |  27 -
 .../export_timeline/index.test.tsx            |  44 +-
 .../open_timeline/export_timeline/index.tsx   |  24 +-
 .../components/open_timeline/helpers.ts       | 192 +++--
 .../components/open_timeline/index.tsx        |  94 +-
 .../open_timeline/open_timeline.test.tsx      |   4 +-
 .../open_timeline/open_timeline.tsx           |  36 +-
 .../open_timeline_modal_body.test.tsx         |   4 +-
 .../open_timeline_modal_body.tsx              |  22 +-
 .../open_timeline/search_row/index.tsx        |  15 +-
 .../timelines_table/actions_columns.tsx       |   8 +-
 .../timelines_table/icon_header_columns.tsx   | 105 ++-
 .../open_timeline/timelines_table/index.tsx   |   8 +-
 .../open_timeline/timelines_table/mocks.ts    |   2 +
 .../components/open_timeline/translations.ts  |  23 +-
 .../components/open_timeline/types.ts         |  30 +-
 .../open_timeline/use_timeline_status.tsx     | 110 +++
 .../open_timeline/use_timeline_types.tsx      | 116 +--
 .../__snapshots__/timeline.test.tsx.snap      |   1 +
 .../timeline/body/actions/index.test.tsx      |  13 +-
 .../timeline/body/actions/index.tsx           | 168 ++--
 .../timeline/body/events/stateful_event.tsx   |   9 +-
 .../components/timeline/body/helpers.test.ts  |  29 +-
 .../components/timeline/body/helpers.ts       |  12 +-
 .../components/timeline/body/index.test.tsx   | 240 ++----
 .../components/timeline/body/translations.ts  |  14 +
 .../components/timeline/header/index.test.tsx |  82 +-
 .../components/timeline/header/index.tsx      |  19 +-
 .../timeline/header/translations.ts           |   8 +
 .../components/timeline/index.test.tsx        |   3 +
 .../timelines/components/timeline/index.tsx   |  10 +-
 .../components/timeline/pin/index.tsx         |  26 +-
 .../timeline/properties/helpers.tsx           |  44 +-
 .../timeline/properties/index.test.tsx        |  56 +-
 .../components/timeline/properties/index.tsx  |   9 +-
 .../properties/new_template_timeline.test.tsx |   9 +-
 .../timeline/properties/properties_left.tsx   |   9 +
 .../properties/properties_right.test.tsx      |   3 +-
 .../timeline/properties/properties_right.tsx  |   8 +-
 .../timeline/properties/translations.ts       |   2 +-
 .../selectable_timeline/index.test.tsx        |   8 +-
 .../timeline/selectable_timeline/index.tsx    |  45 +-
 .../components/timeline/timeline.test.tsx     |   2 +
 .../components/timeline/timeline.tsx          |   4 +
 .../containers/all/index.gql_query.ts         |   9 +
 .../public/timelines/containers/all/index.tsx |  61 +-
 .../public/timelines/containers/api.test.ts   |   7 +-
 .../public/timelines/containers/api.ts        |  65 +-
 .../public/timelines/pages/translations.ts    |  14 +
 .../timelines/store/timeline/actions.ts       |   2 +
 .../public/timelines/store/timeline/epic.ts   |  60 +-
 .../timeline/epic_local_storage.test.tsx      |  19 +-
 .../timelines/store/timeline/helpers.ts       |  57 +-
 .../store/timeline/manage_timeline_id.tsx     |  18 +
 .../public/timelines/store/timeline/model.ts  |   1 -
 .../timelines/store/timeline/reducer.ts       |  38 +-
 .../public/timelines/store/timeline/types.ts  |   3 +
 .../plugins/security_solution/public/types.ts |   5 +
 .../server/graphql/timeline/resolvers.ts      |   4 +-
 .../server/graphql/timeline/schema.gql.ts     |  13 +-
 .../security_solution/server/graphql/types.ts |  67 ++
 .../server/lib/detection_engine/README.md     |   4 +-
 .../lib/timeline/pick_saved_timeline.ts       |  20 +-
 .../routes/__mocks__/import_timelines.ts      |  56 +-
 .../routes/__mocks__/request_responses.ts     |  16 +-
 .../routes/clean_draft_timelines_route.ts     |  12 +-
 .../routes/create_timelines_route.test.ts     |  10 +-
 .../timeline/routes/create_timelines_route.ts |  85 +-
 .../routes/import_timelines_route.test.ts     | 517 ++++++++++-
 .../timeline/routes/import_timelines_route.ts | 157 ++--
 .../routes/update_timelines_route.test.ts     |   8 +-
 .../timeline/routes/update_timelines_route.ts |  85 +-
 .../lib/timeline/routes/utils/common.ts       |  21 +-
 .../utils/compare_timelines_status.test.ts    | 810 ++++++++++++++++++
 .../routes/utils/compare_timelines_status.ts  | 247 ++++++
 .../timeline/routes/utils/create_timelines.ts |  47 +-
 .../timeline/routes/utils/export_timelines.ts |   8 +-
 .../timeline/routes/utils/failure_cases.ts    | 377 ++++++++
 .../timeline/routes/utils/timeline_object.ts  |  86 ++
 .../timeline/routes/utils/update_timelines.ts |  80 --
 .../server/lib/timeline/saved_object.ts       | 144 +++-
 126 files changed, 4536 insertions(+), 1365 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/timelines/components/open_timeline/use_timeline_status.tsx
 create mode 100644 x-pack/plugins/security_solution/server/lib/timeline/routes/utils/compare_timelines_status.test.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/timeline/routes/utils/compare_timelines_status.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/timeline/routes/utils/failure_cases.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/timeline/routes/utils/timeline_object.ts
 delete mode 100644 x-pack/plugins/security_solution/server/lib/timeline/routes/utils/update_timelines.ts

diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 58431e405ea8..4aff1c81c40f 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -158,6 +158,12 @@ export const showAllOthersBucket: string[] = [
 
 /**
  * CreateTemplateTimelineBtn
+ * https://github.com/elastic/kibana/pull/66613
  * Remove the comment here to enable template timeline
  */
-export const disableTemplate = true;
+export const disableTemplate = false;
+
+/*
+ * This should be set to true after https://github.com/elastic/kibana/pull/67496 is merged
+ */
+export const enableElasticFilter = false;
diff --git a/x-pack/plugins/security_solution/common/types/timeline/index.ts b/x-pack/plugins/security_solution/common/types/timeline/index.ts
index 4f255bb6d683..2cf5930a83be 100644
--- a/x-pack/plugins/security_solution/common/types/timeline/index.ts
+++ b/x-pack/plugins/security_solution/common/types/timeline/index.ts
@@ -137,11 +137,13 @@ const SavedSortRuntimeType = runtimeTypes.partial({
 export enum TimelineStatus {
   active = 'active',
   draft = 'draft',
+  immutable = 'immutable',
 }
 
 export const TimelineStatusLiteralRt = runtimeTypes.union([
   runtimeTypes.literal(TimelineStatus.active),
   runtimeTypes.literal(TimelineStatus.draft),
+  runtimeTypes.literal(TimelineStatus.immutable),
 ]);
 
 const TimelineStatusLiteralWithNullRt = unionWithNullType(TimelineStatusLiteralRt);
@@ -151,6 +153,29 @@ export type TimelineStatusLiteralWithNull = runtimeTypes.TypeOf<
   typeof TimelineStatusLiteralWithNullRt
 >;
 
+/**
+ * Template timeline type
+ */
+
+export enum TemplateTimelineType {
+  elastic = 'elastic',
+  custom = 'custom',
+}
+
+export const TemplateTimelineTypeLiteralRt = runtimeTypes.union([
+  runtimeTypes.literal(TemplateTimelineType.elastic),
+  runtimeTypes.literal(TemplateTimelineType.custom),
+]);
+
+export const TemplateTimelineTypeLiteralWithNullRt = unionWithNullType(
+  TemplateTimelineTypeLiteralRt
+);
+
+export type TemplateTimelineTypeLiteral = runtimeTypes.TypeOf<typeof TemplateTimelineTypeLiteralRt>;
+export type TemplateTimelineTypeLiteralWithNull = runtimeTypes.TypeOf<
+  typeof TemplateTimelineTypeLiteralWithNullRt
+>;
+
 /*
  *  Timeline Types
  */
@@ -273,6 +298,13 @@ export const TimelineResponseType = runtimeTypes.type({
   }),
 });
 
+export const TimelineErrorResponseType = runtimeTypes.type({
+  status_code: runtimeTypes.number,
+  message: runtimeTypes.string,
+});
+
+export interface TimelineErrorResponse
+  extends runtimeTypes.TypeOf<typeof TimelineErrorResponseType> {}
 export interface TimelineResponse extends runtimeTypes.TypeOf<typeof TimelineResponseType> {}
 
 /**
diff --git a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/actions.test.tsx b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/actions.test.tsx
index 2fa7cfeedcd1..bd62b79a3c54 100644
--- a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/actions.test.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/actions.test.tsx
@@ -215,8 +215,8 @@ describe('alert actions', () => {
               columnId: '@timestamp',
               sortDirection: 'desc',
             },
-            status: TimelineStatus.draft,
-            title: '',
+            status: TimelineStatus.active,
+            title: 'Test rule - Duplicate',
             timelineType: TimelineType.default,
             templateTimelineId: null,
             templateTimelineVersion: null,
diff --git a/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
index c7015ed81701..9c08e05ddfa3 100644
--- a/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
@@ -12,6 +12,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../mock';
 import { createStore, State } from '../../store';
@@ -35,10 +36,22 @@ jest.mock('../../lib/kibana', () => ({
 describe('AddFilterToGlobalSearchBar Component', () => {
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
     mockAddFilters.mockClear();
   });
 
diff --git a/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx
index 4bc77555f09b..45b75d0f33ac 100644
--- a/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx
@@ -12,6 +12,7 @@ import {
   apolloClientObservable,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../mock';
 import { createStore } from '../../store/store';
@@ -22,10 +23,22 @@ import { State } from '../../store/types';
 describe('Error Toast Dispatcher', () => {
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx
index 45397921a665..f2b7d4597262 100644
--- a/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx
@@ -14,6 +14,7 @@ import {
   mockGlobalState,
   apolloClientObservable,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../mock';
 import { createStore, State } from '../../store';
@@ -36,13 +37,25 @@ describe('Inspect Button', () => {
     state: state.inputs,
   };
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   describe('Render', () => {
     beforeEach(() => {
       const myState = cloneDeep(state);
       myState.inputs = upsertQuery(newQuery);
-      store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+      store = createStore(
+        myState,
+        SUB_PLUGINS_REDUCER,
+        apolloClientObservable,
+        kibanaObservable,
+        storage
+      );
     });
     test('Eui Empty Button', () => {
       const wrapper = mount(
@@ -146,7 +159,13 @@ describe('Inspect Button', () => {
         response: ['my response'],
       };
       myState.inputs = upsertQuery(myQuery);
-      store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+      store = createStore(
+        myState,
+        SUB_PLUGINS_REDUCER,
+        apolloClientObservable,
+        kibanaObservable,
+        storage
+      );
     });
     test('Open Inspect Modal', () => {
       const wrapper = mount(
diff --git a/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
index 50721ef3b26a..f548275b36e7 100644
--- a/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
@@ -34,6 +34,7 @@ import {
   mockGlobalState,
   apolloClientObservable,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../mock';
 import { State, createStore } from '../../store';
@@ -55,7 +56,13 @@ describe('Stat Items Component', () => {
   const theme = () => ({ eui: euiDarkVars, darkMode: true });
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  const store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  const store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   describe.each([
     [
diff --git a/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx
index 19321622d75f..164ca177ee91 100644
--- a/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx
@@ -14,6 +14,7 @@ import {
   apolloClientObservable,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../mock';
 import { createUseUiSetting$Mock } from '../../mock/kibana_react';
@@ -81,11 +82,23 @@ describe('SIEM Super Date Picker', () => {
   describe('#SuperDatePicker', () => {
     const state: State = mockGlobalState;
     const { storage } = createSecuritySolutionStorageMock();
-    let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    let store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
 
     beforeEach(() => {
       jest.clearAllMocks();
-      store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+      store = createStore(
+        state,
+        SUB_PLUGINS_REDUCER,
+        apolloClientObservable,
+        kibanaObservable,
+        storage
+      );
       mockUseUiSetting$.mockImplementation((key, defaultValue) => {
         const useUiSetting$Mock = createUseUiSetting$Mock();
 
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
index ae25e66b2af8..336f906b3bed 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
@@ -13,6 +13,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../mock';
 import { createKibanaCoreStartMock } from '../../mock/kibana_core';
@@ -156,7 +157,13 @@ const state: State = {
 };
 
 const { storage } = createSecuritySolutionStorageMock();
-const store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+const store = createStore(
+  state,
+  SUB_PLUGINS_REDUCER,
+  apolloClientObservable,
+  kibanaObservable,
+  storage
+);
 
 describe('StatefulTopN', () => {
   // Suppress warnings about "react-beautiful-dnd"
diff --git a/x-pack/plugins/security_solution/public/common/lib/compose/kibana_compose.tsx b/x-pack/plugins/security_solution/public/common/lib/compose/kibana_compose.tsx
index 47834f148c91..342db7f43943 100644
--- a/x-pack/plugins/security_solution/public/common/lib/compose/kibana_compose.tsx
+++ b/x-pack/plugins/security_solution/public/common/lib/compose/kibana_compose.tsx
@@ -9,10 +9,10 @@ import ApolloClient from 'apollo-client';
 import { ApolloLink } from 'apollo-link';
 
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { CoreStart } from '../../../../../../../src/core/public';
 import introspectionQueryResultData from '../../../graphql/introspection.json';
 import { AppFrontendLibs } from '../lib';
 import { getLinks } from './helpers';
+import { CoreStart } from '../../../../../../../src/core/public';
 
 export function composeLibs(core: CoreStart): AppFrontendLibs {
   const cache = new InMemoryCache({
diff --git a/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx b/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
index 1db63897a886..779d5eff0b97 100644
--- a/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
@@ -13,7 +13,7 @@ import { coreMock } from '../../../../../../../src/core/public/mocks';
 import { StartPlugins } from '../../../types';
 import { depsStartMock } from './dependencies_start_mock';
 import { MiddlewareActionSpyHelper, createSpyMiddleware } from '../../store/test_utils';
-import { apolloClientObservable } from '../test_providers';
+import { apolloClientObservable, kibanaObservable } from '../test_providers';
 import { createStore, State, substateMiddlewareFactory } from '../../store';
 import { alertMiddlewareFactory } from '../../../endpoint_alerts/store/middleware';
 import { AppRootProvider } from './app_root_provider';
@@ -58,14 +58,21 @@ export const createAppRootMockRenderer = (): AppContextTestRender => {
   const middlewareSpy = createSpyMiddleware();
   const { storage } = createSecuritySolutionStorageMock();
 
-  const store = createStore(mockGlobalState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage, [
-    substateMiddlewareFactory(
-      (globalState) => globalState.alertList,
-      alertMiddlewareFactory(coreStart, depsStart)
-    ),
-    ...managementMiddlewareFactory(coreStart, depsStart),
-    middlewareSpy.actionSpyMiddleware,
-  ]);
+  const store = createStore(
+    mockGlobalState,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage,
+    [
+      substateMiddlewareFactory(
+        (globalState) => globalState.alertList,
+        alertMiddlewareFactory(coreStart, depsStart)
+      ),
+      ...managementMiddlewareFactory(coreStart, depsStart),
+      middlewareSpy.actionSpyMiddleware,
+    ]
+  );
 
   const MockKibanaContextProvider = createKibanaContextProviderMock();
 
diff --git a/x-pack/plugins/security_solution/public/common/mock/kibana_react.ts b/x-pack/plugins/security_solution/public/common/mock/kibana_react.ts
index 2b639bfdc14f..c5d50e137948 100644
--- a/x-pack/plugins/security_solution/public/common/mock/kibana_react.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/kibana_react.ts
@@ -26,6 +26,7 @@ import {
   DEFAULT_INDEX_PATTERN,
 } from '../../../common/constants';
 import { createKibanaCoreStartMock, createKibanaPluginsStartMock } from './kibana_core';
+import { StartServices } from '../../types';
 import { createSecuritySolutionStorageMock } from './mock_local_storage';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -71,6 +72,8 @@ export const createUseUiSetting$Mock = () => {
   ): [T, () => void] | undefined => [useUiSettingMock(key, defaultValue), jest.fn()];
 };
 
+export const createKibanaObservable$Mock = createKibanaCoreStartMock;
+
 export const createUseKibanaMock = () => {
   const core = createKibanaCoreStartMock();
   const plugins = createKibanaPluginsStartMock();
@@ -90,6 +93,36 @@ export const createUseKibanaMock = () => {
   return () => ({ services });
 };
 
+export const createStartServices = () => {
+  const core = createKibanaCoreStartMock();
+  const plugins = createKibanaPluginsStartMock();
+  const security = {
+    authc: {
+      getCurrentUser: jest.fn(),
+      areAPIKeysEnabled: jest.fn(),
+    },
+    sessionTimeout: {
+      start: jest.fn(),
+      stop: jest.fn(),
+      extend: jest.fn(),
+    },
+    license: {
+      isEnabled: jest.fn(),
+      getFeatures: jest.fn(),
+      features$: jest.fn(),
+    },
+    __legacyCompat: { logoutUrl: 'logoutUrl', tenant: 'tenant' },
+  };
+
+  const services = ({
+    ...core,
+    ...plugins,
+    security,
+  } as unknown) as StartServices;
+
+  return services;
+};
+
 export const createWithKibanaMock = () => {
   const kibana = createUseKibanaMock()();
 
diff --git a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
index 0573f049c35c..297dc235a2a5 100644
--- a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
@@ -19,7 +19,7 @@ import { ThemeProvider } from 'styled-components';
 
 import { createStore, State } from '../store';
 import { mockGlobalState } from './global_state';
-import { createKibanaContextProviderMock } from './kibana_react';
+import { createKibanaContextProviderMock, createStartServices } from './kibana_react';
 import { FieldHook, useForm } from '../../shared_imports';
 import { SUB_PLUGINS_REDUCER } from './utils';
 import { createSecuritySolutionStorageMock, localStorageMock } from './mock_local_storage';
@@ -38,6 +38,7 @@ export const apolloClient = new ApolloClient({
 });
 
 export const apolloClientObservable = new BehaviorSubject(apolloClient);
+export const kibanaObservable = new BehaviorSubject(createStartServices());
 
 Object.defineProperty(window, 'localStorage', {
   value: localStorageMock(),
@@ -49,7 +50,13 @@ const { storage } = createSecuritySolutionStorageMock();
 /** A utility for wrapping children in the providers required to run most tests */
 const TestProvidersComponent: React.FC<Props> = ({
   children,
-  store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage),
+  store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  ),
   onDragEnd = jest.fn(),
 }) => (
   <I18nProvider>
@@ -69,7 +76,13 @@ export const TestProviders = React.memo(TestProvidersComponent);
 
 const TestProviderWithoutDragAndDropComponent: React.FC<Props> = ({
   children,
-  store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage),
+  store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  ),
 }) => (
   <I18nProvider>
     <ReduxStoreProvider store={store}>{children}</ReduxStoreProvider>
diff --git a/x-pack/plugins/security_solution/public/common/store/store.ts b/x-pack/plugins/security_solution/public/common/store/store.ts
index 5f53724b287d..a39c9f18bcdb 100644
--- a/x-pack/plugins/security_solution/public/common/store/store.ts
+++ b/x-pack/plugins/security_solution/public/common/store/store.ts
@@ -29,6 +29,7 @@ import { AppAction } from './actions';
 import { Immutable } from '../../../common/endpoint/types';
 import { State } from './types';
 import { Storage } from '../../../../../../src/plugins/kibana_utils/public';
+import { CoreStart } from '../../../../../../src/core/public';
 
 type ComposeType = typeof compose;
 declare global {
@@ -49,6 +50,7 @@ export const createStore = (
   state: PreloadedState<State>,
   pluginsReducer: SubPluginsInitReducer,
   apolloClient: Observable<AppApolloClient>,
+  kibana: Observable<CoreStart>,
   storage: Storage,
   additionalMiddleware?: Array<Middleware<{}, State, Dispatch<AppAction | Immutable<AppAction>>>>
 ): Store<State, Action> => {
@@ -56,6 +58,7 @@ export const createStore = (
 
   const middlewareDependencies = {
     apolloClient$: apolloClient,
+    kibana$: kibana,
     selectAllTimelineQuery: inputsSelectors.globalQueryByIdSelector,
     selectNotesByIdSelector: appSelectors.selectNotesByIdSelector,
     timelineByIdSelector: timelineSelectors.timelineByIdSelector,
diff --git a/x-pack/plugins/security_solution/public/common/store/types.ts b/x-pack/plugins/security_solution/public/common/store/types.ts
index 2b92451e3011..d1e8df0f982c 100644
--- a/x-pack/plugins/security_solution/public/common/store/types.ts
+++ b/x-pack/plugins/security_solution/public/common/store/types.ts
@@ -19,23 +19,22 @@ import { NetworkPluginState } from '../../network/store';
 import { EndpointAlertsPluginState } from '../../endpoint_alerts';
 import { ManagementPluginState } from '../../management';
 
+export type StoreState = HostsPluginState &
+  NetworkPluginState &
+  TimelinePluginState &
+  EndpointAlertsPluginState &
+  ManagementPluginState & {
+    app: AppState;
+    dragAndDrop: DragAndDropState;
+    inputs: InputsState;
+  };
 /**
  * The redux `State` type for the Security App.
  * We use `CombinedState` to wrap our shape because we create our reducer using `combineReducers`.
  * `combineReducers` returns a type wrapped in `CombinedState`.
  * `CombinedState` is required for redux to know what keys to make optional when preloaded state into a store.
  */
-export type State = CombinedState<
-  HostsPluginState &
-    NetworkPluginState &
-    TimelinePluginState &
-    EndpointAlertsPluginState &
-    ManagementPluginState & {
-      app: AppState;
-      dragAndDrop: DragAndDropState;
-      inputs: InputsState;
-    }
->;
+export type State = CombinedState<StoreState>;
 
 export type KueryFilterQueryKind = 'kuery' | 'lucene';
 
diff --git a/x-pack/plugins/security_solution/public/endpoint_alerts/view/test_helpers/render_alert_page.tsx b/x-pack/plugins/security_solution/public/endpoint_alerts/view/test_helpers/render_alert_page.tsx
index acfe3f228c21..f03c72518305 100644
--- a/x-pack/plugins/security_solution/public/endpoint_alerts/view/test_helpers/render_alert_page.tsx
+++ b/x-pack/plugins/security_solution/public/endpoint_alerts/view/test_helpers/render_alert_page.tsx
@@ -19,6 +19,7 @@ import {
   SUB_PLUGINS_REDUCER,
   mockGlobalState,
   apolloClientObservable,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 
@@ -31,7 +32,13 @@ export const alertPageTestRender = () => {
    * Create a store, with the middleware disabled. We don't want side effects being created by our code in this test.
    */
   const { storage } = createSecuritySolutionStorageMock();
-  const store = createStore(mockGlobalState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  const store = createStore(
+    mockGlobalState,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   const depsStart = depsStartMock();
   depsStart.data.ui.SearchBar.mockImplementation(() => <div />);
diff --git a/x-pack/plugins/security_solution/public/graphql/introspection.json b/x-pack/plugins/security_solution/public/graphql/introspection.json
index 48547212bb6c..69356f8fc8aa 100644
--- a/x-pack/plugins/security_solution/public/graphql/introspection.json
+++ b/x-pack/plugins/security_solution/public/graphql/introspection.json
@@ -255,6 +255,18 @@
                 "description": "",
                 "type": { "kind": "ENUM", "name": "TimelineType", "ofType": null },
                 "defaultValue": null
+              },
+              {
+                "name": "templateTimelineType",
+                "description": "",
+                "type": { "kind": "ENUM", "name": "TemplateTimelineType", "ofType": null },
+                "defaultValue": null
+              },
+              {
+                "name": "status",
+                "description": "",
+                "type": { "kind": "ENUM", "name": "TimelineStatus", "ofType": null },
+                "defaultValue": null
               }
             ],
             "type": {
@@ -10405,7 +10417,13 @@
         "interfaces": null,
         "enumValues": [
           { "name": "active", "description": "", "isDeprecated": false, "deprecationReason": null },
-          { "name": "draft", "description": "", "isDeprecated": false, "deprecationReason": null }
+          { "name": "draft", "description": "", "isDeprecated": false, "deprecationReason": null },
+          {
+            "name": "immutable",
+            "description": "",
+            "isDeprecated": false,
+            "deprecationReason": null
+          }
         ],
         "possibleTypes": null
       },
@@ -10529,6 +10547,24 @@
         ],
         "possibleTypes": null
       },
+      {
+        "kind": "ENUM",
+        "name": "TemplateTimelineType",
+        "description": "",
+        "fields": null,
+        "inputFields": null,
+        "interfaces": null,
+        "enumValues": [
+          {
+            "name": "elastic",
+            "description": "",
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          { "name": "custom", "description": "", "isDeprecated": false, "deprecationReason": null }
+        ],
+        "possibleTypes": null
+      },
       {
         "kind": "OBJECT",
         "name": "ResponseTimelines",
@@ -10557,6 +10593,46 @@
             "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
             "isDeprecated": false,
             "deprecationReason": null
+          },
+          {
+            "name": "defaultTimelineCount",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "templateTimelineCount",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "elasticTemplateTimelineCount",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "customTemplateTimelineCount",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "favoriteCount",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
           }
         ],
         "inputFields": null,
diff --git a/x-pack/plugins/security_solution/public/graphql/types.ts b/x-pack/plugins/security_solution/public/graphql/types.ts
index b5088fe51b44..1171e9379353 100644
--- a/x-pack/plugins/security_solution/public/graphql/types.ts
+++ b/x-pack/plugins/security_solution/public/graphql/types.ts
@@ -345,6 +345,7 @@ export enum TlsFields {
 export enum TimelineStatus {
   active = 'active',
   draft = 'draft',
+  immutable = 'immutable',
 }
 
 export enum TimelineType {
@@ -359,6 +360,11 @@ export enum SortFieldTimeline {
   created = 'created',
 }
 
+export enum TemplateTimelineType {
+  elastic = 'elastic',
+  custom = 'custom',
+}
+
 export enum NetworkDirectionEcs {
   inbound = 'inbound',
   outbound = 'outbound',
@@ -2117,6 +2123,16 @@ export interface ResponseTimelines {
   timeline: (Maybe<TimelineResult>)[];
 
   totalCount?: Maybe<number>;
+
+  defaultTimelineCount?: Maybe<number>;
+
+  templateTimelineCount?: Maybe<number>;
+
+  elasticTemplateTimelineCount?: Maybe<number>;
+
+  customTemplateTimelineCount?: Maybe<number>;
+
+  favoriteCount?: Maybe<number>;
 }
 
 export interface Mutation {
@@ -2254,6 +2270,10 @@ export interface GetAllTimelineQueryArgs {
   onlyUserFavorite?: Maybe<boolean>;
 
   timelineType?: Maybe<TimelineType>;
+
+  templateTimelineType?: Maybe<TemplateTimelineType>;
+
+  status?: Maybe<TimelineStatus>;
 }
 export interface AuthenticationsSourceArgs {
   timerange: TimerangeInput;
@@ -4315,6 +4335,8 @@ export namespace GetAllTimeline {
     sort?: Maybe<SortTimeline>;
     onlyUserFavorite?: Maybe<boolean>;
     timelineType?: Maybe<TimelineType>;
+    templateTimelineType?: Maybe<TemplateTimelineType>;
+    status?: Maybe<TimelineStatus>;
   };
 
   export type Query = {
@@ -4328,6 +4350,16 @@ export namespace GetAllTimeline {
 
     totalCount: Maybe<number>;
 
+    defaultTimelineCount: Maybe<number>;
+
+    templateTimelineCount: Maybe<number>;
+
+    elasticTemplateTimelineCount: Maybe<number>;
+
+    customTemplateTimelineCount: Maybe<number>;
+
+    favoriteCount: Maybe<number>;
+
     timeline: (Maybe<Timeline>)[];
   };
 
diff --git a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx
index 3809d848759c..9603f30615a1 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx
@@ -13,6 +13,7 @@ import {
   apolloClientObservable,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { createStore, State } from '../../../common/store';
@@ -26,10 +27,22 @@ describe('Authentication Table Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx b/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx
index 1231c35f2146..ab00e77a4fa4 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx
@@ -15,6 +15,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
@@ -40,11 +41,23 @@ describe('Hosts Table', () => {
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
index ea0b32137eb3..1ea3a3020a1d 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
@@ -16,6 +16,7 @@ import {
   TestProviders,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../common/mock';
 import { SiemNavigation } from '../../common/components/navigation';
@@ -154,7 +155,13 @@ describe('Hosts - rendering', () => {
     });
     const myState: State = mockGlobalState;
     const { storage } = createSecuritySolutionStorageMock();
-    const myStore = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    const myStore = createStore(
+      myState,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
     const wrapper = mount(
       <TestProviders store={myStore}>
         <Router history={mockHistory}>
diff --git a/x-pack/plugins/security_solution/public/network/components/ip_overview/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/ip_overview/index.test.tsx
index 553cb8c63db9..b8d97f06bf85 100644
--- a/x-pack/plugins/security_solution/public/network/components/ip_overview/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/ip_overview/index.test.tsx
@@ -14,6 +14,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { createStore, State } from '../../../common/store';
@@ -28,10 +29,22 @@ describe('IP Overview Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
index 580a5420f1c3..8acd17d2ce76 100644
--- a/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
@@ -12,6 +12,7 @@ import {
   apolloClientObservable,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { createStore, State } from '../../../common/store';
@@ -25,10 +26,22 @@ describe('KpiNetwork Component', () => {
   const narrowDateRange = jest.fn();
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx
index 036ebedd6b88..bbbe56715d34 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx
@@ -15,6 +15,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { State, createStore } from '../../../common/store';
@@ -28,11 +29,23 @@ describe('NetworkTopNFlow Table Component', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx
index ac37aaf30915..72c932c575be 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx
@@ -15,6 +15,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
@@ -31,11 +32,23 @@ describe('NetworkHttp Table Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
index 8b1dbc8c558b..a1ee0574d8b0 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
@@ -17,6 +17,7 @@ import {
   mockIndexPattern,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
@@ -32,10 +33,22 @@ describe('NetworkTopCountries Table Component', () => {
   const mount = useMountAppended();
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx
index b14d411810de..100ecaa51f4a 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx
@@ -16,6 +16,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
@@ -31,11 +32,23 @@ describe('NetworkTopNFlow Table Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx
index acbe974f914d..cd2dc926c03b 100644
--- a/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx
@@ -15,6 +15,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
@@ -28,11 +29,23 @@ describe('Tls Table Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('Rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx
index f0d4d7fbeefc..3f1762cadd65 100644
--- a/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx
@@ -16,6 +16,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
@@ -30,11 +31,23 @@ describe('Users Table Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   describe('Rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx b/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx
index a87eb3d05744..962a6269f848 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx
@@ -18,6 +18,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
@@ -90,7 +91,6 @@ const getMockProps = (ip: string) => ({
 
 describe('Ip Details', () => {
   const mount = useMountAppended();
-
   beforeAll(() => {
     (useWithSource as jest.Mock).mockReturnValue({
       indicesExist: false,
@@ -107,15 +107,27 @@ describe('Ip Details', () => {
   });
 
   afterAll(() => {
-    delete (global as GlobalWithFetch).fetch;
+    jest.resetAllMocks();
   });
 
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   test('it renders', () => {
diff --git a/x-pack/plugins/security_solution/public/network/pages/network.test.tsx b/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
index 7cdfdbf0af69..af84e1d42b45 100644
--- a/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
@@ -16,6 +16,7 @@ import {
   mockGlobalState,
   apolloClientObservable,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../common/mock';
 import { State, createStore } from '../../common/store';
@@ -139,7 +140,13 @@ describe('rendering - rendering', () => {
     });
     const myState: State = mockGlobalState;
     const { storage } = createSecuritySolutionStorageMock();
-    const myStore = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    const myStore = createStore(
+      myState,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
     const wrapper = mount(
       <TestProviders store={myStore}>
         <Router history={mockHistory}>
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
index d29efa2d44c1..2b21385004a7 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
@@ -14,6 +14,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 
@@ -95,11 +96,23 @@ describe('OverviewHost', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   beforeEach(() => {
     const myState = cloneDeep(state);
-    store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      myState,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   test('it renders the expected widget title', () => {
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
index b4b685465dbd..7a9834ee3ea9 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
@@ -14,6 +14,7 @@ import {
   TestProviders,
   SUB_PLUGINS_REDUCER,
   createSecuritySolutionStorageMock,
+  kibanaObservable,
 } from '../../../common/mock';
 
 import { OverviewNetwork } from '.';
@@ -86,11 +87,23 @@ describe('OverviewNetwork', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   beforeEach(() => {
     const myState = cloneDeep(state);
-    store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      myState,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
   });
 
   test('it renders the expected widget title', () => {
diff --git a/x-pack/plugins/security_solution/public/overview/components/recent_timelines/index.tsx b/x-pack/plugins/security_solution/public/overview/components/recent_timelines/index.tsx
index 9c149a850bec..8f2b3c7495f0 100644
--- a/x-pack/plugins/security_solution/public/overview/components/recent_timelines/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/recent_timelines/index.tsx
@@ -24,6 +24,7 @@ import { RecentTimelines } from './recent_timelines';
 import * as i18n from './translations';
 import { FilterMode } from './types';
 import { LoadingPlaceholders } from '../loading_placeholders';
+import { useTimelineStatus } from '../../../timelines/components/open_timeline/use_timeline_status';
 import { useKibana } from '../../../common/lib/kibana';
 import { SecurityPageName } from '../../../app/types';
 import { APP_ID } from '../../../../common/constants';
@@ -83,25 +84,25 @@ const StatefulRecentTimelinesComponent = React.memo<Props>(
     );
 
     const { fetchAllTimeline, timelines, loading } = useGetAllTimeline();
-
-    useEffect(
-      () =>
-        fetchAllTimeline({
-          pageInfo: {
-            pageIndex: 1,
-            pageSize: PAGE_SIZE,
-          },
-          search: '',
-          sort: {
-            sortField: SortFieldTimeline.updated,
-            sortOrder: Direction.desc,
-          },
-          onlyUserFavorite: filterBy === 'favorites',
-          timelineType: TimelineType.default,
-        }),
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-      [filterBy]
-    );
+    const timelineType = TimelineType.default;
+    const { templateTimelineType, timelineStatus } = useTimelineStatus({ timelineType });
+    useEffect(() => {
+      fetchAllTimeline({
+        pageInfo: {
+          pageIndex: 1,
+          pageSize: PAGE_SIZE,
+        },
+        search: '',
+        sort: {
+          sortField: SortFieldTimeline.updated,
+          sortOrder: Direction.desc,
+        },
+        onlyUserFavorite: filterBy === 'favorites',
+        status: timelineStatus,
+        timelineType,
+        templateTimelineType,
+      });
+    }, [fetchAllTimeline, filterBy, timelineStatus, timelineType, templateTimelineType]);
 
     return (
       <>
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index b247170a4a5d..d7e29a466cbf 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -23,7 +23,14 @@ import { FeatureCatalogueCategory } from '../../../../src/plugins/home/public';
 import { initTelemetry } from './common/lib/telemetry';
 import { KibanaServices } from './common/lib/kibana/services';
 import { serviceNowActionType, jiraActionType } from './common/lib/connectors';
-import { PluginSetup, PluginStart, SetupPlugins, StartPlugins, StartServices } from './types';
+import {
+  PluginSetup,
+  PluginStart,
+  SetupPlugins,
+  StartPlugins,
+  StartServices,
+  AppObservableLibs,
+} from './types';
 import {
   APP_ID,
   APP_ICON,
@@ -120,6 +127,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
           this.downloadAssets(),
           this.downloadSubPlugins(),
         ]);
+
         return renderApp({
           ...composeLibs(coreStart),
           ...params,
@@ -396,8 +404,9 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       endpointAlertsSubPlugin,
       managementSubPlugin,
     } = await this.downloadSubPlugins();
-
-    const libs$ = new BehaviorSubject(composeLibs(coreStart));
+    const { apolloClient } = composeLibs(coreStart);
+    const appLibs: AppObservableLibs = { apolloClient, kibana: coreStart };
+    const libs$ = new BehaviorSubject(appLibs);
 
     const alertsStart = alertsSubPlugin.start(storage);
     const hostsStart = hostsSubPlugin.start(storage);
@@ -434,6 +443,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
         ...managementSubPluginStart.store.reducer,
       },
       libs$.pipe(pluck('apolloClient')),
+      libs$.pipe(pluck('kibana')),
       storage,
       [
         ...(endpointAlertsStart.store.middleware ?? []),
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
index 9fe48cd2f019..8e34e11e8572 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
@@ -41,6 +41,7 @@ const StatefulFlyoutHeader = React.memo<Props>(
     notesById,
     status,
     timelineId,
+    timelineType,
     title,
     toggleLock,
     updateDescription,
@@ -66,6 +67,7 @@ const StatefulFlyoutHeader = React.memo<Props>(
         noteIds={noteIds}
         status={status}
         timelineId={timelineId}
+        timelineType={timelineType}
         title={title}
         toggleLock={toggleLock}
         updateDescription={updateDescription}
@@ -100,6 +102,7 @@ const makeMapStateToProps = () => {
       title = '',
       noteIds = emptyNotesId,
       status,
+      timelineType,
     } = timeline;
 
     const history = emptyHistory; // TODO: get history from store via selector
@@ -116,6 +119,7 @@ const makeMapStateToProps = () => {
       notesById: getNotesByIds(state),
       status,
       title,
+      timelineType,
     };
   };
   return mapStateToProps;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/header_with_close_button/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/flyout/header_with_close_button/__snapshots__/index.test.tsx.snap
index df96f2a1f7eb..d0d7a1cd7f5d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/header_with_close_button/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/header_with_close_button/__snapshots__/index.test.tsx.snap
@@ -4,6 +4,7 @@ exports[`FlyoutHeaderWithCloseButton renders correctly against snapshot 1`] = `
 <FlyoutHeaderWithCloseButton
   onClose={[MockFunction]}
   timelineId="test"
+  timelineType="default"
   usersViewing={
     Array [
       "elastic",
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/header_with_close_button/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/header_with_close_button/index.test.tsx
index 3ddc1efe9a47..9b7d4c3266c5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/header_with_close_button/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/header_with_close_button/index.test.tsx
@@ -7,6 +7,7 @@
 import { mount, shallow } from 'enzyme';
 import React from 'react';
 
+import { TimelineType } from '../../../../../common/types/timeline';
 import { TestProviders } from '../../../../common/mock';
 import { FlyoutHeaderWithCloseButton } from '.';
 
@@ -40,14 +41,16 @@ jest.mock('../../../../common/lib/kibana', () => {
 });
 
 describe('FlyoutHeaderWithCloseButton', () => {
+  const props = {
+    onClose: jest.fn(),
+    timelineId: 'test',
+    timelineType: TimelineType.default,
+    usersViewing: ['elastic'],
+  };
   test('renders correctly against snapshot', () => {
     const EmptyComponent = shallow(
       <TestProviders>
-        <FlyoutHeaderWithCloseButton
-          onClose={jest.fn()}
-          timelineId={'test'}
-          usersViewing={['elastic']}
-        />
+        <FlyoutHeaderWithCloseButton {...props} />
       </TestProviders>
     );
     expect(EmptyComponent.find('FlyoutHeaderWithCloseButton')).toMatchSnapshot();
@@ -55,13 +58,13 @@ describe('FlyoutHeaderWithCloseButton', () => {
 
   test('it should invoke onClose when the close button is clicked', () => {
     const closeMock = jest.fn();
+    const testProps = {
+      ...props,
+      onClose: closeMock,
+    };
     const wrapper = mount(
       <TestProviders>
-        <FlyoutHeaderWithCloseButton
-          onClose={closeMock}
-          timelineId={'test'}
-          usersViewing={['elastic']}
-        />
+        <FlyoutHeaderWithCloseButton {...testProps} />
       </TestProviders>
     );
     wrapper.find('[data-test-subj="close-timeline"] button').first().simulate('click');
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx
index 932cde32f3d4..50578ef0a8e4 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx
@@ -14,6 +14,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { createStore, State } from '../../../common/store';
@@ -62,6 +63,7 @@ describe('Flyout', () => {
         stateShowIsTrue,
         SUB_PLUGINS_REDUCER,
         apolloClientObservable,
+        kibanaObservable,
         storage
       );
 
@@ -86,6 +88,7 @@ describe('Flyout', () => {
         stateWithDataProviders,
         SUB_PLUGINS_REDUCER,
         apolloClientObservable,
+        kibanaObservable,
         storage
       );
 
@@ -108,6 +111,7 @@ describe('Flyout', () => {
         stateWithDataProviders,
         SUB_PLUGINS_REDUCER,
         apolloClientObservable,
+        kibanaObservable,
         storage
       );
 
@@ -142,6 +146,7 @@ describe('Flyout', () => {
         stateWithDataProviders,
         SUB_PLUGINS_REDUCER,
         apolloClientObservable,
+        kibanaObservable,
         storage
       );
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/notes/add_note/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/notes/add_note/index.test.tsx
index 1ddf298110a5..570c0028e0f5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/notes/add_note/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/notes/add_note/index.test.tsx
@@ -8,52 +8,39 @@ import { mount, shallow } from 'enzyme';
 import React from 'react';
 
 import { AddNote } from '.';
+import { TimelineStatus } from '../../../../../common/types/timeline';
 
 describe('AddNote', () => {
   const note = 'The contents of a new note';
+  const props = {
+    associateNote: jest.fn(),
+    getNewNoteId: jest.fn(),
+    newNote: note,
+    onCancelAddNote: jest.fn(),
+    updateNewNote: jest.fn(),
+    updateNote: jest.fn(),
+    status: TimelineStatus.active,
+  };
 
   test('renders correctly', () => {
-    const wrapper = shallow(
-      <AddNote
-        associateNote={jest.fn()}
-        getNewNoteId={jest.fn()}
-        newNote={note}
-        onCancelAddNote={jest.fn()}
-        updateNewNote={jest.fn()}
-        updateNote={jest.fn()}
-      />
-    );
+    const wrapper = shallow(<AddNote {...props} />);
     expect(wrapper).toMatchSnapshot();
   });
 
   test('it renders the Cancel button when onCancelAddNote is provided', () => {
-    const wrapper = mount(
-      <AddNote
-        associateNote={jest.fn()}
-        getNewNoteId={jest.fn()}
-        newNote={note}
-        onCancelAddNote={jest.fn()}
-        updateNewNote={jest.fn()}
-        updateNote={jest.fn()}
-      />
-    );
+    const wrapper = mount(<AddNote {...props} />);
 
     expect(wrapper.find('[data-test-subj="cancel"]').exists()).toEqual(true);
   });
 
   test('it invokes onCancelAddNote when the Cancel button is clicked', () => {
     const onCancelAddNote = jest.fn();
+    const testProps = {
+      ...props,
+      onCancelAddNote,
+    };
 
-    const wrapper = mount(
-      <AddNote
-        associateNote={jest.fn()}
-        getNewNoteId={jest.fn()}
-        newNote={note}
-        onCancelAddNote={onCancelAddNote}
-        updateNewNote={jest.fn()}
-        updateNote={jest.fn()}
-      />
-    );
+    const wrapper = mount(<AddNote {...testProps} />);
 
     wrapper.find('[data-test-subj="cancel"]').first().simulate('click');
 
@@ -62,17 +49,12 @@ describe('AddNote', () => {
 
   test('it does NOT invoke associateNote when the Cancel button is clicked', () => {
     const associateNote = jest.fn();
+    const testProps = {
+      ...props,
+      associateNote,
+    };
 
-    const wrapper = mount(
-      <AddNote
-        associateNote={associateNote}
-        getNewNoteId={jest.fn()}
-        newNote={note}
-        onCancelAddNote={jest.fn()}
-        updateNewNote={jest.fn()}
-        updateNote={jest.fn()}
-      />
-    );
+    const wrapper = mount(<AddNote {...testProps} />);
 
     wrapper.find('[data-test-subj="cancel"]').first().simulate('click');
 
@@ -80,47 +62,29 @@ describe('AddNote', () => {
   });
 
   test('it does NOT render the Cancel button when onCancelAddNote is NOT provided', () => {
-    const wrapper = mount(
-      <AddNote
-        associateNote={jest.fn()}
-        getNewNoteId={jest.fn()}
-        newNote={note}
-        updateNewNote={jest.fn()}
-        updateNote={jest.fn()}
-      />
-    );
+    const testProps = {
+      ...props,
+      onCancelAddNote: undefined,
+    };
+    const wrapper = mount(<AddNote {...testProps} />);
 
     expect(wrapper.find('[data-test-subj="cancel"]').exists()).toEqual(false);
   });
 
   test('it renders the contents of the note', () => {
-    const wrapper = mount(
-      <AddNote
-        associateNote={jest.fn()}
-        getNewNoteId={jest.fn()}
-        newNote={note}
-        onCancelAddNote={jest.fn()}
-        updateNewNote={jest.fn()}
-        updateNote={jest.fn()}
-      />
-    );
+    const wrapper = mount(<AddNote {...props} />);
 
     expect(wrapper.find('[data-test-subj="add-a-note"]').first().text()).toEqual(note);
   });
 
   test('it invokes associateNote when the Add Note button is clicked', () => {
     const associateNote = jest.fn();
-
-    const wrapper = mount(
-      <AddNote
-        associateNote={associateNote}
-        getNewNoteId={jest.fn()}
-        newNote={note}
-        onCancelAddNote={jest.fn()}
-        updateNewNote={jest.fn()}
-        updateNote={jest.fn()}
-      />
-    );
+    const testProps = {
+      ...props,
+      newNote: note,
+      associateNote,
+    };
+    const wrapper = mount(<AddNote {...testProps} />);
 
     wrapper.find('[data-test-subj="add-note"]').first().simulate('click');
 
@@ -129,17 +93,12 @@ describe('AddNote', () => {
 
   test('it invokes getNewNoteId when the Add Note button is clicked', () => {
     const getNewNoteId = jest.fn();
+    const testProps = {
+      ...props,
+      getNewNoteId,
+    };
 
-    const wrapper = mount(
-      <AddNote
-        associateNote={jest.fn()}
-        getNewNoteId={getNewNoteId}
-        newNote={note}
-        onCancelAddNote={jest.fn()}
-        updateNewNote={jest.fn()}
-        updateNote={jest.fn()}
-      />
-    );
+    const wrapper = mount(<AddNote {...testProps} />);
 
     wrapper.find('[data-test-subj="add-note"]').first().simulate('click');
 
@@ -148,17 +107,12 @@ describe('AddNote', () => {
 
   test('it invokes updateNewNote when the Add Note button is clicked', () => {
     const updateNewNote = jest.fn();
+    const testProps = {
+      ...props,
+      updateNewNote,
+    };
 
-    const wrapper = mount(
-      <AddNote
-        associateNote={jest.fn()}
-        getNewNoteId={jest.fn()}
-        newNote={note}
-        onCancelAddNote={jest.fn()}
-        updateNewNote={updateNewNote}
-        updateNote={jest.fn()}
-      />
-    );
+    const wrapper = mount(<AddNote {...testProps} />);
 
     wrapper.find('[data-test-subj="add-note"]').first().simulate('click');
 
@@ -167,17 +121,11 @@ describe('AddNote', () => {
 
   test('it invokes updateNote when the Add Note button is clicked', () => {
     const updateNote = jest.fn();
-
-    const wrapper = mount(
-      <AddNote
-        associateNote={jest.fn()}
-        getNewNoteId={jest.fn()}
-        newNote={note}
-        onCancelAddNote={jest.fn()}
-        updateNewNote={jest.fn()}
-        updateNote={updateNote}
-      />
-    );
+    const testProps = {
+      ...props,
+      updateNote,
+    };
+    const wrapper = mount(<AddNote {...testProps} />);
 
     wrapper.find('[data-test-subj="add-note"]').first().simulate('click');
 
@@ -185,16 +133,11 @@ describe('AddNote', () => {
   });
 
   test('it does NOT display the markdown formatting hint when a note has NOT been entered', () => {
-    const wrapper = mount(
-      <AddNote
-        associateNote={jest.fn()}
-        getNewNoteId={jest.fn()}
-        newNote={''}
-        onCancelAddNote={jest.fn()}
-        updateNewNote={jest.fn()}
-        updateNote={jest.fn()}
-      />
-    );
+    const testProps = {
+      ...props,
+      newNote: '',
+    };
+    const wrapper = mount(<AddNote {...testProps} />);
 
     expect(wrapper.find('[data-test-subj="markdown-hint"]').first()).toHaveStyleRule(
       'visibility',
@@ -203,16 +146,11 @@ describe('AddNote', () => {
   });
 
   test('it displays the markdown formatting hint when a note has been entered', () => {
-    const wrapper = mount(
-      <AddNote
-        associateNote={jest.fn()}
-        getNewNoteId={jest.fn()}
-        newNote={'We should see a formatting hint now'}
-        onCancelAddNote={jest.fn()}
-        updateNewNote={jest.fn()}
-        updateNote={jest.fn()}
-      />
-    );
+    const testProps = {
+      ...props,
+      newNote: 'We should see a formatting hint now',
+    };
+    const wrapper = mount(<AddNote {...testProps} />);
 
     expect(wrapper.find('[data-test-subj="markdown-hint"]').first()).toHaveStyleRule(
       'visibility',
diff --git a/x-pack/plugins/security_solution/public/timelines/components/notes/add_note/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/notes/add_note/index.tsx
index d3db1a619600..7c211aafdf8c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/notes/add_note/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/notes/add_note/index.tsx
@@ -61,7 +61,6 @@ export const AddNote = React.memo<{
       }),
     [associateNote, getNewNoteId, newNote, updateNewNote, updateNote]
   );
-
   return (
     <AddNotesContainer alignItems="flexEnd" direction="column" gutterSize="none">
       <NewNote note={newNote} noteInputHeight={200} updateNewNote={updateNewNote} />
diff --git a/x-pack/plugins/security_solution/public/timelines/components/notes/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/notes/index.tsx
index 42f28f034067..957b37a0bd1c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/notes/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/notes/index.tsx
@@ -21,12 +21,14 @@ import { AddNote } from './add_note';
 import { columns } from './columns';
 import { AssociateNote, GetNewNoteId, NotesCount, search, UpdateNote } from './helpers';
 import { NOTES_PANEL_WIDTH, NOTES_PANEL_HEIGHT } from '../timeline/properties/notes_size';
+import { TimelineStatusLiteral, TimelineStatus } from '../../../../common/types/timeline';
 
 interface Props {
   associateNote: AssociateNote;
   getNotesByIds: (noteIds: string[]) => Note[];
   getNewNoteId: GetNewNoteId;
   noteIds: string[];
+  status: TimelineStatusLiteral;
   updateNote: UpdateNote;
 }
 
@@ -53,8 +55,9 @@ InMemoryTable.displayName = 'InMemoryTable';
 
 /** A view for entering and reviewing notes */
 export const Notes = React.memo<Props>(
-  ({ associateNote, getNotesByIds, getNewNoteId, noteIds, updateNote }) => {
+  ({ associateNote, getNotesByIds, getNewNoteId, noteIds, status, updateNote }) => {
     const [newNote, setNewNote] = useState('');
+    const isImmutable = status === TimelineStatus.immutable;
 
     return (
       <NotesPanel>
@@ -63,13 +66,15 @@ export const Notes = React.memo<Props>(
         </EuiModalHeader>
 
         <EuiModalBody>
-          <AddNote
-            associateNote={associateNote}
-            getNewNoteId={getNewNoteId}
-            newNote={newNote}
-            updateNewNote={setNewNote}
-            updateNote={updateNote}
-          />
+          {!isImmutable && (
+            <AddNote
+              associateNote={associateNote}
+              getNewNoteId={getNewNoteId}
+              newNote={newNote}
+              updateNewNote={setNewNote}
+              updateNote={updateNote}
+            />
+          )}
           <EuiSpacer size="s" />
           <InMemoryTable
             data-test-subj="notes-table"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/notes/note_cards/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/notes/note_cards/index.test.tsx
index fa63eb625f28..952295d0858e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/notes/note_cards/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/notes/note_cards/index.test.tsx
@@ -12,6 +12,7 @@ import euiDarkVars from '@elastic/eui/dist/eui_theme_dark.json';
 import { Note } from '../../../../common/lib/note';
 
 import { NoteCards } from '.';
+import { TimelineStatus } from '../../../../../common/types/timeline';
 
 describe('NoteCards', () => {
   const noteIds = ['abc', 'def'];
@@ -38,18 +39,21 @@ describe('NoteCards', () => {
     },
   ];
 
+  const props = {
+    associateNote: jest.fn(),
+    getNotesByIds,
+    getNewNoteId: jest.fn(),
+    noteIds,
+    showAddNote: true,
+    status: TimelineStatus.active,
+    toggleShowAddNote: jest.fn(),
+    updateNote: jest.fn(),
+  };
+
   test('it renders the notes column when noteIds are specified', () => {
     const wrapper = mountWithIntl(
       <ThemeProvider theme={theme}>
-        <NoteCards
-          associateNote={jest.fn()}
-          getNotesByIds={getNotesByIds}
-          getNewNoteId={jest.fn()}
-          noteIds={noteIds}
-          showAddNote={true}
-          toggleShowAddNote={jest.fn()}
-          updateNote={jest.fn()}
-        />
+        <NoteCards {...props} />
       </ThemeProvider>
     );
 
@@ -57,17 +61,10 @@ describe('NoteCards', () => {
   });
 
   test('it does NOT render the notes column when noteIds are NOT specified', () => {
+    const testProps = { ...props, noteIds: [] };
     const wrapper = mountWithIntl(
       <ThemeProvider theme={theme}>
-        <NoteCards
-          associateNote={jest.fn()}
-          getNotesByIds={getNotesByIds}
-          getNewNoteId={jest.fn()}
-          noteIds={[]}
-          showAddNote={true}
-          toggleShowAddNote={jest.fn()}
-          updateNote={jest.fn()}
-        />
+        <NoteCards {...testProps} />
       </ThemeProvider>
     );
 
@@ -77,15 +74,7 @@ describe('NoteCards', () => {
   test('renders note cards', () => {
     const wrapper = mountWithIntl(
       <ThemeProvider theme={theme}>
-        <NoteCards
-          associateNote={jest.fn()}
-          getNotesByIds={getNotesByIds}
-          getNewNoteId={jest.fn()}
-          noteIds={noteIds}
-          showAddNote={true}
-          toggleShowAddNote={jest.fn()}
-          updateNote={jest.fn()}
-        />
+        <NoteCards {...props} />
       </ThemeProvider>
     );
 
@@ -102,15 +91,7 @@ describe('NoteCards', () => {
   test('it shows controls for adding notes when showAddNote is true', () => {
     const wrapper = mountWithIntl(
       <ThemeProvider theme={theme}>
-        <NoteCards
-          associateNote={jest.fn()}
-          getNotesByIds={getNotesByIds}
-          getNewNoteId={jest.fn()}
-          noteIds={noteIds}
-          showAddNote={true}
-          toggleShowAddNote={jest.fn()}
-          updateNote={jest.fn()}
-        />
+        <NoteCards {...props} />
       </ThemeProvider>
     );
 
@@ -118,17 +99,11 @@ describe('NoteCards', () => {
   });
 
   test('it does NOT show controls for adding notes when showAddNote is false', () => {
+    const testProps = { ...props, showAddNote: false };
+
     const wrapper = mountWithIntl(
       <ThemeProvider theme={theme}>
-        <NoteCards
-          associateNote={jest.fn()}
-          getNotesByIds={getNotesByIds}
-          getNewNoteId={jest.fn()}
-          noteIds={noteIds}
-          showAddNote={false}
-          toggleShowAddNote={jest.fn()}
-          updateNote={jest.fn()}
-        />
+        <NoteCards {...testProps} />
       </ThemeProvider>
     );
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/notes/note_cards/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/notes/note_cards/index.tsx
index 3c8fc50e93b8..9d9055e3ad74 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/notes/note_cards/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/notes/note_cards/index.tsx
@@ -12,6 +12,7 @@ import { Note } from '../../../../common/lib/note';
 import { AddNote } from '../add_note';
 import { AssociateNote, GetNewNoteId, UpdateNote } from '../helpers';
 import { NoteCard } from '../note_card';
+import { TimelineStatusLiteral } from '../../../../../common/types/timeline';
 
 const AddNoteContainer = styled.div``;
 AddNoteContainer.displayName = 'AddNoteContainer';
@@ -49,6 +50,7 @@ interface Props {
   getNewNoteId: GetNewNoteId;
   noteIds: string[];
   showAddNote: boolean;
+  status: TimelineStatusLiteral;
   toggleShowAddNote: () => void;
   updateNote: UpdateNote;
 }
@@ -61,6 +63,7 @@ export const NoteCards = React.memo<Props>(
     getNewNoteId,
     noteIds,
     showAddNote,
+    status,
     toggleShowAddNote,
     updateNote,
   }) => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/edit_timeline_batch_actions.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/edit_timeline_batch_actions.tsx
index 4d45b74e9b1b..15c078e17535 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/edit_timeline_batch_actions.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/edit_timeline_batch_actions.tsx
@@ -6,7 +6,9 @@
 
 import { EuiContextMenuPanel, EuiContextMenuItem, EuiBasicTable } from '@elastic/eui';
 import React, { useCallback, useMemo } from 'react';
-import { isEmpty } from 'lodash/fp';
+
+import { TimelineStatus } from '../../../../common/types/timeline';
+
 import * as i18n from './translations';
 import { DeleteTimelines, OpenTimelineResult } from './types';
 import { EditTimelineActions } from './export_timeline';
@@ -63,7 +65,7 @@ export const useEditTimelineBatchActions = ({
 
   const getBatchItemsPopoverContent = useCallback(
     (closePopover: () => void) => {
-      const isDisabled = isEmpty(selectedItems);
+      const disabled = selectedItems?.some((item) => item.status === TimelineStatus.immutable);
       return (
         <>
           <EditTimelineActions
@@ -82,7 +84,7 @@ export const useEditTimelineBatchActions = ({
           <EuiContextMenuPanel
             items={[
               <EuiContextMenuItem
-                disabled={isDisabled}
+                disabled={disabled}
                 icon="exportAction"
                 key="ExportItemKey"
                 onClick={handleEnableExportTimelineDownloader}
@@ -90,7 +92,7 @@ export const useEditTimelineBatchActions = ({
                 {i18n.EXPORT_SELECTED}
               </EuiContextMenuItem>,
               <EuiContextMenuItem
-                disabled={isDisabled}
+                disabled={disabled}
                 icon="trash"
                 key="DeleteItemKey"
                 onClick={handleOnOpenDeleteTimelineModal}
@@ -102,6 +104,7 @@ export const useEditTimelineBatchActions = ({
         </>
       );
     },
+    // eslint-disable-next-line react-hooks/exhaustive-deps
     [
       deleteTimelines,
       isEnableDownloader,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/export_timeline.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/export_timeline.test.tsx
index d377b10a55c2..b8a7cfd59d22 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/export_timeline.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/export_timeline.test.tsx
@@ -8,7 +8,6 @@ import React from 'react';
 import { TimelineDownloader } from './export_timeline';
 import { mockSelectedTimeline } from './mocks';
 import { ReactWrapper, mount } from 'enzyme';
-import { useExportTimeline } from '.';
 
 jest.mock('../translations', () => {
   return {
@@ -32,19 +31,6 @@ describe('TimelineDownloader', () => {
     onComplete: jest.fn(),
   };
   describe('should not render a downloader', () => {
-    beforeAll(() => {
-      ((useExportTimeline as unknown) as jest.Mock).mockReturnValue({
-        enableDownloader: false,
-        setEnableDownloader: jest.fn(),
-        exportedIds: {},
-        getExportedData: jest.fn(),
-      });
-    });
-
-    afterAll(() => {
-      ((useExportTimeline as unknown) as jest.Mock).mockReset();
-    });
-
     test('Without exportedIds', () => {
       const testProps = {
         ...defaultTestProps,
@@ -65,19 +51,6 @@ describe('TimelineDownloader', () => {
   });
 
   describe('should render a downloader', () => {
-    beforeAll(() => {
-      ((useExportTimeline as unknown) as jest.Mock).mockReturnValue({
-        enableDownloader: false,
-        setEnableDownloader: jest.fn(),
-        exportedIds: {},
-        getExportedData: jest.fn(),
-      });
-    });
-
-    afterAll(() => {
-      ((useExportTimeline as unknown) as jest.Mock).mockReset();
-    });
-
     test('With selectedItems and exportedIds is given and isEnableDownloader is true', () => {
       const testProps = {
         ...defaultTestProps,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/index.test.tsx
index 674cd6dad5f7..72f149174253 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/index.test.tsx
@@ -5,31 +5,41 @@
  */
 
 import React from 'react';
-import { mount } from 'enzyme';
-import { useExportTimeline, ExportTimeline } from '.';
+import { shallow } from 'enzyme';
+import { EditTimelineActionsComponent } from '.';
 
-describe('useExportTimeline', () => {
-  describe('call with selected timelines', () => {
-    let exportTimelineRes: ExportTimeline;
-    const TestHook = () => {
-      exportTimelineRes = useExportTimeline();
-      return <div />;
+describe('EditTimelineActionsComponent', () => {
+  describe('render', () => {
+    const props = {
+      deleteTimelines: jest.fn(),
+      ids: ['id1'],
+      isEnableDownloader: false,
+      isDeleteTimelineModalOpen: false,
+      onComplete: jest.fn(),
+      title: 'mockTitle',
     };
 
-    beforeAll(() => {
-      mount(<TestHook />);
-    });
+    test('should render timelineDownloader', () => {
+      const wrapper = shallow(<EditTimelineActionsComponent {...props} />);
 
-    test('Downloader should be disabled by default', () => {
-      expect(exportTimelineRes.isEnableDownloader).toBeFalsy();
+      expect(wrapper.find('[data-test-subj="TimelineDownloader"]').exists()).toBeTruthy();
     });
 
-    test('Should include disableExportTimelineDownloader in return value', () => {
-      expect(exportTimelineRes).toHaveProperty('disableExportTimelineDownloader');
+    test('Should render DeleteTimelineModalOverlay if deleteTimelines is given', () => {
+      const wrapper = shallow(<EditTimelineActionsComponent {...props} />);
+
+      expect(wrapper.find('[data-test-subj="DeleteTimelineModalOverlay"]').exists()).toBeTruthy();
     });
 
-    test('Should include enableExportTimelineDownloader in return value', () => {
-      expect(exportTimelineRes).toHaveProperty('enableExportTimelineDownloader');
+    test('Should not render DeleteTimelineModalOverlay if deleteTimelines is not given', () => {
+      const newProps = {
+        ...props,
+        deleteTimelines: undefined,
+      };
+      const wrapper = shallow(<EditTimelineActionsComponent {...newProps} />);
+      expect(
+        wrapper.find('[data-test-subj="DeleteTimelineModalOverlay"]').exists()
+      ).not.toBeTruthy();
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/index.tsx
index 7bac3229c817..2ad4aa9d208c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/export_timeline/index.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useState, useCallback } from 'react';
+import React from 'react';
 import { DeleteTimelines } from '../types';
 
 import { TimelineDownloader } from './export_timeline';
@@ -17,25 +17,7 @@ export interface ExportTimeline {
   isEnableDownloader: boolean;
 }
 
-export const useExportTimeline = (): ExportTimeline => {
-  const [isEnableDownloader, setIsEnableDownloader] = useState(false);
-
-  const enableExportTimelineDownloader = useCallback(() => {
-    setIsEnableDownloader(true);
-  }, []);
-
-  const disableExportTimelineDownloader = useCallback(() => {
-    setIsEnableDownloader(false);
-  }, []);
-
-  return {
-    disableExportTimelineDownloader,
-    enableExportTimelineDownloader,
-    isEnableDownloader,
-  };
-};
-
-const EditTimelineActionsComponent: React.FC<{
+export const EditTimelineActionsComponent: React.FC<{
   deleteTimelines: DeleteTimelines | undefined;
   ids: string[];
   isEnableDownloader: boolean;
@@ -52,6 +34,7 @@ const EditTimelineActionsComponent: React.FC<{
 }) => (
   <>
     <TimelineDownloader
+      data-test-subj="TimelineDownloader"
       exportedIds={ids}
       getExportedData={exportSelectedTimeline}
       isEnableDownloader={isEnableDownloader}
@@ -59,6 +42,7 @@ const EditTimelineActionsComponent: React.FC<{
     />
     {deleteTimelines != null && (
       <DeleteTimelineModalOverlay
+        data-test-subj="DeleteTimelineModalOverlay"
         deleteTimelines={deleteTimelines}
         isModalOpen={isDeleteTimelineModalOpen}
         onComplete={onComplete}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
index 520215cde486..e841718c8119 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
@@ -10,7 +10,17 @@ import { Action } from 'typescript-fsa';
 import uuid from 'uuid';
 import { Dispatch } from 'redux';
 import { oneTimelineQuery } from '../../containers/one/index.gql_query';
-import { TimelineResult, GetOneTimeline, NoteResult } from '../../../graphql/types';
+import {
+  TimelineResult,
+  GetOneTimeline,
+  NoteResult,
+  FilterTimelineResult,
+  ColumnHeaderResult,
+  PinnedEvent,
+} from '../../../graphql/types';
+
+import { TimelineStatus, TimelineType } from '../../../../common/types/timeline';
+
 import {
   addNotes as dispatchAddNotes,
   updateNote as dispatchUpdateNote,
@@ -22,9 +32,9 @@ import {
   addTimeline as dispatchAddTimeline,
   addNote as dispatchAddGlobalTimelineNote,
 } from '../../../timelines/store/timeline/actions';
-
 import { ColumnHeaderOptions, TimelineModel } from '../../../timelines/store/timeline/model';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
+
 import {
   defaultColumnHeaderType,
   defaultHeaders,
@@ -77,103 +87,115 @@ const parseString = (params: string) => {
   }
 };
 
+const setTimelineColumn = (col: ColumnHeaderResult) => {
+  const timelineCols: ColumnHeaderOptions = {
+    ...col,
+    columnHeaderType: defaultColumnHeaderType,
+    id: col.id != null ? col.id : 'unknown',
+    placeholder: col.placeholder != null ? col.placeholder : undefined,
+    category: col.category != null ? col.category : undefined,
+    description: col.description != null ? col.description : undefined,
+    example: col.example != null ? col.example : undefined,
+    type: col.type != null ? col.type : undefined,
+    aggregatable: col.aggregatable != null ? col.aggregatable : undefined,
+    width: col.id === '@timestamp' ? DEFAULT_DATE_COLUMN_MIN_WIDTH : DEFAULT_COLUMN_MIN_WIDTH,
+  };
+  return timelineCols;
+};
+
+const setTimelineFilters = (filter: FilterTimelineResult) => ({
+  $state: {
+    store: 'appState',
+  },
+  meta: {
+    ...filter.meta,
+    ...(filter.meta && filter.meta.field != null ? { params: parseString(filter.meta.field) } : {}),
+    ...(filter.meta && filter.meta.params != null
+      ? { params: parseString(filter.meta.params) }
+      : {}),
+    ...(filter.meta && filter.meta.value != null ? { value: parseString(filter.meta.value) } : {}),
+  },
+  ...(filter.exists != null ? { exists: parseString(filter.exists) } : {}),
+  ...(filter.match_all != null ? { exists: parseString(filter.match_all) } : {}),
+  ...(filter.missing != null ? { exists: parseString(filter.missing) } : {}),
+  ...(filter.query != null ? { query: parseString(filter.query) } : {}),
+  ...(filter.range != null ? { range: parseString(filter.range) } : {}),
+  ...(filter.script != null ? { exists: parseString(filter.script) } : {}),
+});
+
+const setEventIdToNoteIds = (
+  duplicate: boolean,
+  eventIdToNoteIds: NoteResult[] | null | undefined
+) =>
+  duplicate
+    ? {}
+    : eventIdToNoteIds != null
+    ? eventIdToNoteIds.reduce((acc, note) => {
+        if (note.eventId != null) {
+          const eventNotes = getOr([], note.eventId, acc);
+          return { ...acc, [note.eventId]: [...eventNotes, note.noteId] };
+        }
+        return acc;
+      }, {})
+    : {};
+
+const setPinnedEventsSaveObject = (
+  duplicate: boolean,
+  pinnedEventsSaveObject: PinnedEvent[] | null | undefined
+) =>
+  duplicate
+    ? {}
+    : pinnedEventsSaveObject != null
+    ? pinnedEventsSaveObject.reduce(
+        (acc, pinnedEvent) => ({
+          ...acc,
+          ...(pinnedEvent.eventId != null ? { [pinnedEvent.eventId]: pinnedEvent } : {}),
+        }),
+        {}
+      )
+    : {};
+
+const setPinnedEventIds = (duplicate: boolean, pinnedEventIds: string[] | null | undefined) =>
+  duplicate
+    ? {}
+    : pinnedEventIds != null
+    ? pinnedEventIds.reduce((acc, pinnedEventId) => ({ ...acc, [pinnedEventId]: true }), {})
+    : {};
+
+// eslint-disable-next-line complexity
 export const defaultTimelineToTimelineModel = (
   timeline: TimelineResult,
   duplicate: boolean
 ): TimelineModel => {
-  return Object.entries({
+  const isTemplate = timeline.timelineType === TimelineType.template;
+  const timelineEntries = {
     ...timeline,
-    columns:
-      timeline.columns != null
-        ? timeline.columns.map((col) => {
-            const timelineCols: ColumnHeaderOptions = {
-              ...col,
-              columnHeaderType: defaultColumnHeaderType,
-              id: col.id != null ? col.id : 'unknown',
-              placeholder: col.placeholder != null ? col.placeholder : undefined,
-              category: col.category != null ? col.category : undefined,
-              description: col.description != null ? col.description : undefined,
-              example: col.example != null ? col.example : undefined,
-              type: col.type != null ? col.type : undefined,
-              aggregatable: col.aggregatable != null ? col.aggregatable : undefined,
-              width:
-                col.id === '@timestamp' ? DEFAULT_DATE_COLUMN_MIN_WIDTH : DEFAULT_COLUMN_MIN_WIDTH,
-            };
-            return timelineCols;
-          })
-        : defaultHeaders,
-    eventIdToNoteIds: duplicate
-      ? {}
-      : timeline.eventIdToNoteIds != null
-      ? timeline.eventIdToNoteIds.reduce((acc, note) => {
-          if (note.eventId != null) {
-            const eventNotes = getOr([], note.eventId, acc);
-            return { ...acc, [note.eventId]: [...eventNotes, note.noteId] };
-          }
-          return acc;
-        }, {})
-      : {},
-    filters:
-      timeline.filters != null
-        ? timeline.filters.map((filter) => ({
-            $state: {
-              store: 'appState',
-            },
-            meta: {
-              ...filter.meta,
-              ...(filter.meta && filter.meta.field != null
-                ? { params: parseString(filter.meta.field) }
-                : {}),
-              ...(filter.meta && filter.meta.params != null
-                ? { params: parseString(filter.meta.params) }
-                : {}),
-              ...(filter.meta && filter.meta.value != null
-                ? { value: parseString(filter.meta.value) }
-                : {}),
-            },
-            ...(filter.exists != null ? { exists: parseString(filter.exists) } : {}),
-            ...(filter.match_all != null ? { exists: parseString(filter.match_all) } : {}),
-            ...(filter.missing != null ? { exists: parseString(filter.missing) } : {}),
-            ...(filter.query != null ? { query: parseString(filter.query) } : {}),
-            ...(filter.range != null ? { range: parseString(filter.range) } : {}),
-            ...(filter.script != null ? { exists: parseString(filter.script) } : {}),
-          }))
-        : [],
+    columns: timeline.columns != null ? timeline.columns.map(setTimelineColumn) : defaultHeaders,
+    eventIdToNoteIds: setEventIdToNoteIds(duplicate, timeline.eventIdToNoteIds),
+    filters: timeline.filters != null ? timeline.filters.map(setTimelineFilters) : [],
     isFavorite: duplicate
       ? false
       : timeline.favorite != null
       ? timeline.favorite.length > 0
       : false,
     noteIds: duplicate ? [] : timeline.noteIds != null ? timeline.noteIds : [],
-    pinnedEventIds: duplicate
-      ? {}
-      : timeline.pinnedEventIds != null
-      ? timeline.pinnedEventIds.reduce(
-          (acc, pinnedEventId) => ({ ...acc, [pinnedEventId]: true }),
-          {}
-        )
-      : {},
-    pinnedEventsSaveObject: duplicate
-      ? {}
-      : timeline.pinnedEventsSaveObject != null
-      ? timeline.pinnedEventsSaveObject.reduce(
-          (acc, pinnedEvent) => ({
-            ...acc,
-            ...(pinnedEvent.eventId != null ? { [pinnedEvent.eventId]: pinnedEvent } : {}),
-          }),
-          {}
-        )
-      : {},
+    pinnedEventIds: setPinnedEventIds(duplicate, timeline.pinnedEventIds),
+    pinnedEventsSaveObject: setPinnedEventsSaveObject(duplicate, timeline.pinnedEventsSaveObject),
     id: duplicate ? '' : timeline.savedObjectId,
+    status: duplicate ? TimelineStatus.active : timeline.status,
     savedObjectId: duplicate ? null : timeline.savedObjectId,
     version: duplicate ? null : timeline.version,
-    title: duplicate ? '' : timeline.title || '',
-    templateTimelineId: duplicate ? null : timeline.templateTimelineId,
-    templateTimelineVersion: duplicate ? null : timeline.templateTimelineVersion,
-  }).reduce((acc: TimelineModel, [key, value]) => (value != null ? set(key, value, acc) : acc), {
-    ...timelineDefaults,
-    id: '',
-  });
+    title: duplicate ? `${timeline.title} - Duplicate` : timeline.title || '',
+    templateTimelineId: duplicate && isTemplate ? uuid.v4() : timeline.templateTimelineId,
+    templateTimelineVersion: duplicate && isTemplate ? 1 : timeline.templateTimelineVersion,
+  };
+  return Object.entries(timelineEntries).reduce(
+    (acc: TimelineModel, [key, value]) => (value != null ? set(key, value, acc) : acc),
+    {
+      ...timelineDefaults,
+      id: '',
+    }
+  );
 };
 
 export const formatTimelineResultToModel = (
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
index 24dee1460810..ea63f2b7b071 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
@@ -9,9 +9,9 @@ import React, { useEffect, useState, useCallback } from 'react';
 import { connect, ConnectedProps } from 'react-redux';
 
 import { Dispatch } from 'redux';
-import { defaultHeaders } from '../timeline/body/column_headers/default_headers';
-import { deleteTimelineMutation } from '../../containers/delete/persist.gql_query';
-import { useGetAllTimeline } from '../../containers/all';
+
+import { disableTemplate } from '../../../../common/constants';
+
 import { DeleteTimelineMutation, SortFieldTimeline, Direction } from '../../../graphql/types';
 import { State } from '../../../common/store';
 import { ColumnHeaderOptions, TimelineModel } from '../../../timelines/store/timeline/model';
@@ -21,6 +21,12 @@ import {
   createTimeline as dispatchCreateNewTimeline,
   updateIsLoading as dispatchUpdateIsLoading,
 } from '../../../timelines/store/timeline/actions';
+
+import { deleteTimelineMutation } from '../../containers/delete/persist.gql_query';
+import { useGetAllTimeline } from '../../containers/all';
+
+import { defaultHeaders } from '../timeline/body/column_headers/default_headers';
+
 import { OpenTimeline } from './open_timeline';
 import { OPEN_TIMELINE_CLASS_NAME, queryTimelineById, dispatchUpdateTimeline } from './helpers';
 import { OpenTimelineModalBody } from './open_timeline_modal/open_timeline_modal_body';
@@ -42,7 +48,7 @@ import {
 } from './types';
 import { DEFAULT_SORT_FIELD, DEFAULT_SORT_DIRECTION } from './constants';
 import { useTimelineTypes } from './use_timeline_types';
-import { disableTemplate } from '../../../../common/constants';
+import { useTimelineStatus } from './use_timeline_status';
 
 interface OwnProps<TCache = object> {
   apolloClient: ApolloClient<TCache>;
@@ -106,28 +112,54 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
     /** The requested field to sort on */
     const [sortField, setSortField] = useState(DEFAULT_SORT_FIELD);
 
-    const { timelineType, timelineTabs, timelineFilters } = useTimelineTypes();
-    const { fetchAllTimeline, timelines, loading, totalCount } = useGetAllTimeline();
-
-    const refetch = useCallback(
-      () =>
-        fetchAllTimeline({
-          pageInfo: {
-            pageIndex: pageIndex + 1,
-            pageSize,
-          },
-          search,
-          sort: {
-            sortField: sortField as SortFieldTimeline,
-            sortOrder: sortDirection as Direction,
-          },
-          onlyUserFavorite: onlyFavorites,
-          timelineType,
-        }),
-
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-      [pageIndex, pageSize, search, sortField, sortDirection, timelineType, onlyFavorites]
-    );
+    const {
+      customTemplateTimelineCount,
+      defaultTimelineCount,
+      elasticTemplateTimelineCount,
+      favoriteCount,
+      fetchAllTimeline,
+      timelines,
+      loading,
+      totalCount,
+      templateTimelineCount,
+    } = useGetAllTimeline();
+    const { timelineType, timelineTabs, timelineFilters } = useTimelineTypes({
+      defaultTimelineCount,
+      templateTimelineCount,
+    });
+    const { timelineStatus, templateTimelineType, templateTimelineFilter } = useTimelineStatus({
+      timelineType,
+      customTemplateTimelineCount,
+      elasticTemplateTimelineCount,
+    });
+    const refetch = useCallback(() => {
+      fetchAllTimeline({
+        pageInfo: {
+          pageIndex: pageIndex + 1,
+          pageSize,
+        },
+        search,
+        sort: {
+          sortField: sortField as SortFieldTimeline,
+          sortOrder: sortDirection as Direction,
+        },
+        onlyUserFavorite: onlyFavorites,
+        timelineType,
+        templateTimelineType,
+        status: timelineStatus,
+      });
+    }, [
+      fetchAllTimeline,
+      pageIndex,
+      pageSize,
+      search,
+      sortField,
+      sortDirection,
+      timelineType,
+      timelineStatus,
+      templateTimelineType,
+      onlyFavorites,
+    ]);
 
     /** Invoked when the user presses enters to submit the text in the search input */
     const onQueryChange: OnQueryChange = useCallback((query: EuiSearchBarQuery) => {
@@ -264,6 +296,7 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
         data-test-subj={'open-timeline'}
         deleteTimelines={onDeleteOneTimeline}
         defaultPageSize={defaultPageSize}
+        favoriteCount={favoriteCount}
         isLoading={loading}
         itemIdToExpandedNotesRowMap={itemIdToExpandedNotesRowMap}
         importDataModalToggle={importDataModalToggle}
@@ -285,7 +318,9 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
         selectedItems={selectedItems}
         sortDirection={sortDirection}
         sortField={sortField}
-        tabs={!disableTemplate ? timelineTabs : undefined}
+        templateTimelineFilter={!disableTemplate ? templateTimelineFilter : null}
+        timelineType={timelineType}
+        timelineFilter={!disableTemplate ? timelineTabs : null}
         title={title}
         totalSearchResultsCount={totalCount}
       />
@@ -294,6 +329,7 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
         data-test-subj={'open-timeline-modal'}
         deleteTimelines={onDeleteOneTimeline}
         defaultPageSize={defaultPageSize}
+        favoriteCount={favoriteCount}
         hideActions={hideActions}
         isLoading={loading}
         itemIdToExpandedNotesRowMap={itemIdToExpandedNotesRowMap}
@@ -312,7 +348,9 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
         selectedItems={selectedItems}
         sortDirection={sortDirection}
         sortField={sortField}
-        tabs={!disableTemplate ? timelineFilters : undefined}
+        templateTimelineFilter={!disableTemplate ? templateTimelineFilter : null}
+        timelineType={timelineType}
+        timelineFilter={!disableTemplate ? timelineFilters : null}
         title={title}
         totalSearchResultsCount={totalCount}
       />
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.test.tsx
index a331c62ec475..f42914c86f46 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.test.tsx
@@ -16,6 +16,7 @@ import { TimelinesTableProps } from './timelines_table';
 import { mockTimelineResults } from '../../../common/mock/timeline_results';
 import { OpenTimeline } from './open_timeline';
 import { DEFAULT_SORT_DIRECTION, DEFAULT_SORT_FIELD } from './constants';
+import { TimelineType } from '../../../../common/types/timeline';
 
 jest.mock('../../../common/lib/kibana');
 
@@ -46,8 +47,9 @@ describe('OpenTimeline', () => {
     selectedItems: [],
     sortDirection: DEFAULT_SORT_DIRECTION,
     sortField: DEFAULT_SORT_FIELD,
-    tabs: <div />,
     title,
+    timelineType: TimelineType.default,
+    templateTimelineFilter: [<div />],
     totalSearchResultsCount: mockSearchResults.length,
   });
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx
index 4894b1b2577a..849143894efe 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx
@@ -4,17 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiPanel, EuiBasicTable } from '@elastic/eui';
+import { EuiPanel, EuiBasicTable, EuiCallOut, EuiSpacer } from '@elastic/eui';
 import React, { useCallback, useMemo, useRef } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { OPEN_TIMELINE_CLASS_NAME } from './helpers';
-import { OpenTimelineProps, OpenTimelineResult, ActionTimelineToShow } from './types';
-import { SearchRow } from './search_row';
-import { TimelinesTable } from './timelines_table';
-import { ImportDataModal } from '../../../common/components/import_data_modal';
-import * as i18n from './translations';
-import { importTimelines } from '../../containers/api';
 
+import { ImportDataModal } from '../../../common/components/import_data_modal';
 import {
   UtilityBarGroup,
   UtilityBarText,
@@ -22,14 +16,23 @@ import {
   UtilityBarSection,
   UtilityBarAction,
 } from '../../../common/components/utility_bar';
+
+import { importTimelines } from '../../containers/api';
+
 import { useEditTimelineBatchActions } from './edit_timeline_batch_actions';
 import { useEditTimelineActions } from './edit_timeline_actions';
 import { EditOneTimelineAction } from './export_timeline';
+import { SearchRow } from './search_row';
+import { TimelinesTable } from './timelines_table';
+import * as i18n from './translations';
+import { OPEN_TIMELINE_CLASS_NAME } from './helpers';
+import { OpenTimelineProps, OpenTimelineResult, ActionTimelineToShow } from './types';
 
 export const OpenTimeline = React.memo<OpenTimelineProps>(
   ({
     deleteTimelines,
     defaultPageSize,
+    favoriteCount,
     isLoading,
     itemIdToExpandedNotesRowMap,
     importDataModalToggle,
@@ -51,11 +54,12 @@ export const OpenTimeline = React.memo<OpenTimelineProps>(
     sortDirection,
     setImportDataModalToggle,
     sortField,
-    tabs,
+    timelineType,
+    timelineFilter,
+    templateTimelineFilter,
     totalSearchResultsCount,
   }) => {
     const tableRef = useRef<EuiBasicTable<OpenTimelineResult>>();
-
     const {
       actionItem,
       enableExportTimelineDownloader,
@@ -124,6 +128,8 @@ export const OpenTimeline = React.memo<OpenTimelineProps>(
       [onDeleteSelected, deleteTimelines]
     );
 
+    const SearchRowContent = useMemo(() => <>{templateTimelineFilter}</>, [templateTimelineFilter]);
+
     return (
       <>
         <EditOneTimelineAction
@@ -151,15 +157,20 @@ export const OpenTimeline = React.memo<OpenTimelineProps>(
         />
 
         <EuiPanel className={OPEN_TIMELINE_CLASS_NAME}>
-          {!!tabs && tabs}
+          <EuiCallOut size="s" title={i18n.TEMPLATE_CALL_OUT_MESSAGE} />
+          <EuiSpacer size="m" />
+          {!!timelineFilter && timelineFilter}
           <SearchRow
             data-test-subj="search-row"
+            favoriteCount={favoriteCount}
             onlyFavorites={onlyFavorites}
             onQueryChange={onQueryChange}
             onToggleOnlyFavorites={onToggleOnlyFavorites}
             query={query}
             totalSearchResultsCount={totalSearchResultsCount}
-          />
+          >
+            {SearchRowContent}
+          </SearchRow>
 
           <UtilityBar border>
             <UtilityBarSection>
@@ -206,6 +217,7 @@ export const OpenTimeline = React.memo<OpenTimelineProps>(
             showExtendedColumns={true}
             sortDirection={sortDirection}
             sortField={sortField}
+            timelineType={timelineType}
             tableRef={tableRef}
             totalSearchResultsCount={totalSearchResultsCount}
           />
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_body.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_body.test.tsx
index 42a3f9a44d4b..1d08f0296ce0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_body.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_body.test.tsx
@@ -16,6 +16,7 @@ import { TimelinesTableProps } from '../timelines_table';
 import { mockTimelineResults } from '../../../../common/mock/timeline_results';
 import { OpenTimelineModalBody } from './open_timeline_modal_body';
 import { DEFAULT_SORT_DIRECTION, DEFAULT_SORT_FIELD } from '../constants';
+import { TimelineType } from '../../../../../common/types/timeline';
 
 jest.mock('../../../../common/lib/kibana');
 
@@ -45,7 +46,8 @@ describe('OpenTimelineModal', () => {
     selectedItems: [],
     sortDirection: DEFAULT_SORT_DIRECTION,
     sortField: DEFAULT_SORT_FIELD,
-    tabs: <div />,
+    timelineType: TimelineType.default,
+    templateTimelineFilter: [<div />],
     title,
     totalSearchResultsCount: mockSearchResults.length,
   });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_body.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_body.tsx
index 9eab64d6fcf5..bf66d9a52ff2 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_body.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_body.tsx
@@ -23,6 +23,7 @@ export const OpenTimelineModalBody = memo<OpenTimelineProps>(
   ({
     deleteTimelines,
     defaultPageSize,
+    favoriteCount,
     hideActions = [],
     isLoading,
     itemIdToExpandedNotesRowMap,
@@ -42,7 +43,9 @@ export const OpenTimelineModalBody = memo<OpenTimelineProps>(
     selectedItems,
     sortDirection,
     sortField,
-    tabs,
+    timelineFilter,
+    timelineType,
+    templateTimelineFilter,
     title,
     totalSearchResultsCount,
   }) => {
@@ -54,6 +57,16 @@ export const OpenTimelineModalBody = memo<OpenTimelineProps>(
       return actions.filter((action) => !hideActions.includes(action));
     }, [onDeleteSelected, deleteTimelines, hideActions]);
 
+    const SearchRowContent = useMemo(
+      () => (
+        <>
+          {!!timelineFilter && timelineFilter}
+          {!!templateTimelineFilter && templateTimelineFilter}
+        </>
+      ),
+      [timelineFilter, templateTimelineFilter]
+    );
+
     return (
       <>
         <EuiModalHeader>
@@ -67,13 +80,15 @@ export const OpenTimelineModalBody = memo<OpenTimelineProps>(
             <>
               <SearchRow
                 data-test-subj="search-row"
+                favoriteCount={favoriteCount}
                 onlyFavorites={onlyFavorites}
                 onQueryChange={onQueryChange}
                 onToggleOnlyFavorites={onToggleOnlyFavorites}
                 query={query}
-                tabs={tabs}
                 totalSearchResultsCount={totalSearchResultsCount}
-              />
+              >
+                {SearchRowContent}
+              </SearchRow>
             </>
           </HeaderContainer>
         </EuiModalHeader>
@@ -96,6 +111,7 @@ export const OpenTimelineModalBody = memo<OpenTimelineProps>(
             showExtendedColumns={false}
             sortDirection={sortDirection}
             sortField={sortField}
+            timelineType={timelineType}
             totalSearchResultsCount={totalSearchResultsCount}
           />
         </EuiModalBody>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/search_row/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/search_row/index.tsx
index 557649aa3aa4..6f9178664ccf 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/search_row/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/search_row/index.tsx
@@ -34,8 +34,13 @@ SearchRowFlexGroup.displayName = 'SearchRowFlexGroup';
 
 type Props = Pick<
   OpenTimelineProps,
-  'onlyFavorites' | 'onQueryChange' | 'onToggleOnlyFavorites' | 'query' | 'totalSearchResultsCount'
-> & { tabs?: JSX.Element };
+  | 'favoriteCount'
+  | 'onlyFavorites'
+  | 'onQueryChange'
+  | 'onToggleOnlyFavorites'
+  | 'query'
+  | 'totalSearchResultsCount'
+> & { children?: JSX.Element | null };
 
 const searchBox = {
   placeholder: i18n.SEARCH_PLACEHOLDER,
@@ -47,12 +52,13 @@ const searchBox = {
  */
 export const SearchRow = React.memo<Props>(
   ({
+    favoriteCount,
     onlyFavorites,
     onQueryChange,
     onToggleOnlyFavorites,
     query,
     totalSearchResultsCount,
-    tabs,
+    children,
   }) => {
     return (
       <SearchRowContainer>
@@ -68,10 +74,11 @@ export const SearchRow = React.memo<Props>(
                   data-test-subj="only-favorites-toggle"
                   hasActiveFilters={onlyFavorites}
                   onClick={onToggleOnlyFavorites}
+                  numFilters={favoriteCount ?? undefined}
                 >
                   {i18n.ONLY_FAVORITES}
                 </EuiFilterButton>
-                {tabs}
+                {!!children && children}
               </>
             </EuiFilterGroup>
           </EuiFlexItem>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/actions_columns.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/actions_columns.tsx
index c92e241c0fe7..5b8eb8fd0365 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/actions_columns.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/actions_columns.tsx
@@ -16,6 +16,7 @@ import {
   TimelineActionsOverflowColumns,
 } from '../types';
 import * as i18n from '../translations';
+import { TimelineStatus } from '../../../../../common/types/timeline';
 
 /**
  * Returns the action columns (e.g. delete, open duplicate timeline)
@@ -54,7 +55,9 @@ export const getActionsColumns = ({
     onClick: (selectedTimeline: OpenTimelineResult) => {
       if (enableExportTimelineDownloader != null) enableExportTimelineDownloader(selectedTimeline);
     },
-    enabled: ({ savedObjectId }: OpenTimelineResult) => savedObjectId != null,
+    enabled: (timeline: OpenTimelineResult) => {
+      return timeline.savedObjectId != null && timeline.status !== TimelineStatus.immutable;
+    },
     description: i18n.EXPORT_SELECTED,
     'data-test-subj': 'export-timeline',
   };
@@ -65,7 +68,8 @@ export const getActionsColumns = ({
     onClick: (selectedTimeline: OpenTimelineResult) => {
       if (onOpenDeleteTimelineModal != null) onOpenDeleteTimelineModal(selectedTimeline);
     },
-    enabled: ({ savedObjectId }: OpenTimelineResult) => savedObjectId != null,
+    enabled: ({ savedObjectId, status }: OpenTimelineResult) =>
+      savedObjectId != null && status !== TimelineStatus.immutable,
     description: i18n.DELETE_SELECTED,
     'data-test-subj': 'delete-timeline',
   };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/icon_header_columns.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/icon_header_columns.tsx
index 5b0f3ded7d71..e07c6b6b4614 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/icon_header_columns.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/icon_header_columns.tsx
@@ -13,55 +13,68 @@ import { ACTION_COLUMN_WIDTH } from './common_styles';
 import { getNotesCount, getPinnedEventCount } from '../helpers';
 import * as i18n from '../translations';
 import { FavoriteTimelineResult, OpenTimelineResult } from '../types';
+import { TimelineTypeLiteralWithNull, TimelineType } from '../../../../../common/types/timeline';
 
 /**
  * Returns the columns that have icon headers
  */
-export const getIconHeaderColumns = () => [
-  {
-    align: 'center',
-    field: 'pinnedEventIds',
-    name: (
-      <EuiToolTip content={i18n.PINNED_EVENTS}>
-        <EuiIcon data-test-subj="pinned-event-header-icon" size="m" type="pin" />
-      </EuiToolTip>
-    ),
-    render: (_: Record<string, boolean> | null | undefined, timelineResult: OpenTimelineResult) => (
-      <span data-test-subj="pinned-event-count">{`${getPinnedEventCount(timelineResult)}`}</span>
-    ),
-    sortable: false,
-    width: ACTION_COLUMN_WIDTH,
-  },
-  {
-    align: 'center',
-    field: 'eventIdToNoteIds',
-    name: (
-      <EuiToolTip content={i18n.NOTES}>
-        <EuiIcon data-test-subj="notes-count-header-icon" size="m" type="editorComment" />
-      </EuiToolTip>
-    ),
-    render: (
-      _: Record<string, string[]> | null | undefined,
-      timelineResult: OpenTimelineResult
-    ) => <span data-test-subj="notes-count">{getNotesCount(timelineResult)}</span>,
-    sortable: false,
-    width: ACTION_COLUMN_WIDTH,
-  },
-  {
-    align: 'center',
-    field: 'favorite',
-    name: (
-      <EuiToolTip content={i18n.FAVORITES}>
-        <EuiIcon data-test-subj="favorites-header-icon" size="m" type="starEmpty" />
-      </EuiToolTip>
-    ),
-    render: (favorite: FavoriteTimelineResult[] | null | undefined) => {
-      const isFavorite = favorite != null && favorite.length > 0;
-      const fill = isFavorite ? 'starFilled' : 'starEmpty';
+export const getIconHeaderColumns = ({
+  timelineType,
+}: {
+  timelineType: TimelineTypeLiteralWithNull;
+}) => {
+  const columns = {
+    note: {
+      align: 'center',
+      field: 'eventIdToNoteIds',
+      name: (
+        <EuiToolTip content={i18n.NOTES}>
+          <EuiIcon data-test-subj="notes-count-header-icon" size="m" type="editorComment" />
+        </EuiToolTip>
+      ),
+      render: (
+        _: Record<string, string[]> | null | undefined,
+        timelineResult: OpenTimelineResult
+      ) => <span data-test-subj="notes-count">{getNotesCount(timelineResult)}</span>,
+      sortable: false,
+      width: ACTION_COLUMN_WIDTH,
+    },
+    pinnedEvent: {
+      align: 'center',
+      field: 'pinnedEventIds',
+      name: (
+        <EuiToolTip content={i18n.PINNED_EVENTS}>
+          <EuiIcon data-test-subj="pinned-event-header-icon" size="m" type="pin" />
+        </EuiToolTip>
+      ),
+      render: (
+        _: Record<string, boolean> | null | undefined,
+        timelineResult: OpenTimelineResult
+      ) => (
+        <span data-test-subj="pinned-event-count">{`${getPinnedEventCount(timelineResult)}`}</span>
+      ),
+      sortable: false,
+      width: ACTION_COLUMN_WIDTH,
+    },
+    favorite: {
+      align: 'center',
+      field: 'favorite',
+      name: (
+        <EuiToolTip content={i18n.FAVORITES}>
+          <EuiIcon data-test-subj="favorites-header-icon" size="m" type="starEmpty" />
+        </EuiToolTip>
+      ),
+      render: (favorite: FavoriteTimelineResult[] | null | undefined) => {
+        const isFavorite = favorite != null && favorite.length > 0;
+        const fill = isFavorite ? 'starFilled' : 'starEmpty';
 
-      return <EuiIcon data-test-subj={`favorite-${fill}-star`} type={fill} size="m" />;
+        return <EuiIcon data-test-subj={`favorite-${fill}-star`} type={fill} size="m" />;
+      },
+      sortable: false,
+      width: ACTION_COLUMN_WIDTH,
     },
-    sortable: false,
-    width: ACTION_COLUMN_WIDTH,
-  },
-];
+  };
+  const templateColumns = [columns.note, columns.favorite];
+  const defaultColumns = [columns.pinnedEvent, columns.note, columns.favorite];
+  return timelineType === TimelineType.template ? templateColumns : defaultColumns;
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx
index 7091ef1f0a1f..fdba3247afb3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx
@@ -24,6 +24,7 @@ import { getActionsColumns } from './actions_columns';
 import { getCommonColumns } from './common_columns';
 import { getExtendedColumns } from './extended_columns';
 import { getIconHeaderColumns } from './icon_header_columns';
+import { TimelineTypeLiteralWithNull } from '../../../../../common/types/timeline';
 
 // there are a number of type mismatches across this file
 const EuiBasicTable: any = _EuiBasicTable; // eslint-disable-line @typescript-eslint/no-explicit-any
@@ -58,6 +59,7 @@ export const getTimelinesTableColumns = ({
   onOpenTimeline,
   onToggleShowNotes,
   showExtendedColumns,
+  timelineType,
 }: {
   actionTimelineToShow: ActionTimelineToShow[];
   deleteTimelines?: DeleteTimelines;
@@ -68,6 +70,7 @@ export const getTimelinesTableColumns = ({
   onSelectionChange: OnSelectionChange;
   onToggleShowNotes: OnToggleShowNotes;
   showExtendedColumns: boolean;
+  timelineType: TimelineTypeLiteralWithNull;
 }) => {
   return [
     ...getCommonColumns({
@@ -76,7 +79,7 @@ export const getTimelinesTableColumns = ({
       onToggleShowNotes,
     }),
     ...getExtendedColumnsIfEnabled(showExtendedColumns),
-    ...getIconHeaderColumns(),
+    ...getIconHeaderColumns({ timelineType }),
     ...getActionsColumns({
       actionTimelineToShow,
       deleteTimelines,
@@ -105,6 +108,7 @@ export interface TimelinesTableProps {
   showExtendedColumns: boolean;
   sortDirection: 'asc' | 'desc';
   sortField: string;
+  timelineType: TimelineTypeLiteralWithNull;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   tableRef?: React.MutableRefObject<_EuiBasicTable<any> | undefined>;
   totalSearchResultsCount: number;
@@ -134,6 +138,7 @@ export const TimelinesTable = React.memo<TimelinesTableProps>(
     sortField,
     sortDirection,
     tableRef,
+    timelineType,
     totalSearchResultsCount,
   }) => {
     const pagination = {
@@ -174,6 +179,7 @@ export const TimelinesTable = React.memo<TimelinesTableProps>(
           onSelectionChange,
           onToggleShowNotes,
           showExtendedColumns,
+          timelineType,
         })}
         compressed
         data-test-subj="timelines-table"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/mocks.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/mocks.ts
index 78ca898cc407..0770f460794a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/mocks.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/mocks.ts
@@ -7,6 +7,7 @@ import { DEFAULT_SEARCH_RESULTS_PER_PAGE } from '../../../pages/timelines_page';
 import { DEFAULT_SORT_DIRECTION, DEFAULT_SORT_FIELD } from '../constants';
 import { OpenTimelineResult } from '../types';
 import { TimelinesTableProps } from '.';
+import { TimelineType } from '../../../../../common/types/timeline';
 
 export const getMockTimelinesTableProps = (
   mockOpenTimelineResults: OpenTimelineResult[]
@@ -28,5 +29,6 @@ export const getMockTimelinesTableProps = (
   showExtendedColumns: true,
   sortDirection: DEFAULT_SORT_DIRECTION,
   sortField: DEFAULT_SORT_FIELD,
+  timelineType: TimelineType.default,
   totalSearchResultsCount: mockOpenTimelineResults.length,
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/translations.ts
index edd77330f508..7b07548af67a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/translations.ts
@@ -220,6 +220,20 @@ export const TAB_TEMPLATES = i18n.translate(
   }
 );
 
+export const FILTER_ELASTIC_TIMELINES = i18n.translate(
+  'xpack.securitySolution.timelines.components.templateFilter.elasticTitle',
+  {
+    defaultMessage: 'Elastic templates',
+  }
+);
+
+export const FILTER_CUSTOM_TIMELINES = i18n.translate(
+  'xpack.securitySolution.timelines.components.templateFilter.customizedTitle',
+  {
+    defaultMessage: 'Custom templates',
+  }
+);
+
 export const IMPORT_TIMELINE_BTN_TITLE = i18n.translate(
   'xpack.securitySolution.timelines.components.importTimelineModal.importTimelineTitle',
   {
@@ -230,7 +244,7 @@ export const IMPORT_TIMELINE_BTN_TITLE = i18n.translate(
 export const SELECT_TIMELINE = i18n.translate(
   'xpack.securitySolution.timelines.components.importTimelineModal.selectTimelineDescription',
   {
-    defaultMessage: 'Select a SIEM timeline (as exported from the Timeline view) to import',
+    defaultMessage: 'Select a Security timeline (as exported from the Timeline view) to import',
   }
 );
 
@@ -280,3 +294,10 @@ export const IMPORT_FAILED_DETAILED = (id: string, statusCode: number, message:
       defaultMessage: 'Timeline ID: {id}\n Status Code: {statusCode}\n Message: {message}',
     }
   );
+
+export const TEMPLATE_CALL_OUT_MESSAGE = i18n.translate(
+  'xpack.securitySolution.timelines.components.templateCallOutMessageTitle',
+  {
+    defaultMessage: 'Now you can add timeline templates and link it to rules.',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/types.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/types.ts
index e1515a3a7925..8811d5452e03 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/types.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/types.ts
@@ -8,7 +8,12 @@ import { SetStateAction, Dispatch } from 'react';
 import { AllTimelinesVariables } from '../../containers/all';
 import { TimelineModel } from '../../store/timeline/model';
 import { NoteResult } from '../../../graphql/types';
-import { TimelineTypeLiteral } from '../../../../common/types/timeline';
+import {
+  TimelineTypeLiteral,
+  TimelineTypeLiteralWithNull,
+  TimelineStatus,
+  TemplateTimelineTypeLiteral,
+} from '../../../../common/types/timeline';
 
 /** The users who added a timeline to favorites */
 export interface FavoriteTimelineResult {
@@ -46,6 +51,7 @@ export interface OpenTimelineResult {
   notes?: TimelineResultNote[] | null;
   pinnedEventIds?: Readonly<Record<string, boolean>> | null;
   savedObjectId?: string | null;
+  status?: TimelineStatus | null;
   title?: string | null;
   templateTimelineId?: string | null;
   type?: TimelineTypeLiteral;
@@ -118,6 +124,8 @@ export interface OpenTimelineProps {
   deleteTimelines?: DeleteTimelines;
   /** The default requested size of each page of search results */
   defaultPageSize: number;
+  /** The number of favorite timeline*/
+  favoriteCount?: number | null | undefined;
   /** Displays an indicator that data is loading when true */
   isLoading: boolean;
   /** Required by EuiTable for expandable rows: a map of `TimelineResult.savedObjectId` to rendered notes */
@@ -160,8 +168,12 @@ export interface OpenTimelineProps {
   sortDirection: 'asc' | 'desc';
   /** the requested field to sort on */
   sortField: string;
+  /** this affects timeline's behaviour like editable / duplicatible */
+  timelineType: TimelineTypeLiteralWithNull;
+  /** when timelineType === template, templatetimelineFilter is a JSX.Element */
+  templateTimelineFilter: JSX.Element[] | null;
   /** timeline / template timeline */
-  tabs?: JSX.Element;
+  timelineFilter?: JSX.Element | JSX.Element[] | null;
   /** The title of the Open Timeline component  */
   title: string;
   /** The total (server-side) count of the search results */
@@ -196,9 +208,19 @@ export enum TimelineTabsStyle {
 }
 
 export interface TimelineTab {
-  id: TimelineTypeLiteral;
-  name: string;
+  count: number | undefined;
   disabled: boolean;
   href: string;
+  id: TimelineTypeLiteral;
+  name: string;
   onClick: (ev: { preventDefault: () => void }) => void;
+  withNext: boolean;
+}
+
+export interface TemplateTimelineFilter {
+  id: TemplateTimelineTypeLiteral;
+  name: string;
+  disabled: boolean;
+  withNext: boolean;
+  count: number | undefined;
 }
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/use_timeline_status.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/use_timeline_status.tsx
new file mode 100644
index 000000000000..f17f6aebaddf
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/use_timeline_status.tsx
@@ -0,0 +1,110 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { useState, useCallback, useMemo } from 'react';
+import { EuiFilterButton } from '@elastic/eui';
+
+import {
+  TimelineStatus,
+  TimelineType,
+  TimelineTypeLiteralWithNull,
+  TemplateTimelineType,
+  TemplateTimelineTypeLiteralWithNull,
+  TimelineStatusLiteralWithNull,
+} from '../../../../common/types/timeline';
+
+import * as i18n from './translations';
+import { TemplateTimelineFilter } from './types';
+import { disableTemplate } from '../../../../common/constants';
+
+export const useTimelineStatus = ({
+  timelineType,
+  elasticTemplateTimelineCount,
+  customTemplateTimelineCount,
+}: {
+  timelineType: TimelineTypeLiteralWithNull;
+  elasticTemplateTimelineCount?: number | null;
+  customTemplateTimelineCount?: number | null;
+}): {
+  timelineStatus: TimelineStatusLiteralWithNull;
+  templateTimelineType: TemplateTimelineTypeLiteralWithNull;
+  templateTimelineFilter: JSX.Element[] | null;
+} => {
+  const [selectedTab, setSelectedTab] = useState<TemplateTimelineTypeLiteralWithNull>(
+    disableTemplate ? null : TemplateTimelineType.elastic
+  );
+  const isTemplateFilterEnabled = useMemo(() => timelineType === TimelineType.template, [
+    timelineType,
+  ]);
+
+  const templateTimelineType = useMemo(
+    () => (disableTemplate || !isTemplateFilterEnabled ? null : selectedTab),
+    [selectedTab, isTemplateFilterEnabled]
+  );
+
+  const timelineStatus = useMemo(
+    () =>
+      templateTimelineType == null
+        ? null
+        : templateTimelineType === TemplateTimelineType.elastic
+        ? TimelineStatus.immutable
+        : TimelineStatus.active,
+    [templateTimelineType]
+  );
+
+  const filters = useMemo(
+    () => [
+      {
+        id: TemplateTimelineType.elastic,
+        name: i18n.FILTER_ELASTIC_TIMELINES,
+        disabled: !isTemplateFilterEnabled,
+        withNext: true,
+        count: elasticTemplateTimelineCount ?? undefined,
+      },
+      {
+        id: TemplateTimelineType.custom,
+        name: i18n.FILTER_CUSTOM_TIMELINES,
+        disabled: !isTemplateFilterEnabled,
+        withNext: false,
+        count: customTemplateTimelineCount ?? undefined,
+      },
+    ],
+    [customTemplateTimelineCount, elasticTemplateTimelineCount, isTemplateFilterEnabled]
+  );
+
+  const onFilterClicked = useCallback(
+    (tabId) => {
+      if (selectedTab === tabId) {
+        setSelectedTab(null);
+      } else {
+        setSelectedTab(tabId);
+      }
+    },
+    [setSelectedTab, selectedTab]
+  );
+
+  const templateTimelineFilter = useMemo(() => {
+    return isTemplateFilterEnabled
+      ? filters.map((tab: TemplateTimelineFilter) => (
+          <EuiFilterButton
+            hasActiveFilters={tab.id === templateTimelineType}
+            key={`template-timeline-filter-${tab.id}`}
+            numFilters={tab.count}
+            onClick={onFilterClicked.bind(null, tab.id)}
+            withNext={tab.withNext}
+            isDisabled={tab.disabled}
+          >
+            {tab.name}
+          </EuiFilterButton>
+        ))
+      : null;
+  }, [templateTimelineType, filters, isTemplateFilterEnabled, onFilterClicked]);
+
+  return {
+    timelineStatus,
+    templateTimelineType,
+    templateTimelineFilter,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/use_timeline_types.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/use_timeline_types.tsx
index 56c67b0c294a..bee94db34887 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/use_timeline_types.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/use_timeline_types.tsx
@@ -13,10 +13,16 @@ import { getTimelineTabsUrl, useFormatUrl } from '../../../common/components/lin
 import * as i18n from './translations';
 import { TimelineTabsStyle, TimelineTab } from './types';
 
-export const useTimelineTypes = (): {
+export const useTimelineTypes = ({
+  defaultTimelineCount,
+  templateTimelineCount,
+}: {
+  defaultTimelineCount?: number | null;
+  templateTimelineCount?: number | null;
+}): {
   timelineType: TimelineTypeLiteralWithNull;
   timelineTabs: JSX.Element;
-  timelineFilters: JSX.Element;
+  timelineFilters: JSX.Element[];
 } => {
   const history = useHistory();
   const { formatUrl, search: urlSearch } = useFormatUrl(SecurityPageName.timelines);
@@ -40,35 +46,52 @@ export const useTimelineTypes = (): {
     },
     [history, urlSearch]
   );
-
-  const getFilterOrTabs: (timelineTabsStyle: TimelineTabsStyle) => TimelineTab[] = (
-    timelineTabsStyle: TimelineTabsStyle
-  ) => [
-    {
-      id: TimelineType.default,
-      name:
-        timelineTabsStyle === TimelineTabsStyle.filter
-          ? i18n.FILTER_TIMELINES(i18n.TAB_TIMELINES)
-          : i18n.TAB_TIMELINES,
-      href: formatUrl(getTimelineTabsUrl(TimelineType.default, urlSearch)),
-      disabled: false,
-      onClick: goToTimeline,
-    },
-    {
-      id: TimelineType.template,
-      name:
-        timelineTabsStyle === TimelineTabsStyle.filter
-          ? i18n.FILTER_TIMELINES(i18n.TAB_TEMPLATES)
-          : i18n.TAB_TEMPLATES,
-      href: formatUrl(getTimelineTabsUrl(TimelineType.template, urlSearch)),
-      disabled: false,
-      onClick: goToTemplateTimeline,
-    },
-  ];
+  const getFilterOrTabs: (timelineTabsStyle: TimelineTabsStyle) => TimelineTab[] = useCallback(
+    (timelineTabsStyle: TimelineTabsStyle) => [
+      {
+        id: TimelineType.default,
+        name:
+          timelineTabsStyle === TimelineTabsStyle.filter
+            ? i18n.FILTER_TIMELINES(i18n.TAB_TIMELINES)
+            : i18n.TAB_TIMELINES,
+        href: formatUrl(getTimelineTabsUrl(TimelineType.default, urlSearch)),
+        disabled: false,
+        withNext: true,
+        count:
+          timelineTabsStyle === TimelineTabsStyle.filter
+            ? defaultTimelineCount ?? undefined
+            : undefined,
+        onClick: goToTimeline,
+      },
+      {
+        id: TimelineType.template,
+        name:
+          timelineTabsStyle === TimelineTabsStyle.filter
+            ? i18n.FILTER_TIMELINES(i18n.TAB_TEMPLATES)
+            : i18n.TAB_TEMPLATES,
+        href: formatUrl(getTimelineTabsUrl(TimelineType.template, urlSearch)),
+        disabled: false,
+        withNext: false,
+        count:
+          timelineTabsStyle === TimelineTabsStyle.filter
+            ? templateTimelineCount ?? undefined
+            : undefined,
+        onClick: goToTemplateTimeline,
+      },
+    ],
+    [
+      defaultTimelineCount,
+      templateTimelineCount,
+      urlSearch,
+      formatUrl,
+      goToTimeline,
+      goToTemplateTimeline,
+    ]
+  );
 
   const onFilterClicked = useCallback(
-    (timelineTabsStyle, tabId) => {
-      if (timelineTabsStyle === TimelineTabsStyle.filter && tabId === timelineType) {
+    (tabId) => {
+      if (tabId === timelineType) {
         setTimelineTypes(null);
       } else {
         setTimelineTypes(tabId);
@@ -89,7 +112,7 @@ export const useTimelineTypes = (): {
               href={tab.href}
               onClick={(ev) => {
                 tab.onClick(ev);
-                onFilterClicked(TimelineTabsStyle.tab, tab.id);
+                onFilterClicked(tab.id);
               }}
             >
               {tab.name}
@@ -103,24 +126,21 @@ export const useTimelineTypes = (): {
   }, [tabName]);
 
   const timelineFilters = useMemo(() => {
-    return (
-      <>
-        {getFilterOrTabs(TimelineTabsStyle.tab).map((tab: TimelineTab) => (
-          <EuiFilterButton
-            hasActiveFilters={tab.id === timelineType}
-            key={`timeline-${TimelineTabsStyle.filter}-${tab.id}`}
-            onClick={(ev: { preventDefault: () => void }) => {
-              tab.onClick(ev);
-              onFilterClicked.bind(null, TimelineTabsStyle.filter, tab.id);
-            }}
-          >
-            {tab.name}
-          </EuiFilterButton>
-        ))}
-      </>
-    );
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [timelineType]);
+    return getFilterOrTabs(TimelineTabsStyle.filter).map((tab: TimelineTab) => (
+      <EuiFilterButton
+        hasActiveFilters={tab.id === timelineType}
+        key={`timeline-${TimelineTabsStyle.filter}-${tab.id}`}
+        numFilters={tab.count}
+        onClick={(ev: { preventDefault: () => void }) => {
+          tab.onClick(ev);
+          onFilterClicked(tab.id);
+        }}
+        withNext={tab.withNext}
+      >
+        {tab.name}
+      </EuiFilterButton>
+    ));
+  }, [timelineType, getFilterOrTabs, onFilterClicked]);
 
   return {
     timelineType,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap
index 927822527193..012cfd66317d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap
@@ -926,6 +926,7 @@ In other use cases the message field can be used to concatenate different values
                 }
               }
               start={1521830963132}
+              status="active"
               toggleColumn={[MockFunction]}
               usersViewing={
                 Array [
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
index a50e7e56661f..53b018fb00ad 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
@@ -5,13 +5,24 @@
  */
 import { mount } from 'enzyme';
 import React from 'react';
+import { useSelector } from 'react-redux';
 
-import { TestProviders } from '../../../../../common/mock';
+import { TestProviders, mockTimelineModel } from '../../../../../common/mock';
 import { DEFAULT_ACTIONS_COLUMN_WIDTH } from '../constants';
 
 import { Actions } from '.';
 
+jest.mock('react-redux', () => {
+  const origin = jest.requireActual('react-redux');
+  return {
+    ...origin,
+    useSelector: jest.fn(),
+  };
+});
+
 describe('Actions', () => {
+  (useSelector as jest.Mock).mockReturnValue(mockTimelineModel);
+
   test('it renders a checkbox for selecting the event when `showCheckboxes` is `true`', () => {
     const wrapper = mount(
       <TestProviders>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
index b478070b3157..d343c3db04da 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
@@ -3,10 +3,15 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { EuiButtonIcon, EuiCheckbox, EuiLoadingSpinner, EuiToolTip } from '@elastic/eui';
 import React from 'react';
+import { useSelector } from 'react-redux';
+import { EuiButtonIcon, EuiCheckbox, EuiLoadingSpinner, EuiToolTip } from '@elastic/eui';
 
 import { Note } from '../../../../../common/lib/note';
+import { StoreState } from '../../../../../common/store/types';
+
+import { TimelineModel } from '../../../../store/timeline/model';
+
 import { AssociateNote, UpdateNote } from '../../../notes/helpers';
 import { Pin } from '../../pin';
 import { NotesButton } from '../../properties/helpers';
@@ -79,92 +84,101 @@ export const Actions = React.memo<Props>(
     showNotes,
     toggleShowNotes,
     updateNote,
-  }) => (
-    <EventsTdGroupActions
-      actionsColumnWidth={actionsColumnWidth}
-      data-test-subj="event-actions-container"
-    >
-      {showCheckboxes && (
-        <EventsTd data-test-subj="select-event-container">
+  }) => {
+    const timeline = useSelector<StoreState, TimelineModel>((state) => {
+      return state.timeline.timelineById['timeline-1'];
+    });
+    return (
+      <EventsTdGroupActions
+        actionsColumnWidth={actionsColumnWidth}
+        data-test-subj="event-actions-container"
+      >
+        {showCheckboxes && (
+          <EventsTd data-test-subj="select-event-container">
+            <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
+              {loadingEventIds.includes(eventId) ? (
+                <EuiLoadingSpinner size="m" data-test-subj="event-loader" />
+              ) : (
+                <EuiCheckbox
+                  data-test-subj="select-event"
+                  id={eventId}
+                  checked={checked}
+                  onChange={(event: React.ChangeEvent<HTMLInputElement>) => {
+                    onRowSelected({
+                      eventIds: [eventId],
+                      isSelected: event.currentTarget.checked,
+                    });
+                  }}
+                />
+              )}
+            </EventsTdContent>
+          </EventsTd>
+        )}
+
+        <EventsTd>
           <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
-            {loadingEventIds.includes(eventId) ? (
-              <EuiLoadingSpinner size="m" data-test-subj="event-loader" />
-            ) : (
-              <EuiCheckbox
-                data-test-subj="select-event"
+            {loading && <EventsLoading />}
+
+            {!loading && (
+              <EuiButtonIcon
+                aria-label={expanded ? i18n.COLLAPSE : i18n.EXPAND}
+                data-test-subj="expand-event"
+                iconType={expanded ? 'arrowDown' : 'arrowRight'}
                 id={eventId}
-                checked={checked}
-                onChange={(event: React.ChangeEvent<HTMLInputElement>) => {
-                  onRowSelected({
-                    eventIds: [eventId],
-                    isSelected: event.currentTarget.checked,
-                  });
-                }}
+                onClick={onEventToggled}
               />
             )}
           </EventsTdContent>
         </EventsTd>
-      )}
 
-      <EventsTd>
-        <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
-          {loading && <EventsLoading />}
+        <>{additionalActions}</>
 
-          {!loading && (
-            <EuiButtonIcon
-              aria-label={expanded ? i18n.COLLAPSE : i18n.EXPAND}
-              data-test-subj="expand-event"
-              iconType={expanded ? 'arrowDown' : 'arrowRight'}
-              id={eventId}
-              onClick={onEventToggled}
-            />
-          )}
-        </EventsTdContent>
-      </EventsTd>
+        {!isEventViewer && (
+          <>
+            <EventsTd>
+              <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
+                <EuiToolTip
+                  data-test-subj="timeline-action-pin-tool-tip"
+                  content={getPinTooltip({
+                    isPinned: eventIsPinned,
+                    eventHasNotes: eventHasNotes(noteIds),
+                    timelineType: timeline.timelineType,
+                  })}
+                >
+                  <Pin
+                    allowUnpinning={!eventHasNotes(noteIds)}
+                    data-test-subj="pin-event"
+                    onClick={onPinClicked}
+                    pinned={eventIsPinned}
+                    timelineType={timeline.timelineType}
+                  />
+                </EuiToolTip>
+              </EventsTdContent>
+            </EventsTd>
 
-      <>{additionalActions}</>
-
-      {!isEventViewer && (
-        <>
-          <EventsTd>
-            <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
-              <EuiToolTip
-                data-test-subj="timeline-action-pin-tool-tip"
-                content={getPinTooltip({
-                  isPinned: eventIsPinned,
-                  eventHasNotes: eventHasNotes(noteIds),
-                })}
-              >
-                <Pin
-                  allowUnpinning={!eventHasNotes(noteIds)}
-                  data-test-subj="pin-event"
-                  onClick={onPinClicked}
-                  pinned={eventIsPinned}
+            <EventsTd>
+              <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
+                <NotesButton
+                  animate={false}
+                  associateNote={associateNote}
+                  data-test-subj="add-note"
+                  getNotesByIds={getNotesByIds}
+                  noteIds={noteIds || emptyNotes}
+                  showNotes={showNotes}
+                  size="s"
+                  status={timeline.status}
+                  timelineType={timeline.timelineType}
+                  toggleShowNotes={toggleShowNotes}
+                  toolTip={timeline.timelineType ? i18n.NOTES_DISABLE_TOOLTIP : i18n.NOTES_TOOLTIP}
+                  updateNote={updateNote}
                 />
-              </EuiToolTip>
-            </EventsTdContent>
-          </EventsTd>
-
-          <EventsTd>
-            <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
-              <NotesButton
-                animate={false}
-                associateNote={associateNote}
-                data-test-subj="add-note"
-                getNotesByIds={getNotesByIds}
-                noteIds={noteIds || emptyNotes}
-                showNotes={showNotes}
-                size="s"
-                toggleShowNotes={toggleShowNotes}
-                toolTip={i18n.NOTES_TOOLTIP}
-                updateNote={updateNote}
-              />
-            </EventsTdContent>
-          </EventsTd>
-        </>
-      )}
-    </EventsTdGroupActions>
-  ),
+              </EventsTdContent>
+            </EventsTd>
+          </>
+        )}
+      </EventsTdGroupActions>
+    );
+  },
   (nextProps, prevProps) => {
     return (
       prevProps.actionsColumnWidth === nextProps.actionsColumnWidth &&
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
index cf76cd3ddb8d..d2175c728aa2 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
@@ -5,6 +5,7 @@
  */
 
 import React, { useEffect, useRef, useState, useCallback } from 'react';
+import { useSelector } from 'react-redux';
 import uuid from 'uuid';
 import VisibilitySensor from 'react-visibility-sensor';
 
@@ -13,7 +14,7 @@ import { TimelineDetailsQuery } from '../../../../containers/details';
 import { TimelineItem, DetailItem, TimelineNonEcsData } from '../../../../../graphql/types';
 import { requestIdleCallbackViaScheduler } from '../../../../../common/lib/helpers/scheduler';
 import { Note } from '../../../../../common/lib/note';
-import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
+import { ColumnHeaderOptions, TimelineModel } from '../../../../../timelines/store/timeline/model';
 import { AddNoteToEvent, UpdateNote } from '../../../notes/helpers';
 import { SkeletonRow } from '../../skeleton_row';
 import {
@@ -33,6 +34,7 @@ import { getEventType } from '../helpers';
 import { NoteCards } from '../../../notes/note_cards';
 import { useEventDetailsWidthContext } from '../../../../../common/components/events_viewer/event_details_width_context';
 import { EventColumnView } from './event_column_view';
+import { StoreState } from '../../../../../common/store';
 
 interface Props {
   actionsColumnWidth: number;
@@ -128,7 +130,9 @@ const StatefulEventComponent: React.FC<Props> = ({
   const [expanded, setExpanded] = useState<{ [eventId: string]: boolean }>({});
   const [initialRender, setInitialRender] = useState(false);
   const [showNotes, setShowNotes] = useState<{ [eventId: string]: boolean }>({});
-
+  const timeline = useSelector<StoreState, TimelineModel>((state) => {
+    return state.timeline.timelineById['timeline-1'];
+  });
   const divElement = useRef<HTMLDivElement | null>(null);
 
   const onToggleShowNotes = useCallback(() => {
@@ -251,6 +255,7 @@ const StatefulEventComponent: React.FC<Props> = ({
                         getNotesByIds={getNotesByIds}
                         noteIds={eventIdToNoteIds[event._id] || emptyNotes}
                         showAddNote={!!showNotes[event._id]}
+                        status={timeline.status}
                         toggleShowAddNote={onToggleShowNotes}
                         updateNote={updateNote}
                       />
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts
index e237e99df9ad..7ecd7ec5ed35 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts
@@ -7,6 +7,7 @@
 import { Ecs } from '../../../../graphql/types';
 
 import { eventHasNotes, eventIsPinned, getPinTooltip, stringifyEvent } from './helpers';
+import { TimelineType } from '../../../../../common/types/timeline';
 
 describe('helpers', () => {
   describe('stringifyEvent', () => {
@@ -192,21 +193,37 @@ describe('helpers', () => {
 
   describe('getPinTooltip', () => {
     test('it indicates the event may NOT be unpinned when `isPinned` is `true` and the event has notes', () => {
-      expect(getPinTooltip({ isPinned: true, eventHasNotes: true })).toEqual(
-        'This event cannot be unpinned because it has notes'
-      );
+      expect(
+        getPinTooltip({ isPinned: true, eventHasNotes: true, timelineType: TimelineType.default })
+      ).toEqual('This event cannot be unpinned because it has notes');
     });
 
     test('it indicates the event is pinned when `isPinned` is `true` and the event does NOT have notes', () => {
-      expect(getPinTooltip({ isPinned: true, eventHasNotes: false })).toEqual('Pinned event');
+      expect(
+        getPinTooltip({ isPinned: true, eventHasNotes: false, timelineType: TimelineType.default })
+      ).toEqual('Pinned event');
     });
 
     test('it indicates the event is NOT pinned when `isPinned` is `false` and the event has notes', () => {
-      expect(getPinTooltip({ isPinned: false, eventHasNotes: true })).toEqual('Unpinned event');
+      expect(
+        getPinTooltip({ isPinned: false, eventHasNotes: true, timelineType: TimelineType.default })
+      ).toEqual('Unpinned event');
     });
 
     test('it indicates the event is NOT pinned when `isPinned` is `false` and the event does NOT have notes', () => {
-      expect(getPinTooltip({ isPinned: false, eventHasNotes: false })).toEqual('Unpinned event');
+      expect(
+        getPinTooltip({ isPinned: false, eventHasNotes: false, timelineType: TimelineType.default })
+      ).toEqual('Unpinned event');
+    });
+
+    test('it indicates the event is disabled if timelineType is template', () => {
+      expect(
+        getPinTooltip({
+          isPinned: false,
+          eventHasNotes: false,
+          timelineType: TimelineType.template,
+        })
+      ).toEqual('This event cannot be pinned because it is filtered by a timeline template');
     });
   });
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts
index bdc8c66ec3aa..52bbccbba58e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts
@@ -15,6 +15,7 @@ import { OnPinEvent, OnUnPinEvent } from '../events';
 import { TimelineRowAction, TimelineRowActionOnClick } from './actions';
 
 import * as i18n from './translations';
+import { TimelineTypeLiteral, TimelineType } from '../../../../../common/types/timeline';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export const omitTypenameAndEmpty = (k: string, v: any): any | undefined =>
@@ -28,10 +29,19 @@ export const getPinTooltip = ({
   isPinned,
   // eslint-disable-next-line no-shadow
   eventHasNotes,
+  timelineType,
 }: {
   isPinned: boolean;
   eventHasNotes: boolean;
-}) => (isPinned && eventHasNotes ? i18n.PINNED_WITH_NOTES : isPinned ? i18n.PINNED : i18n.UNPINNED);
+  timelineType: TimelineTypeLiteral;
+}) =>
+  timelineType === TimelineType.template
+    ? i18n.DISABLE_PIN
+    : isPinned && eventHasNotes
+    ? i18n.PINNED_WITH_NOTES
+    : isPinned
+    ? i18n.PINNED
+    : i18n.UNPINNED;
 
 export interface IsPinnedParams {
   eventId: string;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
index 9b96e0c49c73..51bf883ed2d6 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
@@ -5,10 +5,11 @@
  */
 
 import React from 'react';
+import { useSelector } from 'react-redux';
 
 import { mockBrowserFields } from '../../../../common/containers/source/mock';
 import { Direction } from '../../../../graphql/types';
-import { defaultHeaders, mockTimelineData } from '../../../../common/mock';
+import { defaultHeaders, mockTimelineData, mockTimelineModel } from '../../../../common/mock';
 import { TestProviders } from '../../../../common/mock/test_providers';
 
 import { Body, BodyProps } from '.';
@@ -24,6 +25,13 @@ const mockSort: Sort = {
   sortDirection: Direction.desc,
 };
 
+jest.mock('react-redux', () => {
+  const origin = jest.requireActual('react-redux');
+  return {
+    ...origin,
+    useSelector: jest.fn(),
+  };
+});
 jest.mock('../../../../common/components/link_to');
 
 jest.mock(
@@ -41,41 +49,43 @@ jest.mock('../../../../common/lib/helpers/scheduler', () => ({
 
 describe('Body', () => {
   const mount = useMountAppended();
+  const props: BodyProps = {
+    addNoteToEvent: jest.fn(),
+    browserFields: mockBrowserFields,
+    columnHeaders: defaultHeaders,
+    columnRenderers,
+    data: mockTimelineData,
+    eventIdToNoteIds: {},
+    height: testBodyHeight,
+    id: 'timeline-test',
+    isSelectAllChecked: false,
+    getNotesByIds: mockGetNotesByIds,
+    loadingEventIds: [],
+    onColumnRemoved: jest.fn(),
+    onColumnResized: jest.fn(),
+    onColumnSorted: jest.fn(),
+    onFilterChange: jest.fn(),
+    onPinEvent: jest.fn(),
+    onRowSelected: jest.fn(),
+    onSelectAll: jest.fn(),
+    onUnPinEvent: jest.fn(),
+    onUpdateColumns: jest.fn(),
+    pinnedEventIds: {},
+    rowRenderers,
+    selectedEventIds: {},
+    show: true,
+    sort: mockSort,
+    showCheckboxes: false,
+    toggleColumn: jest.fn(),
+    updateNote: jest.fn(),
+  };
+  (useSelector as jest.Mock).mockReturnValue(mockTimelineModel);
 
   describe('rendering', () => {
     test('it renders the column headers', () => {
       const wrapper = mount(
         <TestProviders>
-          <Body
-            addNoteToEvent={jest.fn()}
-            browserFields={mockBrowserFields}
-            columnHeaders={defaultHeaders}
-            columnRenderers={columnRenderers}
-            data={mockTimelineData}
-            eventIdToNoteIds={{}}
-            height={testBodyHeight}
-            id={'timeline-test'}
-            isSelectAllChecked={false}
-            getNotesByIds={mockGetNotesByIds}
-            loadingEventIds={[]}
-            onColumnRemoved={jest.fn()}
-            onColumnResized={jest.fn()}
-            onColumnSorted={jest.fn()}
-            onFilterChange={jest.fn()}
-            onPinEvent={jest.fn()}
-            onRowSelected={jest.fn()}
-            onSelectAll={jest.fn()}
-            onUnPinEvent={jest.fn()}
-            onUpdateColumns={jest.fn()}
-            pinnedEventIds={{}}
-            rowRenderers={rowRenderers}
-            selectedEventIds={{}}
-            show={true}
-            sort={mockSort}
-            showCheckboxes={false}
-            toggleColumn={jest.fn()}
-            updateNote={jest.fn()}
-          />
+          <Body {...props} />
         </TestProviders>
       );
 
@@ -85,36 +95,7 @@ describe('Body', () => {
     test('it renders the scroll container', () => {
       const wrapper = mount(
         <TestProviders>
-          <Body
-            addNoteToEvent={jest.fn()}
-            browserFields={mockBrowserFields}
-            columnHeaders={defaultHeaders}
-            columnRenderers={columnRenderers}
-            data={mockTimelineData}
-            eventIdToNoteIds={{}}
-            height={testBodyHeight}
-            id={'timeline-test'}
-            isSelectAllChecked={false}
-            getNotesByIds={mockGetNotesByIds}
-            loadingEventIds={[]}
-            onColumnRemoved={jest.fn()}
-            onColumnResized={jest.fn()}
-            onColumnSorted={jest.fn()}
-            onFilterChange={jest.fn()}
-            onPinEvent={jest.fn()}
-            onRowSelected={jest.fn()}
-            onSelectAll={jest.fn()}
-            onUnPinEvent={jest.fn()}
-            onUpdateColumns={jest.fn()}
-            pinnedEventIds={{}}
-            rowRenderers={rowRenderers}
-            selectedEventIds={{}}
-            show={true}
-            sort={mockSort}
-            showCheckboxes={false}
-            toggleColumn={jest.fn()}
-            updateNote={jest.fn()}
-          />
+          <Body {...props} />
         </TestProviders>
       );
 
@@ -124,36 +105,7 @@ describe('Body', () => {
     test('it renders events', () => {
       const wrapper = mount(
         <TestProviders>
-          <Body
-            addNoteToEvent={jest.fn()}
-            browserFields={mockBrowserFields}
-            columnHeaders={defaultHeaders}
-            columnRenderers={columnRenderers}
-            data={mockTimelineData}
-            eventIdToNoteIds={{}}
-            height={testBodyHeight}
-            id={'timeline-test'}
-            isSelectAllChecked={false}
-            getNotesByIds={mockGetNotesByIds}
-            loadingEventIds={[]}
-            onColumnRemoved={jest.fn()}
-            onColumnResized={jest.fn()}
-            onColumnSorted={jest.fn()}
-            onFilterChange={jest.fn()}
-            onPinEvent={jest.fn()}
-            onRowSelected={jest.fn()}
-            onSelectAll={jest.fn()}
-            onUnPinEvent={jest.fn()}
-            onUpdateColumns={jest.fn()}
-            pinnedEventIds={{}}
-            rowRenderers={rowRenderers}
-            selectedEventIds={{}}
-            show={true}
-            sort={mockSort}
-            showCheckboxes={false}
-            toggleColumn={jest.fn()}
-            updateNote={jest.fn()}
-          />
+          <Body {...props} />
         </TestProviders>
       );
 
@@ -162,39 +114,10 @@ describe('Body', () => {
 
     test('it renders a tooltip for timestamp', async () => {
       const headersJustTimestamp = defaultHeaders.filter((h) => h.id === '@timestamp');
-
+      const testProps = { ...props, columnHeaders: headersJustTimestamp };
       const wrapper = mount(
         <TestProviders>
-          <Body
-            addNoteToEvent={jest.fn()}
-            browserFields={mockBrowserFields}
-            columnHeaders={headersJustTimestamp}
-            columnRenderers={columnRenderers}
-            data={mockTimelineData}
-            eventIdToNoteIds={{}}
-            height={testBodyHeight}
-            id={'timeline-test'}
-            isSelectAllChecked={false}
-            getNotesByIds={mockGetNotesByIds}
-            loadingEventIds={[]}
-            onColumnRemoved={jest.fn()}
-            onColumnResized={jest.fn()}
-            onColumnSorted={jest.fn()}
-            onFilterChange={jest.fn()}
-            onPinEvent={jest.fn()}
-            onRowSelected={jest.fn()}
-            onSelectAll={jest.fn()}
-            onUnPinEvent={jest.fn()}
-            onUpdateColumns={jest.fn()}
-            pinnedEventIds={{}}
-            rowRenderers={rowRenderers}
-            selectedEventIds={{}}
-            show={true}
-            sort={mockSort}
-            showCheckboxes={false}
-            toggleColumn={jest.fn()}
-            updateNote={jest.fn()}
-          />
+          <Body {...testProps} />
         </TestProviders>
       );
       wrapper.update();
@@ -215,6 +138,11 @@ describe('Body', () => {
   describe('action on event', () => {
     const dispatchAddNoteToEvent = jest.fn();
     const dispatchOnPinEvent = jest.fn();
+    const testProps = {
+      ...props,
+      addNoteToEvent: dispatchAddNoteToEvent,
+      onPinEvent: dispatchOnPinEvent,
+    };
 
     const addaNoteToEvent = (wrapper: ReturnType<typeof mount>, note: string) => {
       wrapper.find('[data-test-subj="add-note"]').first().find('button').simulate('click');
@@ -251,36 +179,7 @@ describe('Body', () => {
     test('Add a Note to an event', () => {
       const wrapper = mount(
         <TestProviders>
-          <Body
-            addNoteToEvent={dispatchAddNoteToEvent}
-            browserFields={mockBrowserFields}
-            columnHeaders={defaultHeaders}
-            columnRenderers={columnRenderers}
-            data={mockTimelineData}
-            eventIdToNoteIds={{}}
-            height={testBodyHeight}
-            id={'timeline-test'}
-            isSelectAllChecked={false}
-            getNotesByIds={mockGetNotesByIds}
-            loadingEventIds={[]}
-            onColumnRemoved={jest.fn()}
-            onColumnResized={jest.fn()}
-            onColumnSorted={jest.fn()}
-            onFilterChange={jest.fn()}
-            onPinEvent={dispatchOnPinEvent}
-            onRowSelected={jest.fn()}
-            onSelectAll={jest.fn()}
-            onUnPinEvent={jest.fn()}
-            onUpdateColumns={jest.fn()}
-            pinnedEventIds={{}}
-            rowRenderers={rowRenderers}
-            selectedEventIds={{}}
-            show={true}
-            sort={mockSort}
-            showCheckboxes={false}
-            toggleColumn={jest.fn()}
-            updateNote={jest.fn()}
-          />
+          <Body {...testProps} />
         </TestProviders>
       );
       addaNoteToEvent(wrapper, 'hello world');
@@ -290,44 +189,13 @@ describe('Body', () => {
     });
 
     test('Add two Note to an event', () => {
-      const Proxy = (props: BodyProps) => (
+      const Proxy = (proxyProps: BodyProps) => (
         <TestProviders>
-          <Body {...props} />
+          <Body {...proxyProps} />
         </TestProviders>
       );
 
-      const wrapper = mount(
-        <Proxy
-          addNoteToEvent={dispatchAddNoteToEvent}
-          browserFields={mockBrowserFields}
-          columnHeaders={defaultHeaders}
-          columnRenderers={columnRenderers}
-          data={mockTimelineData}
-          eventIdToNoteIds={{}}
-          height={testBodyHeight}
-          id={'timeline-test'}
-          isSelectAllChecked={false}
-          getNotesByIds={mockGetNotesByIds}
-          loadingEventIds={[]}
-          onColumnRemoved={jest.fn()}
-          onColumnResized={jest.fn()}
-          onColumnSorted={jest.fn()}
-          onFilterChange={jest.fn()}
-          onPinEvent={dispatchOnPinEvent}
-          onRowSelected={jest.fn()}
-          onSelectAll={jest.fn()}
-          onUnPinEvent={jest.fn()}
-          onUpdateColumns={jest.fn()}
-          pinnedEventIds={{}}
-          rowRenderers={rowRenderers}
-          selectedEventIds={{}}
-          show={true}
-          sort={mockSort}
-          showCheckboxes={false}
-          toggleColumn={jest.fn()}
-          updateNote={jest.fn()}
-        />
-      );
+      const wrapper = mount(<Proxy {...testProps} />);
       addaNoteToEvent(wrapper, 'hello world');
       dispatchAddNoteToEvent.mockClear();
       dispatchOnPinEvent.mockClear();
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/translations.ts
index 63b92d6b316c..ef7ee26cd3ec 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/translations.ts
@@ -13,6 +13,13 @@ export const NOTES_TOOLTIP = i18n.translate(
   }
 );
 
+export const NOTES_DISABLE_TOOLTIP = i18n.translate(
+  'xpack.securitySolution.timeline.body.notes.disableEventTooltip',
+  {
+    defaultMessage: 'Add notes for event filtered by a timeline template is not allowed',
+  }
+);
+
 export const COPY_TO_CLIPBOARD = i18n.translate(
   'xpack.securitySolution.timeline.body.copyToClipboardButtonLabel',
   {
@@ -38,6 +45,13 @@ export const PINNED_WITH_NOTES = i18n.translate(
   }
 );
 
+export const DISABLE_PIN = i18n.translate(
+  'xpack.securitySolution.timeline.body.pinning.disablePinnnedTooltip',
+  {
+    defaultMessage: 'This event cannot be pinned because it is filtered by a timeline template',
+  }
+);
+
 export const EXPAND = i18n.translate(
   'xpack.securitySolution.timeline.body.actions.expandAriaLabel',
   {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.test.tsx
index 6fb2443486f8..922148535d12 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.test.tsx
@@ -15,6 +15,7 @@ import { mockDataProviders } from '../data_providers/mock/mock_data_providers';
 import { useMountAppended } from '../../../../common/utils/use_mount_appended';
 
 import { TimelineHeader } from '.';
+import { TimelineStatus } from '../../../../../common/types/timeline';
 
 const mockUiSettingsForFilterManager = createKibanaCoreStartMock().uiSettings;
 
@@ -23,43 +24,32 @@ jest.mock('../../../../common/lib/kibana');
 describe('Header', () => {
   const indexPattern = mockIndexPattern;
   const mount = useMountAppended();
+  const props = {
+    browserFields: {},
+    dataProviders: mockDataProviders,
+    filterManager: new FilterManager(mockUiSettingsForFilterManager),
+    id: 'foo',
+    indexPattern,
+    onDataProviderEdited: jest.fn(),
+    onDataProviderRemoved: jest.fn(),
+    onToggleDataProviderEnabled: jest.fn(),
+    onToggleDataProviderExcluded: jest.fn(),
+    show: true,
+    showCallOutUnauthorizedMsg: false,
+    status: TimelineStatus.active,
+  };
 
   describe('rendering', () => {
     test('renders correctly against snapshot', () => {
-      const wrapper = shallow(
-        <TimelineHeader
-          browserFields={{}}
-          dataProviders={mockDataProviders}
-          filterManager={new FilterManager(mockUiSettingsForFilterManager)}
-          id="foo"
-          indexPattern={indexPattern}
-          onDataProviderEdited={jest.fn()}
-          onDataProviderRemoved={jest.fn()}
-          onToggleDataProviderEnabled={jest.fn()}
-          onToggleDataProviderExcluded={jest.fn()}
-          show={true}
-          showCallOutUnauthorizedMsg={false}
-        />
-      );
+      const wrapper = shallow(<TimelineHeader {...props} />);
       expect(wrapper).toMatchSnapshot();
     });
 
     test('it renders the data providers when show is true', () => {
+      const testProps = { ...props, show: true };
       const wrapper = mount(
         <TestProviders>
-          <TimelineHeader
-            browserFields={{}}
-            dataProviders={mockDataProviders}
-            filterManager={new FilterManager(mockUiSettingsForFilterManager)}
-            id="foo"
-            indexPattern={indexPattern}
-            onDataProviderEdited={jest.fn()}
-            onDataProviderRemoved={jest.fn()}
-            onToggleDataProviderEnabled={jest.fn()}
-            onToggleDataProviderExcluded={jest.fn()}
-            show={true}
-            showCallOutUnauthorizedMsg={false}
-          />
+          <TimelineHeader {...testProps} />
         </TestProviders>
       );
 
@@ -67,21 +57,11 @@ describe('Header', () => {
     });
 
     test('it does NOT render the data providers when show is false', () => {
+      const testProps = { ...props, show: false };
+
       const wrapper = mount(
         <TestProviders>
-          <TimelineHeader
-            browserFields={{}}
-            dataProviders={mockDataProviders}
-            filterManager={new FilterManager(mockUiSettingsForFilterManager)}
-            id="foo"
-            indexPattern={indexPattern}
-            onDataProviderEdited={jest.fn()}
-            onDataProviderRemoved={jest.fn()}
-            onToggleDataProviderEnabled={jest.fn()}
-            onToggleDataProviderExcluded={jest.fn()}
-            show={false}
-            showCallOutUnauthorizedMsg={false}
-          />
+          <TimelineHeader {...testProps} />
         </TestProviders>
       );
 
@@ -89,21 +69,15 @@ describe('Header', () => {
     });
 
     test('it renders the unauthorized call out providers', () => {
+      const testProps = {
+        ...props,
+        filterManager: new FilterManager(mockUiSettingsForFilterManager),
+        showCallOutUnauthorizedMsg: true,
+      };
+
       const wrapper = mount(
         <TestProviders>
-          <TimelineHeader
-            browserFields={{}}
-            dataProviders={mockDataProviders}
-            filterManager={new FilterManager(mockUiSettingsForFilterManager)}
-            id="foo"
-            indexPattern={indexPattern}
-            onDataProviderEdited={jest.fn()}
-            onDataProviderRemoved={jest.fn()}
-            onToggleDataProviderEnabled={jest.fn()}
-            onToggleDataProviderExcluded={jest.fn()}
-            show={true}
-            showCallOutUnauthorizedMsg={true}
-          />
+          <TimelineHeader {...testProps} />
         </TestProviders>
       );
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.tsx
index e8f1e7371923..0541dee4b1e5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/index.tsx
@@ -22,6 +22,10 @@ import { StatefulSearchOrFilter } from '../search_or_filter';
 import { BrowserFields } from '../../../../common/containers/source';
 
 import * as i18n from './translations';
+import {
+  TimelineStatus,
+  TimelineStatusLiteralWithNull,
+} from '../../../../../common/types/timeline';
 
 interface Props {
   browserFields: BrowserFields;
@@ -36,6 +40,7 @@ interface Props {
   onToggleDataProviderExcluded: OnToggleDataProviderExcluded;
   show: boolean;
   showCallOutUnauthorizedMsg: boolean;
+  status: TimelineStatusLiteralWithNull;
 }
 
 const TimelineHeaderComponent: React.FC<Props> = ({
@@ -51,6 +56,7 @@ const TimelineHeaderComponent: React.FC<Props> = ({
   onToggleDataProviderExcluded,
   show,
   showCallOutUnauthorizedMsg,
+  status,
 }) => (
   <>
     {showCallOutUnauthorizedMsg && (
@@ -62,7 +68,15 @@ const TimelineHeaderComponent: React.FC<Props> = ({
         size="s"
       />
     )}
-
+    {status === TimelineStatus.immutable && (
+      <EuiCallOut
+        data-test-subj="timelineImmutableCallOut"
+        title={i18n.CALL_OUT_IMMUTIABLE}
+        color="primary"
+        iconType="info"
+        size="s"
+      />
+    )}
     {show && !showGraphView(graphEventId) && (
       <>
         <DataProviders
@@ -100,5 +114,6 @@ export const TimelineHeader = React.memo(
     prevProps.onToggleDataProviderEnabled === nextProps.onToggleDataProviderEnabled &&
     prevProps.onToggleDataProviderExcluded === nextProps.onToggleDataProviderExcluded &&
     prevProps.show === nextProps.show &&
-    prevProps.showCallOutUnauthorizedMsg === nextProps.showCallOutUnauthorizedMsg
+    prevProps.showCallOutUnauthorizedMsg === nextProps.showCallOutUnauthorizedMsg &&
+    prevProps.status === nextProps.status
 );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/translations.ts
index c3c11289037a..dd945d345aad 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/translations.ts
@@ -13,3 +13,11 @@ export const CALL_OUT_UNAUTHORIZED_MSG = i18n.translate(
       'You can use Timeline to investigate events, but you do not have the required permissions to save timelines for future use. If you need to save timelines, contact your Kibana administrator.',
   }
 );
+
+export const CALL_OUT_IMMUTIABLE = i18n.translate(
+  'xpack.securitySolution.timeline.callOut.immutable.message.description',
+  {
+    defaultMessage:
+      'This timeline is immutable, therefore not allowed to save it within the security application, though you may continue to use the timeline to search and filter security events',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
index 83ac1a421958..296b24cff43a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
@@ -25,6 +25,7 @@ import { Sort } from './body/sort';
 import { mockDataProviders } from './data_providers/mock/mock_data_providers';
 import { StatefulTimeline, Props as StatefulTimelineProps } from './index';
 import { Timeline } from './timeline';
+import { TimelineType, TimelineStatus } from '../../../../common/types/timeline';
 
 jest.mock('../../../common/lib/kibana', () => {
   const originalModule = jest.requireActual('../../../common/lib/kibana');
@@ -88,6 +89,8 @@ describe('StatefulTimeline', () => {
       showCallOutUnauthorizedMsg: false,
       sort,
       start: startDate,
+      status: TimelineStatus.active,
+      timelineType: TimelineType.default,
       updateColumns: timelineActions.updateColumns,
       updateDataProviderEnabled: timelineActions.updateDataProviderEnabled,
       updateDataProviderExcluded: timelineActions.updateDataProviderExcluded,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
index a66c01d0b5d0..35622eddc359 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
@@ -57,6 +57,8 @@ const StatefulTimelineComponent = React.memo<Props>(
     showCallOutUnauthorizedMsg,
     sort,
     start,
+    status,
+    timelineType,
     updateDataProviderEnabled,
     updateDataProviderExcluded,
     updateItemsPerPage,
@@ -189,6 +191,7 @@ const StatefulTimelineComponent = React.memo<Props>(
         showCallOutUnauthorizedMsg={showCallOutUnauthorizedMsg}
         sort={sort!}
         start={start}
+        status={status}
         toggleColumn={toggleColumn}
         usersViewing={usersViewing}
       />
@@ -207,6 +210,8 @@ const StatefulTimelineComponent = React.memo<Props>(
       prevProps.show === nextProps.show &&
       prevProps.showCallOutUnauthorizedMsg === nextProps.showCallOutUnauthorizedMsg &&
       prevProps.start === nextProps.start &&
+      prevProps.timelineType === nextProps.timelineType &&
+      prevProps.status === nextProps.status &&
       deepEqual(prevProps.columns, nextProps.columns) &&
       deepEqual(prevProps.dataProviders, nextProps.dataProviders) &&
       deepEqual(prevProps.filters, nextProps.filters) &&
@@ -238,11 +243,12 @@ const makeMapStateToProps = () => {
       kqlMode,
       show,
       sort,
+      status,
+      timelineType,
     } = timeline;
     const kqlQueryExpression = getKqlQueryTimeline(state, id)!;
 
     const timelineFilter = kqlMode === 'filter' ? filters || [] : [];
-
     return {
       columns,
       dataProviders,
@@ -261,6 +267,8 @@ const makeMapStateToProps = () => {
       showCallOutUnauthorizedMsg: getShowCallOutUnauthorizedMsg(state),
       sort,
       start: input.timerange.from,
+      status,
+      timelineType,
     };
   };
   return mapStateToProps;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/pin/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/pin/index.tsx
index 800ea814fdd5..30fe8ae0ca1f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/pin/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/pin/index.tsx
@@ -8,6 +8,8 @@ import { EuiButtonIcon, IconSize } from '@elastic/eui';
 import { noop } from 'lodash/fp';
 import React from 'react';
 
+import { TimelineType, TimelineTypeLiteral } from '../../../../../common/types/timeline';
+
 import * as i18n from '../body/translations';
 
 export type PinIcon = 'pin' | 'pinFilled';
@@ -17,21 +19,25 @@ export const getPinIcon = (pinned: boolean): PinIcon => (pinned ? 'pinFilled' :
 interface Props {
   allowUnpinning: boolean;
   iconSize?: IconSize;
+  timelineType?: TimelineTypeLiteral;
   onClick?: () => void;
   pinned: boolean;
 }
 
 export const Pin = React.memo<Props>(
-  ({ allowUnpinning, iconSize = 'm', onClick = noop, pinned }) => (
-    <EuiButtonIcon
-      aria-label={pinned ? i18n.PINNED : i18n.UNPINNED}
-      data-test-subj="pin"
-      iconSize={iconSize}
-      iconType={getPinIcon(pinned)}
-      isDisabled={allowUnpinning ? false : true}
-      onClick={onClick}
-    />
-  )
+  ({ allowUnpinning, iconSize = 'm', onClick = noop, pinned, timelineType }) => {
+    const isTemplate = timelineType === TimelineType.template;
+    return (
+      <EuiButtonIcon
+        aria-label={pinned ? i18n.PINNED : i18n.UNPINNED}
+        data-test-subj="pin"
+        iconSize={iconSize}
+        iconType={getPinIcon(pinned)}
+        onClick={onClick}
+        isDisabled={isTemplate}
+      />
+    );
+  }
 );
 
 Pin.displayName = 'Pin';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
index 528af23191ee..21140d668d71 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
@@ -27,6 +27,7 @@ import {
   TimelineTypeLiteral,
   TimelineStatus,
   TimelineType,
+  TimelineStatusLiteral,
   TimelineId,
 } from '../../../../../common/types/timeline';
 import { SecurityPageName } from '../../../../app/types';
@@ -262,11 +263,13 @@ interface NotesButtonProps {
   getNotesByIds: (noteIds: string[]) => Note[];
   noteIds: string[];
   size: 's' | 'l';
+  status: TimelineStatusLiteral;
   showNotes: boolean;
   toggleShowNotes: () => void;
   text?: string;
   toolTip?: string;
   updateNote: UpdateNote;
+  timelineType: TimelineTypeLiteral;
 }
 
 const getNewNoteId = (): string => uuid.v4();
@@ -303,16 +306,24 @@ LargeNotesButton.displayName = 'LargeNotesButton';
 interface SmallNotesButtonProps {
   noteIds: string[];
   toggleShowNotes: () => void;
+  timelineType: TimelineTypeLiteral;
 }
 
-const SmallNotesButton = React.memo<SmallNotesButtonProps>(({ noteIds, toggleShowNotes }) => (
-  <EuiButtonIcon
-    aria-label={i18n.NOTES}
-    data-test-subj="timeline-notes-button-small"
-    iconType="editorComment"
-    onClick={() => toggleShowNotes()}
-  />
-));
+const SmallNotesButton = React.memo<SmallNotesButtonProps>(
+  ({ noteIds, toggleShowNotes, timelineType }) => {
+    const isTemplate = timelineType === TimelineType.template;
+
+    return (
+      <EuiButtonIcon
+        aria-label={i18n.NOTES}
+        data-test-subj="timeline-notes-button-small"
+        iconType="editorComment"
+        onClick={() => toggleShowNotes()}
+        isDisabled={isTemplate}
+      />
+    );
+  }
+);
 SmallNotesButton.displayName = 'SmallNotesButton';
 
 /**
@@ -326,25 +337,32 @@ const NotesButtonComponent = React.memo<NotesButtonProps>(
     noteIds,
     showNotes,
     size,
+    status,
     toggleShowNotes,
     text,
     updateNote,
+    timelineType,
   }) => (
     <ButtonContainer animate={animate} data-test-subj="timeline-notes-button-container">
       <>
         {size === 'l' ? (
           <LargeNotesButton noteIds={noteIds} text={text} toggleShowNotes={toggleShowNotes} />
         ) : (
-          <SmallNotesButton noteIds={noteIds} toggleShowNotes={toggleShowNotes} />
+          <SmallNotesButton
+            noteIds={noteIds}
+            toggleShowNotes={toggleShowNotes}
+            timelineType={timelineType}
+          />
         )}
         {size === 'l' && showNotes ? (
           <EuiOverlayMask>
             <EuiModal maxWidth={NOTES_PANEL_WIDTH} onClose={toggleShowNotes}>
               <Notes
                 associateNote={associateNote}
+                getNewNoteId={getNewNoteId}
                 getNotesByIds={getNotesByIds}
+                status={status}
                 noteIds={noteIds}
-                getNewNoteId={getNewNoteId}
                 updateNote={updateNote}
               />
             </EuiModal>
@@ -364,6 +382,8 @@ export const NotesButton = React.memo<NotesButtonProps>(
     noteIds,
     showNotes,
     size,
+    status,
+    timelineType,
     toggleShowNotes,
     toolTip,
     text,
@@ -377,9 +397,11 @@ export const NotesButton = React.memo<NotesButtonProps>(
         noteIds={noteIds}
         showNotes={showNotes}
         size={size}
+        status={status}
         toggleShowNotes={toggleShowNotes}
         text={text}
         updateNote={updateNote}
+        timelineType={timelineType}
       />
     ) : (
       <EuiToolTip content={toolTip || ''} data-test-subj="timeline-notes-tool-tip">
@@ -390,9 +412,11 @@ export const NotesButton = React.memo<NotesButtonProps>(
           noteIds={noteIds}
           showNotes={showNotes}
           size={size}
+          status={status}
           toggleShowNotes={toggleShowNotes}
           text={text}
           updateNote={updateNote}
+          timelineType={timelineType}
         />
       </EuiToolTip>
     )
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx
index 1b76db409484..cd089d10d5d4 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx
@@ -6,13 +6,14 @@
 
 import { mount } from 'enzyme';
 import React from 'react';
-import { TimelineStatus } from '../../../../../common/types/timeline';
+import { TimelineStatus, TimelineType } from '../../../../../common/types/timeline';
 import {
   mockGlobalState,
   apolloClientObservable,
   SUB_PLUGINS_REDUCER,
   createSecuritySolutionStorageMock,
   TestProviders,
+  kibanaObservable,
 } from '../../../../common/mock';
 import { createStore, State } from '../../../../common/store';
 import { useThrottledResizeObserver } from '../../../../common/components/utils';
@@ -86,6 +87,7 @@ const defaultProps = {
   isDatepickerLocked: false,
   isFavorite: false,
   title: '',
+  timelineType: TimelineType.default,
   description: '',
   getNotesByIds: jest.fn(),
   noteIds: [],
@@ -103,11 +105,23 @@ describe('Properties', () => {
   const { storage } = createSecuritySolutionStorageMock();
   let mockedWidth = 1000;
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   beforeEach(() => {
     jest.clearAllMocks();
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
     (useThrottledResizeObserver as jest.Mock).mockReturnValue({ width: mockedWidth });
   });
 
@@ -130,9 +144,10 @@ describe('Properties', () => {
   });
 
   test('renders correctly draft timeline', () => {
+    const testProps = { ...defaultProps, status: TimelineStatus.draft };
     const wrapper = mount(
       <TestProviders store={store}>
-        <Properties {...{ ...defaultProps, status: TimelineStatus.draft }} />
+        <Properties {...testProps} />
       </TestProviders>
     );
 
@@ -157,9 +172,11 @@ describe('Properties', () => {
   });
 
   test('it renders a filled star icon when it is a favorite', () => {
+    const testProps = { ...defaultProps, isFavorite: true };
+
     const wrapper = mount(
       <TestProviders store={store}>
-        <Properties {...{ ...defaultProps, isFavorite: true }} />
+        <Properties {...testProps} />
       </TestProviders>
     );
 
@@ -168,10 +185,10 @@ describe('Properties', () => {
 
   test('it renders the title of the timeline', () => {
     const title = 'foozle';
-
+    const testProps = { ...defaultProps, title };
     const wrapper = mount(
       <TestProviders store={store}>
-        <Properties {...{ ...defaultProps, title }} />
+        <Properties {...testProps} />
       </TestProviders>
     );
 
@@ -194,9 +211,11 @@ describe('Properties', () => {
   });
 
   test('it renders the lock icon when isDatepickerLocked is true', () => {
+    const testProps = { ...defaultProps, isDatepickerLocked: true };
+
     const wrapper = mount(
       <TestProviders store={store}>
-        <Properties {...{ ...defaultProps, isDatepickerLocked: true }} />
+        <Properties {...testProps} />
       </TestProviders>
     );
     expect(
@@ -223,13 +242,16 @@ describe('Properties', () => {
 
   test('it renders a description on the left when the width is at least as wide as the threshold', () => {
     const description = 'strange';
+    const testProps = { ...defaultProps, description };
+
+    // mockedWidth = showDescriptionThreshold;
 
     (useThrottledResizeObserver as jest.Mock).mockReset();
     (useThrottledResizeObserver as jest.Mock).mockReturnValue({ width: showDescriptionThreshold });
 
     const wrapper = mount(
       <TestProviders store={store}>
-        <Properties {...{ ...defaultProps, description }} />
+        <Properties {...testProps} />
       </TestProviders>
     );
 
@@ -244,6 +266,9 @@ describe('Properties', () => {
 
   test('it does NOT render a description on the left when the width is less than the threshold', () => {
     const description = 'strange';
+    const testProps = { ...defaultProps, description };
+
+    // mockedWidth = showDescriptionThreshold - 1;
 
     (useThrottledResizeObserver as jest.Mock).mockReset();
     (useThrottledResizeObserver as jest.Mock).mockReturnValue({
@@ -252,7 +277,7 @@ describe('Properties', () => {
 
     const wrapper = mount(
       <TestProviders store={store}>
-        <Properties {...{ ...defaultProps, description }} />
+        <Properties {...testProps} />
       </TestProviders>
     );
 
@@ -313,10 +338,11 @@ describe('Properties', () => {
 
   test('it renders an avatar for the current user viewing the timeline when it has a title', () => {
     const title = 'port scan';
+    const testProps = { ...defaultProps, title };
 
     const wrapper = mount(
       <TestProviders store={store}>
-        <Properties {...{ ...defaultProps, title }} />
+        <Properties {...testProps} />
       </TestProviders>
     );
 
@@ -334,9 +360,11 @@ describe('Properties', () => {
   });
 
   test('insert timeline - new case', async () => {
+    const testProps = { ...defaultProps, title: 'coolness' };
+
     const wrapper = mount(
       <TestProviders store={store}>
-        <Properties {...{ ...defaultProps, title: 'coolness' }} />
+        <Properties {...testProps} />
       </TestProviders>
     );
     wrapper.find('[data-test-subj="settings-gear"]').at(0).simulate('click');
@@ -352,9 +380,11 @@ describe('Properties', () => {
   });
 
   test('insert timeline - existing case', async () => {
+    const testProps = { ...defaultProps, title: 'coolness' };
+
     const wrapper = mount(
       <TestProviders store={store}>
-        <Properties {...{ ...defaultProps, title: 'coolness' }} />
+        <Properties {...testProps} />
       </TestProviders>
     );
     wrapper.find('[data-test-subj="settings-gear"]').at(0).simulate('click');
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.tsx
index 8029d166a688..40462fa0d09d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.tsx
@@ -7,7 +7,7 @@
 import React, { useState, useCallback, useMemo } from 'react';
 
 import { useDispatch, useSelector } from 'react-redux';
-import { TimelineStatus, TimelineTypeLiteral } from '../../../../../common/types/timeline';
+import { TimelineStatusLiteral, TimelineTypeLiteral } from '../../../../../common/types/timeline';
 import { useThrottledResizeObserver } from '../../../../common/components/utils';
 import { Note } from '../../../../common/lib/note';
 import { InputsModelId } from '../../../../common/store/inputs/constants';
@@ -52,7 +52,8 @@ interface Props {
   isFavorite: boolean;
   noteIds: string[];
   timelineId: string;
-  status: TimelineStatus;
+  timelineType: TimelineTypeLiteral;
+  status: TimelineStatusLiteral;
   title: string;
   toggleLock: ToggleLock;
   updateDescription: UpdateDescription;
@@ -87,6 +88,7 @@ export const Properties = React.memo<Props>(
     noteIds,
     status,
     timelineId,
+    timelineType,
     title,
     toggleLock,
     updateDescription,
@@ -164,10 +166,12 @@ export const Properties = React.memo<Props>(
           isFavorite={isFavorite}
           noteIds={noteIds}
           onToggleShowNotes={onToggleShowNotes}
+          status={status}
           showDescription={width >= showDescriptionThreshold}
           showNotes={showNotes}
           showNotesFromWidth={width >= showNotesThreshold}
           timelineId={timelineId}
+          timelineType={timelineType}
           title={title}
           toggleLock={onToggleLock}
           updateDescription={updateDescription}
@@ -196,6 +200,7 @@ export const Properties = React.memo<Props>(
           showUsersView={title.length > 0}
           status={status}
           timelineId={timelineId}
+          timelineType={timelineType}
           title={title}
           updateDescription={updateDescription}
           updateNote={updateNote}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx
index cd6233334c5d..b14248487281 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx
@@ -11,6 +11,7 @@ import {
   mockGlobalState,
   apolloClientObservable,
   SUB_PLUGINS_REDUCER,
+  kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../../../common/mock';
 import { createStore, State } from '../../../../common/store';
@@ -26,7 +27,13 @@ jest.mock('../../../../common/lib/kibana', () => {
 describe('NewTemplateTimeline', () => {
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  const store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  const store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
   const mockClosePopover = jest.fn();
   const mockTitle = 'NEW_TIMELINE';
   let wrapper: ReactWrapper;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_left.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_left.tsx
index 52766422e49c..4673ba662b2e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_left.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_left.tsx
@@ -10,9 +10,12 @@ import React from 'react';
 import styled from 'styled-components';
 import { Description, Name, NotesButton, StarIcon } from './helpers';
 import { AssociateNote, UpdateNote } from '../../notes/helpers';
+
 import { Note } from '../../../../common/lib/note';
 import { SuperDatePicker } from '../../../../common/components/super_date_picker';
 
+import { TimelineTypeLiteral, TimelineStatusLiteral } from '../../../../../common/types/timeline';
+
 import * as i18n from './translations';
 
 type UpdateIsFavorite = ({ id, isFavorite }: { id: string; isFavorite: boolean }) => void;
@@ -22,6 +25,7 @@ type UpdateDescription = ({ id, description }: { id: string; description: string
 interface Props {
   isFavorite: boolean;
   timelineId: string;
+  timelineType: TimelineTypeLiteral;
   updateIsFavorite: UpdateIsFavorite;
   showDescription: boolean;
   description: string;
@@ -29,6 +33,7 @@ interface Props {
   updateTitle: UpdateTitle;
   updateDescription: UpdateDescription;
   showNotes: boolean;
+  status: TimelineStatusLiteral;
   associateNote: AssociateNote;
   showNotesFromWidth: boolean;
   getNotesByIds: (noteIds: string[]) => Note[];
@@ -77,8 +82,10 @@ export const PropertiesLeft = React.memo<Props>(
     showDescription,
     description,
     title,
+    timelineType,
     updateTitle,
     updateDescription,
+    status,
     showNotes,
     showNotesFromWidth,
     associateNote,
@@ -120,10 +127,12 @@ export const PropertiesLeft = React.memo<Props>(
             noteIds={noteIds}
             showNotes={showNotes}
             size="l"
+            status={status}
             text={i18n.NOTES}
             toggleShowNotes={onToggleShowNotes}
             toolTip={i18n.NOTES_TOOL_TIP}
             updateNote={updateNote}
+            timelineType={timelineType}
           />
         </EuiFlexItem>
       ) : null}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.test.tsx
index ae167515495f..a36e841f3f87 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.test.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 
 import { PropertiesRight } from './properties_right';
 import { useKibana } from '../../../../common/lib/kibana';
-import { TimelineStatus } from '../../../../../common/types/timeline';
+import { TimelineStatus, TimelineType } from '../../../../../common/types/timeline';
 import { disableTemplate } from '../../../../../common/constants';
 
 jest.mock('../../../../common/lib/kibana', () => {
@@ -67,6 +67,7 @@ describe('Properties Right', () => {
     onOpenTimelineModal: jest.fn(),
     status: TimelineStatus.active,
     showTimelineModal: false,
+    timelineType: TimelineType.default,
     title: 'title',
     updateNote: jest.fn(),
   };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.tsx
index e20a3db80d88..7a9fe85ae402 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/properties_right.tsx
@@ -17,7 +17,7 @@ import {
 import { NewTimeline, Description, NotesButton, NewCase, ExistingCase } from './helpers';
 
 import { disableTemplate } from '../../../../../common/constants';
-import { TimelineStatus } from '../../../../../common/types/timeline';
+import { TimelineStatusLiteral, TimelineTypeLiteral } from '../../../../../common/types/timeline';
 
 import { InspectButton, InspectButtonContainer } from '../../../../common/components/inspect';
 import { useKibana } from '../../../../common/lib/kibana';
@@ -83,9 +83,10 @@ interface PropertiesRightComponentProps {
   showNotesFromWidth: boolean;
   showTimelineModal: boolean;
   showUsersView: boolean;
-  status: TimelineStatus;
+  status: TimelineStatusLiteral;
   timelineId: string;
   title: string;
+  timelineType: TimelineTypeLiteral;
   updateDescription: UpdateDescription;
   updateNote: UpdateNote;
   usersViewing: string[];
@@ -111,6 +112,7 @@ const PropertiesRightComponent: React.FC<PropertiesRightComponentProps> = ({
   showTimelineModal,
   showUsersView,
   status,
+  timelineType,
   timelineId,
   title,
   updateDescription,
@@ -203,6 +205,8 @@ const PropertiesRightComponent: React.FC<PropertiesRightComponentProps> = ({
                     noteIds={noteIds}
                     showNotes={showNotes}
                     size="l"
+                    status={status}
+                    timelineType={timelineType}
                     text={i18n.NOTES}
                     toggleShowNotes={onToggleShowNotes}
                     toolTip={i18n.NOTES_TOOL_TIP}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/translations.ts
index 2568f4127540..561f8e513aa0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/translations.ts
@@ -112,7 +112,7 @@ export const NEW_TIMELINE = i18n.translate(
 export const NEW_TEMPLATE_TIMELINE = i18n.translate(
   'xpack.securitySolution.timeline.properties.newTemplateTimelineButtonLabel',
   {
-    defaultMessage: 'Create template timeline',
+    defaultMessage: 'Create new timeline template',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.test.tsx
index 2b67cf75dcff..0ff4c0a70fff 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.test.tsx
@@ -30,11 +30,7 @@ describe('SelectableTimeline', () => {
     };
   });
 
-  const {
-    SelectableTimeline,
-
-    ORIGINAL_PAGE_SIZE,
-  } = jest.requireActual('./');
+  const { SelectableTimeline, ORIGINAL_PAGE_SIZE } = jest.requireActual('./');
 
   const props = {
     hideUntitled: false,
@@ -94,8 +90,10 @@ describe('SelectableTimeline', () => {
         sortField: SortFieldTimeline.updated,
         sortOrder: Direction.desc,
       },
+      status: null,
       onlyUserFavorite: false,
       timelineType: TimelineType.default,
+      templateTimelineType: null,
     };
     beforeAll(() => {
       mount(<SelectableTimeline {...props} />);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx
index 56c7c3dcfeb7..dacaf325130d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx
@@ -33,6 +33,7 @@ import * as i18nTimeline from '../../open_timeline/translations';
 import { OpenTimelineResult } from '../../open_timeline/types';
 import { getEmptyTagValue } from '../../../../common/components/empty_value';
 import * as i18n from '../translations';
+import { useTimelineStatus } from '../../open_timeline/use_timeline_status';
 
 const MyEuiFlexItem = styled(EuiFlexItem)`
   display: inline-block;
@@ -118,6 +119,7 @@ const SelectableTimelineComponent: React.FC<SelectableTimelineProps> = ({
   const [onlyFavorites, setOnlyFavorites] = useState(false);
   const [searchRef, setSearchRef] = useState<HTMLElement | null>(null);
   const { fetchAllTimeline, timelines, loading, totalCount: timelineCount } = useGetAllTimeline();
+  const { timelineStatus, templateTimelineType } = useTimelineStatus({ timelineType });
 
   const onSearchTimeline = useCallback((val) => {
     setSearchTimelineValue(val);
@@ -249,24 +251,31 @@ const SelectableTimelineComponent: React.FC<SelectableTimelineProps> = ({
     },
   };
 
-  useEffect(
-    () =>
-      fetchAllTimeline({
-        pageInfo: {
-          pageIndex: 1,
-          pageSize,
-        },
-        search: searchTimelineValue,
-        sort: {
-          sortField: SortFieldTimeline.updated,
-          sortOrder: Direction.desc,
-        },
-        onlyUserFavorite: onlyFavorites,
-        timelineType,
-      }),
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [onlyFavorites, pageSize, searchTimelineValue, timelineType]
-  );
+  useEffect(() => {
+    fetchAllTimeline({
+      pageInfo: {
+        pageIndex: 1,
+        pageSize,
+      },
+      search: searchTimelineValue,
+      sort: {
+        sortField: SortFieldTimeline.updated,
+        sortOrder: Direction.desc,
+      },
+      onlyUserFavorite: onlyFavorites,
+      status: timelineStatus,
+      timelineType,
+      templateTimelineType,
+    });
+  }, [
+    fetchAllTimeline,
+    onlyFavorites,
+    pageSize,
+    searchTimelineValue,
+    timelineType,
+    timelineStatus,
+    templateTimelineType,
+  ]);
 
   return (
     <EuiSelectableContainer isLoading={loading}>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx
index 79ec58711e06..b58505546c34 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx
@@ -24,6 +24,7 @@ import { TimelineComponent, Props as TimelineComponentProps } from './timeline';
 import { Sort } from './body/sort';
 import { mockDataProviders } from './data_providers/mock/mock_data_providers';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
+import { TimelineStatus } from '../../../../common/types/timeline';
 
 jest.mock('../../../common/lib/kibana');
 jest.mock('./properties/properties_right');
@@ -96,6 +97,7 @@ describe('Timeline', () => {
       showCallOutUnauthorizedMsg: false,
       start: startDate,
       sort,
+      status: TimelineStatus.active,
       toggleColumn: jest.fn(),
       usersViewing: ['elastic'],
     };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
index 85e3d5d9478b..07d4b004d2ed 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
@@ -40,6 +40,7 @@ import {
   IIndexPattern,
 } from '../../../../../../../src/plugins/data/public';
 import { useManageTimeline } from '../manage_timeline';
+import { TimelineStatusLiteral } from '../../../../common/types/timeline';
 
 const TimelineContainer = styled.div`
   height: 100%;
@@ -110,6 +111,7 @@ export interface Props {
   showCallOutUnauthorizedMsg: boolean;
   start: number;
   sort: Sort;
+  status: TimelineStatusLiteral;
   toggleColumn: (column: ColumnHeaderOptions) => void;
   usersViewing: string[];
 }
@@ -141,6 +143,7 @@ export const TimelineComponent: React.FC<Props> = ({
   show,
   showCallOutUnauthorizedMsg,
   start,
+  status,
   sort,
   toggleColumn,
   usersViewing,
@@ -214,6 +217,7 @@ export const TimelineComponent: React.FC<Props> = ({
             onToggleDataProviderExcluded={onToggleDataProviderExcluded}
             show={show}
             showCallOutUnauthorizedMsg={showCallOutUnauthorizedMsg}
+            status={status}
           />
         </TimelineHeaderContainer>
       </StyledEuiFlyoutHeader>
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/all/index.gql_query.ts b/x-pack/plugins/security_solution/public/timelines/containers/all/index.gql_query.ts
index 60d000fe7818..5cbc922f09c9 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/all/index.gql_query.ts
+++ b/x-pack/plugins/security_solution/public/timelines/containers/all/index.gql_query.ts
@@ -13,6 +13,8 @@ export const allTimelinesQuery = gql`
     $sort: SortTimeline
     $onlyUserFavorite: Boolean
     $timelineType: TimelineType
+    $templateTimelineType: TemplateTimelineType
+    $status: TimelineStatus
   ) {
     getAllTimeline(
       pageInfo: $pageInfo
@@ -20,8 +22,15 @@ export const allTimelinesQuery = gql`
       sort: $sort
       onlyUserFavorite: $onlyUserFavorite
       timelineType: $timelineType
+      templateTimelineType: $templateTimelineType
+      status: $status
     ) {
       totalCount
+      defaultTimelineCount
+      templateTimelineCount
+      elasticTemplateTimelineCount
+      customTemplateTimelineCount
+      favoriteCount
       timeline {
         savedObjectId
         description
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/all/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/all/index.tsx
index f025cf15181c..17cc0f64de03 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/all/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/all/index.tsx
@@ -22,7 +22,11 @@ import { useApolloClient } from '../../../common/utils/apollo_context';
 
 import { allTimelinesQuery } from './index.gql_query';
 import * as i18n from '../../pages/translations';
-import { TimelineTypeLiteralWithNull } from '../../../../common/types/timeline';
+import {
+  TimelineTypeLiteralWithNull,
+  TimelineStatusLiteralWithNull,
+  TemplateTimelineTypeLiteralWithNull,
+} from '../../../../common/types/timeline';
 
 export interface AllTimelinesArgs {
   fetchAllTimeline: ({
@@ -30,11 +34,17 @@ export interface AllTimelinesArgs {
     pageInfo,
     search,
     sort,
+    status,
     timelineType,
   }: AllTimelinesVariables) => void;
   timelines: OpenTimelineResult[];
   loading: boolean;
   totalCount: number;
+  customTemplateTimelineCount: number;
+  defaultTimelineCount: number;
+  elasticTemplateTimelineCount: number;
+  templateTimelineCount: number;
+  favoriteCount: number;
 }
 
 export interface AllTimelinesVariables {
@@ -42,7 +52,9 @@ export interface AllTimelinesVariables {
   pageInfo: PageInfoTimeline;
   search: string;
   sort: SortTimeline;
+  status: TimelineStatusLiteralWithNull;
   timelineType: TimelineTypeLiteralWithNull;
+  templateTimelineType: TemplateTimelineTypeLiteralWithNull;
 }
 
 export const ALL_TIMELINE_QUERY_ID = 'FETCH_ALL_TIMELINES';
@@ -76,6 +88,7 @@ export const getAllTimeline = memoizeOne(
             )
           : null,
       savedObjectId: timeline.savedObjectId,
+      status: timeline.status,
       title: timeline.title,
       updated: timeline.updated,
       updatedBy: timeline.updatedBy,
@@ -90,27 +103,39 @@ export const useGetAllTimeline = (): AllTimelinesArgs => {
     loading: false,
     totalCount: 0,
     timelines: [],
+    customTemplateTimelineCount: 0,
+    defaultTimelineCount: 0,
+    elasticTemplateTimelineCount: 0,
+    templateTimelineCount: 0,
+    favoriteCount: 0,
   });
 
   const fetchAllTimeline = useCallback(
-    ({ onlyUserFavorite, pageInfo, search, sort, timelineType }: AllTimelinesVariables) => {
+    async ({
+      onlyUserFavorite,
+      pageInfo,
+      search,
+      sort,
+      status,
+      timelineType,
+      templateTimelineType,
+    }: AllTimelinesVariables) => {
       let didCancel = false;
       const abortCtrl = new AbortController();
 
       const fetchData = async () => {
         try {
           if (apolloClient != null) {
-            setAllTimelines({
-              ...allTimelines,
-              loading: true,
-            });
+            setAllTimelines((prevState) => ({ ...prevState, loading: true }));
 
             const variables: GetAllTimeline.Variables = {
               onlyUserFavorite,
               pageInfo,
               search,
               sort,
+              status,
               timelineType,
+              templateTimelineType,
             };
             const response = await apolloClient.query<
               GetAllTimeline.Query,
@@ -125,8 +150,16 @@ export const useGetAllTimeline = (): AllTimelinesArgs => {
                 },
               },
             });
-            const totalCount = response?.data?.getAllTimeline?.totalCount ?? 0;
-            const timelines = response?.data?.getAllTimeline?.timeline ?? [];
+            const getAllTimelineResponse = response?.data?.getAllTimeline;
+            const totalCount = getAllTimelineResponse?.totalCount ?? 0;
+            const timelines = getAllTimelineResponse?.timeline ?? [];
+            const customTemplateTimelineCount =
+              getAllTimelineResponse?.customTemplateTimelineCount ?? 0;
+            const defaultTimelineCount = getAllTimelineResponse?.defaultTimelineCount ?? 0;
+            const elasticTemplateTimelineCount =
+              getAllTimelineResponse?.elasticTemplateTimelineCount ?? 0;
+            const templateTimelineCount = getAllTimelineResponse?.templateTimelineCount ?? 0;
+            const favoriteCount = getAllTimelineResponse?.favoriteCount ?? 0;
             if (!didCancel) {
               dispatch(
                 inputsActions.setQuery({
@@ -141,6 +174,11 @@ export const useGetAllTimeline = (): AllTimelinesArgs => {
                 loading: false,
                 totalCount,
                 timelines: getAllTimeline(JSON.stringify(variables), timelines as TimelineResult[]),
+                customTemplateTimelineCount,
+                defaultTimelineCount,
+                elasticTemplateTimelineCount,
+                templateTimelineCount,
+                favoriteCount,
               });
             }
           }
@@ -155,6 +193,11 @@ export const useGetAllTimeline = (): AllTimelinesArgs => {
               loading: false,
               totalCount: 0,
               timelines: [],
+              customTemplateTimelineCount: 0,
+              defaultTimelineCount: 0,
+              elasticTemplateTimelineCount: 0,
+              templateTimelineCount: 0,
+              favoriteCount: 0,
             });
           }
         }
@@ -165,7 +208,7 @@ export const useGetAllTimeline = (): AllTimelinesArgs => {
         abortCtrl.abort();
       };
     },
-    [apolloClient, allTimelines, dispatch, dispatchToaster]
+    [apolloClient, dispatch, dispatchToaster]
   );
 
   useEffect(() => {
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/api.test.ts b/x-pack/plugins/security_solution/public/timelines/containers/api.test.ts
index 26373fa1a825..8a2f91d7171f 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/api.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/containers/api.test.ts
@@ -165,6 +165,7 @@ describe('persistTimeline', () => {
         },
       },
     };
+
     const version = null;
     const fetchMock = jest.fn();
     const postMock = jest.fn();
@@ -180,7 +181,11 @@ describe('persistTimeline', () => {
           patch: patchMock.mockReturnValue(mockPatchTimelineResponse),
         },
       });
-      api.persistTimeline({ timelineId, timeline: initialDraftTimeline, version });
+      api.persistTimeline({
+        timelineId,
+        timeline: initialDraftTimeline,
+        version,
+      });
     });
 
     afterAll(() => {
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/api.ts b/x-pack/plugins/security_solution/public/timelines/containers/api.ts
index a2277897e99b..fbd89268880d 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/api.ts
+++ b/x-pack/plugins/security_solution/public/timelines/containers/api.ts
@@ -12,6 +12,8 @@ import {
   TimelineResponse,
   TimelineResponseType,
   TimelineStatus,
+  TimelineErrorResponseType,
+  TimelineErrorResponse,
 } from '../../../common/types/timeline';
 import { TimelineInput, TimelineType } from '../../graphql/types';
 import {
@@ -48,6 +50,12 @@ const decodeTimelineResponse = (respTimeline?: TimelineResponse) =>
     fold(throwErrors(createToasterPlainError), identity)
   );
 
+const decodeTimelineErrorResponse = (respTimeline?: TimelineErrorResponse) =>
+  pipe(
+    TimelineErrorResponseType.decode(respTimeline),
+    fold(throwErrors(createToasterPlainError), identity)
+  );
+
 const postTimeline = async ({ timeline }: RequestPostTimeline): Promise<TimelineResponse> => {
   const response = await KibanaServices.get().http.post<TimelineResponse>(TIMELINE_URL, {
     method: 'POST',
@@ -61,12 +69,19 @@ const patchTimeline = async ({
   timelineId,
   timeline,
   version,
-}: RequestPatchTimeline): Promise<TimelineResponse> => {
-  const response = await KibanaServices.get().http.patch<TimelineResponse>(TIMELINE_URL, {
-    method: 'PATCH',
-    body: JSON.stringify({ timeline, timelineId, version }),
-  });
-
+}: RequestPatchTimeline): Promise<TimelineResponse | TimelineErrorResponse> => {
+  let response = null;
+  try {
+    response = await KibanaServices.get().http.patch<TimelineResponse>(TIMELINE_URL, {
+      method: 'PATCH',
+      body: JSON.stringify({ timeline, timelineId, version }),
+    });
+  } catch (err) {
+    // For Future developer
+    // We are not rejecting our promise here because we had issue with our RXJS epic
+    // the issue we were not able to pass the right object to it so we did manage the error in the success
+    return Promise.resolve(decodeTimelineErrorResponse(err.body));
+  }
   return decodeTimelineResponse(response);
 };
 
@@ -74,17 +89,31 @@ export const persistTimeline = async ({
   timelineId,
   timeline,
   version,
-}: RequestPersistTimeline): Promise<TimelineResponse> => {
-  if (timelineId == null && timeline.status === TimelineStatus.draft) {
-    const draftTimeline = await cleanDraftTimeline({ timelineType: timeline.timelineType! });
+}: RequestPersistTimeline): Promise<TimelineResponse | TimelineErrorResponse> => {
+  if (timelineId == null && timeline.status === TimelineStatus.draft && timeline) {
+    const draftTimeline = await cleanDraftTimeline({
+      timelineType: timeline.timelineType!,
+      templateTimelineId: timeline.templateTimelineId ?? undefined,
+      templateTimelineVersion: timeline.templateTimelineVersion ?? undefined,
+    });
+
+    const templateTimelineInfo =
+      timeline.timelineType! === TimelineType.template
+        ? {
+            templateTimelineId:
+              draftTimeline.data.persistTimeline.timeline.templateTimelineId ??
+              timeline.templateTimelineId,
+            templateTimelineVersion:
+              draftTimeline.data.persistTimeline.timeline.templateTimelineVersion ??
+              timeline.templateTimelineVersion,
+          }
+        : {};
 
     return patchTimeline({
       timelineId: draftTimeline.data.persistTimeline.timeline.savedObjectId,
       timeline: {
         ...timeline,
-        templateTimelineId: draftTimeline.data.persistTimeline.timeline.templateTimelineId,
-        templateTimelineVersion:
-          draftTimeline.data.persistTimeline.timeline.templateTimelineVersion,
+        ...templateTimelineInfo,
       },
       version: draftTimeline.data.persistTimeline.timeline.version ?? '',
     });
@@ -147,12 +176,24 @@ export const getDraftTimeline = async ({
 
 export const cleanDraftTimeline = async ({
   timelineType,
+  templateTimelineId,
+  templateTimelineVersion,
 }: {
   timelineType: TimelineType;
+  templateTimelineId?: string;
+  templateTimelineVersion?: number;
 }): Promise<TimelineResponse> => {
+  const templateTimelineInfo =
+    timelineType === TimelineType.template
+      ? {
+          templateTimelineId,
+          templateTimelineVersion,
+        }
+      : {};
   const response = await KibanaServices.get().http.post<TimelineResponse>(TIMELINE_DRAFT_URL, {
     body: JSON.stringify({
       timelineType,
+      ...templateTimelineInfo,
     }),
   });
 
diff --git a/x-pack/plugins/security_solution/public/timelines/pages/translations.ts b/x-pack/plugins/security_solution/public/timelines/pages/translations.ts
index 3ec98d47c67e..5a9f80013a3e 100644
--- a/x-pack/plugins/security_solution/public/timelines/pages/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/pages/translations.ts
@@ -30,3 +30,17 @@ export const ERROR_FETCHING_TIMELINES_TITLE = i18n.translate(
     defaultMessage: 'Failed to query all timelines data',
   }
 );
+
+export const UPDATE_TIMELINE_ERROR_TITLE = i18n.translate(
+  'xpack.securitySolution.timelines.updateTimelineErrorTitle',
+  {
+    defaultMessage: 'Timeline error',
+  }
+);
+
+export const UPDATE_TIMELINE_ERROR_TEXT = i18n.translate(
+  'xpack.securitySolution.timelines.updateTimelineErrorText',
+  {
+    defaultMessage: 'Something went wrong',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
index 55e6849fdb6c..8fd75547cc53 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
@@ -70,6 +70,8 @@ export const createTimeline = actionCreator<{
   showCheckboxes?: boolean;
   showRowRenderers?: boolean;
   timelineType?: TimelineTypeLiteral;
+  templateTimelineId?: string;
+  templateTimelineVersion?: number;
 }>('CREATE_TIMELINE');
 
 export const pinEvent = actionCreator<{ id: string; eventId: string }>('PIN_EVENT');
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
index 2155dc804aa7..94acb9d92075 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
@@ -33,7 +33,7 @@ import {
   Filter,
   MatchAllFilter,
 } from '../../../../../../.../../../src/plugins/data/public';
-import { TimelineStatus } from '../../../../common/types/timeline';
+import { TimelineStatus, TimelineErrorResponse } from '../../../../common/types/timeline';
 import { inputsModel } from '../../../common/store/inputs';
 import {
   TimelineType,
@@ -43,6 +43,10 @@ import {
 } from '../../../graphql/types';
 import { addError } from '../../../common/store/app/actions';
 
+import { persistTimeline } from '../../containers/api';
+import { ALL_TIMELINE_QUERY_ID } from '../../containers/all';
+import * as i18n from '../../pages/translations';
+
 import {
   applyKqlFilterQuery,
   addProvider,
@@ -79,8 +83,6 @@ import { isNotNull } from './helpers';
 import { dispatcherTimelinePersistQueue } from './epic_dispatcher_timeline_persistence_queue';
 import { myEpicTimelineId } from './my_epic_timeline_id';
 import { ActionTimeline, TimelineEpicDependencies } from './types';
-import { persistTimeline } from '../../containers/api';
-import { ALL_TIMELINE_QUERY_ID } from '../../containers/all';
 
 const timelineActionsType = [
   applyKqlFilterQuery.type,
@@ -121,6 +123,7 @@ export const createTimelineEpic = <State>(): Epic<
     timelineByIdSelector,
     timelineTimeRangeSelector,
     apolloClient$,
+    kibana$,
   }
 ) => {
   const timeline$ = state$.pipe(map(timelineByIdSelector), filter(isNotNull));
@@ -146,13 +149,24 @@ export const createTimelineEpic = <State>(): Epic<
         if (action.type === addError.type) {
           return true;
         }
-        if (action.type === createTimeline.type && isItAtimelineAction(timelineId)) {
+        if (
+          isItAtimelineAction(timelineId) &&
+          timelineObj != null &&
+          timelineObj.status != null &&
+          TimelineStatus.immutable === timelineObj.status
+        ) {
+          return false;
+        } else if (action.type === createTimeline.type && isItAtimelineAction(timelineId)) {
           myEpicTimelineId.setTimelineVersion(null);
           myEpicTimelineId.setTimelineId(null);
+          myEpicTimelineId.setTemplateTimelineId(null);
+          myEpicTimelineId.setTemplateTimelineVersion(null);
         } else if (action.type === addTimeline.type && isItAtimelineAction(timelineId)) {
           const addNewTimeline: TimelineModel = get('payload.timeline', action);
           myEpicTimelineId.setTimelineId(addNewTimeline.savedObjectId);
           myEpicTimelineId.setTimelineVersion(addNewTimeline.version);
+          myEpicTimelineId.setTemplateTimelineId(addNewTimeline.templateTimelineId);
+          myEpicTimelineId.setTemplateTimelineVersion(addNewTimeline.templateTimelineVersion);
           return true;
         } else if (
           timelineActionsType.includes(action.type) &&
@@ -176,6 +190,8 @@ export const createTimelineEpic = <State>(): Epic<
         const action: ActionTimeline = get('action', objAction);
         const timelineId = myEpicTimelineId.getTimelineId();
         const version = myEpicTimelineId.getTimelineVersion();
+        const templateTimelineId = myEpicTimelineId.getTemplateTimelineId();
+        const templateTimelineVersion = myEpicTimelineId.getTemplateTimelineVersion();
 
         if (timelineNoteActionsType.includes(action.type)) {
           return epicPersistNote(
@@ -211,13 +227,37 @@ export const createTimelineEpic = <State>(): Epic<
             persistTimeline({
               timelineId,
               version,
-              timeline: convertTimelineAsInput(timeline[action.payload.id], timelineTimeRange),
+              timeline: {
+                ...convertTimelineAsInput(timeline[action.payload.id], timelineTimeRange),
+                templateTimelineId,
+                templateTimelineVersion,
+              },
             })
           ).pipe(
-            withLatestFrom(timeline$, allTimelineQuery$),
-            mergeMap(([result, recentTimeline, allTimelineQuery]) => {
+            withLatestFrom(timeline$, allTimelineQuery$, kibana$),
+            mergeMap(([result, recentTimeline, allTimelineQuery, kibana]) => {
+              const error = result as TimelineErrorResponse;
+              if (error.status_code != null && error.status_code === 405) {
+                kibana.notifications!.toasts.addDanger({
+                  title: i18n.UPDATE_TIMELINE_ERROR_TITLE,
+                  text: error.message ?? i18n.UPDATE_TIMELINE_ERROR_TEXT,
+                });
+                return [
+                  endTimelineSaving({
+                    id: action.payload.id,
+                  }),
+                ];
+              }
+
               const savedTimeline = recentTimeline[action.payload.id];
               const response: ResponseTimeline = get('data.persistTimeline', result);
+              if (response == null) {
+                return [
+                  endTimelineSaving({
+                    id: action.payload.id,
+                  }),
+                ];
+              }
               const callOutMsg = response.code === 403 ? [showCallOutUnauthorizedMsg()] : [];
 
               if (allTimelineQuery.refetch != null) {
@@ -264,6 +304,12 @@ export const createTimelineEpic = <State>(): Epic<
                     myEpicTimelineId.setTimelineVersion(
                       updatedTimeline[get('payload.id', checkAction)].version
                     );
+                    myEpicTimelineId.setTemplateTimelineId(
+                      updatedTimeline[get('payload.id', checkAction)].templateTimelineId
+                    );
+                    myEpicTimelineId.setTemplateTimelineVersion(
+                      updatedTimeline[get('payload.id', checkAction)].templateTimelineVersion
+                    );
                     return true;
                   }
                   return false;
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
index 34778aba7873..388869194085 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
@@ -15,6 +15,7 @@ import {
   defaultHeaders,
   createSecuritySolutionStorageMock,
   mockIndexPattern,
+  kibanaObservable,
 } from '../../../common/mock';
 
 import { createStore, State } from '../../../common/store';
@@ -38,6 +39,7 @@ import { Direction } from '../../../graphql/types';
 
 import { addTimelineInStorage } from '../../containers/local_storage';
 import { isPageTimeline } from './epic_local_storage';
+import { TimelineStatus } from '../../../../common/types/timeline';
 
 jest.mock('../../containers/local_storage');
 
@@ -50,7 +52,13 @@ const addTimelineInStorageMock = addTimelineInStorage as jest.Mock;
 describe('epicLocalStorage', () => {
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+  let store = createStore(
+    state,
+    SUB_PLUGINS_REDUCER,
+    apolloClientObservable,
+    kibanaObservable,
+    storage
+  );
 
   let props = {} as TimelineComponentProps;
   const sort: Sort = {
@@ -63,7 +71,13 @@ describe('epicLocalStorage', () => {
   const indexPattern = mockIndexPattern;
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    store = createStore(
+      state,
+      SUB_PLUGINS_REDUCER,
+      apolloClientObservable,
+      kibanaObservable,
+      storage
+    );
     props = {
       browserFields: mockBrowserFields,
       columns: defaultHeaders,
@@ -89,6 +103,7 @@ describe('epicLocalStorage', () => {
       show: true,
       showCallOutUnauthorizedMsg: false,
       start: startDate,
+      status: TimelineStatus.active,
       sort,
       toggleColumn: jest.fn(),
       usersViewing: ['elastic'],
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
index c0615d36f7a2..33770aacde6b 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
@@ -6,6 +6,7 @@
 
 import { getOr, omit, uniq, isEmpty, isEqualWith, union } from 'lodash/fp';
 
+import uuid from 'uuid';
 import { Filter } from '../../../../../../../src/plugins/data/public';
 
 import { disableTemplate } from '../../../../common/constants';
@@ -19,7 +20,7 @@ import {
 } from '../../../timelines/components/timeline/data_providers/data_provider';
 import { KueryFilterQuery, SerializedFilterQuery } from '../../../common/store/model';
 import { TimelineNonEcsData } from '../../../graphql/types';
-import { TimelineTypeLiteral } from '../../../../common/types/timeline';
+import { TimelineTypeLiteral, TimelineType } from '../../../../common/types/timeline';
 
 import { timelineDefaults } from './defaults';
 import { ColumnHeaderOptions, KqlMode, TimelineModel, EventType } from './model';
@@ -158,28 +159,38 @@ export const addNewTimeline = ({
   showRowRenderers = true,
   timelineById,
   timelineType,
-}: AddNewTimelineParams): TimelineById => ({
-  ...timelineById,
-  [id]: {
-    id,
-    ...timelineDefaults,
-    columns,
-    dataProviders,
-    dateRange,
-    filters,
-    itemsPerPage,
-    kqlQuery,
-    sort,
-    show,
-    savedObjectId: null,
-    version: null,
-    isSaving: false,
-    isLoading: false,
-    showCheckboxes,
-    showRowRenderers,
-    timelineType: !disableTemplate ? timelineType : timelineDefaults.timelineType,
-  },
-});
+}: AddNewTimelineParams): TimelineById => {
+  const templateTimelineInfo =
+    !disableTemplate && timelineType === TimelineType.template
+      ? {
+          templateTimelineId: uuid.v4(),
+          templateTimelineVersion: 1,
+        }
+      : {};
+  return {
+    ...timelineById,
+    [id]: {
+      id,
+      ...timelineDefaults,
+      columns,
+      dataProviders,
+      dateRange,
+      filters,
+      itemsPerPage,
+      kqlQuery,
+      sort,
+      show,
+      savedObjectId: null,
+      version: null,
+      isSaving: false,
+      isLoading: false,
+      showCheckboxes,
+      showRowRenderers,
+      timelineType: !disableTemplate ? timelineType : timelineDefaults.timelineType,
+      ...templateTimelineInfo,
+    },
+  };
+};
 
 interface PinTimelineEventParams {
   id: string;
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/manage_timeline_id.tsx b/x-pack/plugins/security_solution/public/timelines/store/timeline/manage_timeline_id.tsx
index d68c9bd42d97..6f8666a349d7 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/manage_timeline_id.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/manage_timeline_id.tsx
@@ -7,6 +7,8 @@
 export class ManageEpicTimelineId {
   private timelineId: string | null = null;
   private version: string | null = null;
+  private templateTimelineId: string | null = null;
+  private templateVersion: number | null = null;
 
   public getTimelineId(): string | null {
     return this.timelineId;
@@ -16,6 +18,14 @@ export class ManageEpicTimelineId {
     return this.version;
   }
 
+  public getTemplateTimelineId(): string | null {
+    return this.templateTimelineId;
+  }
+
+  public getTemplateTimelineVersion(): number | null {
+    return this.templateVersion;
+  }
+
   public setTimelineId(timelineId: string | null) {
     this.timelineId = timelineId;
   }
@@ -23,4 +33,12 @@ export class ManageEpicTimelineId {
   public setTimelineVersion(version: string | null) {
     this.version = version;
   }
+
+  public setTemplateTimelineId(templateTimelineId: string | null) {
+    this.templateTimelineId = templateTimelineId;
+  }
+
+  public setTemplateTimelineVersion(templateVersion: number | null) {
+    this.templateVersion = templateVersion;
+  }
 }
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
index e8ea3c8d16e3..57895fea8f8f 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
@@ -160,7 +160,6 @@ export type SubsetTimelineModel = Readonly<
     | 'isLoading'
     | 'savedObjectId'
     | 'version'
-    | 'timelineType'
     | 'status'
   >
 >;
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts
index 30b7f73c839d..4072b4ac2f78 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts
@@ -137,24 +137,26 @@ export const timelineReducer = reducerWithInitialState(initialTimelineState)
         timelineType = TimelineType.default,
         filters,
       }
-    ) => ({
-      ...state,
-      timelineById: addNewTimeline({
-        columns,
-        dataProviders,
-        dateRange,
-        filters,
-        id,
-        itemsPerPage,
-        kqlQuery,
-        sort,
-        show,
-        showCheckboxes,
-        showRowRenderers,
-        timelineById: state.timelineById,
-        timelineType,
-      }),
-    })
+    ) => {
+      return {
+        ...state,
+        timelineById: addNewTimeline({
+          columns,
+          dataProviders,
+          dateRange,
+          filters,
+          id,
+          itemsPerPage,
+          kqlQuery,
+          sort,
+          show,
+          showCheckboxes,
+          showRowRenderers,
+          timelineById: state.timelineById,
+          timelineType,
+        }),
+      };
+    }
   )
   .case(upsertColumn, (state, { column, id, index }) => ({
     ...state,
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
index 65798648f92c..c64ed608339b 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
@@ -10,6 +10,8 @@ import { Storage } from '../../../../../../../src/plugins/kibana_utils/public';
 import { AppApolloClient } from '../../../common/lib/lib';
 import { inputsModel } from '../../../common/store/inputs';
 import { NotesById } from '../../../common/store/app/model';
+import { StartServices } from '../../../types';
+
 import { TimelineModel } from './model';
 
 export interface AutoSavedWarningMsg {
@@ -53,5 +55,6 @@ export interface TimelineEpicDependencies<State> {
   selectAllTimelineQuery: () => (state: State, id: string) => inputsModel.GlobalQuery;
   selectNotesByIdSelector: (state: State) => NotesById;
   apolloClient$: Observable<AppApolloClient>;
+  kibana$: Observable<StartServices>;
   storage: Storage;
 }
diff --git a/x-pack/plugins/security_solution/public/types.ts b/x-pack/plugins/security_solution/public/types.ts
index 6d59824702cf..e212289458ed 100644
--- a/x-pack/plugins/security_solution/public/types.ts
+++ b/x-pack/plugins/security_solution/public/types.ts
@@ -19,6 +19,7 @@ import {
   TriggersAndActionsUIPublicPluginStart as TriggersActionsStart,
 } from '../../triggers_actions_ui/public';
 import { SecurityPluginSetup } from '../../security/public';
+import { AppFrontendLibs } from './common/lib/lib';
 
 export interface SetupPlugins {
   home: HomePublicPluginSetup;
@@ -47,3 +48,7 @@ export type StartServices = CoreStart &
 export interface PluginSetup {}
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface PluginStart {}
+
+export interface AppObservableLibs extends AppFrontendLibs {
+  kibana: CoreStart;
+}
diff --git a/x-pack/plugins/security_solution/server/graphql/timeline/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/timeline/resolvers.ts
index a40ef5466c78..ab729bae6474 100644
--- a/x-pack/plugins/security_solution/server/graphql/timeline/resolvers.ts
+++ b/x-pack/plugins/security_solution/server/graphql/timeline/resolvers.ts
@@ -53,7 +53,9 @@ export const createTimelineResolvers = (
         args.pageInfo || null,
         args.search || null,
         args.sort || null,
-        args.timelineType || null
+        args.status || null,
+        args.timelineType || null,
+        args.templateTimelineType || null
       );
     },
   },
diff --git a/x-pack/plugins/security_solution/server/graphql/timeline/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/timeline/schema.gql.ts
index b9aa8534ab0e..a9d07389797d 100644
--- a/x-pack/plugins/security_solution/server/graphql/timeline/schema.gql.ts
+++ b/x-pack/plugins/security_solution/server/graphql/timeline/schema.gql.ts
@@ -133,6 +133,12 @@ export const timelineSchema = gql`
   enum TimelineStatus {
     active
     draft
+    immutable
+  }
+
+  enum TemplateTimelineType {
+    elastic
+    custom
   }
 
   input TimelineInput {
@@ -277,6 +283,11 @@ export const timelineSchema = gql`
   type ResponseTimelines {
     timeline: [TimelineResult]!
     totalCount: Float
+    defaultTimelineCount: Float
+    templateTimelineCount: Float
+    elasticTemplateTimelineCount: Float
+    customTemplateTimelineCount: Float
+    favoriteCount: Float
   }
 
   #########################
@@ -285,7 +296,7 @@ export const timelineSchema = gql`
 
   extend type Query {
     getOneTimeline(id: ID!): TimelineResult!
-    getAllTimeline(pageInfo: PageInfoTimeline, search: String, sort: SortTimeline, onlyUserFavorite: Boolean, timelineType: TimelineType): ResponseTimelines!
+    getAllTimeline(pageInfo: PageInfoTimeline, search: String, sort: SortTimeline, onlyUserFavorite: Boolean, timelineType: TimelineType, templateTimelineType: TemplateTimelineType, status: TimelineStatus): ResponseTimelines!
   }
 
   extend type Mutation {
diff --git a/x-pack/plugins/security_solution/server/graphql/types.ts b/x-pack/plugins/security_solution/server/graphql/types.ts
index 40666b619392..2db3052bae66 100644
--- a/x-pack/plugins/security_solution/server/graphql/types.ts
+++ b/x-pack/plugins/security_solution/server/graphql/types.ts
@@ -347,6 +347,7 @@ export enum TlsFields {
 export enum TimelineStatus {
   active = 'active',
   draft = 'draft',
+  immutable = 'immutable',
 }
 
 export enum TimelineType {
@@ -361,6 +362,11 @@ export enum SortFieldTimeline {
   created = 'created',
 }
 
+export enum TemplateTimelineType {
+  elastic = 'elastic',
+  custom = 'custom',
+}
+
 export enum NetworkDirectionEcs {
   inbound = 'inbound',
   outbound = 'outbound',
@@ -2119,6 +2125,16 @@ export interface ResponseTimelines {
   timeline: (Maybe<TimelineResult>)[];
 
   totalCount?: Maybe<number>;
+
+  defaultTimelineCount?: Maybe<number>;
+
+  templateTimelineCount?: Maybe<number>;
+
+  elasticTemplateTimelineCount?: Maybe<number>;
+
+  customTemplateTimelineCount?: Maybe<number>;
+
+  favoriteCount?: Maybe<number>;
 }
 
 export interface Mutation {
@@ -2256,6 +2272,10 @@ export interface GetAllTimelineQueryArgs {
   onlyUserFavorite?: Maybe<boolean>;
 
   timelineType?: Maybe<TimelineType>;
+
+  templateTimelineType?: Maybe<TemplateTimelineType>;
+
+  status?: Maybe<TimelineStatus>;
 }
 export interface AuthenticationsSourceArgs {
   timerange: TimerangeInput;
@@ -2714,6 +2734,10 @@ export namespace QueryResolvers {
     onlyUserFavorite?: Maybe<boolean>;
 
     timelineType?: Maybe<TimelineType>;
+
+    templateTimelineType?: Maybe<TemplateTimelineType>;
+
+    status?: Maybe<TimelineStatus>;
   }
 }
 
@@ -8670,6 +8694,24 @@ export namespace ResponseTimelinesResolvers {
     timeline?: TimelineResolver<(Maybe<TimelineResult>)[], TypeParent, TContext>;
 
     totalCount?: TotalCountResolver<Maybe<number>, TypeParent, TContext>;
+
+    defaultTimelineCount?: DefaultTimelineCountResolver<Maybe<number>, TypeParent, TContext>;
+
+    templateTimelineCount?: TemplateTimelineCountResolver<Maybe<number>, TypeParent, TContext>;
+
+    elasticTemplateTimelineCount?: ElasticTemplateTimelineCountResolver<
+      Maybe<number>,
+      TypeParent,
+      TContext
+    >;
+
+    customTemplateTimelineCount?: CustomTemplateTimelineCountResolver<
+      Maybe<number>,
+      TypeParent,
+      TContext
+    >;
+
+    favoriteCount?: FavoriteCountResolver<Maybe<number>, TypeParent, TContext>;
   }
 
   export type TimelineResolver<
@@ -8682,6 +8724,31 @@ export namespace ResponseTimelinesResolvers {
     Parent = ResponseTimelines,
     TContext = SiemContext
   > = Resolver<R, Parent, TContext>;
+  export type DefaultTimelineCountResolver<
+    R = Maybe<number>,
+    Parent = ResponseTimelines,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
+  export type TemplateTimelineCountResolver<
+    R = Maybe<number>,
+    Parent = ResponseTimelines,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
+  export type ElasticTemplateTimelineCountResolver<
+    R = Maybe<number>,
+    Parent = ResponseTimelines,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
+  export type CustomTemplateTimelineCountResolver<
+    R = Maybe<number>,
+    Parent = ResponseTimelines,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
+  export type FavoriteCountResolver<
+    R = Maybe<number>,
+    Parent = ResponseTimelines,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
 }
 
 export namespace MutationResolvers {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/README.md b/x-pack/plugins/security_solution/server/lib/detection_engine/README.md
index 7a48df72d6bd..fa0716ec0828 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/README.md
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/README.md
@@ -59,7 +59,7 @@ which will:
 - Delete any existing alerts you have
 - Delete any existing alert tasks you have
 - Delete any existing signal mapping, policies, and template, you might have previously had.
-- Add the latest signal index and its mappings using your settings from `kibana.dev.yml` environment variable of `xpack.security_solution.signalsIndex`.
+- Add the latest signal index and its mappings using your settings from `kibana.dev.yml` environment variable of `xpack.securitySolution.signalsIndex`.
 - Posts the sample rule from `./rules/queries/query_with_rule_id.json`
 - The sample rule checks for root or admin every 5 minutes and reports that as a signal if it is a positive hit
 
@@ -171,6 +171,6 @@ go about doing so.
 To test out the functionality of large lists with rules, the user will need to import a list and post a rule with a reference to that exception list. The following outlines an example using the sample json rule provided in the repo.
 
 * First, set the appropriate env var in order to enable exceptions features`export ELASTIC_XPACK_SECURITY_SOLUTION_LISTS_FEATURE=true` and `export ELASTIC_XPACK_SECURITY_SOLUTION_EXCEPTIONS_LISTS=true` and start kibana
-* Second, import a list of ips from a file called `ci-badguys.txt`. The command should look like this: 
+* Second, import a list of ips from a file called `ci-badguys.txt`. The command should look like this:
 `cd $HOME/kibana/x-pack/plugins/lists/server/scripts && ./import_list_items_by_filename.sh ip ~/ci-badguys.txt`
 * Then, from the detection engine scripts folder (`cd kibana/x-pack/plugins/security_solution/server/lib/detection_engine/scripts`) run `./post_rule.sh rules/queries/lists/query_with_list_plugin.json`
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/pick_saved_timeline.ts b/x-pack/plugins/security_solution/server/lib/timeline/pick_saved_timeline.ts
index 281726d488ab..68e7f8d5e6fe 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/pick_saved_timeline.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/pick_saved_timeline.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import uuid from 'uuid';
 import { isEmpty } from 'lodash/fp';
 import { AuthenticatedUser } from '../../../../security/common/model';
 import { UNAUTHENTICATED_USER } from '../../../common/constants';
@@ -28,18 +27,13 @@ export const pickSavedTimeline = (
     savedTimeline.updatedBy = userInfo?.username ?? UNAUTHENTICATED_USER;
   }
 
-  if (savedTimeline.timelineType === TimelineType.template) {
-    if (savedTimeline.templateTimelineId == null) {
-      // create template timeline
-      savedTimeline.templateTimelineId = uuid.v4();
-      savedTimeline.templateTimelineVersion = 1;
-    } else {
-      // update template timeline
-      if (savedTimeline.templateTimelineVersion != null) {
-        savedTimeline.templateTimelineVersion = savedTimeline.templateTimelineVersion + 1;
-      }
-    }
-  } else {
+  if (savedTimeline.status === TimelineStatus.draft) {
+    savedTimeline.status = !isEmpty(savedTimeline.title)
+      ? TimelineStatus.active
+      : TimelineStatus.draft;
+  }
+
+  if (savedTimeline.timelineType === TimelineType.default) {
     savedTimeline.timelineType = savedTimeline.timelineType ?? TimelineType.default;
     savedTimeline.templateTimelineId = null;
     savedTimeline.templateTimelineVersion = null;
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/import_timelines.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/import_timelines.ts
index 7180f06d853b..adfdf831f22c 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/import_timelines.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/import_timelines.ts
@@ -138,6 +138,7 @@ export const mockGetTimelineValue = {
   kqlMode: 'filter',
   kqlQuery: { filterQuery: [] },
   title: 'My duplicate timeline',
+  timelineType: TimelineType.default,
   dateRange: { start: 1584523907294, end: 1584610307294 },
   savedQueryId: null,
   sort: { columnId: '@timestamp', sortDirection: 'desc' },
@@ -145,17 +146,25 @@ export const mockGetTimelineValue = {
   createdBy: 'angela',
   updated: 1584868346013,
   updatedBy: 'angela',
-  noteIds: [],
+  noteIds: ['d2649d40-6bc5-xxxx-0000-5db0048c6086'],
   pinnedEventIds: ['k-gi8nABm-sIqJ_scOoS'],
 };
 
 export const mockGetTemplateTimelineValue = {
   ...mockGetTimelineValue,
   timelineType: TimelineType.template,
-  templateTimelineId: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
+  templateTimelineId: '79deb4c0-6bc1-0000-0000-f5341fb7a189',
   templateTimelineVersion: 1,
 };
 
+export const mockUniqueParsedTemplateTimelineObjects = [
+  { ...mockUniqueParsedObjects[0], ...mockGetTemplateTimelineValue, templateTimelineVersion: 2 },
+];
+
+export const mockParsedTemplateTimelineObjects = [
+  { ...mockParsedObjects[0], ...mockGetTemplateTimelineValue },
+];
+
 export const mockGetDraftTimelineValue = {
   savedObjectId: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
   version: 'WzEyMjUsMV0=',
@@ -195,8 +204,51 @@ export const mockParsedTimelineObject = omit(
   mockUniqueParsedObjects[0]
 );
 
+export const mockParsedTemplateTimelineObject = omit(
+  [
+    'globalNotes',
+    'eventNotes',
+    'pinnedEventIds',
+    'version',
+    'savedObjectId',
+    'created',
+    'createdBy',
+    'updated',
+    'updatedBy',
+  ],
+  mockUniqueParsedTemplateTimelineObjects[0]
+);
+
 export const mockGetCurrentUser = {
   user: {
     username: 'mockUser',
   },
 };
+
+export const mockCreatedTimeline = {
+  savedObjectId: '79deb4c0-1111-1111-1111-f5341fb7a189',
+  version: 'WzEyMjUsMV0=',
+  columns: [],
+  dataProviders: [],
+  description: 'description',
+  eventType: 'all',
+  filters: [],
+  kqlMode: 'filter',
+  kqlQuery: { filterQuery: [] },
+  title: 'My duplicate timeline',
+  dateRange: { start: 1584523907294, end: 1584610307294 },
+  savedQueryId: null,
+  sort: { columnId: '@timestamp', sortDirection: 'desc' },
+  created: 1584828930463,
+  createdBy: 'angela',
+  updated: 1584868346013,
+  updatedBy: 'angela',
+  eventNotes: [],
+  globalNotes: [],
+  pinnedEventIds: [],
+};
+
+export const mockCreatedTemplateTimeline = {
+  ...mockCreatedTimeline,
+  ...mockGetTemplateTimelineValue,
+};
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts
index 0b320459c76a..9afe5ad53332 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts
@@ -4,15 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import * as rt from 'io-ts';
+import stream from 'stream';
+
 import {
   TIMELINE_DRAFT_URL,
   TIMELINE_EXPORT_URL,
   TIMELINE_IMPORT_URL,
   TIMELINE_URL,
 } from '../../../../../common/constants';
-import stream from 'stream';
-import { requestMock } from '../../../detection_engine/routes/__mocks__';
 import { SavedTimeline, TimelineType, TimelineStatus } from '../../../../../common/types/timeline';
+
+import { requestMock } from '../../../detection_engine/routes/__mocks__';
+
 import { updateTimelineSchema } from '../schemas/update_timelines_schema';
 import { createTimelineSchema } from '../schemas/create_timelines_schema';
 
@@ -59,7 +62,7 @@ export const inputTimeline: SavedTimeline = {
   title: 't',
   timelineType: TimelineType.default,
   templateTimelineId: null,
-  templateTimelineVersion: null,
+  templateTimelineVersion: 1,
   dateRange: { start: 1585227005527, end: 1585313405527 },
   savedQueryId: null,
   sort: { columnId: '@timestamp', sortDirection: 'desc' },
@@ -68,7 +71,7 @@ export const inputTimeline: SavedTimeline = {
 export const inputTemplateTimeline = {
   ...inputTimeline,
   timelineType: TimelineType.template,
-  templateTimelineId: null,
+  templateTimelineId: '79deb4c0-6bc1-11ea-inpt-templatea189',
   templateTimelineVersion: null,
 };
 
@@ -90,11 +93,11 @@ export const createDraftTimelineWithoutTimelineId = {
 };
 
 export const createTemplateTimelineWithoutTimelineId = {
-  templateTimelineId: null,
   timeline: inputTemplateTimeline,
   timelineId: null,
   version: null,
   timelineType: TimelineType.template,
+  status: TimelineStatus.active,
 };
 
 export const createTimelineWithTimelineId = {
@@ -110,7 +113,6 @@ export const createDraftTimelineWithTimelineId = {
 export const createTemplateTimelineWithTimelineId = {
   ...createTemplateTimelineWithoutTimelineId,
   timelineId: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
-  templateTimelineId: 'existing template timeline id',
 };
 
 export const updateTimelineWithTimelineId = {
@@ -122,7 +124,7 @@ export const updateTimelineWithTimelineId = {
 export const updateTemplateTimelineWithTimelineId = {
   timeline: {
     ...inputTemplateTimeline,
-    templateTimelineId: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
+    templateTimelineId: '79deb4c0-6bc1-0000-0000-f5341fb7a189',
     templateTimelineVersion: 1,
   },
   timelineId: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/clean_draft_timelines_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/clean_draft_timelines_route.ts
index 9ad50b8f2266..8cabd84a965b 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/clean_draft_timelines_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/clean_draft_timelines_route.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import uuid from 'uuid';
 import { IRouter } from '../../../../../../../src/core/server';
 import { ConfigType } from '../../..';
 import { transformError, buildSiemResponse } from '../../detection_engine/routes/utils';
@@ -14,6 +15,7 @@ import { buildRouteValidation } from '../../../utils/build_validation/route_vali
 import { getDraftTimeline, resetTimeline, getTimeline, persistTimeline } from '../saved_object';
 import { draftTimelineDefaults } from '../default_timeline';
 import { cleanDraftTimelineSchema } from './schemas/clean_draft_timelines_schema';
+import { TimelineType } from '../../../../common/types/timeline';
 
 export const cleanDraftTimelinesRoute = (
   router: IRouter,
@@ -60,10 +62,18 @@ export const cleanDraftTimelinesRoute = (
             },
           });
         }
+        const templateTimelineData =
+          request.body.timelineType === TimelineType.template
+            ? {
+                timelineType: request.body.timelineType,
+                templateTimelineId: uuid.v4(),
+                templateTimelineVersion: 1,
+              }
+            : {};
 
         const newTimelineResponse = await persistTimeline(frameworkRequest, null, null, {
           ...draftTimelineDefaults,
-          timelineType: request.body.timelineType,
+          ...templateTimelineData,
         });
 
         if (newTimelineResponse.code === 200) {
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.test.ts
index 70ee1532395a..f5345c3dce22 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.test.ts
@@ -23,6 +23,7 @@ import {
   createTimelineWithTimelineId,
   createTemplateTimelineWithoutTimelineId,
   createTemplateTimelineWithTimelineId,
+  updateTemplateTimelineWithTimelineId,
 } from './__mocks__/request_responses';
 import {
   CREATE_TEMPLATE_TIMELINE_ERROR_MESSAGE,
@@ -34,6 +35,7 @@ describe('create timelines', () => {
   let securitySetup: SecurityPluginSetup;
   let { context } = requestContextMock.createTools();
   let mockGetTimeline: jest.Mock;
+  let mockGetTemplateTimeline: jest.Mock;
   let mockPersistTimeline: jest.Mock;
   let mockPersistPinnedEventOnTimeline: jest.Mock;
   let mockPersistNote: jest.Mock;
@@ -55,6 +57,7 @@ describe('create timelines', () => {
     } as unknown) as SecurityPluginSetup;
 
     mockGetTimeline = jest.fn();
+    mockGetTemplateTimeline = jest.fn();
     mockPersistTimeline = jest.fn();
     mockPersistPinnedEventOnTimeline = jest.fn();
     mockPersistNote = jest.fn();
@@ -231,11 +234,14 @@ describe('create timelines', () => {
       });
     });
 
-    describe('Import a template timeline already exist', () => {
+    describe('Create a template timeline already exist', () => {
       beforeEach(() => {
         jest.doMock('../saved_object', () => {
           return {
             getTimeline: mockGetTimeline.mockReturnValue(mockGetTemplateTimelineValue),
+            getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue({
+              timeline: [mockGetTemplateTimelineValue],
+            }),
             persistTimeline: mockPersistTimeline,
           };
         });
@@ -259,7 +265,7 @@ describe('create timelines', () => {
 
       test('returns error message', async () => {
         const response = await server.inject(
-          getCreateTimelinesRequest(createTemplateTimelineWithTimelineId),
+          getCreateTimelinesRequest(updateTemplateTimelineWithTimelineId),
           context
         );
         expect(response.body).toEqual({
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.ts
index d92f2ce0764c..60ddaea367ae 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.ts
@@ -6,7 +6,6 @@
 import { IRouter } from '../../../../../../../src/core/server';
 
 import { TIMELINE_URL } from '../../../../common/constants';
-import { TimelineType } from '../../../../common/types/timeline';
 
 import { ConfigType } from '../../..';
 import { SetupPlugins } from '../../../plugin';
@@ -15,14 +14,12 @@ import { buildRouteValidation } from '../../../utils/build_validation/route_vali
 import { transformError, buildSiemResponse } from '../../detection_engine/routes/utils';
 
 import { createTimelineSchema } from './schemas/create_timelines_schema';
-import { buildFrameworkRequest } from './utils/common';
 import {
-  createTimelines,
-  getTimeline,
-  getTemplateTimeline,
-  CREATE_TEMPLATE_TIMELINE_ERROR_MESSAGE,
-  CREATE_TIMELINE_ERROR_MESSAGE,
-} from './utils/create_timelines';
+  buildFrameworkRequest,
+  CompareTimelinesStatus,
+  TimelineStatusActions,
+} from './utils/common';
+import { createTimelines } from './utils/create_timelines';
 
 export const createTimelinesRoute = (
   router: IRouter,
@@ -36,7 +33,7 @@ export const createTimelinesRoute = (
         body: buildRouteValidation(createTimelineSchema),
       },
       options: {
-        tags: ['access:securitySolution'],
+        tags: ['access:siem'],
       },
     },
     async (context, request, response) => {
@@ -46,40 +43,54 @@ export const createTimelinesRoute = (
         const frameworkRequest = await buildFrameworkRequest(context, security, request);
 
         const { timelineId, timeline, version } = request.body;
-        const { templateTimelineId, timelineType } = timeline;
-        const isHandlingTemplateTimeline = timelineType === TimelineType.template;
-
-        const existTimeline =
-          timelineId != null ? await getTimeline(frameworkRequest, timelineId) : null;
-        const existTemplateTimeline =
-          templateTimelineId != null
-            ? await getTemplateTimeline(frameworkRequest, templateTimelineId)
-            : null;
+        const {
+          templateTimelineId,
+          templateTimelineVersion,
+          timelineType,
+          title,
+          status,
+        } = timeline;
+        const compareTimelinesStatus = new CompareTimelinesStatus({
+          status,
+          title,
+          timelineType,
+          timelineInput: {
+            id: timelineId,
+            version,
+          },
+          templateTimelineInput: {
+            id: templateTimelineId,
+            version: templateTimelineVersion,
+          },
+          frameworkRequest,
+        });
+        await compareTimelinesStatus.init();
 
-        if (
-          (!isHandlingTemplateTimeline && existTimeline != null) ||
-          (isHandlingTemplateTimeline && (existTemplateTimeline != null || existTimeline != null))
-        ) {
-          return siemResponse.error({
-            body: isHandlingTemplateTimeline
-              ? CREATE_TEMPLATE_TIMELINE_ERROR_MESSAGE
-              : CREATE_TIMELINE_ERROR_MESSAGE,
-            statusCode: 405,
+        // Create timeline
+        if (compareTimelinesStatus.isCreatable) {
+          const newTimeline = await createTimelines({
+            frameworkRequest,
+            timeline,
+            timelineVersion: version,
           });
-        }
 
-        // Create timeline
-        const newTimeline = await createTimelines(frameworkRequest, timeline, null, version);
-        return response.ok({
-          body: {
-            data: {
-              persistTimeline: newTimeline,
+          return response.ok({
+            body: {
+              data: {
+                persistTimeline: newTimeline,
+              },
             },
-          },
-        });
+          });
+        } else {
+          return siemResponse.error(
+            compareTimelinesStatus.checkIsFailureCases(TimelineStatusActions.create) || {
+              statusCode: 405,
+              body: 'update timeline error',
+            }
+          );
+        }
       } catch (err) {
         const error = transformError(err);
-
         return siemResponse.error({
           body: error.message,
           statusCode: error.statusCode,
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.test.ts
index 48e22f6af2a7..15fb8f3411cf 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.test.ts
@@ -12,7 +12,7 @@ import {
   createMockConfig,
 } from '../../detection_engine/routes/__mocks__';
 import { TIMELINE_EXPORT_URL } from '../../../../common/constants';
-import { TimelineStatus } from '../../../../common/types/timeline';
+import { TimelineStatus, TimelineType } from '../../../../common/types/timeline';
 import { SecurityPluginSetup } from '../../../../../../plugins/security/server';
 
 import {
@@ -22,7 +22,19 @@ import {
   mockGetCurrentUser,
   mockGetTimelineValue,
   mockParsedTimelineObject,
+  mockParsedTemplateTimelineObjects,
+  mockUniqueParsedTemplateTimelineObjects,
+  mockParsedTemplateTimelineObject,
+  mockCreatedTemplateTimeline,
+  mockGetTemplateTimelineValue,
+  mockCreatedTimeline,
 } from './__mocks__/import_timelines';
+import {
+  TEMPLATE_TIMELINE_VERSION_CONFLICT_MESSAGE,
+  EMPTY_TITLE_ERROR_MESSAGE,
+  NOT_ALLOW_UPDATE_STATUS_ERROR_MESSAGE,
+  NOT_ALLOW_UPDATE_TIMELINE_TYPE_ERROR_MESSAGE,
+} from './utils/failure_cases';
 
 describe('import timelines', () => {
   let server: ReturnType<typeof serverMock.create>;
@@ -35,8 +47,7 @@ describe('import timelines', () => {
   let mockPersistPinnedEventOnTimeline: jest.Mock;
   let mockPersistNote: jest.Mock;
   let mockGetTupleDuplicateErrorsAndUniqueTimeline: jest.Mock;
-  const newTimelineSavedObjectId = '79deb4c0-6bc1-11ea-9999-f5341fb7a189';
-  const newTimelineVersion = '9999';
+
   beforeEach(() => {
     jest.resetModules();
     jest.resetAllMocks();
@@ -90,7 +101,7 @@ describe('import timelines', () => {
           getTimeline: mockGetTimeline.mockReturnValue(null),
           getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue(null),
           persistTimeline: mockPersistTimeline.mockReturnValue({
-            timeline: { savedObjectId: newTimelineSavedObjectId, version: newTimelineVersion },
+            timeline: mockCreatedTimeline,
           }),
         };
       });
@@ -139,19 +150,38 @@ describe('import timelines', () => {
     test('should Create a new timeline savedObject with given timeline', async () => {
       const mockRequest = getImportTimelinesRequest();
       await server.inject(mockRequest, context);
-      expect(mockPersistTimeline.mock.calls[0][3]).toEqual(mockParsedTimelineObject);
+      expect(mockPersistTimeline.mock.calls[0][3]).toEqual({
+        ...mockParsedTimelineObject,
+        status: TimelineStatus.active,
+        templateTimelineId: null,
+        templateTimelineVersion: null,
+      });
     });
 
-    test('should Create a new timeline savedObject with given draft timeline', async () => {
+    test('should throw error if given an untitle timeline', async () => {
       mockGetTupleDuplicateErrorsAndUniqueTimeline.mockReturnValue([
         mockDuplicateIdErrors,
-        [{ ...mockUniqueParsedObjects[0], status: TimelineStatus.draft }],
+        [
+          {
+            ...mockUniqueParsedObjects[0],
+            title: '',
+          },
+        ],
       ]);
       const mockRequest = getImportTimelinesRequest();
-      await server.inject(mockRequest, context);
-      expect(mockPersistTimeline.mock.calls[0][3]).toEqual({
-        ...mockParsedTimelineObject,
-        status: TimelineStatus.active,
+      const response = await server.inject(mockRequest, context);
+      expect(response.body).toEqual({
+        success: false,
+        success_count: 0,
+        errors: [
+          {
+            id: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
+            error: {
+              status_code: 409,
+              message: EMPTY_TITLE_ERROR_MESSAGE,
+            },
+          },
+        ],
       });
     });
 
@@ -178,7 +208,9 @@ describe('import timelines', () => {
     test('should Create a new pinned event with new timelineSavedObjectId', async () => {
       const mockRequest = getImportTimelinesRequest();
       await server.inject(mockRequest, context);
-      expect(mockPersistPinnedEventOnTimeline.mock.calls[0][3]).toEqual(newTimelineSavedObjectId);
+      expect(mockPersistPinnedEventOnTimeline.mock.calls[0][3]).toEqual(
+        mockCreatedTimeline.savedObjectId
+      );
     });
 
     test('should Create notes', async () => {
@@ -202,7 +234,7 @@ describe('import timelines', () => {
     test('should provide note content when Creating notes for a timeline', async () => {
       const mockRequest = getImportTimelinesRequest();
       await server.inject(mockRequest, context);
-      expect(mockPersistNote.mock.calls[0][2]).toEqual(newTimelineVersion);
+      expect(mockPersistNote.mock.calls[0][2]).toEqual(mockCreatedTimeline.version);
     });
 
     test('should provide new notes when Creating notes for a timeline', async () => {
@@ -211,17 +243,17 @@ describe('import timelines', () => {
       expect(mockPersistNote.mock.calls[0][3]).toEqual({
         eventId: undefined,
         note: mockUniqueParsedObjects[0].globalNotes[0].note,
-        timelineId: newTimelineSavedObjectId,
+        timelineId: mockCreatedTimeline.savedObjectId,
       });
       expect(mockPersistNote.mock.calls[1][3]).toEqual({
         eventId: mockUniqueParsedObjects[0].eventNotes[0].eventId,
         note: mockUniqueParsedObjects[0].eventNotes[0].note,
-        timelineId: newTimelineSavedObjectId,
+        timelineId: mockCreatedTimeline.savedObjectId,
       });
       expect(mockPersistNote.mock.calls[2][3]).toEqual({
         eventId: mockUniqueParsedObjects[0].eventNotes[1].eventId,
         note: mockUniqueParsedObjects[0].eventNotes[1].note,
-        timelineId: newTimelineSavedObjectId,
+        timelineId: mockCreatedTimeline.savedObjectId,
       });
     });
 
@@ -268,7 +300,458 @@ describe('import timelines', () => {
             id: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
             error: {
               status_code: 409,
-              message: `timeline_id: "79deb4c0-6bc1-11ea-a90b-f5341fb7a189" already exists`,
+              message: `savedObjectId: "79deb4c0-6bc1-11ea-a90b-f5341fb7a189" already exists`,
+            },
+          },
+        ],
+      });
+    });
+
+    test('should throw error if given an untitle timeline', async () => {
+      mockGetTupleDuplicateErrorsAndUniqueTimeline.mockReturnValue([
+        mockDuplicateIdErrors,
+        [
+          {
+            ...mockUniqueParsedObjects[0],
+            title: '',
+          },
+        ],
+      ]);
+      const mockRequest = getImportTimelinesRequest();
+      const response = await server.inject(mockRequest, context);
+      expect(response.body).toEqual({
+        success: false,
+        success_count: 0,
+        errors: [
+          {
+            id: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
+            error: {
+              status_code: 409,
+              message: EMPTY_TITLE_ERROR_MESSAGE,
+            },
+          },
+        ],
+      });
+    });
+
+    test('should throw error if timelineType updated', async () => {
+      mockGetTupleDuplicateErrorsAndUniqueTimeline.mockReturnValue([
+        mockDuplicateIdErrors,
+        [
+          {
+            ...mockGetTimelineValue,
+            timelineType: TimelineType.template,
+          },
+        ],
+      ]);
+      const mockRequest = getImportTimelinesRequest();
+      const response = await server.inject(mockRequest, context);
+      expect(response.body).toEqual({
+        success: false,
+        success_count: 0,
+        errors: [
+          {
+            id: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
+            error: {
+              status_code: 409,
+              message: NOT_ALLOW_UPDATE_TIMELINE_TYPE_ERROR_MESSAGE,
+            },
+          },
+        ],
+      });
+    });
+  });
+
+  describe('request validation', () => {
+    beforeEach(() => {
+      jest.doMock('../saved_object', () => {
+        return {
+          getTimeline: mockGetTimeline.mockReturnValue(null),
+          persistTimeline: mockPersistTimeline.mockReturnValue({
+            timeline: { savedObjectId: '79deb4c0-6bc1-11ea-9999-f5341fb7a189' },
+          }),
+        };
+      });
+
+      jest.doMock('../../pinned_event/saved_object', () => {
+        return {
+          persistPinnedEventOnTimeline: mockPersistPinnedEventOnTimeline.mockReturnValue(
+            new Error('Test error')
+          ),
+        };
+      });
+
+      jest.doMock('../../note/saved_object', () => {
+        return {
+          persistNote: mockPersistNote,
+        };
+      });
+    });
+    test('disallows invalid query', async () => {
+      request = requestMock.create({
+        method: 'post',
+        path: TIMELINE_EXPORT_URL,
+        body: { id: 'someId' },
+      });
+      const importTimelinesRoute = jest.requireActual('./import_timelines_route')
+        .importTimelinesRoute;
+
+      importTimelinesRoute(server.router, createMockConfig(), securitySetup);
+      const result = server.validate(request);
+
+      expect(result.badRequest).toHaveBeenCalledWith(
+        [
+          'Invalid value "undefined" supplied to "file"',
+          'Invalid value "undefined" supplied to "file"',
+        ].join(',')
+      );
+    });
+  });
+});
+
+describe('import template timelines', () => {
+  let server: ReturnType<typeof serverMock.create>;
+  let request: ReturnType<typeof requestMock.create>;
+  let securitySetup: SecurityPluginSetup;
+  let { context } = requestContextMock.createTools();
+  let mockGetTimeline: jest.Mock;
+  let mockGetTemplateTimeline: jest.Mock;
+  let mockPersistTimeline: jest.Mock;
+  let mockPersistPinnedEventOnTimeline: jest.Mock;
+  let mockPersistNote: jest.Mock;
+  let mockGetTupleDuplicateErrorsAndUniqueTimeline: jest.Mock;
+  const mockNewTemplateTimelineId = 'new templateTimelineId';
+  beforeEach(() => {
+    jest.resetModules();
+    jest.resetAllMocks();
+    jest.restoreAllMocks();
+    jest.clearAllMocks();
+
+    server = serverMock.create();
+    context = requestContextMock.createTools().context;
+
+    securitySetup = ({
+      authc: {
+        getCurrentUser: jest.fn().mockReturnValue(mockGetCurrentUser),
+      },
+      authz: {},
+    } as unknown) as SecurityPluginSetup;
+
+    mockGetTimeline = jest.fn();
+    mockGetTemplateTimeline = jest.fn();
+    mockPersistTimeline = jest.fn();
+    mockPersistPinnedEventOnTimeline = jest.fn();
+    mockPersistNote = jest.fn();
+    mockGetTupleDuplicateErrorsAndUniqueTimeline = jest.fn();
+
+    jest.doMock('../create_timelines_stream_from_ndjson', () => {
+      return {
+        createTimelinesStreamFromNdJson: jest
+          .fn()
+          .mockReturnValue(mockParsedTemplateTimelineObjects),
+      };
+    });
+
+    jest.doMock('../../../../../../../src/legacy/utils', () => {
+      return {
+        createPromiseFromStreams: jest.fn().mockReturnValue(mockParsedTemplateTimelineObjects),
+      };
+    });
+
+    jest.doMock('./utils/import_timelines', () => {
+      const originalModule = jest.requireActual('./utils/import_timelines');
+      return {
+        ...originalModule,
+        getTupleDuplicateErrorsAndUniqueTimeline: mockGetTupleDuplicateErrorsAndUniqueTimeline.mockReturnValue(
+          [mockDuplicateIdErrors, mockUniqueParsedTemplateTimelineObjects]
+        ),
+      };
+    });
+
+    jest.doMock('uuid', () => ({
+      v4: jest.fn().mockReturnValue(mockNewTemplateTimelineId),
+    }));
+  });
+
+  describe('Import a new template timeline', () => {
+    beforeEach(() => {
+      jest.doMock('../saved_object', () => {
+        return {
+          getTimeline: mockGetTimeline.mockReturnValue(null),
+          getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue(null),
+          persistTimeline: mockPersistTimeline.mockReturnValue({
+            timeline: mockCreatedTemplateTimeline,
+          }),
+        };
+      });
+
+      jest.doMock('../../pinned_event/saved_object', () => {
+        return {
+          persistPinnedEventOnTimeline: mockPersistPinnedEventOnTimeline,
+        };
+      });
+
+      jest.doMock('../../note/saved_object', () => {
+        return {
+          persistNote: mockPersistNote,
+        };
+      });
+
+      const importTimelinesRoute = jest.requireActual('./import_timelines_route')
+        .importTimelinesRoute;
+      importTimelinesRoute(server.router, createMockConfig(), securitySetup);
+    });
+
+    test('should use given timelineId to check if the timeline savedObject already exist', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockGetTimeline.mock.calls[0][1]).toEqual(
+        mockUniqueParsedTemplateTimelineObjects[0].savedObjectId
+      );
+    });
+
+    test('should use given templateTimelineId to check if the timeline savedObject already exist', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockGetTemplateTimeline.mock.calls[0][1]).toEqual(
+        mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId
+      );
+    });
+
+    test('should Create a new timeline savedObject', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistTimeline).toHaveBeenCalled();
+    });
+
+    test('should Create a new timeline savedObject without timelineId', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistTimeline.mock.calls[0][1]).toBeNull();
+    });
+
+    test('should Create a new timeline savedObject without timeline version', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistTimeline.mock.calls[0][2]).toBeNull();
+    });
+
+    test('should Create a new timeline savedObject witn given timeline and skip the omitted fields', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistTimeline.mock.calls[0][3]).toEqual({
+        ...mockParsedTemplateTimelineObject,
+        status: TimelineStatus.active,
+      });
+    });
+
+    test('should NOT Create new pinned events', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistPinnedEventOnTimeline).not.toHaveBeenCalled();
+    });
+
+    test('should provide no noteSavedObjectId when Creating notes for a timeline', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistNote.mock.calls[0][1]).toBeNull();
+    });
+
+    test('should provide new timeline version when Creating notes for a timeline', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistNote.mock.calls[0][2]).toEqual(mockCreatedTemplateTimeline.version);
+    });
+
+    test('should exclude event notes when creating notes', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistNote.mock.calls[0][3]).toEqual({
+        eventId: undefined,
+        note: mockUniqueParsedTemplateTimelineObjects[0].globalNotes[0].note,
+        timelineId: mockCreatedTemplateTimeline.savedObjectId,
+      });
+    });
+
+    test('returns 200 when import timeline successfully', async () => {
+      const response = await server.inject(getImportTimelinesRequest(), context);
+      expect(response.status).toEqual(200);
+    });
+
+    test('should assign a templateTimeline Id automatically if not given one', async () => {
+      mockGetTupleDuplicateErrorsAndUniqueTimeline.mockReturnValue([
+        mockDuplicateIdErrors,
+        [
+          {
+            ...mockUniqueParsedTemplateTimelineObjects[0],
+            templateTimelineId: null,
+          },
+        ],
+      ]);
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistTimeline.mock.calls[0][3].templateTimelineId).toEqual(
+        mockNewTemplateTimelineId
+      );
+    });
+  });
+
+  describe('Import a template timeline already exist', () => {
+    beforeEach(() => {
+      jest.doMock('../saved_object', () => {
+        return {
+          getTimeline: mockGetTimeline.mockReturnValue(mockGetTemplateTimelineValue),
+          getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue({
+            timeline: [mockGetTemplateTimelineValue],
+          }),
+          persistTimeline: mockPersistTimeline.mockReturnValue({
+            timeline: mockCreatedTemplateTimeline,
+          }),
+        };
+      });
+
+      jest.doMock('../../pinned_event/saved_object', () => {
+        return {
+          persistPinnedEventOnTimeline: mockPersistPinnedEventOnTimeline,
+        };
+      });
+
+      jest.doMock('../../note/saved_object', () => {
+        return {
+          persistNote: mockPersistNote,
+        };
+      });
+
+      const importTimelinesRoute = jest.requireActual('./import_timelines_route')
+        .importTimelinesRoute;
+      importTimelinesRoute(server.router, createMockConfig(), securitySetup);
+    });
+
+    test('should use given timelineId to check if the timeline savedObject already exist', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockGetTimeline.mock.calls[0][1]).toEqual(
+        mockUniqueParsedTemplateTimelineObjects[0].savedObjectId
+      );
+    });
+
+    test('should use given templateTimelineId to check if the timeline savedObject already exist', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockGetTemplateTimeline.mock.calls[0][1]).toEqual(
+        mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId
+      );
+    });
+
+    test('should UPDATE timeline savedObject', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistTimeline).toHaveBeenCalled();
+    });
+
+    test('should UPDATE timeline savedObject with timelineId', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistTimeline.mock.calls[0][1]).toEqual(
+        mockUniqueParsedTemplateTimelineObjects[0].savedObjectId
+      );
+    });
+
+    test('should UPDATE timeline savedObject without timeline version', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistTimeline.mock.calls[0][2]).toEqual(
+        mockUniqueParsedTemplateTimelineObjects[0].version
+      );
+    });
+
+    test('should UPDATE a new timeline savedObject witn given timeline and skip the omitted fields', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistTimeline.mock.calls[0][3]).toEqual(mockParsedTemplateTimelineObject);
+    });
+
+    test('should NOT Create new pinned events', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistPinnedEventOnTimeline).not.toHaveBeenCalled();
+    });
+
+    test('should provide noteSavedObjectId when Creating notes for a timeline', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistNote.mock.calls[0][1]).toBeNull();
+    });
+
+    test('should provide new timeline version when Creating notes for a timeline', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistNote.mock.calls[0][2]).toEqual(mockCreatedTemplateTimeline.version);
+    });
+
+    test('should exclude event notes when creating notes', async () => {
+      const mockRequest = getImportTimelinesRequest();
+      await server.inject(mockRequest, context);
+      expect(mockPersistNote.mock.calls[0][3]).toEqual({
+        eventId: undefined,
+        note: mockUniqueParsedTemplateTimelineObjects[0].globalNotes[0].note,
+        timelineId: mockCreatedTemplateTimeline.savedObjectId,
+      });
+    });
+
+    test('returns 200 when import timeline successfully', async () => {
+      const response = await server.inject(getImportTimelinesRequest(), context);
+      expect(response.status).toEqual(200);
+    });
+
+    test('should throw error if with given template timeline version conflict', async () => {
+      mockGetTupleDuplicateErrorsAndUniqueTimeline.mockReturnValue([
+        mockDuplicateIdErrors,
+        [
+          {
+            ...mockUniqueParsedTemplateTimelineObjects[0],
+            templateTimelineVersion: 1,
+          },
+        ],
+      ]);
+      const mockRequest = getImportTimelinesRequest();
+      const response = await server.inject(mockRequest, context);
+      expect(response.body).toEqual({
+        success: false,
+        success_count: 0,
+        errors: [
+          {
+            id: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
+            error: {
+              status_code: 409,
+              message: TEMPLATE_TIMELINE_VERSION_CONFLICT_MESSAGE,
+            },
+          },
+        ],
+      });
+    });
+
+    test('should throw error if status updated', async () => {
+      mockGetTupleDuplicateErrorsAndUniqueTimeline.mockReturnValue([
+        mockDuplicateIdErrors,
+        [
+          {
+            ...mockUniqueParsedTemplateTimelineObjects[0],
+            status: TimelineStatus.immutable,
+          },
+        ],
+      ]);
+      const mockRequest = getImportTimelinesRequest();
+      const response = await server.inject(mockRequest, context);
+      expect(response.body).toEqual({
+        success: false,
+        success_count: 0,
+        errors: [
+          {
+            id: '79deb4c0-6bc1-11ea-a90b-f5341fb7a189',
+            error: {
+              status_code: 409,
+              message: NOT_ALLOW_UPDATE_STATUS_ERROR_MESSAGE,
             },
           },
         ],
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.ts
index 5080142f22b1..fb4991d7d1e7 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.ts
@@ -7,17 +7,17 @@
 import { extname } from 'path';
 import { chunk, omit } from 'lodash/fp';
 
-import { validate } from '../../../../common/validate';
-import { importRulesSchema } from '../../../../common/detection_engine/schemas/response/import_rules_schema';
+import uuid from 'uuid';
 import { createPromiseFromStreams } from '../../../../../../../src/legacy/utils';
 import { IRouter } from '../../../../../../../src/core/server';
 
 import { TIMELINE_IMPORT_URL } from '../../../../common/constants';
+import { validate } from '../../../../common/validate';
 
 import { SetupPlugins } from '../../../plugin';
 import { ConfigType } from '../../../config';
 import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
-
+import { importRulesSchema } from '../../../../common/detection_engine/schemas/response/import_rules_schema';
 import {
   buildSiemResponse,
   createBulkErrorObject,
@@ -28,7 +28,11 @@ import {
 import { createTimelinesStreamFromNdJson } from '../create_timelines_stream_from_ndjson';
 
 import { ImportTimelinesPayloadSchemaRt } from './schemas/import_timelines_schema';
-import { buildFrameworkRequest } from './utils/common';
+import {
+  buildFrameworkRequest,
+  CompareTimelinesStatus,
+  TimelineStatusActions,
+} from './utils/common';
 import {
   getTupleDuplicateErrorsAndUniqueTimeline,
   isBulkError,
@@ -38,11 +42,11 @@ import {
   PromiseFromStreams,
   timelineSavedObjectOmittedFields,
 } from './utils/import_timelines';
-import { createTimelines, getTimeline, getTemplateTimeline } from './utils/create_timelines';
-import { TimelineType, TimelineStatus } from '../../../../common/types/timeline';
-import { checkIsFailureCases } from './utils/update_timelines';
+import { createTimelines } from './utils/create_timelines';
+import { TimelineStatus } from '../../../../common/types/timeline';
 
 const CHUNK_PARSED_OBJECT_SIZE = 10;
+const DEFAULT_IMPORT_ERROR = `Something went wrong, there's something we didn't handle properly, please help us improve by providing the file you try to import on https://discuss.elastic.co/c/security/siem`;
 
 export const importTimelinesRoute = (
   router: IRouter,
@@ -118,100 +122,112 @@ export const importTimelinesRoute = (
 
                       return null;
                     }
+
                     const {
-                      savedObjectId = null,
+                      savedObjectId,
                       pinnedEventIds,
                       globalNotes,
                       eventNotes,
+                      status,
                       templateTimelineId,
                       templateTimelineVersion,
+                      title,
                       timelineType,
-                      version = null,
+                      version,
                     } = parsedTimeline;
                     const parsedTimelineObject = omit(
                       timelineSavedObjectOmittedFields,
                       parsedTimeline
                     );
-
                     let newTimeline = null;
                     try {
-                      const templateTimeline =
-                        templateTimelineId != null
-                          ? await getTemplateTimeline(frameworkRequest, templateTimelineId)
-                          : null;
-
-                      const timeline =
-                        savedObjectId != null &&
-                        (await getTimeline(frameworkRequest, savedObjectId));
-                      const isHandlingTemplateTimeline = timelineType === TimelineType.template;
-
-                      if (
-                        (timeline == null && !isHandlingTemplateTimeline) ||
-                        (timeline == null && templateTimeline == null && isHandlingTemplateTimeline)
-                      ) {
+                      const compareTimelinesStatus = new CompareTimelinesStatus({
+                        status,
+                        timelineType,
+                        title,
+                        timelineInput: {
+                          id: savedObjectId,
+                          version,
+                        },
+                        templateTimelineInput: {
+                          id: templateTimelineId,
+                          version: templateTimelineVersion,
+                        },
+                        frameworkRequest,
+                      });
+                      await compareTimelinesStatus.init();
+                      const isTemplateTimeline = compareTimelinesStatus.isHandlingTemplateTimeline;
+                      if (compareTimelinesStatus.isCreatableViaImport) {
                         // create timeline / template timeline
-                        newTimeline = await createTimelines(
+                        newTimeline = await createTimelines({
                           frameworkRequest,
-                          {
+                          timeline: {
                             ...parsedTimelineObject,
                             status:
-                              parsedTimelineObject.status === TimelineStatus.draft
+                              status === TimelineStatus.draft
                                 ? TimelineStatus.active
-                                : parsedTimelineObject.status,
+                                : status ?? TimelineStatus.active,
+                            templateTimelineVersion: isTemplateTimeline
+                              ? templateTimelineVersion
+                              : null,
+                            templateTimelineId: isTemplateTimeline
+                              ? templateTimelineId ?? uuid.v4()
+                              : null,
                           },
-                          null, // timelineSavedObjectId
-                          null, // timelineVersion
-                          pinnedEventIds,
-                          isHandlingTemplateTimeline
-                            ? globalNotes
-                            : [...globalNotes, ...eventNotes],
-                          [] // existing note ids
-                        );
+                          pinnedEventIds: isTemplateTimeline ? null : pinnedEventIds,
+                          notes: isTemplateTimeline ? globalNotes : [...globalNotes, ...eventNotes],
+                        });
 
                         resolve({
                           timeline_id: newTimeline.timeline.savedObjectId,
                           status_code: 200,
                         });
-                      } else if (
-                        timeline &&
-                        timeline != null &&
-                        templateTimeline != null &&
-                        isHandlingTemplateTimeline
-                      ) {
-                        // update template timeline
-                        const errorObj = checkIsFailureCases(
-                          isHandlingTemplateTimeline,
-                          version,
-                          templateTimelineVersion ?? null,
-                          timeline,
-                          templateTimeline
-                        );
-                        if (errorObj != null) {
-                          return siemResponse.error(errorObj);
-                        }
+                      }
 
-                        newTimeline = await createTimelines(
-                          frameworkRequest,
-                          { ...parsedTimelineObject, templateTimelineId, templateTimelineVersion },
-                          timeline.savedObjectId, // timelineSavedObjectId
-                          timeline.version, // timelineVersion
-                          pinnedEventIds,
-                          globalNotes,
-                          [] // existing note ids
+                      if (!compareTimelinesStatus.isHandlingTemplateTimeline) {
+                        const errorMessage = compareTimelinesStatus.checkIsFailureCases(
+                          TimelineStatusActions.createViaImport
                         );
+                        const message = errorMessage?.body ?? DEFAULT_IMPORT_ERROR;
 
-                        resolve({
-                          timeline_id: newTimeline.timeline.savedObjectId,
-                          status_code: 200,
-                        });
-                      } else {
                         resolve(
                           createBulkErrorObject({
                             id: savedObjectId ?? 'unknown',
                             statusCode: 409,
-                            message: `timeline_id: "${savedObjectId}" already exists`,
+                            message,
                           })
                         );
+                      } else {
+                        if (compareTimelinesStatus.isUpdatableViaImport) {
+                          // update template timeline
+                          newTimeline = await createTimelines({
+                            frameworkRequest,
+                            timeline: parsedTimelineObject,
+                            timelineSavedObjectId: compareTimelinesStatus.timelineId,
+                            timelineVersion: compareTimelinesStatus.timelineVersion,
+                            notes: globalNotes,
+                            existingNoteIds: compareTimelinesStatus.timelineInput.data?.noteIds,
+                          });
+
+                          resolve({
+                            timeline_id: newTimeline.timeline.savedObjectId,
+                            status_code: 200,
+                          });
+                        } else {
+                          const errorMessage = compareTimelinesStatus.checkIsFailureCases(
+                            TimelineStatusActions.updateViaImport
+                          );
+
+                          const message = errorMessage?.body ?? DEFAULT_IMPORT_ERROR;
+
+                          resolve(
+                            createBulkErrorObject({
+                              id: savedObjectId ?? 'unknown',
+                              statusCode: 409,
+                              message,
+                            })
+                          );
+                        }
                       }
                     } catch (err) {
                       resolve(
@@ -236,9 +252,9 @@ export const importTimelinesRoute = (
           ];
         }
 
-        const errorsResp = importTimelineResponse.filter((resp) =>
-          isBulkError(resp)
-        ) as BulkError[];
+        const errorsResp = importTimelineResponse.filter((resp) => {
+          return isBulkError(resp);
+        }) as BulkError[];
         const successes = importTimelineResponse.filter((resp) => {
           if (isImportRegular(resp)) {
             return resp.status_code === 200;
@@ -261,7 +277,6 @@ export const importTimelinesRoute = (
       } catch (err) {
         const error = transformError(err);
         const siemResponse = buildSiemResponse(response);
-
         return siemResponse.error({
           body: error.message,
           statusCode: error.statusCode,
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.test.ts
index 2a3feb7afd59..3cedb925649a 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.test.ts
@@ -26,7 +26,7 @@ import {
 import {
   UPDATE_TIMELINE_ERROR_MESSAGE,
   UPDATE_TEMPLATE_TIMELINE_ERROR_MESSAGE,
-} from './utils/update_timelines';
+} from './utils/failure_cases';
 
 describe('update timelines', () => {
   let server: ReturnType<typeof serverMock.create>;
@@ -93,7 +93,7 @@ describe('update timelines', () => {
         await server.inject(mockRequest, context);
       });
 
-      test('should Check a if given timeline id exist', async () => {
+      test('should Check if given timeline id exist', async () => {
         expect(mockGetTimeline.mock.calls[0][1]).toEqual(updateTimelineWithTimelineId.timelineId);
       });
 
@@ -178,7 +178,7 @@ describe('update timelines', () => {
               timeline: [mockGetTemplateTimelineValue],
             }),
             persistTimeline: mockPersistTimeline.mockReturnValue({
-              timeline: updateTimelineWithTimelineId.timeline,
+              timeline: updateTemplateTimelineWithTimelineId.timeline,
             }),
           };
         });
@@ -211,7 +211,7 @@ describe('update timelines', () => {
 
       test('should Update existing template timeline with template timelineId', async () => {
         expect(mockGetTemplateTimeline.mock.calls[0][1]).toEqual(
-          updateTemplateTimelineWithTimelineId.timelineId
+          updateTemplateTimelineWithTimelineId.timeline.templateTimelineId
         );
       });
 
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.ts
index d5ecd408a6ef..f59df151b695 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.ts
@@ -7,19 +7,17 @@
 import { IRouter } from '../../../../../../../src/core/server';
 
 import { TIMELINE_URL } from '../../../../common/constants';
-import { TimelineType } from '../../../../common/types/timeline';
 
 import { SetupPlugins } from '../../../plugin';
 import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
 import { ConfigType } from '../../..';
 
 import { transformError, buildSiemResponse } from '../../detection_engine/routes/utils';
-import { FrameworkRequest } from '../../framework';
 
 import { updateTimelineSchema } from './schemas/update_timelines_schema';
-import { buildFrameworkRequest } from './utils/common';
-import { createTimelines, getTimeline, getTemplateTimeline } from './utils/create_timelines';
-import { checkIsFailureCases } from './utils/update_timelines';
+import { buildFrameworkRequest, TimelineStatusActions } from './utils/common';
+import { createTimelines } from './utils/create_timelines';
+import { CompareTimelinesStatus } from './utils/compare_timelines_status';
 
 export const updateTimelinesRoute = (
   router: IRouter,
@@ -33,7 +31,7 @@ export const updateTimelinesRoute = (
         body: buildRouteValidation(updateTimelineSchema),
       },
       options: {
-        tags: ['access:securitySolution'],
+        tags: ['access:siem'],
       },
     },
     // eslint-disable-next-line complexity
@@ -43,39 +41,54 @@ export const updateTimelinesRoute = (
       try {
         const frameworkRequest = await buildFrameworkRequest(context, security, request);
         const { timelineId, timeline, version } = request.body;
-        const { templateTimelineId, templateTimelineVersion, timelineType } = timeline;
-        const isHandlingTemplateTimeline = timelineType === TimelineType.template;
-        const existTimeline =
-          timelineId != null ? await getTimeline(frameworkRequest, timelineId) : null;
+        const {
+          templateTimelineId,
+          templateTimelineVersion,
+          timelineType,
+          title,
+          status,
+        } = timeline;
 
-        const existTemplateTimeline =
-          templateTimelineId != null
-            ? await getTemplateTimeline(frameworkRequest, templateTimelineId)
-            : null;
-
-        const errorObj = checkIsFailureCases(
-          isHandlingTemplateTimeline,
-          version,
-          templateTimelineVersion ?? null,
-          existTimeline,
-          existTemplateTimeline
-        );
-        if (errorObj != null) {
-          return siemResponse.error(errorObj);
-        }
-        const updatedTimeline = await createTimelines(
-          (frameworkRequest as unknown) as FrameworkRequest,
-          timeline,
-          timelineId,
-          version
-        );
-        return response.ok({
-          body: {
-            data: {
-              persistTimeline: updatedTimeline,
-            },
+        const compareTimelinesStatus = new CompareTimelinesStatus({
+          status,
+          title,
+          timelineType,
+          timelineInput: {
+            id: timelineId,
+            version,
+          },
+          templateTimelineInput: {
+            id: templateTimelineId,
+            version: templateTimelineVersion,
           },
+          frameworkRequest,
         });
+
+        await compareTimelinesStatus.init();
+        if (compareTimelinesStatus.isUpdatable) {
+          const updatedTimeline = await createTimelines({
+            frameworkRequest,
+            timeline,
+            timelineSavedObjectId: timelineId,
+            timelineVersion: version,
+          });
+
+          return response.ok({
+            body: {
+              data: {
+                persistTimeline: updatedTimeline,
+              },
+            },
+          });
+        } else {
+          const error = compareTimelinesStatus.checkIsFailureCases(TimelineStatusActions.update);
+          return siemResponse.error(
+            error || {
+              statusCode: 405,
+              body: 'update timeline error',
+            }
+          );
+        }
       } catch (err) {
         const error = transformError(err);
         return siemResponse.error({
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/common.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/common.ts
index adbfdbf6d605..2c2d651fd483 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/common.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/common.ts
@@ -5,9 +5,10 @@
  */
 import { set } from 'lodash/fp';
 
-import { RequestHandlerContext } from 'src/core/server';
+import { KibanaRequest, RequestHandlerContext } from 'src/core/server';
+
 import { SetupPlugins } from '../../../../plugin';
-import { KibanaRequest } from '../../../../../../../../src/core/server';
+
 import { FrameworkRequest } from '../../../framework';
 
 export const buildFrameworkRequest = async (
@@ -28,3 +29,19 @@ export const buildFrameworkRequest = async (
     )
   );
 };
+
+export enum TimelineStatusActions {
+  create = 'create',
+  createViaImport = 'createViaImport',
+  update = 'update',
+  updateViaImport = 'updateViaImport',
+}
+
+export type TimelineStatusAction =
+  | TimelineStatusActions.create
+  | TimelineStatusActions.createViaImport
+  | TimelineStatusActions.update
+  | TimelineStatusActions.updateViaImport;
+
+export * from './compare_timelines_status';
+export * from './timeline_object';
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/compare_timelines_status.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/compare_timelines_status.test.ts
new file mode 100644
index 000000000000..a6d379e534bc
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/compare_timelines_status.test.ts
@@ -0,0 +1,810 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { TimelineType, TimelineStatus } from '../../../../../common/types/timeline';
+import { FrameworkRequest } from '../../../framework';
+
+import {
+  mockUniqueParsedObjects,
+  mockUniqueParsedTemplateTimelineObjects,
+  mockGetTemplateTimelineValue,
+  mockGetTimelineValue,
+} from '../__mocks__/import_timelines';
+
+import { CompareTimelinesStatus as TimelinesStatusType } from './compare_timelines_status';
+import {
+  EMPTY_TITLE_ERROR_MESSAGE,
+  UPDATE_STATUS_ERROR_MESSAGE,
+  UPDATE_TEMPLATE_TIMELINE_ERROR_MESSAGE,
+  TEMPLATE_TIMELINE_VERSION_CONFLICT_MESSAGE,
+  CREATE_TEMPLATE_TIMELINE_ERROR_MESSAGE,
+  getImportExistingTimelineError,
+} from './failure_cases';
+import { TimelineStatusActions } from './common';
+
+describe('CompareTimelinesStatus', () => {
+  describe('timeline', () => {
+    describe('given timeline exists', () => {
+      const mockGetTimeline: jest.Mock = jest.fn();
+      const mockGetTemplateTimeline: jest.Mock = jest.fn();
+      let timelineObj: TimelinesStatusType;
+
+      afterEach(() => {
+        jest.clearAllMocks();
+      });
+
+      afterAll(() => {
+        jest.resetModules();
+      });
+
+      beforeAll(() => {
+        jest.resetModules();
+      });
+
+      beforeEach(async () => {
+        jest.doMock('../../saved_object', () => {
+          return {
+            getTimeline: mockGetTimeline.mockReturnValue(mockGetTimelineValue),
+            getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue({
+              timeline: [],
+            }),
+          };
+        });
+
+        const CompareTimelinesStatus = jest.requireActual('./compare_timelines_status')
+          .CompareTimelinesStatus;
+
+        timelineObj = new CompareTimelinesStatus({
+          timelineInput: {
+            id: mockUniqueParsedObjects[0].savedObjectId,
+            version: mockUniqueParsedObjects[0].version,
+          },
+          timelineType: TimelineType.default,
+          title: mockUniqueParsedObjects[0].title,
+          templateTimelineInput: {
+            id: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId,
+            version: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineVersion,
+          },
+          frameworkRequest: {} as FrameworkRequest,
+        });
+
+        await timelineObj.init();
+      });
+
+      test('should get timeline', () => {
+        expect(mockGetTimeline).toHaveBeenCalled();
+      });
+
+      test('should get templateTimeline', () => {
+        expect(mockGetTemplateTimeline).toHaveBeenCalled();
+      });
+
+      test('should not creatable', () => {
+        expect(timelineObj.isCreatable).toEqual(false);
+      });
+
+      test('should not CreatableViaImport', () => {
+        expect(timelineObj.isCreatableViaImport).toEqual(false);
+      });
+
+      test('should be Updatable', () => {
+        expect(timelineObj.isUpdatable).toEqual(true);
+      });
+
+      test('should not be UpdatableViaImport', () => {
+        expect(timelineObj.isUpdatableViaImport).toEqual(false);
+      });
+
+      test('should indicate we are handling a timeline', () => {
+        expect(timelineObj.isHandlingTemplateTimeline).toEqual(false);
+      });
+    });
+
+    describe('given timeline does NOT exists', () => {
+      const mockGetTimeline: jest.Mock = jest.fn();
+      const mockGetTemplateTimeline: jest.Mock = jest.fn();
+      let timelineObj: TimelinesStatusType;
+
+      afterEach(() => {
+        jest.clearAllMocks();
+      });
+
+      afterAll(() => {
+        jest.resetModules();
+      });
+
+      beforeAll(() => {
+        jest.resetModules();
+      });
+
+      beforeEach(async () => {
+        jest.doMock('../../saved_object', () => {
+          return {
+            getTimeline: mockGetTimeline.mockReturnValue(null),
+            getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue({
+              timeline: [],
+            }),
+          };
+        });
+
+        const CompareTimelinesStatus = jest.requireActual('./compare_timelines_status')
+          .CompareTimelinesStatus;
+
+        timelineObj = new CompareTimelinesStatus({
+          timelineInput: {
+            id: mockUniqueParsedObjects[0].savedObjectId,
+            version: mockUniqueParsedObjects[0].version,
+          },
+          timelineType: TimelineType.default,
+          title: mockUniqueParsedObjects[0].title,
+          templateTimelineInput: {
+            id: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId,
+            version: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineVersion,
+          },
+          frameworkRequest: {} as FrameworkRequest,
+        });
+
+        await timelineObj.init();
+      });
+
+      test('should get timeline', () => {
+        expect(mockGetTimeline).toHaveBeenCalled();
+      });
+
+      test('should get templateTimeline', () => {
+        expect(mockGetTemplateTimeline).toHaveBeenCalled();
+      });
+
+      test('should be creatable', () => {
+        expect(timelineObj.isCreatable).toEqual(true);
+      });
+
+      test('should be CreatableViaImport', () => {
+        expect(timelineObj.isCreatableViaImport).toEqual(true);
+      });
+
+      test('should be Updatable', () => {
+        expect(timelineObj.isUpdatable).toEqual(false);
+      });
+
+      test('should not be UpdatableViaImport', () => {
+        expect(timelineObj.isUpdatableViaImport).toEqual(false);
+      });
+
+      test('should indicate we are handling a timeline', () => {
+        expect(timelineObj.isHandlingTemplateTimeline).toEqual(false);
+      });
+    });
+  });
+
+  describe('template timeline', () => {
+    describe('given template timeline exists', () => {
+      const mockGetTimeline: jest.Mock = jest.fn();
+      const mockGetTemplateTimeline: jest.Mock = jest.fn();
+
+      let timelineObj: TimelinesStatusType;
+
+      beforeEach(async () => {
+        jest.doMock('../../saved_object', () => ({
+          getTimeline: mockGetTimeline.mockReturnValue(mockGetTemplateTimelineValue),
+          getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue({
+            timeline: [mockGetTemplateTimelineValue],
+          }),
+        }));
+
+        const CompareTimelinesStatus = jest.requireActual('./compare_timelines_status')
+          .CompareTimelinesStatus;
+
+        timelineObj = new CompareTimelinesStatus({
+          timelineInput: {
+            id: mockUniqueParsedObjects[0].savedObjectId,
+            version: mockUniqueParsedObjects[0].version,
+          },
+          timelineType: TimelineType.template,
+          title: mockUniqueParsedObjects[0].title,
+          templateTimelineInput: {
+            id: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId,
+            version: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineVersion,
+          },
+          frameworkRequest: {} as FrameworkRequest,
+        });
+        await timelineObj.init();
+      });
+
+      afterEach(() => {
+        jest.clearAllMocks();
+      });
+
+      afterAll(() => {
+        jest.resetModules();
+      });
+
+      beforeAll(() => {
+        jest.resetModules();
+      });
+
+      test('should get timeline', () => {
+        expect(mockGetTimeline).toHaveBeenCalled();
+      });
+
+      test('should get templateTimeline', () => {
+        expect(mockGetTemplateTimeline).toHaveBeenCalled();
+      });
+
+      test('should not creatable', () => {
+        expect(timelineObj.isCreatable).toEqual(false);
+      });
+
+      test('should not CreatableViaImport', () => {
+        expect(timelineObj.isCreatableViaImport).toEqual(false);
+      });
+
+      test('should be Updatable', () => {
+        expect(timelineObj.isUpdatable).toEqual(true);
+      });
+
+      test('should be UpdatableViaImport', () => {
+        expect(timelineObj.isUpdatableViaImport).toEqual(true);
+      });
+
+      test('should indicate we are handling a template timeline', () => {
+        expect(timelineObj.isHandlingTemplateTimeline).toEqual(true);
+      });
+    });
+
+    describe('given template timeline does NOT exists', () => {
+      const mockGetTimeline: jest.Mock = jest.fn();
+      const mockGetTemplateTimeline: jest.Mock = jest.fn();
+
+      let timelineObj: TimelinesStatusType;
+
+      afterEach(() => {
+        jest.clearAllMocks();
+      });
+
+      afterAll(() => {
+        jest.resetModules();
+      });
+
+      beforeAll(() => {
+        jest.resetModules();
+      });
+
+      beforeEach(async () => {
+        jest.doMock('../../saved_object', () => ({
+          getTimeline: mockGetTimeline,
+          getTimelineByTemplateTimelineId: mockGetTemplateTimeline,
+        }));
+
+        const CompareTimelinesStatus = jest.requireActual('./compare_timelines_status')
+          .CompareTimelinesStatus;
+
+        timelineObj = new CompareTimelinesStatus({
+          timelineInput: {
+            id: mockUniqueParsedObjects[0].savedObjectId,
+            version: mockUniqueParsedObjects[0].version,
+          },
+          timelineType: TimelineType.template,
+          title: mockUniqueParsedObjects[0].title,
+          templateTimelineInput: {
+            id: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId,
+            version: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineVersion,
+          },
+          frameworkRequest: {} as FrameworkRequest,
+        });
+        await timelineObj.init();
+      });
+
+      test('should get timeline', () => {
+        expect(mockGetTimeline).toHaveBeenCalled();
+      });
+
+      test('should get templateTimeline', () => {
+        expect(mockGetTemplateTimeline).toHaveBeenCalled();
+      });
+
+      test('should be creatable', () => {
+        expect(timelineObj.isCreatable).toEqual(true);
+      });
+
+      test('should throw no error on creatable', () => {
+        expect(timelineObj.checkIsFailureCases(TimelineStatusActions.create)).toBeNull();
+      });
+
+      test('should be CreatableViaImport', () => {
+        expect(timelineObj.isCreatableViaImport).toEqual(true);
+      });
+
+      test('should throw no error on CreatableViaImport', () => {
+        expect(timelineObj.checkIsFailureCases(TimelineStatusActions.createViaImport)).toBeNull();
+      });
+
+      test('should not be Updatable', () => {
+        expect(timelineObj.isUpdatable).toEqual(false);
+      });
+
+      test('should throw error when updat', () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.update);
+        expect(error?.body).toEqual(UPDATE_TEMPLATE_TIMELINE_ERROR_MESSAGE);
+      });
+
+      test('should not be UpdatableViaImport', () => {
+        expect(timelineObj.isUpdatableViaImport).toEqual(false);
+      });
+
+      test('should throw error when UpdatableViaImport', () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.updateViaImport);
+        expect(error?.body).toEqual(UPDATE_TEMPLATE_TIMELINE_ERROR_MESSAGE);
+      });
+
+      test('should indicate we are handling a template timeline', () => {
+        expect(timelineObj.isHandlingTemplateTimeline).toEqual(true);
+      });
+    });
+  });
+
+  describe(`Throw error if given title does NOT exists`, () => {
+    describe('timeline', () => {
+      const mockGetTimeline: jest.Mock = jest.fn();
+      const mockGetTemplateTimeline: jest.Mock = jest.fn();
+      let timelineObj: TimelinesStatusType;
+
+      afterEach(() => {
+        jest.clearAllMocks();
+      });
+
+      afterAll(() => {
+        jest.resetModules();
+      });
+
+      beforeAll(() => {
+        jest.resetModules();
+      });
+
+      beforeEach(async () => {
+        jest.doMock('../../saved_object', () => {
+          return {
+            getTimeline: mockGetTimeline.mockReturnValue(null),
+            getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue({
+              timeline: [],
+            }),
+          };
+        });
+
+        const CompareTimelinesStatus = jest.requireActual('./compare_timelines_status')
+          .CompareTimelinesStatus;
+
+        timelineObj = new CompareTimelinesStatus({
+          timelineInput: {
+            id: mockUniqueParsedObjects[0].savedObjectId,
+            type: TimelineType.default,
+            version: mockUniqueParsedObjects[0].version,
+          },
+          timelineType: TimelineType.default,
+          title: null,
+          templateTimelineInput: {
+            id: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId,
+            type: TimelineType.template,
+            version: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineVersion,
+          },
+          frameworkRequest: {} as FrameworkRequest,
+        });
+
+        await timelineObj.init();
+      });
+
+      test(`should not be creatable`, () => {
+        expect(timelineObj.isCreatable).toEqual(false);
+      });
+
+      test(`throw error on create`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.create);
+        expect(error?.body).toEqual(EMPTY_TITLE_ERROR_MESSAGE);
+      });
+
+      test(`should not be creatable via import`, () => {
+        expect(timelineObj.isCreatableViaImport).toEqual(false);
+      });
+
+      test(`throw error when create via import`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.createViaImport);
+        expect(error?.body).toEqual(EMPTY_TITLE_ERROR_MESSAGE);
+      });
+
+      test(`should not be updatable`, () => {
+        expect(timelineObj.isUpdatable).toEqual(false);
+      });
+
+      test(`throw error when update`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.update);
+        expect(error?.body).toEqual(EMPTY_TITLE_ERROR_MESSAGE);
+      });
+
+      test(`should not be updatable via import`, () => {
+        expect(timelineObj.isUpdatableViaImport).toEqual(false);
+      });
+    });
+
+    describe('template timeline', () => {
+      const mockGetTimeline: jest.Mock = jest.fn();
+      const mockGetTemplateTimeline: jest.Mock = jest.fn();
+      let timelineObj: TimelinesStatusType;
+
+      afterEach(() => {
+        jest.clearAllMocks();
+      });
+
+      afterAll(() => {
+        jest.resetModules();
+      });
+
+      beforeAll(() => {
+        jest.resetModules();
+      });
+
+      beforeEach(async () => {
+        jest.doMock('../../saved_object', () => {
+          return {
+            getTimeline: mockGetTimeline.mockReturnValue(null),
+            getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue({
+              timeline: [],
+            }),
+          };
+        });
+
+        const CompareTimelinesStatus = jest.requireActual('./compare_timelines_status')
+          .CompareTimelinesStatus;
+
+        timelineObj = new CompareTimelinesStatus({
+          timelineInput: {
+            id: mockUniqueParsedObjects[0].savedObjectId,
+            type: TimelineType.default,
+            version: mockUniqueParsedObjects[0].version,
+          },
+          timelineType: TimelineType.default,
+          title: null,
+          templateTimelineInput: {
+            id: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId,
+            type: TimelineType.template,
+            version: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineVersion,
+          },
+          frameworkRequest: {} as FrameworkRequest,
+        });
+
+        await timelineObj.init();
+      });
+
+      test(`should not be creatable`, () => {
+        expect(timelineObj.isCreatable).toEqual(false);
+      });
+
+      test(`throw error on create`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.create);
+        expect(error?.body).toEqual(EMPTY_TITLE_ERROR_MESSAGE);
+      });
+
+      test(`should not be creatable via import`, () => {
+        expect(timelineObj.isCreatableViaImport).toEqual(false);
+      });
+
+      test(`throw error when create via import`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.createViaImport);
+        expect(error?.body).toEqual(EMPTY_TITLE_ERROR_MESSAGE);
+      });
+
+      test(`should not be updatable`, () => {
+        expect(timelineObj.isUpdatable).toEqual(false);
+      });
+
+      test(`throw error when update`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.update);
+        expect(error?.body).toEqual(EMPTY_TITLE_ERROR_MESSAGE);
+      });
+
+      test(`should not be updatable via import`, () => {
+        expect(timelineObj.isUpdatableViaImport).toEqual(false);
+      });
+
+      test(`throw error when update via import`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.updateViaImport);
+        expect(error?.body).toEqual(EMPTY_TITLE_ERROR_MESSAGE);
+      });
+    });
+  });
+
+  describe(`Throw error if timeline status is updated`, () => {
+    describe('immutable timeline', () => {
+      const mockGetTimeline: jest.Mock = jest.fn();
+      const mockGetTemplateTimeline: jest.Mock = jest.fn();
+      let timelineObj: TimelinesStatusType;
+
+      afterEach(() => {
+        jest.clearAllMocks();
+      });
+
+      afterAll(() => {
+        jest.resetModules();
+      });
+
+      beforeAll(() => {
+        jest.resetModules();
+      });
+
+      beforeEach(async () => {
+        jest.doMock('../../saved_object', () => {
+          return {
+            getTimeline: mockGetTimeline.mockReturnValue({
+              ...mockGetTimelineValue,
+              status: TimelineStatus.immutable,
+            }),
+            getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue({
+              timeline: [],
+            }),
+          };
+        });
+
+        const CompareTimelinesStatus = jest.requireActual('./compare_timelines_status')
+          .CompareTimelinesStatus;
+
+        timelineObj = new CompareTimelinesStatus({
+          timelineInput: {
+            id: mockUniqueParsedObjects[0].savedObjectId,
+            type: TimelineType.default,
+            version: mockUniqueParsedObjects[0].version,
+          },
+          timelineType: TimelineType.default,
+          title: 'mock title',
+          status: TimelineStatus.immutable,
+          templateTimelineInput: {
+            id: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId,
+            type: TimelineType.template,
+            version: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineVersion,
+          },
+          frameworkRequest: {} as FrameworkRequest,
+        });
+
+        await timelineObj.init();
+      });
+
+      test(`should not be updatable if existing status is immutable`, () => {
+        expect(timelineObj.isUpdatable).toBe(false);
+      });
+
+      test(`should throw error when update`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.update);
+        expect(error?.body).toEqual(UPDATE_STATUS_ERROR_MESSAGE);
+      });
+
+      test(`should not be updatable via import if existing status is immutable`, () => {
+        expect(timelineObj.isUpdatableViaImport).toBe(false);
+      });
+
+      test(`should throw error when update via import`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.updateViaImport);
+        expect(error?.body).toEqual(
+          getImportExistingTimelineError(mockUniqueParsedObjects[0].savedObjectId)
+        );
+      });
+    });
+
+    describe('immutable template timeline', () => {
+      const mockGetTimeline: jest.Mock = jest.fn();
+      const mockGetTemplateTimeline: jest.Mock = jest.fn();
+      let timelineObj: TimelinesStatusType;
+
+      afterEach(() => {
+        jest.clearAllMocks();
+      });
+
+      afterAll(() => {
+        jest.resetModules();
+      });
+
+      beforeAll(() => {
+        jest.resetModules();
+      });
+
+      beforeEach(async () => {
+        jest.doMock('../../saved_object', () => {
+          return {
+            getTimeline: mockGetTimeline.mockReturnValue({
+              ...mockGetTemplateTimelineValue,
+              status: TimelineStatus.immutable,
+            }),
+            getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue({
+              timeline: [{ ...mockGetTemplateTimelineValue, status: TimelineStatus.immutable }],
+            }),
+          };
+        });
+
+        const CompareTimelinesStatus = jest.requireActual('./compare_timelines_status')
+          .CompareTimelinesStatus;
+
+        timelineObj = new CompareTimelinesStatus({
+          timelineInput: {
+            id: mockUniqueParsedObjects[0].savedObjectId,
+            type: TimelineType.default,
+            version: mockUniqueParsedObjects[0].version,
+          },
+          status: TimelineStatus.immutable,
+          timelineType: TimelineType.template,
+          title: 'mock title',
+          templateTimelineInput: {
+            id: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId,
+            type: TimelineType.template,
+            version: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineVersion,
+          },
+          frameworkRequest: {} as FrameworkRequest,
+        });
+
+        await timelineObj.init();
+      });
+
+      test(`should not be able to update`, () => {
+        expect(timelineObj.isUpdatable).toEqual(false);
+      });
+
+      test(`should not throw error when update`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.update);
+        expect(error?.body).toEqual(UPDATE_STATUS_ERROR_MESSAGE);
+      });
+
+      test(`should not be able to update via import`, () => {
+        expect(timelineObj.isUpdatableViaImport).toEqual(true);
+      });
+
+      test(`should not throw error when update via import`, () => {
+        const error = timelineObj.checkIsFailureCases(TimelineStatusActions.updateViaImport);
+        expect(error?.body).toBeUndefined();
+      });
+    });
+  });
+
+  describe('If create template timeline without template timeline id', () => {
+    const mockGetTimeline: jest.Mock = jest.fn();
+    const mockGetTemplateTimeline: jest.Mock = jest.fn();
+
+    let timelineObj: TimelinesStatusType;
+
+    afterEach(() => {
+      jest.clearAllMocks();
+    });
+
+    afterAll(() => {
+      jest.resetModules();
+    });
+
+    beforeAll(() => {
+      jest.resetModules();
+    });
+
+    beforeEach(async () => {
+      jest.doMock('../../saved_object', () => ({
+        getTimeline: mockGetTimeline,
+        getTimelineByTemplateTimelineId: mockGetTemplateTimeline,
+      }));
+
+      const CompareTimelinesStatus = jest.requireActual('./compare_timelines_status')
+        .CompareTimelinesStatus;
+
+      timelineObj = new CompareTimelinesStatus({
+        timelineInput: {
+          id: mockUniqueParsedObjects[0].savedObjectId,
+          version: mockUniqueParsedObjects[0].version,
+        },
+        timelineType: TimelineType.template,
+        title: mockUniqueParsedObjects[0].title,
+        templateTimelineInput: {
+          id: null,
+          version: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineVersion,
+        },
+        frameworkRequest: {} as FrameworkRequest,
+      });
+      await timelineObj.init();
+    });
+
+    test('should not be creatable', () => {
+      expect(timelineObj.isCreatable).toEqual(true);
+    });
+
+    test(`throw no error when create`, () => {
+      const error = timelineObj.checkIsFailureCases(TimelineStatusActions.create);
+      expect(error?.body).toBeUndefined();
+    });
+
+    test('should be Creatable via import', () => {
+      expect(timelineObj.isCreatableViaImport).toEqual(true);
+    });
+
+    test(`throw no error when CreatableViaImport`, () => {
+      const error = timelineObj.checkIsFailureCases(TimelineStatusActions.createViaImport);
+      expect(error?.body).toBeUndefined();
+    });
+  });
+
+  describe('Throw error if template timeline version is conflict when update via import', () => {
+    const mockGetTimeline: jest.Mock = jest.fn();
+    const mockGetTemplateTimeline: jest.Mock = jest.fn();
+
+    let timelineObj: TimelinesStatusType;
+
+    afterEach(() => {
+      jest.clearAllMocks();
+    });
+
+    afterAll(() => {
+      jest.resetModules();
+    });
+
+    beforeAll(() => {
+      jest.resetModules();
+    });
+
+    beforeEach(async () => {
+      jest.doMock('../../saved_object', () => ({
+        getTimeline: mockGetTimeline.mockReturnValue(mockGetTemplateTimelineValue),
+        getTimelineByTemplateTimelineId: mockGetTemplateTimeline.mockReturnValue({
+          timeline: [mockGetTemplateTimelineValue],
+        }),
+      }));
+
+      const CompareTimelinesStatus = jest.requireActual('./compare_timelines_status')
+        .CompareTimelinesStatus;
+
+      timelineObj = new CompareTimelinesStatus({
+        timelineInput: {
+          id: mockUniqueParsedObjects[0].savedObjectId,
+          version: mockUniqueParsedObjects[0].version,
+        },
+        timelineType: TimelineType.template,
+        title: mockUniqueParsedObjects[0].title,
+        templateTimelineInput: {
+          id: mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId,
+          version: mockGetTemplateTimelineValue.templateTimelineVersion,
+        },
+        frameworkRequest: {} as FrameworkRequest,
+      });
+      await timelineObj.init();
+    });
+
+    test('should not be creatable', () => {
+      expect(timelineObj.isCreatable).toEqual(false);
+    });
+
+    test(`throw error when create`, () => {
+      const error = timelineObj.checkIsFailureCases(TimelineStatusActions.create);
+      expect(error?.body).toEqual(CREATE_TEMPLATE_TIMELINE_ERROR_MESSAGE);
+    });
+
+    test('should not be Creatable via import', () => {
+      expect(timelineObj.isCreatableViaImport).toEqual(false);
+    });
+
+    test(`throw error when CreatableViaImport`, () => {
+      const error = timelineObj.checkIsFailureCases(TimelineStatusActions.createViaImport);
+      expect(error?.body).toEqual(
+        getImportExistingTimelineError(mockUniqueParsedObjects[0].savedObjectId)
+      );
+    });
+
+    test('should be updatable', () => {
+      expect(timelineObj.isUpdatable).toEqual(true);
+    });
+
+    test(`throw no error when update`, () => {
+      const error = timelineObj.checkIsFailureCases(TimelineStatusActions.update);
+      expect(error).toBeNull();
+    });
+
+    test('should not be updatable via import', () => {
+      expect(timelineObj.isUpdatableViaImport).toEqual(false);
+    });
+
+    test(`throw error when UpdatableViaImport`, () => {
+      const error = timelineObj.checkIsFailureCases(TimelineStatusActions.updateViaImport);
+      expect(error?.body).toEqual(TEMPLATE_TIMELINE_VERSION_CONFLICT_MESSAGE);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/compare_timelines_status.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/compare_timelines_status.ts
new file mode 100644
index 000000000000..d61d217a4cf4
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/compare_timelines_status.ts
@@ -0,0 +1,247 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { isEmpty } from 'lodash/fp';
+import {
+  TimelineTypeLiteralWithNull,
+  TimelineType,
+  TimelineStatus,
+  TimelineTypeLiteral,
+} from '../../../../../common/types/timeline';
+import { FrameworkRequest } from '../../../framework';
+
+import { TimelineStatusActions, TimelineStatusAction } from './common';
+import { TimelineObject } from './timeline_object';
+import {
+  checkIsCreateFailureCases,
+  checkIsUpdateFailureCases,
+  checkIsCreateViaImportFailureCases,
+  checkIsUpdateViaImportFailureCases,
+  commonFailureChecker,
+} from './failure_cases';
+
+interface GivenTimelineInput {
+  id: string | null | undefined;
+  type?: TimelineTypeLiteralWithNull;
+  version: string | number | null | undefined;
+}
+
+interface TimelinesStatusProps {
+  status: TimelineStatus | null | undefined;
+  title: string | null | undefined;
+  timelineType: TimelineTypeLiteralWithNull | undefined;
+  timelineInput: GivenTimelineInput;
+  templateTimelineInput: GivenTimelineInput;
+  frameworkRequest: FrameworkRequest;
+}
+
+export class CompareTimelinesStatus {
+  public readonly timelineObject: TimelineObject;
+  public readonly templateTimelineObject: TimelineObject;
+  private readonly timelineType: TimelineTypeLiteral;
+  private readonly title: string | null;
+  private readonly status: TimelineStatus;
+  constructor({
+    status = TimelineStatus.active,
+    title,
+    timelineType = TimelineType.default,
+    timelineInput,
+    templateTimelineInput,
+    frameworkRequest,
+  }: TimelinesStatusProps) {
+    this.timelineObject = new TimelineObject({
+      id: timelineInput.id,
+      type: timelineInput.type ?? TimelineType.default,
+      version: timelineInput.version,
+      frameworkRequest,
+    });
+
+    this.templateTimelineObject = new TimelineObject({
+      id: templateTimelineInput.id,
+      type: templateTimelineInput.type ?? TimelineType.template,
+      version: templateTimelineInput.version,
+      frameworkRequest,
+    });
+
+    this.timelineType = timelineType ?? TimelineType.default;
+    this.title = title ?? null;
+    this.status = status ?? TimelineStatus.active;
+  }
+
+  public get isCreatable() {
+    return (
+      this.isTitleValid &&
+      !this.isSavedObjectVersionConflict &&
+      ((this.timelineObject.isCreatable && !this.isHandlingTemplateTimeline) ||
+        (this.templateTimelineObject.isCreatable &&
+          this.timelineObject.isCreatable &&
+          this.isHandlingTemplateTimeline))
+    );
+  }
+
+  public get isCreatableViaImport() {
+    return (
+      this.isCreatedStatusValid &&
+      ((this.isCreatable && !this.isHandlingTemplateTimeline) ||
+        (this.isCreatable && this.isHandlingTemplateTimeline && this.isTemplateVersionValid))
+    );
+  }
+
+  private get isCreatedStatusValid() {
+    const obj = this.isHandlingTemplateTimeline ? this.templateTimelineObject : this.timelineObject;
+
+    return obj.isExists
+      ? this.status === obj.getData?.status && this.status !== TimelineStatus.draft
+      : this.status !== TimelineStatus.draft;
+  }
+
+  public get isUpdatable() {
+    return (
+      this.isTitleValid &&
+      !this.isSavedObjectVersionConflict &&
+      ((this.timelineObject.isUpdatable && !this.isHandlingTemplateTimeline) ||
+        (this.templateTimelineObject.isUpdatable && this.isHandlingTemplateTimeline))
+    );
+  }
+
+  private get isTimelineTypeValid() {
+    const obj = this.isHandlingTemplateTimeline ? this.templateTimelineObject : this.timelineObject;
+    const existintTimelineType = obj.getData?.timelineType ?? TimelineType.default;
+    return obj.isExists ? this.timelineType === existintTimelineType : true;
+  }
+
+  public get isUpdatableViaImport() {
+    return (
+      this.isTimelineTypeValid &&
+      this.isTitleValid &&
+      this.isUpdatedTimelineStatusValid &&
+      (this.timelineObject.isUpdatableViaImport ||
+        (this.templateTimelineObject.isUpdatableViaImport &&
+          this.isTemplateVersionValid &&
+          this.isHandlingTemplateTimeline))
+    );
+  }
+
+  public get isTitleValid() {
+    return (
+      (this.status !== TimelineStatus.draft && !isEmpty(this.title)) ||
+      this.status === TimelineStatus.draft
+    );
+  }
+
+  public getFailureChecker(action?: TimelineStatusAction) {
+    if (action === TimelineStatusActions.create) {
+      return checkIsCreateFailureCases;
+    } else if (action === TimelineStatusActions.createViaImport) {
+      return checkIsCreateViaImportFailureCases;
+    } else if (action === TimelineStatusActions.update) {
+      return checkIsUpdateFailureCases;
+    } else {
+      return checkIsUpdateViaImportFailureCases;
+    }
+  }
+
+  public checkIsFailureCases(action?: TimelineStatusAction) {
+    const failureChecker = this.getFailureChecker(action);
+    const version = this.templateTimelineObject.getVersion;
+    const commonError = commonFailureChecker(this.status, this.title);
+    if (commonError != null) {
+      return commonError;
+    }
+
+    const msg = failureChecker(
+      this.isHandlingTemplateTimeline,
+      this.status,
+      this.timelineType,
+      this.timelineObject.getVersion?.toString() ?? null,
+      version != null && typeof version === 'string' ? parseInt(version, 10) : version,
+      this.templateTimelineObject.getId,
+      this.timelineObject.getData,
+      this.templateTimelineObject.getData
+    );
+    return msg;
+  }
+
+  public get templateTimelineInput() {
+    return this.templateTimelineObject;
+  }
+
+  public get timelineInput() {
+    return this.timelineObject;
+  }
+
+  private getTimelines() {
+    return Promise.all([
+      this.timelineObject.getTimeline(),
+      this.templateTimelineObject.getTimeline(),
+    ]);
+  }
+
+  public get isHandlingTemplateTimeline() {
+    return this.timelineType === TimelineType.template;
+  }
+
+  private get isSavedObjectVersionConflict() {
+    const version = this.timelineObject?.getVersion;
+    const existingVersion = this.timelineObject?.data?.version;
+    if (version != null && this.timelineObject.isExists) {
+      return version !== existingVersion;
+    } else if (this.timelineObject.isExists && version == null) {
+      return true;
+    }
+    return false;
+  }
+
+  private get isTemplateVersionConflict() {
+    const version = this.templateTimelineObject?.getVersion;
+    const existingTemplateTimelineVersion = this.templateTimelineObject?.data
+      ?.templateTimelineVersion;
+    if (
+      version != null &&
+      this.templateTimelineObject.isExists &&
+      existingTemplateTimelineVersion != null
+    ) {
+      return version <= existingTemplateTimelineVersion;
+    } else if (this.templateTimelineObject.isExists && version == null) {
+      return true;
+    }
+    return false;
+  }
+
+  private get isTemplateVersionValid() {
+    const version = this.templateTimelineObject?.getVersion;
+    return typeof version === 'number' && !this.isTemplateVersionConflict;
+  }
+
+  private get isUpdatedTimelineStatusValid() {
+    const status = this.status;
+    const existingStatus = this.isHandlingTemplateTimeline
+      ? this.templateTimelineInput.data?.status
+      : this.timelineInput.data?.status;
+    return (
+      ((existingStatus == null || existingStatus === TimelineStatus.active) &&
+        (status == null || status === TimelineStatus.active)) ||
+      (existingStatus != null && status === existingStatus)
+    );
+  }
+
+  public get timelineId() {
+    if (this.isHandlingTemplateTimeline) {
+      return this.templateTimelineInput.data?.savedObjectId ?? this.templateTimelineInput.getId;
+    }
+    return this.timelineInput.data?.savedObjectId ?? this.timelineInput.getId;
+  }
+
+  public get timelineVersion() {
+    const version = this.isHandlingTemplateTimeline
+      ? this.templateTimelineInput.data?.version ?? this.timelineInput.getVersion
+      : this.timelineInput.data?.version ?? this.timelineInput.getVersion;
+    return version != null ? version.toString() : null;
+  }
+
+  public async init() {
+    await this.getTimelines();
+  }
+}
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/create_timelines.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/create_timelines.ts
index 5b2470821b69..abe298566341 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/create_timelines.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/create_timelines.ts
@@ -12,6 +12,7 @@ import { FrameworkRequest } from '../../../framework';
 import { SavedTimeline, TimelineSavedObject } from '../../../../../common/types/timeline';
 import { SavedNote } from '../../../../../common/types/timeline/note';
 import { NoteResult, ResponseTimeline } from '../../../../graphql/types';
+
 export const CREATE_TIMELINE_ERROR_MESSAGE =
   'UPDATE timeline with POST is not allowed, please use PATCH instead';
 export const CREATE_TEMPLATE_TIMELINE_ERROR_MESSAGE =
@@ -20,16 +21,10 @@ export const CREATE_TEMPLATE_TIMELINE_ERROR_MESSAGE =
 export const saveTimelines = (
   frameworkRequest: FrameworkRequest,
   timeline: SavedTimeline,
-  timelineSavedObjectId?: string | null,
-  timelineVersion?: string | null
-): Promise<ResponseTimeline> => {
-  return timelineLib.persistTimeline(
-    frameworkRequest,
-    timelineSavedObjectId ?? null,
-    timelineVersion ?? null,
-    timeline
-  );
-};
+  timelineSavedObjectId: string | null = null,
+  timelineVersion: string | null = null
+): Promise<ResponseTimeline> =>
+  timelineLib.persistTimeline(frameworkRequest, timelineSavedObjectId, timelineVersion, timeline);
 
 export const savePinnedEvents = (
   frameworkRequest: FrameworkRequest,
@@ -72,15 +67,25 @@ export const saveNotes = (
   );
 };
 
-export const createTimelines = async (
-  frameworkRequest: FrameworkRequest,
-  timeline: SavedTimeline,
-  timelineSavedObjectId?: string | null,
-  timelineVersion?: string | null,
-  pinnedEventIds?: string[] | null,
-  notes?: NoteResult[],
-  existingNoteIds?: string[]
-): Promise<ResponseTimeline> => {
+interface CreateTimelineProps {
+  frameworkRequest: FrameworkRequest;
+  timeline: SavedTimeline;
+  timelineSavedObjectId?: string | null;
+  timelineVersion?: string | null;
+  pinnedEventIds?: string[] | null;
+  notes?: NoteResult[];
+  existingNoteIds?: string[];
+}
+
+export const createTimelines = async ({
+  frameworkRequest,
+  timeline,
+  timelineSavedObjectId = null,
+  timelineVersion = null,
+  pinnedEventIds = null,
+  notes = [],
+  existingNoteIds = [],
+}: CreateTimelineProps): Promise<ResponseTimeline> => {
   const responseTimeline = await saveTimelines(
     frameworkRequest,
     timeline,
@@ -89,7 +94,6 @@ export const createTimelines = async (
   );
   const newTimelineSavedObjectId = responseTimeline.timeline.savedObjectId;
   const newTimelineVersion = responseTimeline.timeline.version;
-
   let myPromises: unknown[] = [];
   if (pinnedEventIds != null && !isEmpty(pinnedEventIds)) {
     myPromises = [
@@ -143,8 +147,9 @@ export const getTemplateTimeline = async (
       frameworkRequest,
       templateTimelineId
     );
+    // eslint-disable-next-line no-empty
   } catch (e) {
     return null;
   }
-  return templateTimeline.timeline[0];
+  return templateTimeline?.timeline[0] ?? null;
 };
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/export_timelines.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/export_timelines.ts
index 1f02851c56b8..23090bfc6f0b 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/export_timelines.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/export_timelines.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { omit } from 'lodash/fp';
+
 import {
   SavedObjectsClient,
   SavedObjectsFindOptions,
@@ -16,7 +18,6 @@ import {
   ExportedNotes,
   TimelineSavedObject,
   ExportTimelineNotFoundError,
-  TimelineStatus,
 } from '../../../../../common/types/timeline';
 import { NoteSavedObject } from '../../../../../common/types/timeline/note';
 import { PinnedEventSavedObject } from '../../../../../common/types/timeline/pinned_event';
@@ -180,12 +181,11 @@ const getTimelinesFromObjects = async (
     if (myTimeline != null) {
       const timelineNotes = myNotes.filter((n) => n.timelineId === timelineId);
       const timelinePinnedEventIds = myPinnedEventIds.filter((p) => p.timelineId === timelineId);
+      const exportedTimeline = omit('status', myTimeline);
       return [
         ...acc,
         {
-          ...myTimeline,
-          status:
-            myTimeline.status === TimelineStatus.draft ? TimelineStatus.active : myTimeline.status,
+          ...exportedTimeline,
           ...getGlobalEventNotesByTimelineId(timelineNotes),
           pinnedEventIds: getPinnedEventsIdsByTimelineId(timelinePinnedEventIds),
         },
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/failure_cases.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/failure_cases.ts
new file mode 100644
index 000000000000..60ba5389280c
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/failure_cases.ts
@@ -0,0 +1,377 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { isEmpty } from 'lodash/fp';
+import {
+  TimelineSavedObject,
+  TimelineStatus,
+  TimelineTypeLiteral,
+} from '../../../../../common/types/timeline';
+
+export const UPDATE_TIMELINE_ERROR_MESSAGE =
+  'CREATE timeline with PATCH is not allowed, please use POST instead';
+export const UPDATE_TEMPLATE_TIMELINE_ERROR_MESSAGE =
+  "CREATE template timeline with PATCH is not allowed, please use POST instead (Given template timeline doesn't exist)";
+export const NO_MATCH_VERSION_ERROR_MESSAGE =
+  'TimelineVersion conflict: The given version doesn not match with existing timeline';
+export const NO_MATCH_ID_ERROR_MESSAGE =
+  "Timeline id doesn't match with existing template timeline";
+export const TEMPLATE_TIMELINE_VERSION_CONFLICT_MESSAGE = 'Template timelineVersion conflict';
+export const CREATE_TIMELINE_ERROR_MESSAGE =
+  'UPDATE timeline with POST is not allowed, please use PATCH instead';
+export const CREATE_TEMPLATE_TIMELINE_ERROR_MESSAGE =
+  'UPDATE template timeline with POST is not allowed, please use PATCH instead';
+export const EMPTY_TITLE_ERROR_MESSAGE = 'Title cannot be empty';
+export const UPDATE_STATUS_ERROR_MESSAGE = 'Update an immutable timeline is is not allowed';
+export const CREATE_TEMPLATE_TIMELINE_WITHOUT_VERSION_ERROR_MESSAGE =
+  'Create template timeline without a valid templateTimelineVersion is not allowed. Please start from 1 to create a new template timeline';
+export const CREATE_WITH_INVALID_STATUS_ERROR_MESSAGE = 'Cannot create a draft timeline';
+export const NOT_ALLOW_UPDATE_STATUS_ERROR_MESSAGE = 'Update status is not allowed';
+export const NOT_ALLOW_UPDATE_TIMELINE_TYPE_ERROR_MESSAGE = 'Update timelineType is not allowed';
+export const UPDAT_TIMELINE_VIA_IMPORT_NOT_ALLOWED_ERROR_MESSAGE =
+  'Update timeline via import is not allowed';
+
+const isUpdatingStatus = (
+  isHandlingTemplateTimeline: boolean,
+  status: TimelineStatus | null | undefined,
+  existTimeline: TimelineSavedObject | null,
+  existTemplateTimeline: TimelineSavedObject | null
+) => {
+  const obj = isHandlingTemplateTimeline ? existTemplateTimeline : existTimeline;
+  return obj?.status === TimelineStatus.immutable ? UPDATE_STATUS_ERROR_MESSAGE : null;
+};
+
+const isGivenTitleValid = (status: TimelineStatus, title: string | null | undefined) => {
+  return (status !== TimelineStatus.draft && !isEmpty(title)) || status === TimelineStatus.draft
+    ? null
+    : EMPTY_TITLE_ERROR_MESSAGE;
+};
+
+export const getImportExistingTimelineError = (id: string) =>
+  `savedObjectId: "${id}" already exists`;
+
+export const commonFailureChecker = (status: TimelineStatus, title: string | null | undefined) => {
+  const error = [isGivenTitleValid(status, title)].filter((msg) => msg != null).join(',');
+  return !isEmpty(error)
+    ? {
+        body: error,
+        statusCode: 405,
+      }
+    : null;
+};
+
+const commonUpdateTemplateTimelineCheck = (
+  isHandlingTemplateTimeline: boolean,
+  status: TimelineStatus | null | undefined,
+  timelineType: TimelineTypeLiteral,
+  version: string | null,
+  templateTimelineVersion: number | null,
+  templateTimelineId: string | null | undefined,
+  existTimeline: TimelineSavedObject | null,
+  existTemplateTimeline: TimelineSavedObject | null
+) => {
+  if (isHandlingTemplateTimeline) {
+    if (existTimeline != null && timelineType !== existTimeline.timelineType) {
+      return {
+        body: NOT_ALLOW_UPDATE_TIMELINE_TYPE_ERROR_MESSAGE,
+        statusCode: 403,
+      };
+    }
+
+    if (existTemplateTimeline == null && templateTimelineVersion != null) {
+      // template timeline !exists
+      // Throw error to create template timeline in patch
+      return {
+        body: UPDATE_TEMPLATE_TIMELINE_ERROR_MESSAGE,
+        statusCode: 405,
+      };
+    }
+
+    if (
+      existTimeline != null &&
+      existTemplateTimeline != null &&
+      existTimeline.savedObjectId !== existTemplateTimeline.savedObjectId
+    ) {
+      // Throw error you can not have a no matching between your timeline and your template timeline during an update
+      return {
+        body: NO_MATCH_ID_ERROR_MESSAGE,
+        statusCode: 409,
+      };
+    }
+
+    if (
+      existTemplateTimeline != null &&
+      existTemplateTimeline.templateTimelineVersion == null &&
+      existTemplateTimeline.version !== version
+    ) {
+      // throw error 409 conflict timeline
+      return {
+        body: NO_MATCH_VERSION_ERROR_MESSAGE,
+        statusCode: 409,
+      };
+    }
+  }
+  return null;
+};
+
+const commonUpdateTimelineCheck = (
+  isHandlingTemplateTimeline: boolean,
+  status: TimelineStatus | null | undefined,
+  timelineType: TimelineTypeLiteral,
+  version: string | null,
+  templateTimelineVersion: number | null,
+  templateTimelineId: string | null | undefined,
+  existTimeline: TimelineSavedObject | null,
+  existTemplateTimeline: TimelineSavedObject | null
+) => {
+  if (existTimeline == null) {
+    // timeline !exists
+    return {
+      body: UPDATE_TIMELINE_ERROR_MESSAGE,
+      statusCode: 405,
+    };
+  }
+
+  if (existTimeline?.version !== version) {
+    // throw error 409 conflict timeline
+    return {
+      body: NO_MATCH_VERSION_ERROR_MESSAGE,
+      statusCode: 409,
+    };
+  }
+
+  return null;
+};
+
+const commonUpdateCases = (
+  isHandlingTemplateTimeline: boolean,
+  status: TimelineStatus | null | undefined,
+  timelineType: TimelineTypeLiteral,
+  version: string | null,
+  templateTimelineVersion: number | null,
+  templateTimelineId: string | null | undefined,
+  existTimeline: TimelineSavedObject | null,
+  existTemplateTimeline: TimelineSavedObject | null
+) => {
+  if (isHandlingTemplateTimeline) {
+    return commonUpdateTemplateTimelineCheck(
+      isHandlingTemplateTimeline,
+      status,
+      timelineType,
+      version,
+      templateTimelineVersion,
+      templateTimelineId,
+      existTimeline,
+      existTemplateTimeline
+    );
+  } else {
+    return commonUpdateTimelineCheck(
+      isHandlingTemplateTimeline,
+      status,
+      timelineType,
+      version,
+      templateTimelineVersion,
+      templateTimelineId,
+      existTimeline,
+      existTemplateTimeline
+    );
+  }
+};
+
+const createTemplateTimelineCheck = (
+  isHandlingTemplateTimeline: boolean,
+  status: TimelineStatus,
+  timelineType: TimelineTypeLiteral,
+  version: string | null,
+  templateTimelineVersion: number | null,
+  templateTimelineId: string | null | undefined,
+  existTimeline: TimelineSavedObject | null,
+  existTemplateTimeline: TimelineSavedObject | null
+) => {
+  if (isHandlingTemplateTimeline && existTemplateTimeline != null) {
+    // Throw error to create template timeline in patch
+    return {
+      body: CREATE_TEMPLATE_TIMELINE_ERROR_MESSAGE,
+      statusCode: 405,
+    };
+  } else if (isHandlingTemplateTimeline && templateTimelineVersion == null) {
+    return {
+      body: CREATE_TEMPLATE_TIMELINE_WITHOUT_VERSION_ERROR_MESSAGE,
+      statusCode: 403,
+    };
+  } else {
+    return null;
+  }
+};
+
+export const checkIsUpdateViaImportFailureCases = (
+  isHandlingTemplateTimeline: boolean,
+  status: TimelineStatus | null | undefined,
+  timelineType: TimelineTypeLiteral,
+  version: string | null,
+  templateTimelineVersion: number | null,
+  templateTimelineId: string | null | undefined,
+  existTimeline: TimelineSavedObject | null,
+  existTemplateTimeline: TimelineSavedObject | null
+) => {
+  if (!isHandlingTemplateTimeline) {
+    if (existTimeline == null) {
+      return { body: UPDAT_TIMELINE_VIA_IMPORT_NOT_ALLOWED_ERROR_MESSAGE, statusCode: 405 };
+    } else {
+      return {
+        body: getImportExistingTimelineError(existTimeline!.savedObjectId),
+        statusCode: 405,
+      };
+    }
+  } else {
+    if (existTemplateTimeline != null && timelineType !== existTemplateTimeline?.timelineType) {
+      return {
+        body: NOT_ALLOW_UPDATE_TIMELINE_TYPE_ERROR_MESSAGE,
+        statusCode: 403,
+      };
+    }
+    const isStatusValid =
+      ((existTemplateTimeline?.status == null ||
+        existTemplateTimeline?.status === TimelineStatus.active) &&
+        (status == null || status === TimelineStatus.active)) ||
+      (existTemplateTimeline?.status != null && status === existTemplateTimeline?.status);
+
+    if (!isStatusValid) {
+      return {
+        body: NOT_ALLOW_UPDATE_STATUS_ERROR_MESSAGE,
+        statusCode: 405,
+      };
+    }
+
+    const error = commonUpdateTemplateTimelineCheck(
+      isHandlingTemplateTimeline,
+      status,
+      timelineType,
+      version,
+      templateTimelineVersion,
+      templateTimelineId,
+      existTimeline,
+      existTemplateTimeline
+    );
+    if (error) {
+      return error;
+    }
+    if (
+      templateTimelineVersion != null &&
+      existTemplateTimeline != null &&
+      existTemplateTimeline.templateTimelineVersion != null &&
+      existTemplateTimeline.templateTimelineVersion >= templateTimelineVersion
+    ) {
+      // Throw error you can not update a template timeline version with an old version
+      return {
+        body: TEMPLATE_TIMELINE_VERSION_CONFLICT_MESSAGE,
+        statusCode: 409,
+      };
+    }
+  }
+  return null;
+};
+
+export const checkIsUpdateFailureCases = (
+  isHandlingTemplateTimeline: boolean,
+  status: TimelineStatus | null | undefined,
+  timelineType: TimelineTypeLiteral,
+  version: string | null,
+  templateTimelineVersion: number | null,
+  templateTimelineId: string | null | undefined,
+  existTimeline: TimelineSavedObject | null,
+  existTemplateTimeline: TimelineSavedObject | null
+) => {
+  const error = isUpdatingStatus(
+    isHandlingTemplateTimeline,
+    status,
+    existTimeline,
+    existTemplateTimeline
+  );
+  if (error) {
+    return {
+      body: error,
+      statusCode: 403,
+    };
+  }
+  return commonUpdateCases(
+    isHandlingTemplateTimeline,
+    status,
+    timelineType,
+    version,
+    templateTimelineVersion,
+    templateTimelineId,
+    existTimeline,
+    existTemplateTimeline
+  );
+};
+
+export const checkIsCreateFailureCases = (
+  isHandlingTemplateTimeline: boolean,
+  status: TimelineStatus,
+  timelineType: TimelineTypeLiteral,
+  version: string | null,
+  templateTimelineVersion: number | null,
+  templateTimelineId: string | null | undefined,
+  existTimeline: TimelineSavedObject | null,
+  existTemplateTimeline: TimelineSavedObject | null
+) => {
+  if (!isHandlingTemplateTimeline && existTimeline != null) {
+    return {
+      body: CREATE_TIMELINE_ERROR_MESSAGE,
+      statusCode: 405,
+    };
+  } else if (isHandlingTemplateTimeline) {
+    return createTemplateTimelineCheck(
+      isHandlingTemplateTimeline,
+      status,
+      timelineType,
+      version,
+      templateTimelineVersion,
+      templateTimelineId,
+      existTimeline,
+      existTemplateTimeline
+    );
+  } else {
+    return null;
+  }
+};
+
+export const checkIsCreateViaImportFailureCases = (
+  isHandlingTemplateTimeline: boolean,
+  status: TimelineStatus | null | undefined,
+  timelineType: TimelineTypeLiteral,
+  version: string | null,
+  templateTimelineVersion: number | null,
+  templateTimelineId: string | null | undefined,
+  existTimeline: TimelineSavedObject | null,
+  existTemplateTimeline: TimelineSavedObject | null
+) => {
+  if (status === TimelineStatus.draft) {
+    return {
+      body: CREATE_WITH_INVALID_STATUS_ERROR_MESSAGE,
+      statusCode: 405,
+    };
+  }
+
+  if (!isHandlingTemplateTimeline) {
+    if (existTimeline != null) {
+      return {
+        body: getImportExistingTimelineError(existTimeline.savedObjectId),
+        statusCode: 405,
+      };
+    }
+  } else {
+    if (existTemplateTimeline != null) {
+      // Throw error to create template timeline in patch
+      return {
+        body: getImportExistingTimelineError(existTemplateTimeline.savedObjectId),
+        statusCode: 405,
+      };
+    }
+  }
+
+  return null;
+};
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/timeline_object.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/timeline_object.ts
new file mode 100644
index 000000000000..9fb96b509ec3
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/timeline_object.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import {
+  TimelineType,
+  TimelineTypeLiteral,
+  TimelineSavedObject,
+  TimelineStatus,
+} from '../../../../../common/types/timeline';
+import { getTimeline, getTemplateTimeline } from './create_timelines';
+import { FrameworkRequest } from '../../../framework';
+
+interface TimelineObjectProps {
+  id: string | null | undefined;
+  type: TimelineTypeLiteral;
+  version: string | number | null | undefined;
+  frameworkRequest: FrameworkRequest;
+}
+
+export class TimelineObject {
+  public readonly id: string | null;
+  private type: TimelineTypeLiteral;
+  public readonly version: string | number | null;
+  private frameworkRequest: FrameworkRequest;
+
+  public data: TimelineSavedObject | null;
+
+  constructor({
+    id = null,
+    type = TimelineType.default,
+    version = null,
+    frameworkRequest,
+  }: TimelineObjectProps) {
+    this.id = id;
+    this.type = type;
+
+    this.version = version;
+    this.frameworkRequest = frameworkRequest;
+    this.data = null;
+  }
+
+  public async getTimeline() {
+    this.data =
+      this.id != null
+        ? this.type === TimelineType.template
+          ? await getTemplateTimeline(this.frameworkRequest, this.id)
+          : await getTimeline(this.frameworkRequest, this.id)
+        : null;
+
+    return this.data;
+  }
+
+  public get getData() {
+    return this.data;
+  }
+
+  private get isImmutable() {
+    return this.data?.status === TimelineStatus.immutable;
+  }
+
+  public get isExists() {
+    return this.data != null;
+  }
+
+  public get isUpdatable() {
+    return this.isExists && !this.isImmutable;
+  }
+
+  public get isCreatable() {
+    return !this.isExists;
+  }
+
+  public get isUpdatableViaImport() {
+    return this.type === TimelineType.template && this.isExists;
+  }
+
+  public get getVersion() {
+    return this.version;
+  }
+
+  public get getId() {
+    return this.id;
+  }
+}
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/update_timelines.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/update_timelines.ts
deleted file mode 100644
index a4efa676dadd..000000000000
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/update_timelines.ts
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { TimelineSavedObject } from '../../../../../common/types/timeline';
-
-export const UPDATE_TIMELINE_ERROR_MESSAGE =
-  'CREATE timeline with PATCH is not allowed, please use POST instead';
-export const UPDATE_TEMPLATE_TIMELINE_ERROR_MESSAGE =
-  'CREATE template timeline with PATCH is not allowed, please use POST instead';
-export const NO_MATCH_VERSION_ERROR_MESSAGE =
-  'TimelineVersion conflict: The given version doesn not match with existing timeline';
-export const NO_MATCH_ID_ERROR_MESSAGE =
-  "Timeline id doesn't match with existing template timeline";
-export const TEMPLATE_TIMELINE_VERSION_CONFLICT_MESSAGE = 'Template timelineVersion conflict';
-
-export const checkIsFailureCases = (
-  isHandlingTemplateTimeline: boolean,
-  version: string | null,
-  templateTimelineVersion: number | null,
-  existTimeline: TimelineSavedObject | null,
-  existTemplateTimeline: TimelineSavedObject | null
-) => {
-  if (!isHandlingTemplateTimeline && existTimeline == null) {
-    return {
-      body: UPDATE_TIMELINE_ERROR_MESSAGE,
-      statusCode: 405,
-    };
-  } else if (isHandlingTemplateTimeline && existTemplateTimeline == null) {
-    // Throw error to create template timeline in patch
-    return {
-      body: UPDATE_TEMPLATE_TIMELINE_ERROR_MESSAGE,
-      statusCode: 405,
-    };
-  } else if (
-    isHandlingTemplateTimeline &&
-    existTimeline != null &&
-    existTemplateTimeline != null &&
-    existTimeline.savedObjectId !== existTemplateTimeline.savedObjectId
-  ) {
-    // Throw error you can not have a no matching between your timeline and your template timeline during an update
-    return {
-      body: NO_MATCH_ID_ERROR_MESSAGE,
-      statusCode: 409,
-    };
-  } else if (!isHandlingTemplateTimeline && existTimeline?.version !== version) {
-    // throw error 409 conflict timeline
-    return {
-      body: NO_MATCH_VERSION_ERROR_MESSAGE,
-      statusCode: 409,
-    };
-  } else if (
-    isHandlingTemplateTimeline &&
-    existTemplateTimeline != null &&
-    existTemplateTimeline.templateTimelineVersion == null &&
-    existTemplateTimeline.version !== version
-  ) {
-    // throw error 409 conflict timeline
-    return {
-      body: NO_MATCH_VERSION_ERROR_MESSAGE,
-      statusCode: 409,
-    };
-  } else if (
-    isHandlingTemplateTimeline &&
-    templateTimelineVersion != null &&
-    existTemplateTimeline != null &&
-    existTemplateTimeline.templateTimelineVersion != null &&
-    existTemplateTimeline.templateTimelineVersion !== templateTimelineVersion
-  ) {
-    // Throw error you can not update a template timeline version with an old version
-    return {
-      body: TEMPLATE_TIMELINE_VERSION_CONFLICT_MESSAGE,
-      statusCode: 409,
-    };
-  } else {
-    return null;
-  }
-};
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object.ts
index bbb11cd642c4..ec90fc6d8e07 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object.ts
@@ -7,13 +7,20 @@
 import { getOr } from 'lodash/fp';
 
 import { SavedObjectsFindOptions } from '../../../../../../src/core/server';
-import { UNAUTHENTICATED_USER, disableTemplate } from '../../../common/constants';
+import {
+  UNAUTHENTICATED_USER,
+  disableTemplate,
+  enableElasticFilter,
+} from '../../../common/constants';
 import { NoteSavedObject } from '../../../common/types/timeline/note';
 import { PinnedEventSavedObject } from '../../../common/types/timeline/pinned_event';
 import {
   SavedTimeline,
   TimelineSavedObject,
   TimelineTypeLiteralWithNull,
+  TimelineStatusLiteralWithNull,
+  TemplateTimelineTypeLiteralWithNull,
+  TemplateTimelineType,
 } from '../../../common/types/timeline';
 import {
   ResponseTimeline,
@@ -38,6 +45,14 @@ interface ResponseTimelines {
   totalCount: number;
 }
 
+interface AllTimelinesResponse extends ResponseTimelines {
+  defaultTimelineCount: number;
+  templateTimelineCount: number;
+  elasticTemplateTimelineCount: number;
+  customTemplateTimelineCount: number;
+  favoriteCount: number;
+}
+
 export interface ResponseTemplateTimeline {
   code?: Maybe<number>;
 
@@ -55,8 +70,10 @@ export interface Timeline {
     pageInfo: PageInfoTimeline | null,
     search: string | null,
     sort: SortTimeline | null,
-    timelineType: TimelineTypeLiteralWithNull
-  ) => Promise<ResponseTimelines>;
+    status: TimelineStatusLiteralWithNull,
+    timelineType: TimelineTypeLiteralWithNull,
+    templateTimelineType: TemplateTimelineTypeLiteralWithNull
+  ) => Promise<AllTimelinesResponse>;
 
   persistFavorite: (
     request: FrameworkRequest,
@@ -97,7 +114,7 @@ export const getTimelineByTemplateTimelineId = async (
 }> => {
   const options: SavedObjectsFindOptions = {
     type: timelineSavedObjectType,
-    filter: `siem-ui-timeline.attributes.templateTimelineId: ${templateTimelineId}`,
+    filter: `siem-ui-timeline.attributes.templateTimelineId: "${templateTimelineId}"`,
   };
   return getAllSavedTimeline(request, options);
 };
@@ -106,10 +123,13 @@ export const getTimelineByTemplateTimelineId = async (
  * which has no timelineType exists in the savedObject */
 const getTimelineTypeFilter = (
   timelineType: TimelineTypeLiteralWithNull,
-  includeDraft: boolean
+  templateTimelineType: TemplateTimelineTypeLiteralWithNull,
+  status: TimelineStatusLiteralWithNull
 ) => {
   const typeFilter =
-    timelineType === TimelineType.template
+    timelineType == null
+      ? null
+      : timelineType === TimelineType.template
       ? `siem-ui-timeline.attributes.timelineType: ${TimelineType.template}` /** Show only whose timelineType exists and equals to "template" */
       : /** Show me every timeline whose timelineType is not "template".
          * which includes timelineType === 'default' and
@@ -119,10 +139,30 @@ const getTimelineTypeFilter = (
   /** Show me every timeline whose status is not "draft".
    * which includes status === 'active' and
    * those status doesn't exists */
-  const draftFilter = includeDraft
-    ? `siem-ui-timeline.attributes.status: ${TimelineStatus.draft}`
-    : `not siem-ui-timeline.attributes.status: ${TimelineStatus.draft}`;
-  return `${typeFilter} and ${draftFilter}`;
+  const draftFilter =
+    status === TimelineStatus.draft
+      ? `siem-ui-timeline.attributes.status: ${TimelineStatus.draft}`
+      : `not siem-ui-timeline.attributes.status: ${TimelineStatus.draft}`;
+
+  const immutableFilter =
+    status == null
+      ? null
+      : status === TimelineStatus.immutable
+      ? `siem-ui-timeline.attributes.status: ${TimelineStatus.immutable}`
+      : `not siem-ui-timeline.attributes.status: ${TimelineStatus.immutable}`;
+
+  const templateTimelineTypeFilter =
+    templateTimelineType == null
+      ? null
+      : templateTimelineType === TemplateTimelineType.elastic
+      ? `siem-ui-timeline.attributes.createdBy: "Elsatic"`
+      : `not siem-ui-timeline.attributes.createdBy: "Elastic"`;
+
+  const filters =
+    !disableTemplate && enableElasticFilter
+      ? [typeFilter, draftFilter, immutableFilter, templateTimelineTypeFilter]
+      : [typeFilter, draftFilter, immutableFilter];
+  return filters.filter((f) => f != null).join(' and ');
 };
 
 export const getAllTimeline = async (
@@ -131,8 +171,10 @@ export const getAllTimeline = async (
   pageInfo: PageInfoTimeline | null,
   search: string | null,
   sort: SortTimeline | null,
-  timelineType: TimelineTypeLiteralWithNull
-): Promise<ResponseTimelines> => {
+  status: TimelineStatusLiteralWithNull,
+  timelineType: TimelineTypeLiteralWithNull,
+  templateTimelineType: TemplateTimelineTypeLiteralWithNull
+): Promise<AllTimelinesResponse> => {
   const options: SavedObjectsFindOptions = {
     type: timelineSavedObjectType,
     perPage: pageInfo != null ? pageInfo.pageSize : undefined,
@@ -144,13 +186,78 @@ export const getAllTimeline = async (
     /**
      * CreateTemplateTimelineBtn
      * Remove the comment here to enable template timeline and apply the change below
-     * filter: getTimelineTypeFilter(timelineType, false)
+     * filter: getTimelineTypeFilter(timelineType, templateTimelineType, false)
      */
-    filter: getTimelineTypeFilter(disableTemplate ? TimelineType.default : timelineType, false),
+    filter: getTimelineTypeFilter(
+      disableTemplate ? TimelineType.default : timelineType,
+      disableTemplate ? null : templateTimelineType,
+      disableTemplate ? null : status
+    ),
     sortField: sort != null ? sort.sortField : undefined,
     sortOrder: sort != null ? sort.sortOrder : undefined,
   };
-  return getAllSavedTimeline(request, options);
+
+  const timelineOptions = {
+    type: timelineSavedObjectType,
+    perPage: 1,
+    page: 1,
+    filter: getTimelineTypeFilter(TimelineType.default, null, TimelineStatus.active),
+  };
+
+  const templateTimelineOptions = {
+    type: timelineSavedObjectType,
+    perPage: 1,
+    page: 1,
+    filter: getTimelineTypeFilter(TimelineType.template, null, null),
+  };
+
+  const elasticTemplateTimelineOptions = {
+    type: timelineSavedObjectType,
+    perPage: 1,
+    page: 1,
+    filter: getTimelineTypeFilter(
+      TimelineType.template,
+      TemplateTimelineType.elastic,
+      TimelineStatus.immutable
+    ),
+  };
+
+  const customTemplateTimelineOptions = {
+    type: timelineSavedObjectType,
+    perPage: 1,
+    page: 1,
+    filter: getTimelineTypeFilter(
+      TimelineType.template,
+      TemplateTimelineType.custom,
+      TimelineStatus.active
+    ),
+  };
+
+  const favoriteTimelineOptions = {
+    type: timelineSavedObjectType,
+    searchFields: ['title', 'description', 'favorite.keySearch'],
+    perPage: 1,
+    page: 1,
+    filter: getTimelineTypeFilter(timelineType, null, TimelineStatus.active),
+  };
+
+  const result = await Promise.all([
+    getAllSavedTimeline(request, options),
+    getAllSavedTimeline(request, timelineOptions),
+    getAllSavedTimeline(request, templateTimelineOptions),
+    getAllSavedTimeline(request, elasticTemplateTimelineOptions),
+    getAllSavedTimeline(request, customTemplateTimelineOptions),
+    getAllSavedTimeline(request, favoriteTimelineOptions),
+  ]);
+
+  return Promise.resolve({
+    ...result[0],
+    defaultTimelineCount: result[1].totalCount,
+    templateTimelineCount: result[2].totalCount,
+    elasticTemplateTimelineCount: result[3].totalCount,
+    customTemplateTimelineCount: result[4].totalCount,
+    favoriteCount: result[5].totalCount,
+  });
 };
 
 export const getDraftTimeline = async (
@@ -160,7 +267,11 @@ export const getDraftTimeline = async (
   const options: SavedObjectsFindOptions = {
     type: timelineSavedObjectType,
     perPage: 1,
-    filter: getTimelineTypeFilter(timelineType, true),
+    filter: getTimelineTypeFilter(
+      timelineType,
+      timelineType === TimelineType.template ? TemplateTimelineType.custom : null,
+      TimelineStatus.draft
+    ),
     sortField: 'created',
     sortOrder: 'desc',
   };
@@ -395,7 +506,6 @@ const getAllSavedTimeline = async (request: FrameworkRequest, options: SavedObje
   }
 
   const savedObjects = await savedObjectsClient.find(options);
-
   const timelinesWithNotesAndPinnedEvents = await Promise.all(
     savedObjects.saved_objects.map(async (savedObject) => {
       const timelineSaveObject = convertSavedObjectToSavedTimeline(savedObject);

From 40ff82d7794a84cb3faf06b8a3eb201a3da925c9 Mon Sep 17 00:00:00 2001
From: Wylie Conlon <william.conlon@elastic.co>
Date: Sat, 27 Jun 2020 02:20:29 -0400
Subject: [PATCH 71/78] [Lens] Fix broken test (#70117)

---
 .../lens/public/indexpattern_datasource/loader.test.ts       | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
index d8d8ebcf12de..e8c8c5762bb8 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
@@ -177,8 +177,7 @@ function mockClient() {
   } as unknown) as Pick<SavedObjectsClientContract, 'find' | 'bulkGet'>;
 }
 
-// Failing: See https://github.com/elastic/kibana/issues/70104
-describe.skip('loader', () => {
+describe('loader', () => {
   describe('loadIndexPatterns', () => {
     it('should not load index patterns that are already loaded', async () => {
       const cache = await loadIndexPatterns({
@@ -318,7 +317,6 @@ describe.skip('loader', () => {
           a: sampleIndexPatterns.a,
         },
         layers: {},
-        showEmptyFields: false,
       });
       expect(storage.set).toHaveBeenCalledWith('lens-settings', {
         indexPatternId: 'a',
@@ -341,7 +339,6 @@ describe.skip('loader', () => {
           b: sampleIndexPatterns.b,
         },
         layers: {},
-        showEmptyFields: false,
       });
     });
 

From 3571100bcce63ec3f338a893bd9c549007f7255c Mon Sep 17 00:00:00 2001
From: Alison Goryachev <alison.goryachev@elastic.co>
Date: Mon, 29 Jun 2020 08:31:59 -0400
Subject: [PATCH 72/78] [CCR] Fix reducer function when finding missing
 privileges (#70158)

---
 .../cross_cluster_replication/register_permissions_route.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/x-pack/plugins/cross_cluster_replication/server/routes/api/cross_cluster_replication/register_permissions_route.ts b/x-pack/plugins/cross_cluster_replication/server/routes/api/cross_cluster_replication/register_permissions_route.ts
index b8eb5ae14750..008828d264a2 100644
--- a/x-pack/plugins/cross_cluster_replication/server/routes/api/cross_cluster_replication/register_permissions_route.ts
+++ b/x-pack/plugins/cross_cluster_replication/server/routes/api/cross_cluster_replication/register_permissions_route.ts
@@ -43,13 +43,13 @@ export const registerPermissionsRoute = ({
         });
 
         const missingClusterPrivileges = Object.keys(cluster).reduce(
-          (permissions: any, permissionName: any) => {
+          (permissions: string[], permissionName: string) => {
             if (!cluster[permissionName]) {
               permissions.push(permissionName);
-              return permissions;
             }
+            return permissions;
           },
-          [] as any[]
+          []
         );
 
         return response.ok({

From 7e5cff4be988e95165513c2620d333bcf1ae893c Mon Sep 17 00:00:00 2001
From: Pierre Gayvallet <pierre.gayvallet@elastic.co>
Date: Mon, 29 Jun 2020 15:17:00 +0200
Subject: [PATCH 73/78] [GS] add application result provider (#68488)

* add application result provider

* remove empty contracts & cache searchable apps

* fix types
---
 ...kibana-plugin-core-public.publicappinfo.md |   3 +
 ...-plugin-core-public.publiclegacyappinfo.md |   2 +
 package.json                                  |   1 +
 src/core/public/application/types.ts          |   7 +
 src/core/public/application/utils.ts          |   5 +
 src/core/public/public.api.md                 |   5 +
 .../global_search_providers/kibana.json       |  10 +
 .../global_search_providers/public/index.ts   |  11 +
 .../public/plugin.test.ts                     |  33 +++
 .../global_search_providers/public/plugin.ts  |  29 +++
 .../providers/application.test.mocks.ts       |  10 +
 .../public/providers/application.test.ts      | 204 ++++++++++++++++++
 .../public/providers/application.ts           |  39 ++++
 .../public/providers/get_app_results.test.ts  | 119 ++++++++++
 .../public/providers/get_app_results.ts       |  58 +++++
 .../public/providers/index.ts                 |   7 +
 x-pack/typings/js_levenshtein.d.ts            |  10 +
 yarn.lock                                     |   5 +
 18 files changed, 558 insertions(+)
 create mode 100644 x-pack/plugins/global_search_providers/kibana.json
 create mode 100644 x-pack/plugins/global_search_providers/public/index.ts
 create mode 100644 x-pack/plugins/global_search_providers/public/plugin.test.ts
 create mode 100644 x-pack/plugins/global_search_providers/public/plugin.ts
 create mode 100644 x-pack/plugins/global_search_providers/public/providers/application.test.mocks.ts
 create mode 100644 x-pack/plugins/global_search_providers/public/providers/application.test.ts
 create mode 100644 x-pack/plugins/global_search_providers/public/providers/application.ts
 create mode 100644 x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts
 create mode 100644 x-pack/plugins/global_search_providers/public/providers/get_app_results.ts
 create mode 100644 x-pack/plugins/global_search_providers/public/providers/index.ts
 create mode 100644 x-pack/typings/js_levenshtein.d.ts

diff --git a/docs/development/core/public/kibana-plugin-core-public.publicappinfo.md b/docs/development/core/public/kibana-plugin-core-public.publicappinfo.md
index c70f3a97a888..4b3b103c9273 100644
--- a/docs/development/core/public/kibana-plugin-core-public.publicappinfo.md
+++ b/docs/development/core/public/kibana-plugin-core-public.publicappinfo.md
@@ -11,5 +11,8 @@ Public information about a registered [application](./kibana-plugin-core-public.
 ```typescript
 export declare type PublicAppInfo = Omit<App, 'mount' | 'updater$'> & {
     legacy: false;
+    status: AppStatus;
+    navLinkStatus: AppNavLinkStatus;
+    appRoute: string;
 };
 ```
diff --git a/docs/development/core/public/kibana-plugin-core-public.publiclegacyappinfo.md b/docs/development/core/public/kibana-plugin-core-public.publiclegacyappinfo.md
index cc3e9de3193c..051638daabd1 100644
--- a/docs/development/core/public/kibana-plugin-core-public.publiclegacyappinfo.md
+++ b/docs/development/core/public/kibana-plugin-core-public.publiclegacyappinfo.md
@@ -11,5 +11,7 @@ Information about a registered [legacy application](./kibana-plugin-core-public.
 ```typescript
 export declare type PublicLegacyAppInfo = Omit<LegacyApp, 'updater$'> & {
     legacy: true;
+    status: AppStatus;
+    navLinkStatus: AppNavLinkStatus;
 };
 ```
diff --git a/package.json b/package.json
index b1202631a0c0..6b4c8ee78581 100644
--- a/package.json
+++ b/package.json
@@ -202,6 +202,7 @@
     "inline-style": "^2.0.0",
     "joi": "^13.5.2",
     "jquery": "^3.5.0",
+    "js-levenshtein": "^1.1.6",
     "js-yaml": "3.13.1",
     "json-stable-stringify": "^1.0.1",
     "json-stringify-pretty-compact": "1.2.0",
diff --git a/src/core/public/application/types.ts b/src/core/public/application/types.ts
index 6926b6acf241..cd2dd99c30c1 100644
--- a/src/core/public/application/types.ts
+++ b/src/core/public/application/types.ts
@@ -269,6 +269,10 @@ export interface LegacyApp extends AppBase {
  */
 export type PublicAppInfo = Omit<App, 'mount' | 'updater$'> & {
   legacy: false;
+  // remove optional on fields populated with default values
+  status: AppStatus;
+  navLinkStatus: AppNavLinkStatus;
+  appRoute: string;
 };
 
 /**
@@ -278,6 +282,9 @@ export type PublicAppInfo = Omit<App, 'mount' | 'updater$'> & {
  */
 export type PublicLegacyAppInfo = Omit<LegacyApp, 'updater$'> & {
   legacy: true;
+  // remove optional on fields populated with default values
+  status: AppStatus;
+  navLinkStatus: AppNavLinkStatus;
 };
 
 /**
diff --git a/src/core/public/application/utils.ts b/src/core/public/application/utils.ts
index 1dc9ec705900..92d25fa468c4 100644
--- a/src/core/public/application/utils.ts
+++ b/src/core/public/application/utils.ts
@@ -120,12 +120,17 @@ export function getAppInfo(app: App<unknown> | LegacyApp): PublicAppInfo | Publi
     const { updater$, ...infos } = app;
     return {
       ...infos,
+      status: app.status!,
+      navLinkStatus: app.navLinkStatus!,
       legacy: true,
     };
   } else {
     const { updater$, mount, ...infos } = app;
     return {
       ...infos,
+      status: app.status!,
+      navLinkStatus: app.navLinkStatus!,
+      appRoute: app.appRoute!,
       legacy: false,
     };
   }
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index d10e351f4d13..a65b9dd9d242 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -1143,11 +1143,16 @@ export type PluginOpaqueId = symbol;
 // @public
 export type PublicAppInfo = Omit<App, 'mount' | 'updater$'> & {
     legacy: false;
+    status: AppStatus;
+    navLinkStatus: AppNavLinkStatus;
+    appRoute: string;
 };
 
 // @public
 export type PublicLegacyAppInfo = Omit<LegacyApp, 'updater$'> & {
     legacy: true;
+    status: AppStatus;
+    navLinkStatus: AppNavLinkStatus;
 };
 
 // @public
diff --git a/x-pack/plugins/global_search_providers/kibana.json b/x-pack/plugins/global_search_providers/kibana.json
new file mode 100644
index 000000000000..025ea2bceed2
--- /dev/null
+++ b/x-pack/plugins/global_search_providers/kibana.json
@@ -0,0 +1,10 @@
+{
+  "id": "globalSearchProviders",
+  "version": "8.0.0",
+  "kibanaVersion": "kibana",
+  "server": false,
+  "ui": true,
+  "requiredPlugins": ["globalSearch"],
+  "optionalPlugins": [],
+  "configPath": ["xpack", "global_search_providers"]
+}
diff --git a/x-pack/plugins/global_search_providers/public/index.ts b/x-pack/plugins/global_search_providers/public/index.ts
new file mode 100644
index 000000000000..bc66994aa393
--- /dev/null
+++ b/x-pack/plugins/global_search_providers/public/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { PluginInitializer } from 'src/core/public';
+import { GlobalSearchProvidersPlugin, GlobalSearchProvidersPluginSetupDeps } from './plugin';
+
+export const plugin: PluginInitializer<{}, {}, GlobalSearchProvidersPluginSetupDeps, {}> = () =>
+  new GlobalSearchProvidersPlugin();
diff --git a/x-pack/plugins/global_search_providers/public/plugin.test.ts b/x-pack/plugins/global_search_providers/public/plugin.test.ts
new file mode 100644
index 000000000000..a2880acae440
--- /dev/null
+++ b/x-pack/plugins/global_search_providers/public/plugin.test.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { coreMock } from '../../../../src/core/public/mocks';
+import { globalSearchPluginMock } from '../../global_search/public/mocks';
+import { GlobalSearchProvidersPlugin } from './plugin';
+
+describe('GlobalSearchProvidersPlugin', () => {
+  let plugin: GlobalSearchProvidersPlugin;
+  let globalSearchSetup: ReturnType<typeof globalSearchPluginMock.createSetupContract>;
+
+  beforeEach(() => {
+    globalSearchSetup = globalSearchPluginMock.createSetupContract();
+    plugin = new GlobalSearchProvidersPlugin();
+  });
+
+  describe('#setup', () => {
+    it('registers the `application` result provider', () => {
+      const coreSetup = coreMock.createSetup();
+      plugin.setup(coreSetup, { globalSearch: globalSearchSetup });
+
+      expect(globalSearchSetup.registerResultProvider).toHaveBeenCalledTimes(1);
+      expect(globalSearchSetup.registerResultProvider).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: 'application',
+        })
+      );
+    });
+  });
+});
diff --git a/x-pack/plugins/global_search_providers/public/plugin.ts b/x-pack/plugins/global_search_providers/public/plugin.ts
new file mode 100644
index 000000000000..9f18c06608b0
--- /dev/null
+++ b/x-pack/plugins/global_search_providers/public/plugin.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreSetup, Plugin } from 'src/core/public';
+import { GlobalSearchPluginSetup } from '../../global_search/public';
+import { createApplicationResultProvider } from './providers';
+
+export interface GlobalSearchProvidersPluginSetupDeps {
+  globalSearch: GlobalSearchPluginSetup;
+}
+
+export class GlobalSearchProvidersPlugin
+  implements Plugin<{}, {}, GlobalSearchProvidersPluginSetupDeps, {}> {
+  setup(
+    { getStartServices }: CoreSetup<{}, {}>,
+    { globalSearch }: GlobalSearchProvidersPluginSetupDeps
+  ) {
+    const applicationPromise = getStartServices().then(([core]) => core.application);
+    globalSearch.registerResultProvider(createApplicationResultProvider(applicationPromise));
+    return {};
+  }
+
+  start() {
+    return {};
+  }
+}
diff --git a/x-pack/plugins/global_search_providers/public/providers/application.test.mocks.ts b/x-pack/plugins/global_search_providers/public/providers/application.test.mocks.ts
new file mode 100644
index 000000000000..4fdf8a75a4bc
--- /dev/null
+++ b/x-pack/plugins/global_search_providers/public/providers/application.test.mocks.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const getAppResultsMock = jest.fn();
+jest.doMock('./get_app_results', () => ({
+  getAppResults: getAppResultsMock,
+}));
diff --git a/x-pack/plugins/global_search_providers/public/providers/application.test.ts b/x-pack/plugins/global_search_providers/public/providers/application.test.ts
new file mode 100644
index 000000000000..ca19bddb6029
--- /dev/null
+++ b/x-pack/plugins/global_search_providers/public/providers/application.test.ts
@@ -0,0 +1,204 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getAppResultsMock } from './application.test.mocks';
+
+import { of, EMPTY } from 'rxjs';
+import { TestScheduler } from 'rxjs/testing';
+import { ApplicationStart, AppNavLinkStatus, AppStatus, PublicAppInfo } from 'src/core/public';
+import {
+  GlobalSearchProviderFindOptions,
+  GlobalSearchProviderResult,
+} from '../../../global_search/public';
+import { applicationServiceMock } from 'src/core/public/mocks';
+import { createApplicationResultProvider } from './application';
+
+const getTestScheduler = () =>
+  new TestScheduler((actual, expected) => {
+    expect(actual).toEqual(expected);
+  });
+
+const createApp = (props: Partial<PublicAppInfo> = {}): PublicAppInfo => ({
+  id: 'app1',
+  title: 'App 1',
+  appRoute: '/app/app1',
+  legacy: false,
+  status: AppStatus.accessible,
+  navLinkStatus: AppNavLinkStatus.visible,
+  chromeless: false,
+  ...props,
+});
+
+const createResult = (props: Partial<GlobalSearchProviderResult>): GlobalSearchProviderResult => ({
+  id: 'id',
+  title: 'title',
+  type: 'application',
+  url: '/app/id',
+  score: 100,
+  ...props,
+});
+
+const createAppMap = (apps: PublicAppInfo[]): Map<string, PublicAppInfo> => {
+  return new Map(apps.map((app) => [app.id, app]));
+};
+
+const expectApp = (id: string) => expect.objectContaining({ id });
+const expectResult = expectApp;
+
+describe('applicationResultProvider', () => {
+  let application: ReturnType<typeof applicationServiceMock.createStartContract>;
+
+  const defaultOption: GlobalSearchProviderFindOptions = {
+    preference: 'pref',
+    maxResults: 20,
+    aborted$: EMPTY,
+  };
+
+  beforeEach(() => {
+    application = applicationServiceMock.createStartContract();
+    getAppResultsMock.mockReturnValue([]);
+  });
+
+  it('has the correct id', () => {
+    const provider = createApplicationResultProvider(Promise.resolve(application));
+    expect(provider.id).toBe('application');
+  });
+
+  it('calls `getAppResults` with the term and the list of apps', async () => {
+    application.applications$ = of(
+      createAppMap([
+        createApp({ id: 'app1', title: 'App 1' }),
+        createApp({ id: 'app2', title: 'App 2' }),
+        createApp({ id: 'app3', title: 'App 3' }),
+      ])
+    );
+    const provider = createApplicationResultProvider(Promise.resolve(application));
+
+    await provider.find('term', defaultOption).toPromise();
+
+    expect(getAppResultsMock).toHaveBeenCalledTimes(1);
+    expect(getAppResultsMock).toHaveBeenCalledWith('term', [
+      expectApp('app1'),
+      expectApp('app2'),
+      expectApp('app3'),
+    ]);
+  });
+
+  it('ignores inaccessible apps', async () => {
+    application.applications$ = of(
+      createAppMap([
+        createApp({ id: 'app1', title: 'App 1' }),
+        createApp({ id: 'disabled', title: 'disabled', status: AppStatus.inaccessible }),
+      ])
+    );
+    const provider = createApplicationResultProvider(Promise.resolve(application));
+    await provider.find('term', defaultOption).toPromise();
+
+    expect(getAppResultsMock).toHaveBeenCalledWith('term', [expectApp('app1')]);
+  });
+
+  it('ignores chromeless apps', async () => {
+    application.applications$ = of(
+      createAppMap([
+        createApp({ id: 'app1', title: 'App 1' }),
+        createApp({ id: 'chromeless', title: 'chromeless', chromeless: true }),
+      ])
+    );
+
+    const provider = createApplicationResultProvider(Promise.resolve(application));
+    await provider.find('term', defaultOption).toPromise();
+
+    expect(getAppResultsMock).toHaveBeenCalledWith('term', [expectApp('app1')]);
+  });
+
+  it('sorts the results returned by `getAppResults`', async () => {
+    getAppResultsMock.mockReturnValue([
+      createResult({ id: 'r60', score: 60 }),
+      createResult({ id: 'r100', score: 100 }),
+      createResult({ id: 'r50', score: 50 }),
+      createResult({ id: 'r75', score: 75 }),
+    ]);
+
+    const provider = createApplicationResultProvider(Promise.resolve(application));
+    const results = await provider.find('term', defaultOption).toPromise();
+
+    expect(results).toEqual([
+      expectResult('r100'),
+      expectResult('r75'),
+      expectResult('r60'),
+      expectResult('r50'),
+    ]);
+  });
+
+  it('only returns the highest `maxResults` results', async () => {
+    getAppResultsMock.mockReturnValue([
+      createResult({ id: 'r60', score: 60 }),
+      createResult({ id: 'r100', score: 100 }),
+      createResult({ id: 'r50', score: 50 }),
+      createResult({ id: 'r75', score: 75 }),
+    ]);
+
+    const provider = createApplicationResultProvider(Promise.resolve(application));
+
+    const options = {
+      ...defaultOption,
+      maxResults: 2,
+    };
+    const results = await provider.find('term', options).toPromise();
+
+    expect(results).toEqual([expectResult('r100'), expectResult('r75')]);
+  });
+
+  it('only emits once, even if `application$` emits multiple times', () => {
+    getTestScheduler().run(({ hot, expectObservable }) => {
+      const appMap = createAppMap([createApp({ id: 'app1', title: 'App 1' })]);
+
+      application.applications$ = hot('--a---b', { a: appMap, b: appMap });
+
+      // test scheduler doesnt play well with promises. need to workaround by passing
+      // an observable instead. Behavior with promise is asserted in previous tests of the suite
+      const applicationPromise = (hot('a', { a: application }) as unknown) as Promise<
+        ApplicationStart
+      >;
+
+      const provider = createApplicationResultProvider(applicationPromise);
+
+      const options = {
+        ...defaultOption,
+        aborted$: hot<undefined>('|'),
+      };
+
+      const resultObs = provider.find('term', options);
+
+      expectObservable(resultObs).toBe('--(a|)', { a: [] });
+    });
+  });
+
+  it('only emits results until `aborted$` emits', () => {
+    getTestScheduler().run(({ hot, expectObservable }) => {
+      const appMap = createAppMap([createApp({ id: 'app1', title: 'App 1' })]);
+
+      application.applications$ = hot('---a', { a: appMap, b: appMap });
+
+      // test scheduler doesnt play well with promises. need to workaround by passing
+      // an observable instead. Behavior with promise is asserted in previous tests of the suite
+      const applicationPromise = (hot('a', { a: application }) as unknown) as Promise<
+        ApplicationStart
+      >;
+
+      const provider = createApplicationResultProvider(applicationPromise);
+
+      const options = {
+        ...defaultOption,
+        aborted$: hot<undefined>('-(a|)', { a: undefined }),
+      };
+
+      const resultObs = provider.find('term', options);
+
+      expectObservable(resultObs).toBe('-|');
+    });
+  });
+});
diff --git a/x-pack/plugins/global_search_providers/public/providers/application.ts b/x-pack/plugins/global_search_providers/public/providers/application.ts
new file mode 100644
index 000000000000..e40fcef17f73
--- /dev/null
+++ b/x-pack/plugins/global_search_providers/public/providers/application.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { from } from 'rxjs';
+import { take, map, takeUntil, mergeMap, shareReplay } from 'rxjs/operators';
+import { ApplicationStart } from 'src/core/public';
+import { GlobalSearchResultProvider } from '../../../global_search/public';
+import { getAppResults } from './get_app_results';
+
+export const createApplicationResultProvider = (
+  applicationPromise: Promise<ApplicationStart>
+): GlobalSearchResultProvider => {
+  const searchableApps$ = from(applicationPromise).pipe(
+    mergeMap((application) => application.applications$),
+    map((apps) =>
+      [...apps.values()].filter(
+        (app) => app.status === 0 && (app.legacy === true || app.chromeless !== true)
+      )
+    ),
+    shareReplay(1)
+  );
+
+  return {
+    id: 'application',
+    find: (term, { aborted$, maxResults }) => {
+      return searchableApps$.pipe(
+        takeUntil(aborted$),
+        take(1),
+        map((apps) => {
+          const results = getAppResults(term, [...apps.values()]);
+          return results.sort((a, b) => b.score - a.score).slice(0, maxResults);
+        })
+      );
+    },
+  };
+};
diff --git a/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts b/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts
new file mode 100644
index 000000000000..1c5a446b8e56
--- /dev/null
+++ b/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AppNavLinkStatus, AppStatus, PublicAppInfo, PublicLegacyAppInfo } from 'src/core/public';
+import { appToResult, getAppResults, scoreApp } from './get_app_results';
+
+const createApp = (props: Partial<PublicAppInfo> = {}): PublicAppInfo => ({
+  id: 'app1',
+  title: 'App 1',
+  appRoute: '/app/app1',
+  legacy: false,
+  status: AppStatus.accessible,
+  navLinkStatus: AppNavLinkStatus.visible,
+  chromeless: false,
+  ...props,
+});
+
+const createLegacyApp = (props: Partial<PublicLegacyAppInfo> = {}): PublicLegacyAppInfo => ({
+  id: 'app1',
+  title: 'App 1',
+  appUrl: '/app/app1',
+  legacy: true,
+  status: AppStatus.accessible,
+  navLinkStatus: AppNavLinkStatus.visible,
+  ...props,
+});
+
+describe('getAppResults', () => {
+  it('retrieves the matching results', () => {
+    const apps = [
+      createApp({ id: 'dashboard', title: 'dashboard' }),
+      createApp({ id: 'visualize', title: 'visualize' }),
+    ];
+
+    const results = getAppResults('dashboard', apps);
+
+    expect(results.length).toBe(1);
+    expect(results[0]).toEqual(expect.objectContaining({ id: 'dashboard', score: 100 }));
+  });
+});
+
+describe('scoreApp', () => {
+  describe('when the term is included in the title', () => {
+    it('returns 100 if the app title is an exact match', () => {
+      expect(scoreApp('dashboard', createApp({ title: 'dashboard' }))).toBe(100);
+      expect(scoreApp('dashboard', createApp({ title: 'DASHBOARD' }))).toBe(100);
+      expect(scoreApp('DASHBOARD', createApp({ title: 'DASHBOARD' }))).toBe(100);
+      expect(scoreApp('dashBOARD', createApp({ title: 'DASHboard' }))).toBe(100);
+    });
+
+    it('returns 90 if the app title starts with the term', () => {
+      expect(scoreApp('dash', createApp({ title: 'dashboard' }))).toBe(90);
+      expect(scoreApp('DASH', createApp({ title: 'dashboard' }))).toBe(90);
+    });
+
+    it('returns 75 if the term in included in the app title', () => {
+      expect(scoreApp('board', createApp({ title: 'dashboard' }))).toBe(75);
+      expect(scoreApp('shboa', createApp({ title: 'dashboard' }))).toBe(75);
+    });
+  });
+
+  describe('when the term is not included in the title', () => {
+    it('returns the levenshtein ratio if superior or equal to 60', () => {
+      expect(scoreApp('0123456789', createApp({ title: '012345' }))).toBe(60);
+      expect(scoreApp('--1234567-', createApp({ title: '123456789' }))).toBe(60);
+    });
+    it('returns 0 if the levenshtein ratio is inferior to 60', () => {
+      expect(scoreApp('0123456789', createApp({ title: '12345' }))).toBe(0);
+      expect(scoreApp('1-2-3-4-5', createApp({ title: '123456789' }))).toBe(0);
+    });
+  });
+
+  it('works with legacy apps', () => {
+    expect(scoreApp('dashboard', createLegacyApp({ title: 'dashboard' }))).toBe(100);
+    expect(scoreApp('dash', createLegacyApp({ title: 'dashboard' }))).toBe(90);
+    expect(scoreApp('board', createLegacyApp({ title: 'dashboard' }))).toBe(75);
+    expect(scoreApp('0123456789', createLegacyApp({ title: '012345' }))).toBe(60);
+    expect(scoreApp('0123456789', createLegacyApp({ title: '12345' }))).toBe(0);
+  });
+});
+
+describe('appToResult', () => {
+  it('converts an app to a result', () => {
+    const app = createApp({
+      id: 'foo',
+      title: 'Foo',
+      euiIconType: 'fooIcon',
+      appRoute: '/app/foo',
+    });
+    expect(appToResult(app, 42)).toEqual({
+      id: 'foo',
+      title: 'Foo',
+      type: 'application',
+      icon: 'fooIcon',
+      url: '/app/foo',
+      score: 42,
+    });
+  });
+
+  it('converts a legacy app to a result', () => {
+    const app = createLegacyApp({
+      id: 'legacy',
+      title: 'Legacy',
+      euiIconType: 'legacyIcon',
+      appUrl: '/app/legacy',
+    });
+    expect(appToResult(app, 69)).toEqual({
+      id: 'legacy',
+      title: 'Legacy',
+      type: 'application',
+      icon: 'legacyIcon',
+      url: '/app/legacy',
+      score: 69,
+    });
+  });
+});
diff --git a/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts b/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts
new file mode 100644
index 000000000000..1a1939230105
--- /dev/null
+++ b/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import levenshtein from 'js-levenshtein';
+import { PublicAppInfo, PublicLegacyAppInfo } from 'src/core/public';
+import { GlobalSearchProviderResult } from '../../../global_search/public';
+
+export const getAppResults = (
+  term: string,
+  apps: Array<PublicAppInfo | PublicLegacyAppInfo>
+): GlobalSearchProviderResult[] => {
+  return apps
+    .map((app) => ({ app, score: scoreApp(term, app) }))
+    .filter(({ score }) => score > 0)
+    .map(({ app, score }) => appToResult(app, score));
+};
+
+export const scoreApp = (term: string, { title }: PublicAppInfo | PublicLegacyAppInfo): number => {
+  term = term.toLowerCase();
+  title = title.toLowerCase();
+
+  // shortcuts to avoid calculating the distance when there is an exact match somewhere.
+  if (title === term) {
+    return 100;
+  }
+  if (title.startsWith(term)) {
+    return 90;
+  }
+  if (title.includes(term)) {
+    return 75;
+  }
+  const length = Math.max(term.length, title.length);
+  const distance = levenshtein(term, title);
+
+  // maximum lev distance is length, we compute the match ratio (lower distance is better)
+  const ratio = Math.floor((1 - distance / length) * 100);
+  if (ratio >= 60) {
+    return ratio;
+  }
+  return 0;
+};
+
+export const appToResult = (
+  app: PublicAppInfo | PublicLegacyAppInfo,
+  score: number
+): GlobalSearchProviderResult => {
+  return {
+    id: app.id,
+    title: app.title,
+    type: 'application',
+    icon: app.euiIconType,
+    url: app.legacy ? app.appUrl : app.appRoute,
+    score,
+  };
+};
diff --git a/x-pack/plugins/global_search_providers/public/providers/index.ts b/x-pack/plugins/global_search_providers/public/providers/index.ts
new file mode 100644
index 000000000000..d71c30d41d46
--- /dev/null
+++ b/x-pack/plugins/global_search_providers/public/providers/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { createApplicationResultProvider } from './application';
diff --git a/x-pack/typings/js_levenshtein.d.ts b/x-pack/typings/js_levenshtein.d.ts
new file mode 100644
index 000000000000..812bf24bf3dd
--- /dev/null
+++ b/x-pack/typings/js_levenshtein.d.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+declare module 'js-levenshtein' {
+  const levenshtein: (a: string, b: string) => number;
+  export = levenshtein;
+}
diff --git a/yarn.lock b/yarn.lock
index 0a7899e4ac10..8b13f3bdacb6 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -19523,6 +19523,11 @@ js-levenshtein@^1.1.3:
   resolved "https://registry.yarnpkg.com/js-levenshtein/-/js-levenshtein-1.1.3.tgz#3ef627df48ec8cf24bacf05c0f184ff30ef413c5"
   integrity sha512-/812MXr9RBtMObviZ8gQBhHO8MOrGj8HlEE+4ccMTElNA/6I3u39u+bhny55Lk921yn44nSZFy9naNLElL5wgQ==
 
+js-levenshtein@^1.1.6:
+  version "1.1.6"
+  resolved "https://registry.yarnpkg.com/js-levenshtein/-/js-levenshtein-1.1.6.tgz#c6cee58eb3550372df8deb85fad5ce66ce01d59d"
+  integrity sha512-X2BB11YZtrRqY4EnQcLX5Rh373zbK4alC1FW7D7MBhL2gtcC17cTnr6DmfHZeS0s2rTHjUTMMHfG7gO8SSdw+g==
+
 js-search@^1.4.3:
   version "1.4.3"
   resolved "https://registry.yarnpkg.com/js-search/-/js-search-1.4.3.tgz#23a86d7e064ca53a473930edc48615b6b1c1954a"

From 8e57db696aefd4342d0dd18bfaf0047787d6e861 Mon Sep 17 00:00:00 2001
From: Nathan L Smith <nathan.smith@elastic.co>
Date: Mon, 29 Jun 2020 08:23:52 -0500
Subject: [PATCH 74/78] [APM] Use licensing from context (#70118)

* [APM] Use licensing from context

We added the usage of `featureUsage.notifyUsage` from the licensing plugin in #69455.

This required us to use `getStartServices to add `licensing` to `context.plugins`.

In #69838 `featureUsage` was added to `context.licensing`, so we don't need to add it to `context.plugins`.
---
 x-pack/plugins/apm/server/plugin.ts           | 64 ++++++++-----------
 .../server/routes/create_api/index.test.ts    |  3 +-
 .../plugins/apm/server/routes/service_map.ts  |  5 +-
 x-pack/plugins/apm/server/routes/typings.ts   |  3 -
 4 files changed, 30 insertions(+), 45 deletions(-)

diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index eb781ee07830..deafda67b806 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -4,46 +4,42 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { i18n } from '@kbn/i18n';
+import { combineLatest, Observable } from 'rxjs';
+import { map, take } from 'rxjs/operators';
 import {
-  PluginInitializerContext,
-  Plugin,
   CoreSetup,
   CoreStart,
   Logger,
+  Plugin,
+  PluginInitializerContext,
 } from 'src/core/server';
-import { Observable, combineLatest } from 'rxjs';
-import { map, take } from 'rxjs/operators';
-import { ObservabilityPluginSetup } from '../../observability/server';
-import { SecurityPluginSetup } from '../../security/server';
-import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/server';
-import { TaskManagerSetupContract } from '../../task_manager/server';
-import { AlertingPlugin } from '../../alerts/server';
-import { ActionsPlugin } from '../../actions/server';
+import { APMConfig, APMXPackConfig, mergeConfigs } from '.';
 import { APMOSSPluginSetup } from '../../../../src/plugins/apm_oss/server';
-import { createApmAgentConfigurationIndex } from './lib/settings/agent_configuration/create_agent_config_index';
-import { createApmCustomLinkIndex } from './lib/settings/custom_link/create_custom_link_index';
-import { createApmApi } from './routes/create_apm_api';
-import { getApmIndices } from './lib/settings/apm_indices/get_apm_indices';
-import { APMConfig, mergeConfigs, APMXPackConfig } from '.';
 import { HomeServerPluginSetup } from '../../../../src/plugins/home/server';
+import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/server';
+import { ActionsPlugin } from '../../actions/server';
+import { AlertingPlugin } from '../../alerts/server';
 import { CloudSetup } from '../../cloud/server';
-import { getInternalSavedObjectsClient } from './lib/helpers/get_internal_saved_objects_client';
-import {
-  LicensingPluginSetup,
-  LicensingPluginStart,
-} from '../../licensing/server';
-import { registerApmAlerts } from './lib/alerts/register_apm_alerts';
-import { createApmTelemetry } from './lib/apm_telemetry';
-
 import { PluginSetupContract as FeaturesPluginSetup } from '../../features/server';
+import { LicensingPluginSetup } from '../../licensing/server';
+import { MlPluginSetup } from '../../ml/server';
+import { ObservabilityPluginSetup } from '../../observability/server';
+import { SecurityPluginSetup } from '../../security/server';
+import { TaskManagerSetupContract } from '../../task_manager/server';
 import {
   APM_FEATURE,
   APM_SERVICE_MAPS_FEATURE_NAME,
   APM_SERVICE_MAPS_LICENSE_TYPE,
 } from './feature';
+import { registerApmAlerts } from './lib/alerts/register_apm_alerts';
+import { createApmTelemetry } from './lib/apm_telemetry';
+import { getInternalSavedObjectsClient } from './lib/helpers/get_internal_saved_objects_client';
+import { createApmAgentConfigurationIndex } from './lib/settings/agent_configuration/create_agent_config_index';
+import { getApmIndices } from './lib/settings/apm_indices/get_apm_indices';
+import { createApmCustomLinkIndex } from './lib/settings/custom_link/create_custom_link_index';
+import { createApmApi } from './routes/create_apm_api';
 import { apmIndices, apmTelemetry } from './saved_objects';
 import { createElasticCloudInstructions } from './tutorial/elastic_cloud';
-import { MlPluginSetup } from '../../ml/server';
 
 export interface APMPluginSetup {
   config$: Observable<APMConfig>;
@@ -135,18 +131,14 @@ export class APMPlugin implements Plugin<APMPluginSetup> {
       APM_SERVICE_MAPS_LICENSE_TYPE
     );
 
-    core.getStartServices().then(([_coreStart, pluginsStart]) => {
-      createApmApi().init(core, {
-        config$: mergedConfig$,
-        logger: this.logger!,
-        plugins: {
-          licensing: (pluginsStart as { licensing: LicensingPluginStart })
-            .licensing,
-          observability: plugins.observability,
-          security: plugins.security,
-          ml: plugins.ml,
-        },
-      });
+    createApmApi().init(core, {
+      config$: mergedConfig$,
+      logger: this.logger!,
+      plugins: {
+        observability: plugins.observability,
+        security: plugins.security,
+        ml: plugins.ml,
+      },
     });
 
     return {
diff --git a/x-pack/plugins/apm/server/routes/create_api/index.test.ts b/x-pack/plugins/apm/server/routes/create_api/index.test.ts
index f5db936c00d3..3d3e26f680e0 100644
--- a/x-pack/plugins/apm/server/routes/create_api/index.test.ts
+++ b/x-pack/plugins/apm/server/routes/create_api/index.test.ts
@@ -9,7 +9,6 @@ import { CoreSetup, Logger } from 'src/core/server';
 import { Params } from '../typings';
 import { BehaviorSubject } from 'rxjs';
 import { APMConfig } from '../..';
-import { LicensingPluginStart } from '../../../../licensing/server';
 
 const getCoreMock = () => {
   const get = jest.fn();
@@ -41,7 +40,7 @@ const getCoreMock = () => {
       logger: ({
         error: jest.fn(),
       } as unknown) as Logger,
-      plugins: { licensing: {} as LicensingPluginStart },
+      plugins: {},
     },
   };
 };
diff --git a/x-pack/plugins/apm/server/routes/service_map.ts b/x-pack/plugins/apm/server/routes/service_map.ts
index 3937c18b3fe5..a3e2f708b0b2 100644
--- a/x-pack/plugins/apm/server/routes/service_map.ts
+++ b/x-pack/plugins/apm/server/routes/service_map.ts
@@ -35,10 +35,7 @@ export const serviceMapRoute = createRoute(() => ({
     if (!isValidPlatinumLicense(context.licensing.license)) {
       throw Boom.forbidden(invalidLicenseMessage);
     }
-
-    context.plugins.licensing.featureUsage.notifyUsage(
-      APM_SERVICE_MAPS_FEATURE_NAME
-    );
+    context.licensing.featureUsage.notifyUsage(APM_SERVICE_MAPS_FEATURE_NAME);
 
     const setup = await setupRequest(context, request);
     const {
diff --git a/x-pack/plugins/apm/server/routes/typings.ts b/x-pack/plugins/apm/server/routes/typings.ts
index f30a9d18d7ae..b1815e88d291 100644
--- a/x-pack/plugins/apm/server/routes/typings.ts
+++ b/x-pack/plugins/apm/server/routes/typings.ts
@@ -14,7 +14,6 @@ import {
 import { PickByValue, Optional } from 'utility-types';
 import { Observable } from 'rxjs';
 import { Server } from 'hapi';
-import { LicensingPluginStart } from '../../../licensing/server';
 import { ObservabilityPluginSetup } from '../../../observability/server';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { FetchOptions } from '../../public/services/rest/callApi';
@@ -67,7 +66,6 @@ export type APMRequestHandlerContext<
   config: APMConfig;
   logger: Logger;
   plugins: {
-    licensing: LicensingPluginStart;
     observability?: ObservabilityPluginSetup;
     security?: SecurityPluginSetup;
     ml?: MlPluginSetup;
@@ -116,7 +114,6 @@ export interface ServerAPI<TRouteState extends RouteState> {
       config$: Observable<APMConfig>;
       logger: Logger;
       plugins: {
-        licensing: LicensingPluginStart;
         observability?: ObservabilityPluginSetup;
         security?: SecurityPluginSetup;
         ml?: MlPluginSetup;

From e91594aeb9ecdd718190c20818493e6bc0f3f128 Mon Sep 17 00:00:00 2001
From: Sonja Krause-Harder <sonja.krause-harder@elastic.co>
Date: Mon, 29 Jun 2020 15:24:11 +0200
Subject: [PATCH 75/78] [Ingest Manager] Use DockerServers service in
 integration tests. (#69822)

* Partially disable test files.

* Use DockerServers in EPM tests.

* Only run tests when DockerServers have been set up

* Reenable ingest manager API integration tests

* Pass new test_packages to registry container

* Enable DockerServers tests in CI.

* Correctly serve filetest package for file tests.

* Add helper to skip test and log warning.

* Reenable further file tests.

* Add developer documentation about Docker in Kibana CI.

* Document use of yarn test:ftr

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 vars/kibanaPipeline.groovy                    |   2 +
 .../dev_docs/api_integration_tests.md         | 113 +++++++++++++
 x-pack/scripts/functional_tests.js            |   1 +
 x-pack/test/epm_api_integration/apis/file.ts  | 151 ------------------
 .../packages/epr/yamlpipeline_1.0.0.tar.gz    | Bin 1996 -> 0 bytes
 .../packages/package/yamlpipeline_1.0.0       |  32 ----
 x-pack/test/epm_api_integration/apis/list.ts  | 124 --------------
 x-pack/test/epm_api_integration/config.ts     |  35 ----
 .../apis/file.ts                              |  96 +++++++++++
 .../apis/fixtures/package_registry_config.yml |   3 +
 .../filetest/0.1.0/docs/README.md             |   5 +
 .../test_packages/filetest/0.1.0/img/logo.svg |   7 +
 .../img/screenshots/metricbeat_dashboard.png  | Bin 0 -> 94863 bytes
 .../kibana/dashboard/sample_dashboard.json    |  38 +++++
 .../0.1.0/kibana/search/sample_search.json    |  36 +++++
 .../visualization/sample_visualization.json   |  22 +++
 .../test_packages/filetest/0.1.0/manifest.yml |  30 ++++
 .../apis/ilm.ts                               |   0
 .../apis/index.js                             |   2 +-
 .../apis/list.ts                              |  38 +++++
 .../apis/mock_http_server.d.ts                |   0
 .../apis/template.ts                          |   0
 .../ingest_manager_api_integration/config.ts  |  67 ++++++++
 .../ingest_manager_api_integration/helpers.ts |  15 ++
 24 files changed, 474 insertions(+), 343 deletions(-)
 create mode 100644 x-pack/plugins/ingest_manager/dev_docs/api_integration_tests.md
 delete mode 100644 x-pack/test/epm_api_integration/apis/file.ts
 delete mode 100644 x-pack/test/epm_api_integration/apis/fixtures/packages/epr/yamlpipeline_1.0.0.tar.gz
 delete mode 100644 x-pack/test/epm_api_integration/apis/fixtures/packages/package/yamlpipeline_1.0.0
 delete mode 100644 x-pack/test/epm_api_integration/apis/list.ts
 delete mode 100644 x-pack/test/epm_api_integration/config.ts
 create mode 100644 x-pack/test/ingest_manager_api_integration/apis/file.ts
 create mode 100644 x-pack/test/ingest_manager_api_integration/apis/fixtures/package_registry_config.yml
 create mode 100644 x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/docs/README.md
 create mode 100644 x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/img/logo.svg
 create mode 100644 x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/img/screenshots/metricbeat_dashboard.png
 create mode 100644 x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/dashboard/sample_dashboard.json
 create mode 100644 x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/search/sample_search.json
 create mode 100644 x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/visualization/sample_visualization.json
 create mode 100644 x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/manifest.yml
 rename x-pack/test/{epm_api_integration => ingest_manager_api_integration}/apis/ilm.ts (100%)
 rename x-pack/test/{epm_api_integration => ingest_manager_api_integration}/apis/index.js (90%)
 create mode 100644 x-pack/test/ingest_manager_api_integration/apis/list.ts
 rename x-pack/test/{epm_api_integration => ingest_manager_api_integration}/apis/mock_http_server.d.ts (100%)
 rename x-pack/test/{epm_api_integration => ingest_manager_api_integration}/apis/template.ts (100%)
 create mode 100644 x-pack/test/ingest_manager_api_integration/config.ts
 create mode 100644 x-pack/test/ingest_manager_api_integration/helpers.ts

diff --git a/vars/kibanaPipeline.groovy b/vars/kibanaPipeline.groovy
index 46a76bbb8d52..f3fc5f84583c 100644
--- a/vars/kibanaPipeline.groovy
+++ b/vars/kibanaPipeline.groovy
@@ -21,6 +21,7 @@ def functionalTestProcess(String name, Closure closure) {
     def kibanaPort = "61${processNumber}1"
     def esPort = "61${processNumber}2"
     def esTransportPort = "61${processNumber}3"
+    def ingestManagementPackageRegistryPort = "61${processNumber}4"
 
     withEnv([
       "CI_PARALLEL_PROCESS_NUMBER=${processNumber}",
@@ -29,6 +30,7 @@ def functionalTestProcess(String name, Closure closure) {
       "TEST_KIBANA_URL=http://elastic:changeme@localhost:${kibanaPort}",
       "TEST_ES_URL=http://elastic:changeme@localhost:${esPort}",
       "TEST_ES_TRANSPORT_PORT=${esTransportPort}",
+      "INGEST_MANAGEMENT_PACKAGE_REGISTRY_PORT=${ingestManagementPackageRegistryPort}",
       "IS_PIPELINE_JOB=1",
       "JOB=${name}",
       "KBN_NP_PLUGINS_BUILT=true",
diff --git a/x-pack/plugins/ingest_manager/dev_docs/api_integration_tests.md b/x-pack/plugins/ingest_manager/dev_docs/api_integration_tests.md
new file mode 100644
index 000000000000..612d94d01a2d
--- /dev/null
+++ b/x-pack/plugins/ingest_manager/dev_docs/api_integration_tests.md
@@ -0,0 +1,113 @@
+# API integration tests
+
+Many API integration tests for Ingest Manager trigger at some point a connection to the package registry, and retrieval of some packages. If these connections are made to a package registry deployment outside of Kibana CI, these tests can fail at any time for two reasons:
+* the deployed registry is temporarily unavailable
+* the packages served by the registry do not match the expectation of the code under test
+
+For that reason, we run a dockerized version of the package registry in Kibana CI. For this to work, our tests must run against a custom test configuration and be kept in a custom directory, `x-pack/test/ingest_manager_api_integration`.
+
+## How to run the tests locally
+
+Usually, having the test server and the test runner in two different shells is most efficient, as it is possible to keep the server running and only rerun the test runner as often as needed. To do so, in one shell in the main `kibana` directory, run:
+```
+$ export INGEST_MANAGEMENT_PACKAGE_REGISTRY_PORT=12345
+$ yarn test:ftr:server --config x-pack/test/ingest_manager_api_integration/config.ts
+```
+
+In another shell in the same directory, run
+```
+$ export INGEST_MANAGEMENT_PACKAGE_REGISTRY_PORT=12345
+$ yarn test:ftr:runner --config x-pack/test/ingest_manager_api_integration/config.ts
+```
+
+However, it is also possible to **alternatively** run everything in one go, again from the main `kibana` directory:
+```
+$ export INGEST_MANAGEMENT_PACKAGE_REGISTRY_PORT=12345
+$ yarn test:ftr --config x-pack/test/ingest_manager_api_integration/config.ts
+```
+Port `12345` is used as an example here, it can be anything, but the environment variable has to be present for the tests to run at all.
+
+
+## DockerServers service setup
+
+We use the `DockerServers` service provided by `kbn-test`. The documentation for this functionality can be found here:
+https://github.com/elastic/kibana/blob/master/packages/kbn-test/src/functional_test_runner/lib/docker_servers/README.md
+
+The main configuration for the `DockerServers` service for our tests can be found in `x-pack/test/ingest_manager_api_integration/config.ts`:
+
+### Specify the arguments to pass to `docker run`:
+
+```
+  const dockerArgs: string[] = [
+    '-v',
+    `${path.join(
+      path.dirname(__filename),
+      './apis/fixtures/package_registry_config.yml'
+    )}:/registry/config.yml`,
+    '-v',
+    `${path.join(
+      path.dirname(__filename),
+      './apis/fixtures/test_packages'
+    )}:/registry/packages/test-packages`,
+  ];
+  ```
+
+  `-v` mounts local paths into the docker image. The first one puts a custom configuration file into the correct place in the docker container, the second one mounts a directory containing additional packages.
+
+### Specify the docker image to use
+
+```
+image: 'docker.elastic.co/package-registry/package-registry:kibana-testing-1'
+```
+
+This image contains the content of `docker.elastic.co/package-registry/package-registry:master` on June 26 2020. The image used here should be stable, i.e. using `master` would defeat the purpose of having a stable set of packages to be used in Kibana CI.
+
+### Packages available for testing
+
+The containerized package registry contains a set of packages which should be sufficient to run tests against all parts of Ingest Manager. The list of the packages are logged to the console when the docker container is initialized during testing, or when the container is started manually with
+
+```
+docker run -p 8080:8080 docker.elastic.co/package-registry/package-registry:kibana-testing-1
+```
+
+Additional packages for testing certain corner cases or error conditions can be put into `x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages`. A package `filetest` has been added there as an example.
+
+## Some DockerServers background
+
+For the `DockerServers` servers to run correctly in CI, the `INGEST_MANAGEMENT_PACKAGE_REGISTRY_PORT` environment variable needs to be under control of the CI environment. The reason behind this: it is possible that several versions of our tests are run in parallel on the same worker in Jenkins, and if we used a hard-coded port number here, those tests would run into port conflicts. (This is also the case for a few other ports, and the setup happens in `vars/kibanaPipeline.groovy`).
+
+Also, not every developer has `docker` installed on their workstation, so it must be possible to run the testsuite as a whole without `docker`, and preferably this should be the default behaviour. Therefore, our `DockerServers` service is only enabled when `INGEST_MANAGEMENT_PACKAGE_REGISTRY_PORT` is set. This needs to be checked in every test like this:
+
+```
+    it('fetches a .json search file', async function () {
+      if (server.enabled) {
+        await supertest
+          .get('/api/ingest_manager/epm/packages/filetest/0.1.0/kibana/search/sample_search.json')
+          .set('kbn-xsrf', 'xxx')
+          .expect('Content-Type', 'application/json; charset=utf-8')
+          .expect(200);
+      } else {
+        warnAndSkipTest(this, log);
+      }
+    });
+```
+
+If the tests are skipped in this way, they are marked in the test summary as `pending` and a warning is logged:
+
+```
+└-: EPM Endpoints
+   └-> "before all" hook
+   └-: list
+     └-> "before all" hook
+     └-> lists all packages from the registry
+       └-> "before each" hook: global before each
+       │ warn disabling tests because DockerServers service is not enabled, set INGEST_MANAGEMENT_PACKAGE_REGISTRY_PORT to run them
+       └-> lists all packages from the registry
+       └-> "after all" hook
+[...]  
+           │
+           │1 passing (233ms)
+           │6 pending
+           │
+
+```
diff --git a/x-pack/scripts/functional_tests.js b/x-pack/scripts/functional_tests.js
index 6cafa3eeef08..29be6d826c1b 100644
--- a/x-pack/scripts/functional_tests.js
+++ b/x-pack/scripts/functional_tests.js
@@ -52,6 +52,7 @@ const onlyNotInCoverageTests = [
   require.resolve('../test/endpoint_api_integration_no_ingest/config.ts'),
   require.resolve('../test/reporting_api_integration/config.js'),
   require.resolve('../test/functional_embedded/config.ts'),
+  require.resolve('../test/ingest_manager_api_integration/config.ts'),
 ];
 
 require('@kbn/plugin-helpers').babelRegister();
diff --git a/x-pack/test/epm_api_integration/apis/file.ts b/x-pack/test/epm_api_integration/apis/file.ts
deleted file mode 100644
index 7cf07e2cd99a..000000000000
--- a/x-pack/test/epm_api_integration/apis/file.ts
+++ /dev/null
@@ -1,151 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import ServerMock from 'mock-http-server';
-import { FtrProviderContext } from '../../api_integration/ftr_provider_context';
-
-export default function ({ getService }: FtrProviderContext) {
-  describe('package file', () => {
-    const server = new ServerMock({ host: 'localhost', port: 6666 });
-    beforeEach(() => {
-      server.start(() => {});
-    });
-    afterEach(() => {
-      server.stop(() => {});
-    });
-    it('fetches a .png screenshot image', async () => {
-      server.on({
-        method: 'GET',
-        path: '/package/auditd/2.0.4/img/screenshots/auditbeat-file-integrity-dashboard.png',
-        reply: {
-          headers: { 'content-type': 'image/png' },
-        },
-      });
-
-      const supertest = getService('supertest');
-      await supertest
-        .get(
-          '/api/ingest_manager/epm/packages/auditd/2.0.4/img/screenshots/auditbeat-file-integrity-dashboard.png'
-        )
-        .set('kbn-xsrf', 'xxx')
-        .expect('Content-Type', 'image/png')
-        .expect(200);
-    });
-
-    it('fetches an .svg icon image', async () => {
-      server.on({
-        method: 'GET',
-        path: '/package/auditd/2.0.4/img/icon.svg',
-        reply: {
-          headers: { 'content-type': 'image/svg' },
-        },
-      });
-
-      const supertest = getService('supertest');
-      await supertest
-        .get('/api/ingest_manager/epm/packages/auditd/2.0.4/img/icon.svg')
-        .set('kbn-xsrf', 'xxx')
-        .expect('Content-Type', 'image/svg');
-    });
-
-    it('fetches an auditbeat .conf rule file', async () => {
-      server.on({
-        method: 'GET',
-        path: '/package/auditd/2.0.4/auditbeat/rules/sample-rules-linux-32bit.conf',
-      });
-
-      const supertest = getService('supertest');
-      await supertest
-        .get(
-          '/api/ingest_manager/epm/packages/auditd/2.0.4/auditbeat/rules/sample-rules-linux-32bit.conf'
-        )
-        .set('kbn-xsrf', 'xxx')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200);
-    });
-
-    it('fetches an auditbeat .yml config file', async () => {
-      server.on({
-        method: 'GET',
-        path: '/package/auditd/2.0.4/auditbeat/config/config.yml',
-        reply: {
-          headers: { 'content-type': 'text/yaml; charset=UTF-8' },
-        },
-      });
-
-      const supertest = getService('supertest');
-      await supertest
-        .get('/api/ingest_manager/epm/packages/auditd/2.0.4/auditbeat/config/config.yml')
-        .set('kbn-xsrf', 'xxx')
-        .expect('Content-Type', 'text/yaml; charset=UTF-8')
-        .expect(200);
-    });
-
-    it('fetches a .json kibana visualization file', async () => {
-      server.on({
-        method: 'GET',
-        path:
-          '/package/auditd/2.0.4/kibana/visualization/b21e0c70-c252-11e7-8692-232bd1143e8a-ecs.json',
-      });
-
-      const supertest = getService('supertest');
-      await supertest
-        .get(
-          '/api/ingest_manager/epm/packages/auditd/2.0.4/kibana/visualization/b21e0c70-c252-11e7-8692-232bd1143e8a-ecs.json'
-        )
-        .set('kbn-xsrf', 'xxx')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200);
-    });
-
-    it('fetches a .json kibana dashboard file', async () => {
-      server.on({
-        method: 'GET',
-        path:
-          '/package/auditd/2.0.4/kibana/dashboard/7de391b0-c1ca-11e7-8995-936807a28b16-ecs.json',
-      });
-
-      const supertest = getService('supertest');
-      await supertest
-        .get(
-          '/api/ingest_manager/epm/packages/auditd/2.0.4/kibana/dashboard/7de391b0-c1ca-11e7-8995-936807a28b16-ecs.json'
-        )
-        .set('kbn-xsrf', 'xxx')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200);
-    });
-
-    it('fetches an .json index pattern file', async () => {
-      server.on({
-        method: 'GET',
-        path: '/package/auditd/2.0.4/kibana/index-pattern/auditbeat-*.json',
-      });
-
-      const supertest = getService('supertest');
-      await supertest
-        .get('/api/ingest_manager/epm/packages/auditd/2.0.4/kibana/index-pattern/auditbeat-*.json')
-        .set('kbn-xsrf', 'xxx')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200);
-    });
-
-    it('fetches a .json search file', async () => {
-      server.on({
-        method: 'GET',
-        path: '/package/auditd/2.0.4/kibana/search/0f10c430-c1c3-11e7-8995-936807a28b16-ecs.json',
-      });
-
-      const supertest = getService('supertest');
-      await supertest
-        .get(
-          '/api/ingest_manager/epm/packages/auditd/2.0.4/kibana/search/0f10c430-c1c3-11e7-8995-936807a28b16-ecs.json'
-        )
-        .set('kbn-xsrf', 'xxx')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200);
-    });
-  });
-}
diff --git a/x-pack/test/epm_api_integration/apis/fixtures/packages/epr/yamlpipeline_1.0.0.tar.gz b/x-pack/test/epm_api_integration/apis/fixtures/packages/epr/yamlpipeline_1.0.0.tar.gz
deleted file mode 100644
index ca8695f111d023b24c6ebf0e5c230a6cc79dd4a5..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1996
zcmV;-2Q&B|iwFP&aOPbA1MOPtZyUK0_vig9SRDe%ZM>1JSD_$v4|fOjbxG0Om%=p!
zYL}8&Q_D5Ub>ay6-#aAt?bRz$bPbL_AhARaXGqR)9u%MOip4Z0j7H?D=Xd??tBX^k
z3m6ZF<}aZB*L?2vhvVL03?By<-QM+RJib7~lh339iBwo1bRjrbyXf}yf1`MMuKyK|
z=$uI9KdsnFWM~DC27|5oAN2dF{zv0s?;7+!ydGR%pzcYe@4;_e|8p)@SWO>^kd#Lg
zWK6*GBD^9KR5lJzQN^I`-_VBsnKq&r2lseEypYI1&{!EBfASFeWl3e$ivk`gOe2Y~
zVTm%HzE_hQU_};OP$DPjmhpwW^8{f8OAtIG3VR--0g234ENS4Wrx-rd2!;u)rF$^o
zA)$h-NTen(5yG%kG>`;~V5u7rN`?9>3WCRW!QY{`98s94^vwSg&-=Aia~3q5{}3zK
zaCN#kaJc`^&OdmBk@NrOzz+Sx`8$mb9IyXjujk_bS+Ga{74P}E)^NQ3$K!s_>Hi!!
zO8+!kKwfy2(I09LN9+H(-@P6>{htG0r2l;2e<h?-Tg!z#`G0RT9M|+e>i35(|33$=
zuCA)dd!E`uWq?8|B?%Ph9sR%s`SI<0^tbo#-Xfiv`(7+~K&0eC>b&|231Z3ylVc+^
zr-X$Qv;qoUA=pOP>jhEMw2wSOlI}ykzn~FjDG6OfAZj|tlqCX^dnFQL*lQ!JF>hp0
zm7zzO;ptjx9E{~w=NMz9h=8qVzgQ~@eG0GQ4Z3}?hGqK<WU|d2f<Cf}eaRCMkPYyE
zu?{2Y({O`Y_TxhWLv@{@i<C{uyw(-K`I4J@tKLT47!mb>i+f)Q9Lbmqr5gj-os?QU
z`I3Gr@y`0-AFOrC@AZJ2Su!_dtyGR6zzmA0X~090311Q%5;2`KypYcsW<#vJvZTb;
zT^rfnZUYUQTvbxFZ>t4tXMUf|KxIS`*~tG{_YM&&{#X-{e#vZb7YiQc4Tc@~(YnbB
z!9{H|9x+RRLu<W8Q|n{>g3&akMVn3Q^fl>e{6CyRu*GcwV2}SF4Tqz;{~z|d&i|hS
zyZwKpZ-*HDqyxa;^D~skg61%gSw&{}bUs0W`k2|gA1tx>UUj;c=*=6{(cdmRt##`%
zCAU{k?e+Sv#@h1vv?|#~3ywqkNO8aWJaI9@`hw}BDrDOI$|N!zEhZ2)Xv9Ef+GqoV
zy$rL^ld=IT5Ckg{qBpwjw*BWk%CzrZm&vPL8TmG9-}<gjiQw|}K7V(>O0o^r@$M!K
zczQ3Rgt1+Vy=~iOGxLaiK!3q<`7@3?m&LT{98{9>PFXkG$8GEK60P%b8X=jZ*ltQ?
zJdHx~@f|R3-?dAkvLUQt2qV!#Eju-8O_dVhFoX~&8-~hcCY68#(&@cK@pcY6eD53{
z|Ka*2VkHI}M3^MUExOa5oOR9JFI{u5w&rGoCYdcaMbvBu;%Cvcx)2>ds}^nhZ}OEE
zMt!C4tRIQkB1<nUOEiibXd-rutS3yB;UQ0Ej2tk!Nct+{8IKkRjILyHpTi)}D=UL%
zoHK%LmYu{g5rMw2uX3oTm{ylDqjgaYgc_2>7&eXzQ0&W=8I3_y6xQ8-I@OzJbKT89
zHJTsa9qZo<ubycZEdFP#mcHOg6n08;Dky%B^lDbpmjPxZw}0DM<eR2<f_nKi$=0=I
zjLR0hCzah|kZGh?LA6BnveQWM9r|Uda{|Wr2b~QBJf@Hdm~E42F8E6Ctcj*F#t<Mn
zKmG9j5-E<<l4P<BpMnHB@gt|9K0ShmNuU|eAU56`2}{^^;@e-6<dP>WL^G1EDm1Kg
zit<ODv-;@!Fr<1Fn6anl=86Iwl?MBDPm*n@*-V&FHM-Rf0S&7*1Gz(5`DNL`7RFh9
zcVo-G-BRpHH-wGiY9-{sqV@J4B3aYz7Hq22gXL;hafn<^w_C0$r}xOMl(@Ua=1x(Q
zHcGD6%Z({uMR?i0)MOu#Dn6T^<@Y9&QxWspoQHqW#ZtkEr7Lsllz?<kAEl71^oa5m
zh_*-2-?xmNHgn)Ybn@{~nsdc?URTJ#mjmHLo|nMndeubnAxjN`w3Hm8w%@MjhK=$J
z`%3Pj8I_ZdZ?1g*Vw|S_&r77nJAi%nzujKF{vY>8Jy-vq14rNg=BnOO{Wo8;x*OJ$
z+_3)k{FB4i#UB5ElDB|+{67SMVg2|20gyZYe+Hzl`u@Qe_GMrG+|SD{2B1Xttk;-A
zr@3iG)r)`UHojdnoPTqb=<7@N6Uo^7`~P@Qd;dKc_gwyW7U;66rL&<HBnV|=XuZ@u
z#y#k+#%I5lCVft;sf+>H)>2Zbdk%XK{GTWl3%*B>Dn0DA9mNA-=)N`iO-s8deIs~h
zC`!+Nfy7pYt$RAd5!T;z;<Yh^kQNeEV)H7U-K#xM;>|?%&~FQ&$BsSr=hv^qKYQNu
zmDpFR$3m0Ur|EU`vSJGTW%Ykyvd>~#I{lKt!z7Ew^rg9OFB&sTG)9)U7V*$B)<Zmd
zg^<lY<R2o&aj5%Vkyuprs$t`Na6|s$lU*GYNJ}$t`$o6C&9Ch{92^`R92^`R92^`R
e92^`R92^`R92^`R92^|}zwkc<%(j;RPyhe{*6}6)

diff --git a/x-pack/test/epm_api_integration/apis/fixtures/packages/package/yamlpipeline_1.0.0 b/x-pack/test/epm_api_integration/apis/fixtures/packages/package/yamlpipeline_1.0.0
deleted file mode 100644
index bf167c583aab..000000000000
--- a/x-pack/test/epm_api_integration/apis/fixtures/packages/package/yamlpipeline_1.0.0
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "name": "yamlpipeline",
-  "title": "Yaml Pipeline package",
-  "version": "1.0.0",
-  "description": "This package contains a yaml pipeline.\n",
-  "type": "integration",
-  "categories": [
-    "logs"
-  ],
-  "requirement": {
-    "kibana": {}
-  },
-  "assets": [
-    "/package/yamlpipeline-1.0.0/manifest.yml",
-    "/package/yamlpipeline-1.0.0/dataset/log/manifest.yml",
-    "/package/yamlpipeline-1.0.0/dataset/log/elasticsearch/ingest-pipeline/pipeline-entry.yml",
-    "/package/yamlpipeline-1.0.0/dataset/log/elasticsearch/ingest-pipeline/pipeline-json.yml",
-    "/package/yamlpipeline-1.0.0/dataset/log/elasticsearch/ingest-pipeline/pipeline-plaintext.yml"
-  ],
-  "format_version": "1.0.0",
-  "datasets": [
-    {
-      "title": "Log Yaml pipeline",
-      "name": "log",
-      "release": "",
-      "type": "logs",
-      "ingest_pipeline": ""
-    }
-  ],
-  "download": "/epr/yamlpipeline/yamlpipeline-1.0.0.tar.gz",
-  "path": "/package/yamlpipeline-1.0.0"
-}
\ No newline at end of file
diff --git a/x-pack/test/epm_api_integration/apis/list.ts b/x-pack/test/epm_api_integration/apis/list.ts
deleted file mode 100644
index cc486fe1c5a4..000000000000
--- a/x-pack/test/epm_api_integration/apis/list.ts
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import ServerMock from 'mock-http-server';
-import { FtrProviderContext } from '../../api_integration/ftr_provider_context';
-
-export default function ({ getService }: FtrProviderContext) {
-  describe('list', () => {
-    const server = new ServerMock({ host: 'localhost', port: 6666 });
-    beforeEach(() => {
-      server.start(() => {});
-    });
-    afterEach(() => {
-      server.stop(() => {});
-    });
-    it('lists all packages from the registry', async () => {
-      const searchResponse = [
-        {
-          description: 'First integration package',
-          download: '/package/first-1.0.1.tar.gz',
-          name: 'first',
-          title: 'First',
-          type: 'integration',
-          version: '1.0.1',
-        },
-        {
-          description: 'Second integration package',
-          download: '/package/second-2.0.4.tar.gz',
-          icons: [
-            {
-              src: '/package/second-2.0.4/img/icon.svg',
-              type: 'image/svg+xml',
-            },
-          ],
-          name: 'second',
-          title: 'Second',
-          type: 'integration',
-          version: '2.0.4',
-        },
-      ];
-      server.on({
-        method: 'GET',
-        path: '/search',
-        reply: {
-          status: 200,
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify(searchResponse),
-        },
-      });
-
-      const supertest = getService('supertest');
-      const fetchPackageList = async () => {
-        const response = await supertest
-          .get('/api/ingest_manager/epm/packages')
-          .set('kbn-xsrf', 'xxx')
-          .expect(200);
-        return response.body;
-      };
-
-      const listResponse = await fetchPackageList();
-      expect(listResponse.response.length).to.be(2);
-      expect(listResponse.response[0]).to.eql({ ...searchResponse[0], status: 'not_installed' });
-      expect(listResponse.response[1]).to.eql({ ...searchResponse[1], status: 'not_installed' });
-    });
-
-    it('sorts the packages even if the registry sends them unsorted', async () => {
-      const searchResponse = [
-        {
-          description: 'BBB integration package',
-          download: '/package/bbb-1.0.1.tar.gz',
-          name: 'bbb',
-          title: 'BBB',
-          type: 'integration',
-          version: '1.0.1',
-        },
-        {
-          description: 'CCC integration package',
-          download: '/package/ccc-2.0.4.tar.gz',
-          name: 'ccc',
-          title: 'CCC',
-          type: 'integration',
-          version: '2.0.4',
-        },
-        {
-          description: 'AAA integration package',
-          download: '/package/aaa-0.0.1.tar.gz',
-          name: 'aaa',
-          title: 'AAA',
-          type: 'integration',
-          version: '0.0.1',
-        },
-      ];
-      server.on({
-        method: 'GET',
-        path: '/search',
-        reply: {
-          status: 200,
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify(searchResponse),
-        },
-      });
-
-      const supertest = getService('supertest');
-      const fetchPackageList = async () => {
-        const response = await supertest
-          .get('/api/ingest_manager/epm/packages')
-          .set('kbn-xsrf', 'xxx')
-          .expect(200);
-        return response.body;
-      };
-
-      const listResponse = await fetchPackageList();
-
-      expect(listResponse.response.length).to.be(3);
-      expect(listResponse.response[0].name).to.eql('aaa');
-      expect(listResponse.response[1].name).to.eql('bbb');
-      expect(listResponse.response[2].name).to.eql('ccc');
-    });
-  });
-}
diff --git a/x-pack/test/epm_api_integration/config.ts b/x-pack/test/epm_api_integration/config.ts
deleted file mode 100644
index 6b08c7ec5795..000000000000
--- a/x-pack/test/epm_api_integration/config.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
-
-export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const xPackAPITestsConfig = await readConfigFile(require.resolve('../api_integration/config.ts'));
-
-  return {
-    testFiles: [require.resolve('./apis')],
-    servers: xPackAPITestsConfig.get('servers'),
-    services: {
-      supertest: xPackAPITestsConfig.get('services.supertest'),
-      es: xPackAPITestsConfig.get('services.es'),
-    },
-    junit: {
-      reportName: 'X-Pack EPM API Integration Tests',
-    },
-
-    esTestCluster: {
-      ...xPackAPITestsConfig.get('esTestCluster'),
-    },
-
-    kbnTestServer: {
-      ...xPackAPITestsConfig.get('kbnTestServer'),
-      serverArgs: [
-        ...xPackAPITestsConfig.get('kbnTestServer.serverArgs'),
-        '--xpack.ingestManager.epm.registryUrl=http://localhost:6666',
-      ],
-    },
-  };
-}
diff --git a/x-pack/test/ingest_manager_api_integration/apis/file.ts b/x-pack/test/ingest_manager_api_integration/apis/file.ts
new file mode 100644
index 000000000000..33eeda1ee274
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/file.ts
@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrProviderContext } from '../../api_integration/ftr_provider_context';
+import { warnAndSkipTest } from '../helpers';
+
+export default function ({ getService }: FtrProviderContext) {
+  const log = getService('log');
+  const supertest = getService('supertest');
+  const dockerServers = getService('dockerServers');
+
+  const server = dockerServers.get('registry');
+  describe('package file', () => {
+    it('fetches a .png screenshot image', async function () {
+      if (server.enabled) {
+        await supertest
+          .get(
+            '/api/ingest_manager/epm/packages/filetest/0.1.0/img/screenshots/metricbeat_dashboard.png'
+          )
+          .set('kbn-xsrf', 'xxx')
+          .expect('Content-Type', 'image/png')
+          .expect(200);
+      } else {
+        warnAndSkipTest(this, log);
+      }
+    });
+
+    it('fetches an .svg icon image', async function () {
+      if (server.enabled) {
+        await supertest
+          .get('/api/ingest_manager/epm/packages/filetest/0.1.0/img/logo.svg')
+          .set('kbn-xsrf', 'xxx')
+          .expect('Content-Type', 'image/svg+xml')
+          .expect(200);
+      } else {
+        warnAndSkipTest(this, log);
+      }
+    });
+
+    it('fetches a .json kibana visualization file', async function () {
+      if (server.enabled) {
+        await supertest
+          .get(
+            '/api/ingest_manager/epm/packages/filetest/0.1.0/kibana/visualization/sample_visualization.json'
+          )
+          .set('kbn-xsrf', 'xxx')
+          .expect('Content-Type', 'application/json; charset=utf-8')
+          .expect(200);
+      } else {
+        warnAndSkipTest(this, log);
+      }
+    });
+
+    it('fetches a .json kibana dashboard file', async function () {
+      if (server.enabled) {
+        await supertest
+          .get(
+            '/api/ingest_manager/epm/packages/filetest/0.1.0/kibana/dashboard/sample_dashboard.json'
+          )
+          .set('kbn-xsrf', 'xxx')
+          .expect('Content-Type', 'application/json; charset=utf-8')
+          .expect(200);
+      } else {
+        warnAndSkipTest(this, log);
+      }
+    });
+
+    it('fetches a .json search file', async function () {
+      if (server.enabled) {
+        await supertest
+          .get('/api/ingest_manager/epm/packages/filetest/0.1.0/kibana/search/sample_search.json')
+          .set('kbn-xsrf', 'xxx')
+          .expect('Content-Type', 'application/json; charset=utf-8')
+          .expect(200);
+      } else {
+        warnAndSkipTest(this, log);
+      }
+    });
+  });
+
+  // Disabled for now as we don't serve prebuilt index patterns in current packages.
+  // it('fetches an .json index pattern file', async function () {
+  //   if (server.enabled) {
+  //     await supertest
+  //       .get('/api/ingest_manager/epm/packages/filetest/0.1.0/kibana/index-pattern/sample-*.json')
+  //       .set('kbn-xsrf', 'xxx')
+  //       .expect('Content-Type', 'application/json; charset=utf-8')
+  //       .expect(200);
+  //   } else {
+  //     warnAndSkipTest(this, log);
+  //   }
+  // });
+}
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fixtures/package_registry_config.yml b/x-pack/test/ingest_manager_api_integration/apis/fixtures/package_registry_config.yml
new file mode 100644
index 000000000000..0060e247827d
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/fixtures/package_registry_config.yml
@@ -0,0 +1,3 @@
+  package_paths:
+    - /registry/packages/package-storage
+    - /registry/packages/test-packages
\ No newline at end of file
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/docs/README.md b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/docs/README.md
new file mode 100644
index 000000000000..0d19532bae2d
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/docs/README.md
@@ -0,0 +1,5 @@
+# filetest
+
+This package contains randomly collected files from other packages to be used in API integration tests.
+
+It also serves as an example how to serve a package from the fixtures directory with the package registry docker container. For this, also see the `x-pack/test/ingest_manager_api_integration/config.ts` how the `test_packages` directory is mounted into the docker container, and `x-pack/test/ingest_manager_api_integration/apis/fixtures/package_registry_config.yml` how to pass the directory to the registry.
\ No newline at end of file
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/img/logo.svg b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/img/logo.svg
new file mode 100644
index 000000000000..15b49bcf28ae
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/img/logo.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 64 64">
+  <g fill="none" fill-rule="evenodd">
+    <path fill="#F04E98" d="M29,32.0001 L15.935,9.4321 C13.48,5.1941 7,6.9351 7,11.8321 L7,52.1681 C7,57.0651 13.48,58.8061 15.935,54.5671 L29,32.0001 Z"/>
+    <path fill="#FA744E" d="M34.7773,32.0001 L33.3273,34.5051 L20.2613,57.0731 C19.8473,57.7871 19.3533,58.4271 18.8023,59.0001 L34.9273,59.0001 C38.7073,59.0001 42.2213,57.0601 44.2363,53.8611 L58.0003,32.0001 L34.7773,32.0001 Z"/>
+    <path fill="#343741" d="M44.2363,10.1392 C42.2213,6.9402 38.7073,5.0002 34.9273,5.0002 L18.8023,5.0002 C19.3533,5.5732 19.8473,6.2122 20.2613,6.9272 L33.3273,29.4942 L34.7773,32.0002 L58.0003,32.0002 L44.2363,10.1392 Z"/>
+  </g>
+</svg>
\ No newline at end of file
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/img/screenshots/metricbeat_dashboard.png b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/img/screenshots/metricbeat_dashboard.png
new file mode 100644
index 0000000000000000000000000000000000000000..76d414b86c4ab447ba7334e7a4797ae7e137a4f4
GIT binary patch
literal 94863
zcmb??byQqSvu}U^Nw5G3F2O@^XV4G`E=fpmAKYPZcbDMK1P|`+?hNiQxDGnFKF+$|
zJtybBKi+$5y<Th9?%h+nySlroyXsfn!C&MhFkTV8diLxYhLoh(w`b2#g`Yh`s(yj;
zRC1j6-t+149P~-*`-`XK_Ci1C>7CH-vx=Rfm7$%ZuC2i{BTFj_111pA*1*6LWNc-3
zgw!hZ?Ag0#Qeq<Col;>-o*Lh`(=H$JeK=GIGYz8qW~pW8U&vX}T0V>Mk|LQ$G5;`Y
z)txO}E51MrTPm(;lo@ZPsis+w+gWmDTUw?z;W}*YQe(3i&HmJY9sS}OL4~6#fNc&l
z*k)A!cb|?v%FiQmFT{=^uXh1W;7C+Y-tE-=o78=cZLb-ll6}APi;D}&f2C9GO$*_d
zZDI5gqGEq0{ZH?&>HkGJ;S&x1R{=ZI|1$|YsndmGQ+eWjdOoHY_4AlXZI-AFBh+qT
zX#1(CAbuUB+b+3R+TrJQfM)?x{d3YBPP(M?TQ^10KI)S)kUhJz>p~viYwZ6@QP}9@
zDM^PwF8qn!Y9`^5ZNZgqgjhwutfhcq?w#J2sD@t)`fHjW-1P_`9<OFBb@mU7%~jO<
z9zwCxA)=bsR7Kip{(?+N8=U+}g)?wTXVUb@eJasU6GC;Zmio}=v>!#KJ(OS{s9@mQ
z%SYI|Q#yz(Ji=E1-kuX3bZ5-_;}P_5h}vj_x>OmwR^+Yy&4K&kF<`!x4I_mq{0{rE
z&)5ihQ$=wbnCX7xa_SH;o~036GD7VM&4IIG(Ok4}6B`fe!&D3VS?pQMjj&x7V1o)m
z#0v7eV_z>9TG_&j)^andW4Co7L*P+Vub}@*8p#0>CTEY?7W$9hQ7_n5KnFS27I-H8
z+~)lz`ddW?z<RTS&SbX(xme+f^wc5FXbbM>37CHIQlFi`Ia+J$2sswId+PZorxTYz
z&y8+ky9Me~u5u3Hn2jL`>#!<|byN0<Xes$Yefw1{4e0>6^oK4ZRS?vVsdWbA0Zu&T
zyZoA%(%;~d_uJIGn*i8N1ngQ+=~hJE?;B!5=SvqHSGf{<ah;An8kiDNIpV6MZ;{j&
zxVEvW$vncbi+J7a)O3Ge?aXtHoA@mJg?+Etx1$xE9u3OIdlG&dpO6`1RXB*pY}(Cx
z%?tw<ceu*oRWBMQbL)X6BgKIg<^JR0dPa8-1z2rOb~5%LOVFKu%$LWh;5{g@tSfA@
zR)YWh2c}zp28`I(!T=M`%<fo|C1ey>TeRFU(&TjPYQsP9p0RJ;LlHnTxAiiF=B!4F
zrJ(og2Jq;HvnC<~1=8Yn8lo#|g1w9Tw&uSFe4G)W{$7(DQXj=bl`zmZRJB={^}h6(
zgc=2nKfTKFn#1&%KD(T~e#~GcIJ}<tcW}S1=qg@xG3{}k&17Q|ImcAHTm)KUYd|Dw
zgh8tP&2jwzy^40n*Ft}IAfr2sW$|M$e_&=BP1kyM(L3;YH=Mo^8erphx`Bu;<AxK{
z(^LGJF-<tw{)Xhu_NL+%Ck|Ng<LZq$&d4&3T&xxIud<@BI{{pE86KU+-}r)6uI$$2
zD3QG~cQ<Liwl7i8bA#{X1XP_9BKtV{n_@GIJx*uvzD)7`eCD57jHPK!M!jKRMMc$-
z#KDo;r&<|QsZwWkjsIKTzc(Gw)&Ahlw`5hml>lKs>g5k|JFca^Gr}!RCwt!xX`i_O
zfxZ$(JvR9Qgs%mYSjh4Y%rRE2*95umDpCPhmUO4R5X=QkF~81W$GW40%^_!N)F|P6
zeYs94KGdU$sdf&CQq*w_sh^;VxJEyNIS8DRLB!jG86x8WK{`rbDJN|;8u8_?yRMFC
zk;@Z&b95yLN6{-Z&H!vovW-r+p;>8nZd=t0bRnU$c9eQ0R>`iB8hl3|^dMhSmRFRf
zHQBx=b%=G3ETZ9HB2=$POFhrwoky6T(@vBT`OI+sc`iFAC+a*1iC21ek0gXt4mJd#
zU;-pf@kb(Rk>t?CVm+8f9KClX@26sT`rel4BK6aVhe*55b4O%<GY%;kdD^*_<nT>q
zH;V3QZMO+|?vexW2e3IEgE1_tDtk=K&W>|z>zX>-YUP0u*Z!8oSMMbW>H(%S98^ZP
zASpjcSz3p3`BR3Y$ztAQJ_)k-m#+3_&w=_DzVYbS?5d>059}j<D(_I#W+%cZT8qR(
z7rNt9^{3;p4yX@qr(@!;UqrlK!~M@%m~X_I#3~_i8Ez&fflF%foJ1fR;I_$v#XmzE
zqb#)ixP(f`Kwyt<TxFBpVu8@Bj%X?T)NjUDgM;)MDWXb-v<|M*-Gr^jye6l!eVVOr
z7Th?tu9eJp8B~+lo!(5pICK}N;Et*CKFQQA4;L!ovi4ZFsO?|LDyj1dNyIRB-}9(Y
z#7VSDhurzSiQh5=5?jbFJ3fv6MwG$PK7LXm&$nex<NVE^C9B_4t-w)7r5->cERqG4
zO}jM<Q%b{5yqXf?RI$VD!i=H;G0S$oZ(9<$g2Mjx*K=i!vB}umN6(2X(Z`h$!+$7<
zX=BXO<ysHfcXb)DF%-w7SO}<HyvUIkj!)IAd4o<ZbQxs@G19g}oI_TB-(SAs7=J1`
zw^R5I1?NhYPc0?TLjeWWS+#C)4lGw=OBucw9ute4FG6z9XW1%}<-ZuJ7N~%HR&=H?
z16A}@E%a+NM>QLz0G%u;Vjl=#M_wPd$#;a3lZDKy3>B-Ye^x!P%*#%qkD@tk8}Xt|
z;MCP02s)gVt`h+mk~hJvalXQJDI?^IJ;@Q`hpzYfQ1MHOLywG5u1o!i>ll*cmbfky
zGfvP*{ETRKs3!&UI%dSZ)7#!@m0h>;0MrNe-vfut1KMtp{*KH!2fYAJ=skUMdZA&b
zw#!KT*ZW1ZA^>|r@2Tw$(-k|vB}{LkhRDH5Gzi;EQJ`|)K0R2oukbNet~>mz7uaY(
zTQBC4DE&IGapx|N#(c*kw6}+~@!D5eYb6chk)91`zr-;1-~;r_4+IqPtY&5o$+^fA
z1yGc}J70C8j-+&??RGV@hAj-J0qOVAF4icLyODD?@(3kISn_gn1C}lqZX!XIRzQj$
zC;RlpzkgA?W|szD{bo?>6^-EKj#Vo2gvv{wf=2GyHZH$a8<3w|^XKQ6W@Nr6RsKr$
z*}mnq-ae31RSL2oJJ;f}cWFVpp!i8Q2@SD_EExpJ)3K?lJjytabz+~>_$qO~jH7hx
z@J)&Q*Kuy~MuJm6^PEg`R={cTb&-5|#C}TBft-5ZU@4t5h^_vmFSx*attL8&G&0ML
zJYD2=CSe8_2<hSWJ_-J>MZS;owRO?EK7!Gpb;<S~b)QJIRjb^h?0}7qZw|`ezx=4d
z6g5Fep}R#6*mA;=W&ThQ!G3dNDr8y%Gkgg6b}_|2s~jC}W%lrMR-Al>h&A0Ig}Q}r
zpztocbg-T1Mr87BaaJ3)f`|!5M6zv2MRV-NW~Jl1*<Ul(AtOA$%Og;=u2eQ9;+%Ky
z7r{d0R4e2yW1DRTLA~5{iZs-~tl);Io+)2}Kp#OxaZh=<C-Kivkey20e?ud*`u@je
z_!Wjpkv5opL%{vPJI{!det#y$@OVN+tJ`TDi~!Ebs&U@A)Nd0COHhi8yvfw4U_a0|
zEH=ES5{b9G;8CpUmNFc(eCp=cn&qy;I}&b~Om3MS&)XlHZ)hjsU&fZlVnXomZmp`|
zShnPHy31|G!?{jAxWDj!-aVHcqZV@*oty@{rMl7#mNthub9k#79@Y%!)^AS!Lh1+(
zV|}(d)OaV&UYgF8T~|kpU$MHUDuxIuX^FTkIR%yF043{AcxY|GIjv!4!V={e4kWzG
zJh$*O*Ejqf^(?LwGFt(iL#m5zimy_b9Tj0aFPM4`ndeL7H<A{Zs1ps@jA*SJ{ChD8
z>yAbsHkI@whM%L7qWVtzz7P)#GqAXO9n?@82D<e9){`8R?^M(pnfp<e;_&ToklN^~
z$wnJP-62Iqy)4?#m`Y4tH95hz-jK)Md;HvkMN6Hmdmj(Tl_K##D|#y=&48}|c2S{W
zO4jbo4d)vUiW~;d>x8u40YBrmAb<hsrO~I)&YDp2h>R|7VgIu?42D#%EvP{G$h9Ch
z=xYG6!-Tx_2e)hkx=WgmzTIP5qH{vHfb0FTr0~~*;BMm6GE~joF0Zjs&%^0Acndv3
z5(`HkHXoXX>lCLeb+43RK3#&s9K<P=sqPYx1MRQmqAm^{e%*BcF~?&Hoz0m0`}>VN
z$4@VjCHpjgf9-kY6OIth8S%!vi6)zk0qF$b%$NohW;Gb0=4cn4K#ssbHjvf5-?INw
z5j`|TJXbN}ZR96jt6xetW0-3-`yr4d#nITjy{Eco!ZN0NB5cs89ZxtwU&^z!kAC*!
zfEyLT@T?NvPov_DD!ml}UyaUuKB!05vi3R|RxCvmSraXXXbKZiO#a)W-!H?zri+U7
zS|bVM(PowgEYdMwB%1NNqM_0VmH$+<W5WSIV<xeDCuDIpxB6_1dwdO{*4L()p2Ijo
zhke0K2+*Aq8~diRx+*L>(3Xv#OwYpO7mG1L5M;!_#*<*H%FaBoyi{FU`!a-<hJ(;|
z(3}4YVa&-bOBb|RF^-2-t&*O30B}1m=?S+yMMI<x_9YnXD5lzxaS_MC{J79)b<!5<
zxjKc_a1$MsMrx<E04Au`fB;QcY%U>#&afNE@y9)T##;0=NfLbiE9RGU>^>PX^Xau%
z)EZnVBQpwPC__(%Ywn@(G`gy)10EVM%b0H*Qw%u*+l!E~X=LbU(^fDpC+@Jj?_e6?
zaK~T<r3x-W6C8&nt?I;np{t3Qi;pSrEE92n#QDwauacryK!=wv#aT9e9qj<t&cylB
zwI`!15RBj|7u~biW^cc$cl#xcX?1Q&6-aKR<{o#W;Wpf8EoqibUTl7|^Q8Q9O*tfi
zgA12|fivMOn|DXr&nGk*BC6Qiw!6(_sg2f^PA6^^gj7hh=p@RcIj+8kDdDXBGOT)q
zJN@lvqxW5060B;wjF~6!%&**2xI^=(BR#=4?~3Bp<<Uk)x9`9UyvsYg3X7CERr}bu
zdicrI_b<3HBk|9@f`b+Q<37?R(BvgDnL#k53FHjJc<EX)KLQCwdcDL6Bwle_u3}mY
z4VagsFNch=jt`{<<68{oWK*KeJiL+y570ICb<7WU7ZG!I2-__VI%%1=_g43eS;p|W
zarD>>V&D2FT{)o*W8$AdC@`Eb^3L2O8e5-T^7bHYb|AZ8`m+Y`?}1DyZ%p62>-qHf
z_0lGvVIa?vx*y3r=h^iCJX?#GD%YYZaNDnN%m1Otiy{X0@&ngO<r!sFy^RMV5=eY_
zE9cFd>a{**1F#W2gM<liaHU0`^BG&`a+>*b&lRXq%;_!5tUD)-yVGlkN64!|2#r5*
zybq#4ep%{+CgYKAyscyOW{?F{zN!1vLVm5nYIBO1nF`0)<>ZploN#uoEqbA~t(;h)
zY`qOUcUEXi*0Lmjez1)b9>pP=Uxj)TQ*7;F%W2)zu169?<<`~NyI-83mBDb$zsSl~
zufUr7(}JhW!-(|y#ADz>wU53Mk*Y}Dq6{uMY#1MLGDwE9F6PGH)w_ah2x$Z$bvxM6
z5uZwzn=i`leq#`CtELG|wYhV*>i6(ta(+p$v{?ixY}2nszwc!KLLx`yhWGtx^Qie2
zx74+KS{z%XJ`i6`W3I_lgYVpH@YdSX5>W!fOjY$u+j7M)BkA2o3@3}>*-G;_aY{Cv
zJgCZ_N!fO3sAYBB{<A8v*Q3*Nz_%mM_%g9IMq@|Oh#3fMNa$ysWL^N30_aJ92lX^K
z(IAIb_A?DrIRamrG#+iklGVKR&}=l!h7Pz@hw!$DQ*7$oSUvR^FkLY6*4$7F$Oi9e
zfJW@VQ<r1R>oU^P89$RQbMc?sqkfUAnD(oXlzc+afvYy<M(Kf!*G<acY}vHL$#fts
z0Kv4|(EF7UM#P22mIO=g?;eq{<E44hNnV6P3-m$LOSButG#_rTReK12Eh<5=JKe8S
zoAcf;5122mhSEBk+Nl|#ZU}?RH~AhXuTfcQEADJ}%uQCOek+t`2<N{L<n(0yWIE27
z&}gMS)NZ9Eu@EZv-7dU%I%9C>V$?1>4UhmibamWWB*3AZcRu%Rmq^{xkwLXl{v1fQ
zZVk!`&PvOzX(vz5+!cF)aEo<v%D_>-37_#V1MQeIRI(|@ebrJD*ZhQ;M73lb?^GmC
zcOKE!?4jXFtiF~Mi6-GyzbBFAOJ{j&4bVs|if_rm^y%6HO|Jw=(bYa?pa?}YjDTgy
z#_!G9IiTh}=7Tx!PzPQ~L*&Y_rp56X;5Ms7?5InEFlZJlU74LGwt>3su_fuj=VgR5
z=nPyL?`z`PO2%E<_Vj10)p_x}&7X@+2_KY6-`eMj$Sli$`Fp~V(FrgfbbTo;HHvY+
zoJj(aDZ&ua=ysfBjDboCC{)w>#B7I3ixdIGdv(*!xdobG{j)I{hGxz?M;n#1Wki9O
zXjt-j#Gy=GZ+dg)v6yuPj&b;7@(rq^Rva-8sN~LhgL?7sSL&X&llFA_ETKHw?9zxQ
zQ>Z=BOdGN4_3f`q8cUVNsQZ|k)5YuAN?f)pv-fivJOks|2a^`dvf<E=dNpa~9#ii&
zj7+?^!N*&U_10|Ug)~<sF?46GNC7aMJ&sGg%T*~CD~rB<$jBkte1pr5fO~STBXo83
z(Jft8f;y!o`6J?MLar2Ni{5<eTLfXbK%!YYr%{bo+}=5xtLME9I}6L>^6DE!Esj<Z
zB5-ftH?6M8@-Dm=3F2hdewA)xaqj&?s(55|*klaClIOu>JAA|KGkddV?QsG+p|8l+
zjSbyHxMr^DJ!*oLn*~RwM9xFQpX?rw-;cxizguD4mW_ty+k~-PF|azKkdPF~enNvi
zD?7gWq%T@3lFl)K4%+-=%A~HBd^hCcV=8*GoXS(ylc+7_c56GFN=7d942*`4V-9Wy
zWEz;L5~y*j%uw0<PG2nY^ah*|hOq2X*<IH!$ic(LH98J6UneFptJde0#iWK;j$Ve-
zIZ(ZHM%KTssVJX(t492Jp<f#QP3?O~=Q<Mf>t0Rl7wjG3Hxm1^jjj2Q?ynE(Qkk1_
z6I<;2d%I<CdMMciQ~IIflb3C;Tr9kIIBmxlVNA?fJ*n=NCV?*_|9kgfCS$01{=0M*
zDvYwySzVd!*<_ZA82;9e6~!+7*E$nLn3-%`)-63$St4ftefouiK*_!NoQAwv2&sAy
zknU-_5N9(uz!@IL*bjEZD`zfEY{tYVi$sNt(e7RFi^~Uz=an;~4ZI4?=ifsD2j-^v
z$JTvQNg>n=0fyXqL-%+2ArIh-iwAkZ^piF;LZh^jFp~}abTbKXZ+m<ud(#EUxH!=e
z<`v1S3)z>)smVWEh(3W6*VtyfpBvBrd~Qr}OLt<J3<e3;pP(cUa+j4@v&i}Gn_B5v
zt@3fl*0XhO+j`2c)Lgg<lANQr&@E8RR&wg3D6|RAY4whbyYp(0&AST;lsq}xHVn%{
zQ?q$zOtu+!q^up+sEv`inOL<7@@u#~KkwY~E}XX>j(LVYFm7*=dgi)J8#!$qwYDL}
zKhWrv%Im9}@<!g9;_G4w4K790zhP+&a5j?J*+?4rfb*&r_d*AdR0`3VSPEVgh&QI%
zsxaxU=KLW9X+rfBU5r?#Uaa?9D@2XY$JpLtVbM)Fe|{Mki>-9UIEXd0;mu{TXz_}s
zXN;iEwcA4A^$C9b;~9_G!#<ihpA9J%s(auzJqZhM-Cd1(;uQ<x5FIE7Lw0u~JA4{D
zEc=al2Je!Li56|BB3?{=&CjI~kfV#VmXL!2_8fh`KK@jA#)B~)zPSO=$2U+ZH>QF&
zrrLkA4kd)UD@HldzmPZKY~u|(e7|ff;iu<CY1g~*xzqPUT;FOe*=jb-PZ`$gTi=2D
zWKV6nEvurGe@dB2QSe6wjEj#kGA$1Ai30XH6eZ=gC7uAc^Ca(O>%$CF5ZRo`6Lu=o
zzhFXL`u+$uzp{>#_Q_*R?M@v|?{M`gsPS>JV%%E!hwg|hc~wyxb=QAe-T1*#XXpO2
zOIT4B5NZyFgip$N&Pi<TSfoFGmHWH{e$473a9X5{wF#$Rv&u1)LD;vAk8W{dOEL@n
zU2d*3NF^hoxq2+{B+%jJuNJx+qNCHgHxl<|Qxim8T=<e0;O`gJB=&=*h|8C>Kk0_V
zbS!e3o6MQN=P9q*h{`Cncx7yQ>)i-Dl2lL-zO8gJp}6%v2}jlH<K4G2pr&c{!(emm
zhsaXUfCO(D_vz_X1P1u;5CsE$B3C0GQj>#Ph@`=ZH*CsTTq$eqFTa$cTD^ca5_tM^
zbH~1kdb{1J>LAQ8G0`{FPeDf)Q*{=%sJ+#NpYZu>f50zoGMj{ZQW?~x$lbZmlgRGz
zD3)-v7P@fpJA0ZU$gsYR^s6K@8SA_^6$X<+ZsmR#j&0Z5<S?ORA0gP~+KIf|8t%KI
z+S*#jPtwsZC&g@($kOjVkf{kwmG^bQ%dOmrXy`X%H|0-Vk>>|hQ?#VjR0;QcntnI@
z2apX4(%{>hO{|Gn^2JrlWvrPL5R-1RIJH>=#VLMK5mghRn8S^ge5JAab#Fk1o~g8B
z4Avg{5|oPJ>cCt-M~{2|K{v^ewxQK!K><<PLn|}(E_In%>$I|2ATo!4V)pv`VdBhp
z{Qtxl{(4;hCXn<9Xo3}Mm=}Lv1dAsNhDwkql7`C0-V<|_=jAAV0U;c%zKA;7(F&1H
zmefkf>B{??*PtLbM&qq*nt_?+h?yf)Uj#)v&SXL%xvP1T%bOEmn@$L=%Qt3o+-^X9
zY{T%Z?JN4_pX}XcKSTehL6(`xmEm8ZmkFQv=C^;ah#h6}xnJSW0_-Hb*t<7>mPDC|
z{BI<bJ_ptteNmy<fqyg?)R(AfKlMZ8(xxhPBUJq{6ieuAY{3=VC)x%L&6mMY;#7NI
z2=Z8WT2W38T_C=~AqUv{&Cbr+puYc;Np?atH8mev;WTomYmE~!myyu~Rna+!j5@(t
zI)z&gdMZ@ACl8qUiEm)R1820N_Fv!1Jw>Wcb1ZImc9A<i216o!v|gZP<vq?LC-pj$
z(FlM3BUGh7zk6`7DQm?tY>^iWzmweCJZMc{leIcZ#Q7!d5%NdJ`l{@<WLb<xMs8vw
z<5@?}E^N1ko{!v->~ntm*Fc4uRJkcxv7Ds>Kv7vy!PB5EbfA<fimXR~KRpKXpL`~i
zjGd}BpJkp~=J_r^m=O~FkBORy#sl2%5btw+KUMsLWihc_<bQWUOkeHG|0fdAHzyl`
zbKba;{C|h^gys!F$`_<ncRS4T_>1lL<uQuAH%E)zM?$w_3Z&w);u((1&UBZ{t}Lpm
zsxe>huA7((3QPfu;~`j7xxZD`q7P=*<?!<!=-0dJUGYci-s;aW7lY30Kjfb=Qw$oW
zP6B%d_Dk|=YNEE3Sac{2MLx*DP7)!9tL<NZ$aStN-4O(-mieJKzE$j7kXS8Q>lZAh
zE>>$lmf0+EN!1*-VN{Rvw(rY#{q0hLvtBWkos4?0u(J=f>@p6a?9rp4=X$$OZSNgw
zqZx3zHd`GUpZ!B$g|2jj!omdRX-S<MZOQ?JLA4C-J`^eri(;Kko^DKNu^$e%;bfC6
z{(u#*N0;-(>E`?+4t>2Jdz6*GMCtE5Dr5Bu@rs<AVJs>y4D`PqWYwzu*^5_Ixs?Y|
zTn69*FZDn33(88L!i|J)2~)T&){a*@@79GM*7d)$1*H^dLe?W1eM{$=5|7u<>#T_}
z+Oh6~;Ps~Y=RK7$92qwstV>;<u-z2Yb%0@!0OxcqPE1wU_fSG#sGR5~*~Ryyx?W3!
zHqGil6e~)?!gy>^hVUP8uoA8`IWOb|AtFa02f?rMF<%Qm_wWb90<$F*7@kkgt!#gx
zN}OrW4t({zX3ex{^ZGy`s?HoaKR#F<Pb+MnJrzMlkCGO?L8p#7j|0XpZA>572Ir2~
z1r%MCPYJpJ@~Km5z8*;Gchfk6|JIT|3C-<bJhFRH+{e=TxGl_}u#l}>KLz*-zVNVI
zWsj1Q`nrdbBkhUCK%4i0z)hD-lfyo#!1>%R7?dPC%=OsafiM5j&%3Trs1wKlgYCG*
z=b-Y5@_8(8RtB4!WM(4$Lenlo6567rxla1|vkg~4p#8G-(Vg33zU!}NW>ywm)`w#k
z<MZC=RMQ+5WxX!r3XBwk&F&xSpY4HYTIgL}G*RVUJ#&j8y&^v>sD_zHuh?F5={Mr{
zmMqyZ_P;C0h*nPK52`o#;YpcQx;Wp1r-q<7i5Op022N?-w*T7LnB0TM@><k9IxTEt
zrN4Oe%9@)SD6PS@qv4yn?QF4~Sx}K|$a2-Z{E*Tuc^Bf^U-rBdy8b)2AtR|pD)ws^
z?R>vvL`JnKK7_ydD!KOLis5zKtgx%)q{GE3*$KgKcU!EMFxN8mk*WRJ=J2g6@8?s-
zHY%)ZIS=_9y#ZMNeHP$=w-~ANawyx-AeA3E%YQOkg~)8lsa&Vy^SUllaA9<L;xk6-
zyq<Np1_WhOl<8j!5@sLp&xhHlmvnP88n6`#+*KYqU#BEKACWd)@`c#zqwMU9ic`^M
zA*Z+_<E<+SXil~Hd^IA7Smtp%{7|EOqiXB0m5-&o=}>^-0GkYRV?w&9ZgI`!Vk1mF
zuT#Hwuhhpyy?p#QGaT92;vGM^AyTP&d&FggR_wvr&G^nfIL!(4`yAs4t#e`AZ_Jbq
zD8iw@(@5blSxC5%oT@GFW=m2X7w%-9eE-j>0o)zG(9(wrZ^t$ByTO_0Ium(b3yWe{
ziS6-qv{L$rx|n$1%P+z#E!WC?f#~7lwu%FJ^*u#h+x~m73s6NR+Rj=y4^*eq+w6DC
za@a|m>wSIFoIcc<qnjr=IP@5FTr9d+JJ@fQ#?jv=ndKCf)Tdf&U8IBEi~0RzZktcl
z6KXN!diXY3(Q0*dKg-1BP}S1;{<~MjGeg_X%+CT2u8e5g0Ta6x+f&IXhaS84530Wf
zSuYju7I^S0whG=;HY$9(*IW8^K#ma;efK;lB4SIq_2#Yc-6~f7(<<qFchXBohhWN%
z3p8$<gVA`z8dwTeH|Af^R+!7-88+1wIF{$lcNL(Ud3JQjYS`lC<Kc>f18)Qs6z7Z$
z>`y;Blh%DGWb0l~t)@otEoVtvE1B<x7oRMae?SUtkF1>vH2IQQUY`-A9$&nsRf!GG
zOCQK%$gh5`VCmmABMXvwg9h`()5mZ~7j?>qYKHUJAYabPuGp8kx>CjeD3ro9@JY_|
z9zY=vW|-FDAUttis=Co*)$7vJZpS&|PPH)$V2&gDl_nw7146JlV@pJTp8Onk?$S=;
zi_kXV)2l;ab9|k$UiRg4C~DF3IU#Ao!F}^zG!6)aN@%3juEy3JjP<ZyaswKw>Lkq{
z)lNO-Vg&&Dq}d)9OxJI0k=E92ExJ-PRF?d4Q_PHnO4dIV4<e|5KS=O^u%H=sV{Lf#
zxXQv%#oNO2lxN_Wfdk(g&!79;i*3y{=AZHK6t&mvAnDTRNG}(3&as<Vp1BjsKF-by
z83W>xRqm>@w21%Su%pW1iY=G#O5IJdJ=L7K;5Wi)M#*v=(4N=VU0M%DQ+d}D33@>r
zZz6?GaOCLGj_*%cORMe2dg%JfSk~}8apkBzJ~+0vH3-|=R^%hX$#s@H7Oo}|D4h@D
zgyEU)2y+R6mp?}BLr#S`k6RzkghocJOOklNJ_b^5RNN#Z(=pFH-9i)Q@2czrL7hxe
z0`~iFhjt@xbu^J4;hVswvFQmO#q)T7-x^Q1)D$?tH|0>{(}@P%pr=|lv6zkW1x~uE
zO|pN^(Kl69xm-tjxfyQu(ld>UH-?pN-IU41n6_{b9q;rUVO7z3`Ap?HoP++s01)Zw
zQa5gHxLR}}5<G0pZq*u(Dh)PTj*_P=ZAdqo&OSMgf<|pO^kLW`(B2p42;YoFUY#bi
z4%N2aA4nCnf7+{{{=GC3(^&A^(K$fw(td2znA$`~DS6C~iwj#6M0My*Du-8uH!&w>
zeCP9?Ppx@7<oNnn{ae3ujSf4}Z4Cc?<+FrrJuX5vBDqASEsFk>-&fzw?<bhUx5RLO
z_f;+^ajq0<OI1XSi4fYgPrQ(JH|9lBJRH>cHO_8a@&#|#t~3c?b}JWaGNXzQlOj=3
zTCYVFuk38aq3-9?_k?udlp7RbG@M&p2M=-&->8ghHY9OTR3Xn73lbaMbF<RsZUW*%
z)M^-<JPqQh(Uu{#F{ZZPRD~nB*?M%??N&%nMs?gfgSyj2QX7*^^J4Z)d29$B#I;3u
zVp|NUX>CSbCBsh`g9w)&MPb6eht(~Fwc<lHG}%3z6Dw!wObpiUA~%TlN51x-7JWcT
zyVEy$f2n)mgMg;OF9tggfT13c@3_j80`YG#OnRqDURDW6g{g0W<=oOaQd*lgUqx^=
z4-zAh+q+&H{9sT8$XricRyy78D^E0C(zG1yA)xE)yQhQQ4N+>DhP&Vp?NtTs5W<Xc
zGOb1R?uN^)<4`Mi{}OWj(@E$R{T)R4D%{apu($4>0lcjMePln{q<MWkuzv^txK@-C
zyjZ~8a&peUdv&6GH6e(0ZJD|YjJs-Lyx=ge@K+qOZeme>t-I<?+~{<bRO_4tN4Kki
zr{FJd&DzgYP_us&!A99?TIf4XP_uThv#sEttZ><Z9U_icFT#c5Bm$V57u;6fr9|4T
zA<2_DhxSGgs1WeG;;8AJ%FYi#Li>$tqU;p}v}$8+ZUoH>BPdK%QTh#mP;((L@%DP;
zH^Gf}Xj;NL&%wPS7M;3_=?@!ztw@Z%xNpVv)&iDxmhl7<RbT7SCeS+^ivzVa@oh7G
zubQ;(0(eKZghY8E6nFT%?Zc^lg5}Wz2MXhL@1nB1#EL|s!R-szYh7c#zF8H~(_IEd
zi9tzqSxOU<KnW6=wHrNlnjYNhX6!sj$UzgUT-QR3^<hB=Hn@9M3!8AoG+>g4ah7Av
z$yS+$x@0B&qXmwhHb*x)zjyn+C*zDom+P=(7$9UCj|B<iZCT6LDsG|S^>8l;YA!Dx
zqpJ6k3p1wT8tFEjtl&A!Wm!1DRyI*~#p2xdA^aaNh#iwO&-n1+x#RFlavOLmfOgA1
zHM1VgGWjK|FYz~=zC&{H@Fq6|VO6KZ(uWiGhe)pYkARv=dGgIMVSo66tNEf3z78Hw
z4)xd3E0V~E-8YU)>|Y?;b!L{H8o7n4fKqRX$TY<LkBAm1JwYud;&A3xJ->~EvzVVZ
z$nuPtEV^?CtL3Nov&V+Y(4Ik{WTJuLwQ%WLc{{4Tb0U8K3Vmkhne}n8E-s>P+>~w5
zt*Irj7iwe!&8T&*yI>knZwQE;UmO?8ju^50v`?P!Q%b?(;W$vZYuE0y3s*tbR!&?N
zkNAR-xIbdaywv=irOx#ipupfE>1JA(7HXUVk6r^+=oF#5V{`2TeN8PUi#tpzR7wtX
zb*H1Z!`St48<5)XLsQ@_9*AE!{9KD}WLjlS9DK+VhAm@@cS-GH&BguY_Kce-x`pp%
zsNwYjfLioa9vFu73@c*E)tJ)=eF>t|wQ`9eLv?d<jT$e5QFHHhC{CvZPS~#H0^bj9
z!^dWKy1B=1I%tV6vJD-60Ll%+&xVt~Itf<YWCal)REh2oYn9@+js;~r-j^b{etNNq
zd?>YEZ|NPr?ZLsM(i1Y-l2atXx2(gd%Z||~-vXcM!BC1Ad*&hck8d3nYHmHgmkba!
zI_mBn$t^w<oqt#LTwk4d#1hw&U!TAck7p<)94^VfIDWa;$q+b&OUP!NDQ%9}T9*?r
zMFTk%>&WYG-JH<xm49>$;U@pB+mA-Klj_O@DXI^s!Qu;`WonGDc3d62%XKy1bZ|IN
zebjBMXmC2o!4DE-4Q#Z$BS~pV8b)GKD&NSNt~{}G2)A357|dpJU07ZosckuDdY10A
z7ToU)-F`2N$MKbPxh02Qt~}9Z0!C(Fq=3fsRSBnf8;3;8>II1Msr+~pr^Ae%&VTIL
zvIu>m&bBidM?T?+llI(5jDk?VVxu~%k$#v>4TTOTP;Nx$Tp9O-i<8x<f19G1K#w1M
z8LWFnr^P3(2IBlkBI^7b+8o%qWl$tpjV|{+3CMQ4REL^yWYQDvucG*3ArM|~EPx(7
zc&Iy7@MGKK8<QO;cf^gjV$85SPW2>Tb363woHF*|4T@UU8sSNGZN?c!X-t6{OYmSk
z_EB-pIDk`;XX8UyeJS$m0eg;aJ)t8l_}Jd=JJYTJth9Dx-rCr6>iBhHlZ)!V-M&7j
z&%?CLYof{X;>(NETbnAA=3B!8m#TE4xCUuJ*((1J>?>9LNVQPY?dDd6^~QwSuU8wO
z?B+$jn~ffm%t|=tk)56Goh0sMGv=i`m-m%-IGz0Hq+kM#vfRf3=E(}a`Kw_WuDjvV
zWxbJum-_Od_Ii+{*bO5^Mclu9YcxE@6^W<)c!O4`*)o-xhpZGI3<-qn=eA5sNx%>p
zpNTUBqpeu~cq<=?MecrEhq8=e%C5U(JpnsG5Nay<V45N-=|RLq&GK}@Lo;+?9|??A
z+KYRv>D7tYTYf9$Fy;E`?y_u8j`p}Vy^v+rIpRxtV|(yPd})R0)CZ-azIXP0MUb}h
zb^CQ&tk{Fjg}rVo)^nClvo3x1(fLI;=9XUv0v&9L!Ca!16Ydwps9F+C@<+eAG}?Fr
z(tIJJ_a%b7axyB>#$89}YX^_J{L9j7h{EANFmF1}zGyE5d5Y*g-m>^wkPmE|X9GS&
z>6<}e?cU@dJscYky6`MoEV)^jl#`j6P59{B`!i3Op6$+ko3GmSp@M;O)CSZXdLLN*
zT2_k+x{1Le1>NHbZ%T`^kL;7FG!lMo`oCMT=NEp+7P~pBZn+nXFf~;NN|CZH@ay?|
z-@>y`*Umr5PWscB{sRt;Bs&8b)?H>b9b@5eaNexyr4SsaWGg@f+%jQnI@;>uv>uco
z38xEavf|Lev6V+Z!Pe3uW*>4%=7~t7JS<?_@|FeF?@z1$Zrz?pb-QMbo6xDzH6A(c
zK`X7a*g7|tIk2i6xqR=?mb@8yC2mfg@OfxM8vb_CAau2&9FM%H2%u~|V-KohN7SJ`
zDIXi!6&Nm;lJ--Glj`4m=oG#~`VZVfW!ZYtLo9K3*XE71{(D#kB+4{ZtmP)enyeQT
zF0)yfKV6Ai%y{vZv9LJD6vF+XxuwN@?Lei-3lJP8h83qEEYC!%w-()}QsE^S=sRWh
zmz7WY<HvVPXuu3=ZX&XNQ5o=+O+W&4|0o3;Z>=>jD41dz8q|x1r}$zU@W~k^#(R42
zKtM~-TAFqZhof%?j7?bP;YLzYuyKvaA{3UWw<f6;-_>UBD07N~2lGfjh*SbfYV-(R
ztQ@#Ku;CTuJC1()(SJdQ;Ok9b_Ce~Tm@|-|_b14jXLRLa4RoaIy1oKpi>g~AgT=RS
z%N7^tLuyQ$63ZCt{0$rif400az6EHdhBI~18l{3qIn<=2i?(*f@$=)q;ze-H^-1y#
zUF^Xpf|qZec*N5A3lZXGjxs1TH@a<?L_EhRtqf7K5*VzwQ6El~7QcIPemA?K-wLnU
zznq@&L33LQ;K(zyk+69Cqme9c3hG!&!=&zGk6uZSbh+KXk&!dy1=yg;`A2Mg*nT$K
zQ7FVVjo^Ejt!rCWTPwb)s;(|?Ebu0;)f`sT4kfIBS-{)H$?nZxL0bme%4;9`9&aYl
zm6k!DAB9lXGSPXV0^;yb3~;Z$q|Sm=uE;xo%)`a?cU0S;MY7H9m3EX@g38A%k3eqg
zkYDmm5Gw(WdO=HOxZ#Zn-}F=TaFnoMLd%gMCEYpDx1N5{bqATuioY{-lch{xU7SoS
zW|&)%H*GoQJNfUd4z}qI-?+E^r(v9Ajc$0L<B7%bj$G34Chij>Ku(8?tE(&0Um!2G
z9uUZ)B!I)t5}~;OXwrGh(9@*E<doJpw;2Xh4Zr|-%J*#Vy0RE87EA%PAC$zzw@Nnp
zrI7{?%OjH){{fo`BS&zV1a1O_;g87+)(&25rrfo3j4SOd9?2<&7%=+~39wT-K5k6i
zsT?Xl^!DdSpMvcSKK@B)Yp_tlJHZp?eUGI!tB7+}mTT_ik>ug5M@JTx`PPmJFov+Y
z(ls38uGIHv9frQ0><sVMuK8)zOLVgbuzDmLsC|t1wEu0-DhY#b+2Fhs>)Y<`1~o^$
z;j+MK0`18`Vb9|-Bt9Omq+zcByY@U4;M-c5qHt$CQ#Y89f4PdKtdmG6auwEwHveD9
zzeo19Mx1#mSGl?U9zo0pA&th`F@n}7bgaE{OyIkqYOu|m>9@EX?4)Nxsg1Q?tyH`B
z^xd;Q{te^ic1TL~?~3+AcCCu~AyUrUc^V|*PqI%-S3NQc<(&7VriCA0nz`7_%#53t
zReTIqhzedU$yrX348ZyGA_abTb`xBY84tIn$h9ndT@p0T9&K7UcdpOnUMdns*@L4X
zu2d1f^(N^(9)F>-g8l110BCY@X%7z#!r@sMLr)y<Ka=$2mejwY|JMZ$c8lSyM$cNG
zBYArQO8nsEfBi{G`Tyf~$Nyf-Q=>1?e3$bhKJ}C&5b6SjrT-m*NQ&?1SV;y{>X1lr
zCYkE0Y>&{Iht0_U4<d(-7f2mfkjEq1j?Ru>$`iuE>@Kb^v3%1Umt>)F=z>T@*aPxR
zOib$-a(~axQ)VOcDO_<($RU}^6F5+scT%lcx_&)c`qrAoMpxJR8Ybzm!MMf&4x@GJ
z31b_6K;J(g6&zk#Sdg)@V)1ANmy|G%qyjpVIE-j1E&ulOo-$EvDQrL#4#Odxt)V0W
zbd-*cju*rf{L>2ygGtL;4GoQe12|}YyLV>lv$7+W`z~9tzpKeE4I^V%680*A(TINh
zSQ}%OcM>-C5Wyx9*4ESgo99W_fG>SRNgPiHQh(*;8Tt798Gynj1RozCS4u&~qV;rj
zb%&l&c625gaK07-qKJ3Oj->8x%9hgJYK9p44eRuTu^I*h0-r=(%*jbI7}EYp?ZTla
ztVP*3B1h+6z36BC+4zc<k+H~gZj!ab$PdU1LfM(x7iRhDp5NDE#tjsoO~eJi{&WiZ
z)waB>)zR76i~DC>E2z)!De!^;pvS|*6L(S};OKC931&m;c-N**Verb|-(SQ^8^^9G
zhFvuI+PQ}PUv1NKr#Jn8;?x^GvXvwBch$Ga;LfN1i#_ZpnbiODeWOoZtDS*)d?-(o
z68Su9EC{llvd8)~^+Ml-PJ$JVR|Coal6Fc;a{8OcC*J#JyGI&vyvh{w<j>`882?bD
zr|kOl#1gXcocf=PVkgo5UqsRVFGwhvH&$@-8n2d8B%BYe(H`$-Fx8sU?Cj2EznfET
z2PYHC7tu#6c(RAE^!8Q==n8?1hEw;-{w2*guO0R#^OwuX?5gfLA8%}N6#x+{M*t2&
zn_$1L*FwG;3sVBtW&-dmBRPBCKfA_`?9$NaWkW3twy!DMay(BxoJLouw;Kw1VKjJ3
zU4hG}NcuPa|CgPtp^wxLVQYrNJ!eR^4l8D2uVQ6Jb`Qyvj$G0n6>q1%2mV<*r6Tpl
z#x{pl!`yfKAhyyd2HU7JM6APGj#fcCy8_WaM>C54^|#Z?lPjs|xEY2M`h+H}74=49
zYZ89IRL0*1`ctOwGv2q;zgo|&ydBc-rDUhzYlIvhm9`2_>HZHo&g)&%+n<_h;@^ez
z(rroFr!H2%2U7gWAO6?TjcqHeW}aOUeQ320)ZIZqqUUtqN4-CN$4dyY2WprV$8l}p
z%(jo{G_sq%LG-Ud|AxbPU4O)Kq#ee4Bi41gaXH=>(d6_)tAe?TNzZC!_-L^WBTBil
zc15XzikXoFXfDutJEClS-LC8ePvMEiw%6T625s8&oc8+gU(d{nkVl-PJ{&{w^Nwno
zzlLts_VzXlQZJF81}6Kuxn7Dq+^5M$)Y^}~^a?zBxcmIje9#esl?_i5w|uzPDiVf5
zT3u;N$^IDA`Y(d8>jRLAr)!gN<ZF!uSEeQphwavA?Fz8AoZhl-1+tt+LvsfA@bjIE
z<6{ob+#5<I=l+J#8s4S;@)1Rn{lhgC2|A0Vj7h-2Ha44p+ocij#bRaGgBc(RHPhMr
zdP)N@GKx6ejczHa`RV*%l{1Z?#w2X}?64nA^}+#$71+PwlplXY)*QA-EZm(rNB7?8
z^sNWmCraBLBvZXqbAG9HDe@z*fYefdFq8TpV@vy`_p67!K!{lcPbFQpn+P4G#V%2h
z6zQ=g%wD@8-2g<((gliuhkF)MKBkqtWa8R!Yg;F6dFT2x3yyluTmIH$Djpa%p3ZS~
z&?ZzvhR9+`Y7nzsy0LC&1mD1IWmkfxy&%6*S0!r)q&)uecf`&v%ivJ%BBU(q*kFJv
z^IH63*t~%ohw>M^k0L&yB^)%#YZx7Mk4$!GsnZWSngHnCS3boMwxygbd7LFs3Yxry
zJxHhT7P~vJ_d_>lppEfcqSo*qQDVvHRivgXhXa>@mt9aNjs?qBA7|`Uv2+hGs>9?l
z`MnhV`bYEx;$IV;xpaljiyS*}?D?%!5ew|!!<53^M=g#>atrC}s7$_?M*?!{bXE4Z
z0EZ69$CIpD!H>K=PzQz-%jChPATrG9Nt;WVBM|!q5xYXGTy9}0ycx9edJ5c{KGf%U
z9r=uBq;78w-9iF0>e_`r$qd$o!E7B1B9c39A#Q8y^ftV((~=sA9T7k5vZ)GHS1ew<
z$Zt`=b7yhrx=(lCWgX$yQ_Y^6_(OTf`H$|dH6wcIPK_@S$nHRN04ZM_6bq(}qiYU>
zUbm~ne*9KDw0a4wFUKQNSLdE5<{Jig@R_2frdtT()y;vM(MUb;!l_{=EJ%MWJXj#v
z@DTiNd$mzmc*r1>(uU;WwYDQ&FI7qQ4nwdT+p87P0S`|v@ZDu#mHp*w09|}$sy`!t
zW5W(1AHTwB=)tY-lwL?l5`e<uHRrYSIKIFF5#UmdtcG;s5IlV%&hrud@#1`cb#6P@
zy)cHsqV{wz1Y&)xYz3F^diw@yk>fm5$!Kq{8`hk@cZ*KqYGItzvyU_P#wN&L*gZ04
zXl3BHwYVlPrydFqV?(&!1h}8k9UOzO2enywQ@ZSg+(UJ=j<goTX#G1NcOS>uu<9mL
zPxY!@3l^96jxzZi`h@G-Lu?`HPa1TnUPSNw)@U2uvaj#g+6BW^WFGV=h3WcyKV!{V
z4+`_^OCsREo!?p=n>U<<qm3Fak$xw!TupSGWlKA%+(kZK-7Yuc2jCTvcm*-2exl)d
ztisUlB6&DZsr|Zm%6K`PJe-Q9hSKdA;=4S@*hKQM{(_3wNb|DEKEN@e2}{g&xoab8
zgx>4R&7m=(APHY&eVrpjy=f8wv^8X~bjKmuiC*DuEQnfPd*Qyk3(JU6D1$|$IB|Md
zZ=H%>2tfNF5%yy>R>Dc8-KXnuh9r&9%>jNKRKa%*SDo-u4A+l2KPQ$xJ*0~d2nfD*
zCaiZ{lw8fDLcoGD+1TtS2=$jhc~01s;j&tkp*J%89z(wC-?b|m4t75BUs&Iz;XRCc
zYKA4aM=uQF!r$Tivz$etZ5kwG1*Vp|MSs?KQVK^KTBdhoUNLWCNxPia^_K4%g8L5T
zBXIlU!0M8R{HQAo4zGrvk!cC3FH5}|AabU&XY;&Uqzi%x^|wCWaJ699Cx&DzoE?nc
z3qjJG!j)Sdq$qdW%S%HVwUQwz+Bej9j=0yw%J4ntWijpi^aVxOnOb*xu$&i)<^?zB
zfq>GrgXbD<U4d2ZN^b2<E;5<$#@f`Zf(?lJwJU~9lNH?hk@1uEp!O{HC&b~IX_18~
zrD+u-;0AgxzqpjXeP`1?e)+)--r@3zrM3_A$NOHad;eVIC%hd|2h*&?mlWebWDj1p
zKAQh<Ge7qvWl7u|&*%h;dHE5ZAcj?3oscd`s57(hJ$K473`{gP=g*?D5JvkY#r`Sm
zJc0WDh`{3uomG_`qLEWCsG#)lm&K9pf_F`ed*j0ULt#i?kTqW;Dr6p(QOTd$_c0%C
zGyQh<#WpAX4LN3wLd8x`p$Vvo-?-;Q+xgg0&Mud^=e(K!3OF)F@?Zt|m1FaS;_MAD
zl;-Z3IUa98SvDiJ*-rwup=;+9u5Lao%MOD3Lmbz7H*x}%>=B=_HF+Z*;v54QZ~0?b
zmdk%?R0c1Wx<4(M4F0L_S%ew*gWxynPH<NlXE=kQ*77}y0g`(T+?}jwcOyl+75DO2
z7hToQ#|@A8$D6l*{iaC>RQ4~>S!P-sF5o$>mK|(|+<1RT%FA;tj+`jv7_*1RxyHwx
z-vzFZj|zRV9%0nJvL8Alv2nP{pMRRn=4$teE+{8w3!zaGE&YC?W{kF2@myMtDO|g-
zZs*f{@(nVR2Xi@7&AWk1q6K2)0+E#86gbkED6Ah*hM#eG-zC4ieu$Dv^t(&+^Fv=f
zR|z%P8WM7Cg+vWKon?bHd-t6T@wl~z7IXB&0_U`Z)4|Z!^6$MUV#fsKqN>OZ8;#Iq
z)@7GLLqiI|*+pHB9g8mx!^o#jg+!Dv`qBRTEI?Nz$GU*(LWN7-+>l?4_HiS`jQ3?2
ziAm<*lwC^doyQ;@?9_<3m+XueK0%^)21L;$MRkv{qUuQGHALhm3$@^Xvu6`!^i2FY
zM@7qs(X<xTg$uMRS$T?V{K1W@wdvjvGoW#{uK6d}eO~HSKWnn~^73=K0>~l4oaSvF
zW@WkQD|iXvh&mnJ&n-aLWdTBiS!w>#Lo}Tk(Mt?8+UHa+p^`eE-NXhTi$-6Fr}Ig_
zA7!Nsi#ng$9+8JJ*OXkjLR`jyg5k67mNxtL+^)$lxSn6fqESwcin%*_BHYd@y*N|<
zHbFApYlZ40Oma$z(8B@!(iVC_prnp)i~X=l2tl)1w&DyU7>-;UzN@xRwpKWDd`$!h
zaXNxf(P@atx=#T(Qbk3>{fK;Ca1k^r@H*;0`pBIFoifgShg@htRKlC363L0UXgV9y
zyEe=D+XvT;7RK*jfgk?Z&E)RZvpQqR9pLBMo@;^*C~%3XyFLCWzjVu$jTe=U^=iUt
zmMi+kx1dkM6k$R?2HA8Fz1sVBK(trR%3WbiAv0TkWroVw{f``}Ryne|=NMUh3SKBl
z*JChx*&{i!Y&1b7HW#rV&%wYO+79_C-O@WhVjee#!*A7jL;ymffVWMmtM9}eu)E6#
zASz|697<uqn@?BaPgkrQk52&{BnoAe+wNDEABYuOHsTSLFAvtYs<BA!PH)QH;2SD?
zG7i<ld;1N|Iz<^?wHEuEx|1_p9W$-%W;5V-7QT-4P&3PHQ#Iw8-QMP1X_mve>#2zc
zK8XNSMeUiOeFl6wMao1ko*1jTFu!9Lht!?Nni~-J_6|0MJ8xkg7V0H{95YLTz~mM@
zH*tGVM?Y5y=E~t(zLz0>e`3cCZH$!Xv4(wri}i3ZSlKJk8GKpA+)4aNHg8z7y_CJg
zXu6+v&-+FcT<Hd-*Ws0#QP4d!ZhP(Lte*`r|N4*GViR(n|1jr$(+?(>(Ni)L%6(wn
z-N!nPypc52G}O<w8XqT5@J|KFH&=QCn<X<Nsv_w4fdaz9_F)E|H(uRTmg}3dzb^cJ
zhVFioU*5rN<`&9Vmx_Dm{R>2!@W=*PN>7*(2Cc;-&mJ`F6G>Oc7|W|QK1%9y!ZUqF
zih*L!i`B{bTKU=^Zr&Zm&PNHj9Gz#^(pV4yocB0c9;*{$CM@-B^sx?*Fi?dIdS__M
zFOqvI2j?87$eu;rStlcNeB60kbhTx$5%-;goiTRwh7U&8W=(jhDZFJ~)3Ep2c~!Y`
zjmU~A;LA_|nI8Z4yxRWWR=T~typc=O<x>swl2(j(@orh0eEED`W&y_WVuaqSvO(ak
zVLHqx$Gt^Y*JX?IETQ`)i(Biu&~;(>!*!|Hny_%2@SgWzSXfbM_bw=8!cp8z;pmq8
z{F*Kszb(=*uk674P0esi$d$*Hc;}qTCjvoRO3&+li@U~ii04wf_F5A;nP$yfG1w1f
z_RE0xTmOr_w~nf6ZQn)-1rd;vl9EQcyOfp`l#tFvcXxLPNT*WL-Q5k+-3^O|MJ(b>
z-*@k=`}ci+eCM2T{yU7pU;^`*Yd&?ybzk@Wte|(N7QS1Eln=Jx;q=;%8%omI@74JY
ze~JQW6>-Gb1|4yW`+N`*-sGFC!Z`(Hv}wBf3F|}-H`As<-Uc4!l_z-k7C-XtRH?B@
zi&a>iM6t~vlQpRuHWlAi@ycU+t`md>K5Z=VV!o3|yotx(U!XE}i3);Ptz+FK-te&9
zK6fMp8!8TL=yZE|b<8(fZLD7TBIQKiQ<B(R)pQb`e=OfDO*r2<UY3gc780vXv|a6y
zmpJ<^^vhsx<*8e_3_JUWW1I7bktK8fr~Z+v+lga@^qKd933)B6K~}P>_s4R2y@4K@
zwP>q1F%gLG=2(nKoHD@Q1Yky4&i1LwH_8XgUu9lrU0pBdfvf{PJ4i}eqt`QJ*9?Y{
zIFAZe@25Fr1hgykl<>Xku3pHwGd<fcR6Fe@YEoDlZf3E!u~=HFEE(Cmc$B`nYI!Jp
z{-D4Wa7EHcSokeuJ!*N!Eh8OP?rc!VYoO<N>Fp<H^h@d&m7Al>NrmL4Yt<PV?GvpJ
z)C>IgW6F<7_#R@Vqb4`jb-A%<LGrT-%A-YfHjDdj^knBang|J=U-sU3gv7dr)tVci
z9YcSVmgbR8g413si}t58(Omd5x1!C=f8T=N&*)u5H+gd4y!}dW^>NOQl1bh|?Y8E@
zfMEn9H+|;xPxTolikkA?wBEsp;xI1&zy30CjDFt1Uqq>Nea9}h3_QH#et&HF3Waph
zbwRd?5TrM9!D8-u?-ep{xV>Yi=RSf4+DpwhXx3_TXdF=(wO-#S+1awX<>A@?h#gkj
zBCY0u{w;7#rq1;FX!k7@Pw&Z@R|L;-;j!`T-b7wXBc1iC0Yj|U)s?4}vo$J6{5I{b
z;_P_w?1OwGPUM=rn#%bO*sJ2ux69E6sov-nwACfpUp8oA*b(K4o0mJm2XZ$yzVbj0
zuf^eSN%=)7KRr2Z?{`Q}FEx!E?^bEW7tl_237~Thw81|yjJCC(63EGIu2ia1xy)Rh
zcoK}-c-G#KPZRQq7#lxZc^{&;*&2CTED@79)#AW;cg6TVccrHR31*7^*5VDzN=AE>
z#O(u0uOJiE{UvQ=K=RE^>dS3{$mmO<jIupRcvNqmv-i_WLILU`3mG$Mx1&Pq2VS?n
zO!)2cJ02<E)8@LIKU5GIu5fIgA;dJQU)~$B_T|}(hXexu4`idwsivDg<A;-ltJ!I#
zBc=XPOW9_DI7;l}6F<-NYL}K4J`+NwQMp&(U*Oh1Uz>2ovYwE-9qP7HqaIyW#|ow$
zF%ZSz&WhL+`54&iP(%nbV?0*CY70?geZl~RjE}>ztn=^cIlqK*H1besQU;7VglG+_
z{v45)IQpCwW!C<fs}6dgkI45g`gpytE5|vO4kX*gV06-)7s<S}#Ub=xKsH$dO)JQ=
zX1?Z;2CWrB>X4r66DpNG(}D8VyooxRPrnz%@i#RB7!+Hd>XAFJ!x`3UaA9QLqgqdH
z43n|>^P+p=t#M33_S7L~0wL&hb$Hk_0<iTzodzxp&{I{;DyKqtxk?X(Iv^Faf<m65
z1<9^*^&I3M5k{Wrqw9BwgoL2%l+2djWhAm_5E~JK{{^NQpkGS=54yEMSv8eV5SlIF
zpVLJ~cK`0*U^E6k=KqBINdG6V{(o~zyY=<ST6^T%U#PSW`zxEqB|oCTUq}}v1%-cL
zU|{<Tp#0M2_wQa_02FtzjCWuR6PPCG(ctn${}1g6T<%p;$q(WNRe_8DM8bkmkp4||
z5AOStx%n@&_J4Pa&ThW2ot@pnXlEem!9^YLKHVjSf+JUTLX%d%A;AkRuZS_nq&ss<
zOUuHcT3FQO(BM9W$@x}P0?wkP(c<IF$@YSk--~6h@ti2jV#?&Kvbtk?d)v<QNOlVt
zR9vhT!I4_O!)q<jPW6MzeeORUkX*TN2%nze>6c%5yTAq-S+%VPgxn4Qhu>q@1_w*F
z5eT|-lai7q4jTockt|P-If6B&{(M0puU=!mSB|$Ado^E8dSMq!TW&+6$t75AHzj?2
zeGwqffkgu+2}Izj<x<<WY;C%+RbZ;1Js3a!cx!x`hw!l)x?`K#rk#{K|4R5e4h|0g
zfB>7DtpqfCFwg<mgX_}`c6N4vL>XLTg?ppe`kU&?YVG<8=yUQN;j(L{gLVbbi=T^&
zGMbu1z?|VynF4za#*i~5zp&7329PHo{?)YMRo3Bv^$KqB!6qjM$Jpd#HYF5T4KcVc
zU;6iMe9O<zA4IMBv%@IiM?J=TY)u<Jz~@*4Q3zOM1)zc6<fq3Up1%_f3|4RWaLkPF
zzd3j;rdRxuLkR`bN$D+S1BHKdyq=ktAnR~9)zC_PW)KJ=MOX5wOKbfxJ$(Udqn;T*
z`zvY%45a}xfl*BJGHRdex50pr-l|`2(J#-i0OUrklX$ggQvBXT@L7$gb9P3a13Evb
zgrE}q+F)WZ5JcOIL8rNw%k27%)rxexPzzmIYIHEwe5~O!Vp8qZr<+j%^RLY3FqtA}
zfR^Nz+%cksC)HZ#I^-TE=+v||4paniH$eB@c$NRGB@GQ;S<m#*Wy6v6%c6znS9cc}
zm_r^V;<rWdXY26BFCu~^ANNbFz!?HU<iW{;X%vP1Q5FC5Ay1xr_3EPD&ly|HX{#n2
zkU5NzDUx}t<mX;9F;%)aJ$+Fda%y8@Fd|JkZ$Qn&moh$?r<!cbsq|U>j-QT8UG-v;
zKAg|4-=pyB`yc{+|G3>rl<mB3z3<6)c{92h>7i~;g4mI~`(@}(JN&FlMR?5)^>j`#
zjXW9S?-8plvEu94w}+)E8yw8%G-cP~Rh;#m@Ou}<$%>>57>6m^Cp8z-v;^Wbd*&A!
z?r2s_7O!+>Z`ldLG$yfy+GC2*qnm=YmvB*!Ohap%I)J3b$f;N5vzT>kY_Ts>Fn&-y
z?h&TqpO<Y~8JLw5nf1^r4+Vp1xdF-IR883D<;SW-i=<4hc}2%bYs&{Ms)hVSyUcF%
z%&Q)i^;^36%CrB&j-V{ZsHSkmf{DUuLwP{c(v*mCALbePDYblbQ(k2vISe^>=*?g<
z!1T6W<&31_WT?co`JK;{I%U;AIzPZaZ9zkA)UK##A)ev1`0>t=D1|7W-q{p`lknws
z2{}mrNfeU|8B2E$L1UOr?ob<;L0d~fu4^(!RAu`#?9d^b(IXUFnOx58X<YSmrQf$B
zeek@e_tQbIZhp49!<!;ESE3Y#!oF~ekaj#H%C(VzMJ$VMaLH?{C0<*n?&vt9r;A@L
z9#HG!l#*)K-|CSqa?>6JGhY&3@x*?nJ6ByXENU()>^;-$w&+N$_eJT|2d6iL=CBP}
zT*d*-2<WiX%G_bgw?ET9x1B4q6zJ*2jWIy5R%l{L==<uX8m&v-k!{jQM&?&A=-J)1
zIU;yKS8G3kcG(r>Ip7hlxgeeNIDu^-{;FNA?OeWPX!=K9U-;9q*j7)rlD$C}Q*jDQ
zsNA$bb66d=TDF=`f7+$|ly}N_)6$SuSt=-NxQ^}&V7vPie;9Q=_#O5=U2!?SL0T=}
zsnlIkCS<u{Zru1N?)1i`QFbw%2R^0$85NyWWiHl-hLp3<!7?&b4Ypj}Q=mcIc!@7x
z^v;Qyb=VVO$c@bCW3xPBZ4r9p<;~Q!W{hRG(hX>qH60z*n)_5S^@<ZCyx$~uQ6NXY
zx6-ff-o$++InosMq!2&$4W@e0Fkjz-$70$6+4S=Cl+w-7`cZi8-Nn#c7tmE>DpzqT
zr_a*;OlQl;PDBo4P8F{$Sd}aBW6KK%0FltKSAqtPI@9vJR02LcLrgKd){mJw+Q3fH
zWp*KodyuADA{wlD+iomNHfNMq^?gS`hN1uJ%PWiAoWk^xi{1Ik%RjW%yVjvQ`>zX0
zyk@*345eQhuWYtuAyVG+bY(L{I-?a5E;*WmAL>kf`kusO)mE6vbFe9r+a%y9zKU*B
zBoKa;l+R=CY)jdQnHw9=oAyK<x>?YzXL2=fTB*=D_?AHj!IaLig2Rdn8!{j7Z=442
z6y8hVOzBt~_tK0ScS>oIC~thWA*8z2;qqfkNlG2x#GXTPc|@&FX_-g?HnUDxm^hC-
zpcKY5TgOSZJZ|RXllU&`#o<A%=9{?__x$&JDr6QdL|@B2nt#jE=ATUcqhtL^iwUM#
z^JRh5+RKu<3yKBB#WIEu^8pkNyl|#eq&&&PH*P=V(juG7QiJ`)s)nHK7%4ShL9uji
z7SnnO%#>piYJzi2K(Y43i`OrT8$2YW3!P#r8A+tK-zig6gW*j_2dNszN0ARWk0M=z
zt5qB>6_!`7-THMt?kkB>SYIq6rfc84xZBM`S^D%6UpCy3ukksUVyMj5gRAjyjH2fv
z6)3x-^^e&St+kr~=oX1j<e(vt))1^M7dYFZoHq=$@RWHATXS@cxm%XHN2`z64PR_a
zS5SJ{HOYb^N8sJ`_}=99meRh`Cx@KQyv&pVc*k&MWU4lgy04+ZPZXO&<gJw~oYEL9
z%P~UIp1V=My}@wG;|=@oh&R?X&!?G$^q7KGm!-CJ5#x=$@}dB<C380y4P2G5o9mu%
zJHJz{uRq;nkeZTVv^5ZCP|8HU-+nU`Y_9#DjrSkzX7Kt_{;V=0$$#jEf~U5Ew6wy|
zd*Z9GDdx+~ZAFE>>}k!g2`zD5-KQ3f-bw3;#5<YRgN*OV6-O9HKWmDwEx%8-^!^Nv
zbKIA~5WOBkw*fD|_YA<|vMji=G&1`ZoxN9%2dnS@v@$Dod|*EQJdCTdc@lKYqD06R
zyFVM(7|=XbU1ydyOGo>|5sF`1dZc$~p(zk|%xEd2N+vUV^;Pi@GUCtC9UYI-Xj`kG
ze27pRJCIgyUfUZJk2k0Ggp7>Uo8LjMAWbgS!pn42_POH%qT`v`u|&pP&N4(P%~mPC
zm0$v#!~bx-QKWkNtda`K2tOt@^n20W7iq^gTlBt^?jbkfZ#EK8*Q=;wnwK=+mRBn?
zWK*9h-ZV@=6zMY7i)9OuHWlcXG`A&WdUWK%xEk69Ylz}@t8;xZbNV2GhoesDG?F1^
zzhEN1J{|)k`UdvW64uFnpfF@4BcJCRClCljRI+n+8TKllB5J?(=j$Jm(G$^CFOwP3
zc)z`^q2+SMLg;|bA{c;}AdY2nL2aqM)D7rBSK1ZLMRYe10uoO>|LKOt&;;)3M<e>N
zD+aygc$Gd6Bcxu_2vu{W#TJ^Z`?D^<@p#Macpsl}e8z(wKO{fBJooM6mB%Vi#%1l*
zPmp6_?fu6cnfPb4TtfX7!^`l2&-4^`Ds>#`b4T<>s_a$L{;@SAOHuheZtd9s8=7r+
zc$l4oW9`)0nwzkzt4pI!(iB<sTvgCUO)dMT8q<se*x?GCW(>$!RceXB!6>O`XSVb>
z$OwKunVGKxQ3(*3>+X%b^BGlptsHw<yx!7|QNeIk$2In;DG7IMsAZdegZ*bm?PZPh
z7_0Z1sB^e{j!!w*F|>k~)YJvPSAQNd@2dz1QZl7MpYN<i{r$^b)ZQ4e49^SuBPuPK
z_5Ugs2-tYiQo<BMOH%>n%UV)0pIMWCktA%(S#<F&ax3ca+zzzTk4y*7Y81_b$=_<5
z{}ZB#M$Uc&aJRVkH3mYmEuAtK7dP~h%$M%J#O{;ST{Yx7J3Gb$Wy@R~?`K6UZ}{tI
zB8-dWnEqKzxRR^jU&JHK%&MK=-bvqTJ<Zi`LiK<8$pbK(ehYKp@&88-&HsVV^Z(xh
z4CencckzE6y8F~S`n9Ag=ke(yD?VGDa}gQo)Xw>szz2)>e>&`<T|v69>71|yJJ+WW
zC5Ps_Vy?gVnE(40MjQAVutjGySN~@S?U0(R<857K@0FF&T&lWcxV*u<X4u@vb+{KN
z>#5GU44wokX6-Q`$*|S{urF(kKzctz$Y~d~967@|{;~rss#OIyON1d)$=0_j6ACK1
zjS|C@xfPh7Z4a_x{W9k@u@LmpCiNv8KeI=pc*Es)dhYxowTs;wRw_<dDgSKmUl$rE
z2vj#}O7BK0=tE01#YfI4$UaALHAzE!soxMbdMDIakn!!onBkUgF9p(!Z_9l9W=tTq
z?7s29wX(K5o8-Pw9}nhFgpPAAFIL5O<4**e7M{>p?Qop@3|r`P+ao1gQJ0<0g%^Id
zrXO3UKWEp}a7c+GLG+r7E(jB5rm;xtgd%`+ugLRMY?{$6v1+!@Qjg#Z-yiN3u(j^Z
zh2xtA8Z0=NI5;r{8J?_kTM|6i-XW5pM`P%JE%;oOIpNxZr%4HpYk26j$)#xxc6}nx
zIgQIPks+92PlKc->7)m9+0#yF0%x(EXr{)B&U2)5k)08<XL#$I2~+vW;T89p^~(*T
z5yO(&q1na~Lx;5wk?g|eAzXn8@yu)k)HP0xAq*z3k7594-OFTEVNJ*xT8WT})HxHA
zczH-8{=!l99}z%?JL^p$)VYxmeXf8%h*LskwgA+EA%``#o>UOQ=dr`=KaICA_dj{{
z`V8kNxh9#qwmHbm9N&s0RdRmc`CUnxq@3fk!WpCJ(|uFS9fL~O8`-K!JQ+#ny4qZH
zGWxZ$*5p@_Cy@E6&CNLLs$2}?%;@Y&mM0Rdj^@zB#t48RNb!Y;Y3tDM!%)3YBnG<z
z<k2E4lQ#4?93R~Fd(ko$!M^wG!SYgiHRsga+gVuYVmEKMh=D{JZ{3m9A;MHlHN4J1
zi1|+Xfz>z3F86fvj9+Ws@oN?qD8|uZ@YHOg()o=C3zQ2~zS>W3Yt$m5%r8tn6=|wN
zxVqjqX8MdodN)PB0-R&IZ8_f)bNx(X0moXYrndgX+Lr*$`hsSa?Yt5?`wO>F4GvKl
zm6CJO@&D#Cfl3;VvUkJ&k1B}%W~2kTd-B>h+c3&b<(iK_>7HszSaO`uvi$4me%P^1
zRc>_8D@4QN!`?NbOjN04k<Zo`r7c?GA6<E8;7}<SW-p9Lp=guB2HZq;(S|9?mGx!*
z9TtWCE@*lnDwglLKH}a8h=}i(DL{5o>Nj7y*mDCC%1tiAnlx4W8m%n#)TKnC$^q8m
zlcK?rt;hqj*%lK%uiFVBZcHcSH(3aLG=INp{nxre4e&h(`{_;ZEYt-4NGnyn$rEW5
z7anYQAG7m@I1>+XMxmvqjrBE~(1Pe<S4HpfcjGnFiWQmldcK%G*EeC{UOUy8QwolD
z94ab-q5X@L&jUde(djrNh4uPU^5=4c=Ch+Ig({WvA4IILMPrBujNW4Ygh7{CucBG*
z|J)Wkh0ezoHf5I;Y_8fS;xagUaYCq-me}P>i56W~)JHHOQ!&FxMdyY!NbKlM8P8L=
z^M!a^#2i?;J_B~)9y!(F&4TGjsL&e~DWo8(#V-G!m14BCw7deB_mBBTU%NZ53&k(g
zxy7@}<#&kkf2<89RhC+)pgo)+YZH}ZwJc9Sc+vGM<{3NjSiM(3=OVp{C3qk*3VLI7
za^L*|-hDYlWf?{Z_z|oKi&FAle+<XDHo?fNY<(GW22y`*V*X%^G=kWhGaWK|KWIc(
zGFC*YJ$qI23;)Dd`^nd5k`@aG)^^O~tvISI0h&gyZDnR(i`!cQ5(%M&)6-i2%sDxq
z*SX-(;dR#&g`2rK0c~GDKRk~d6Z9;TH3F<B;zESMEJV=n@jX4cH8VcwO1&UI7Ay%J
zW)y<1V7PM^N_2hRn@{i@BbE2oue-8$upbG9oWGU|&UGfuW1*nchxhf*=+@s3yp6~|
zstVdKXaF8!opI5$PU6&w4^U(lv=HCPfJWHuvdNe;z5zI1Pu(uYlc%T~``3feV#}yr
z5hW$1(Wi~*n6|K9E2eTWj|a_7r$;9H?k|EgEw<7#Wc7MDJP7Fa!y8#ME(y-LSAChy
z$nejP^(*RE3R<lf-R2UTQ~a@`zWf}{s;x9<D%tIyy*<X!!n}2<qD<d%p`^d!!L*r(
z-Aqe!mXiF)E5DuVWa9~6l8oS+H?$RRvwS8s*zW;y!QCRIuz}@KljbFq(d(B!UUjp#
z9P0$>zjsaC(eg@+Y>4_LLzt%$uoaC`M$p!o5Wgp)S45}?@wB7Gj0jpwNJu!j9<ike
z8OnTwkF^4~=70C_s9T1<<v@Hqe4;bCtDty<H)F+e`Dw1V_r`t{>9uZ9-NxTs0A~Hr
zI{w7Hy_&a?KekAKfZ#o*F+RU!8k_DHayTe%^~+|>r{3+{sgpcd%m`?fF|)d*`cBJZ
zHHk)xhUE0_*0C8rcuJZPL3gc0rfzAj$Nt{ICOZdl&Wj8yKPBY|!n%3;;1wf4eO{Le
z>M|j0y*fmj262t2D2+9rYCKL~qwB%__g^+r(W2d`4}E<l7IAe=e%muL&8f2o2wwex
zzFbk(cd7y~Sgn>uXI$inJY+OOwRS^%C%mTzM*F6&Y)(2l*Mg<tHJajz1rA@xpWlIg
z2)k(UDC}ofmA!hFn&_UP(!t2aEU?76J4)vocoucwOx~zfYVJn#Y?QA06E*i`j~xoh
z^qKi8|0y{k$Nd%MOv_KUua7{x++}+)VfSdtpBXA}EV)T5X+Mwq<!c*{M};0DM(gtJ
z(sD~mV6Uvn0rVy0*@0nv@fw9X4({1B2sGkSc*Mq6N?+1>u7R09bFn_it{JdeqBD4#
zmdK`ZYF-q*?@Q<ztKN4OAcgXv<jI7eB{j&7HFhYWz#+D<(!=b<S`&5zhd8qe84%P!
zgxFa>78Z?|8GMFlqC8{)wTb$~I?zQY_Qd(C?7^3)#3-Z>0t%ixLJ}-&_w$~p)J;(Y
zMx(B~rlF5Fl+}5Quq?)i%*gY4@2{tgWyld8$4qb-;6q=yX}0~^ohGPp8TD|qxm80n
z144pwXHGp&Wn}X0s1zSgZ7^FLp2oj@2y`h_6EeP8Le5T9WTT>?5*m`M{ctzR6jE>b
zvc?R-%Nymjg(Z9A<Bp_o_t#{W=yfmRPCZoQU|7~?;6xena0>T>(DoOI#x9&R&gYVC
z-7l?2>3s08d~TXBgIS)gpT9Sg@tNHDb@AEgqj$GGhnM?sinDRxSf}82O^_#Z9jOfj
zpY}^SD%_1rx1)n-TX*(O+!1hpsMjlQ&$96Q43aGa5omS}iypg*xb`52KGV6`iYQe3
z$|3pM+-{&ho<kz(7LlMuyR@*lPrtLromN0sG+h35&qm7Wg+lZdzZIA_e9)pTKDqy{
zN>wH<;A^r`8BGnPK3<Y7AIrkZ_bSeimtL*Ct2Ihr8lw-l7_I$C_Z@K<Q+=?l7m)jw
z>e3X02s(-=Mm)bjG0A+Iiypff>5;@=kXWzUH<S<61??RzHGSIeIJDP$pVaGHWgLFE
z51U098Ge&Qk$S$=@qD>&PHY@NRqS6WVNQ9?32TW_7WEq?@PrKInAi(8zvX=%o=02Y
z0=n!pNbtuJa$=Zs5=C(o2Gj*^#Lq%YioI3F2dKPG8$8C0?ZM&0WzL6FpXz#t*AF73
z==#sUdO6=#XkrmFKT2BVB;M)cV~Lygtd34!0>5Advm}Y*!LjBFOFgSrlzBkzN`yO|
zdkwVe+KCeme}kTZ3aox%@HreqZozjlJcI<b;?$Z2o{C0qCZRWLp>Iz8Ua4d*QU5#-
zZG9R02;6I##?!wO5b%}fGbru_h#O=qtKFd4d);(R7x_uMmuo{};vT31<;!K(zyP~C
z=j1Q&iBqw+ic_&?8}+Fwu}1fIRjeZbvE|p4?z*TvPN?+7mY-v8pqs0p3L4%}iB{Xm
z9C@`9D_X4+_9J)v#e>n)r5vlWrL>+6c}ks*h>1PRB#wPxubsQ#u@Udg^;0cQ1r$9F
zBb*h}Nmj#^*uGF#DL1acPvujqWDPp3tW+(Zd|usM<fX?K&>tqrQadTqW1F64-lKNS
zKibq3dnyh3IW<q4)@#t=s*Mnmqh8LaIe;<@_@(Wdwclka_IQpzTxbz9F-UckuFZep
zb1wN2oXQ7h_EQ<~jeXfPMkW^~Zrbnn+#es@ZXO;(I$yokw)(G+8||ZVsfz)FWtAkg
zc#j5ia*E7^VkAk1`Q;V&?P(AQE2Ag6D>vJAA-vzcShHXYCGUlo%-RlPL(&A&<XRbY
z!ctS(x8jo_#uf%!-4dVQgt0VLz2+Hf@}`0M;C`(*L4H5Z`!HJTMghEt7B<lcyl`Uv
zW>unD<8pMzOz$PbsX7)tPPe>pWt@s$cE1H`H~ml<G7D3NfbJ;^7D_5-wl78m8w{M7
zxvsUs%n{V{>s?21w4aUgmiLx|CsV(?`?y8?B6Vqg<}opQl%4%I`N<Zekk(YnGg3-s
zGxXXS@_1NEct3;a{;46Mv|E;Vb61o?A@!yp+>6A_*v*2FBbrX)75+%vqV<Ngpl7Rp
zrBz1z<z6cfKO{wCZfk#8T!!3xL!g>Jm3hS?ShIREnamxs$F6HxJ7bL3aw8PWgW_aC
zgojE5dF!xYL%?i5OFo%?#Xe{C5l(!4TcEpxB4fb3QjOh<dZD&N->@WZGhD_<p3`qo
ztoTjC((*TqXex~<#$!78T*pH^lU9KOF2)382}6ulwInYHQC3{t5oVQUH-$&;9|6uj
zG4P;3H%xdvDTZHvS2nbzm-_ME>y5@0;fjmy{c8zoGN1Ng6>Y+-_N%^fOu<>)0WRu@
z4(B;%OGzIzWOvL=5TU!x1-putgBq?wAQo4DTZxmv5|@DKOB<EjrbuSp0*AFH$BJc^
zrVF1w1XbdEW{a*K;SJAamQkkDz3Kg7WIO0$i5SPo#u5)1R+~^hfmW4tvPg`+w%bEF
z${(TzEe*cpZwdYy9Q=aCr?4TOxf1C_Zh_tL!?)7lXF~uG?!JfO8ruS9r`i&N(gXh7
zZ%{vanfL4g3L`3)?B71g+GsN1b%z-EQz6phj^$H8fFFK(@RRTfZVjS5lJs_m6K(gh
ztHOAfFx`!MQc9n4K{f&TG<(O&i{fa1l36^GMa{;}kb!W$isOogn*6T1=Y6HdQnU?+
zjdPmY1nN&4&*;?kY*oIr4!+gUW1o$Yw8s6St&Cik&*&azD@|t8EQQH?INMw=6YIb~
z&Fm!2H};02!Rc&T3pAKA6|i~85*?#+D7NLz5RyOQUUTf=y5rkmqg?y2IGD(+%gM_F
z-tBH^fivFz1N#vxbZ8xA;i9M^LS~7gIC?;wJ?~ARxxGJ5tUldpe=aWy*MrZWCij!y
z?;y-eiDmg6xNi-eGk*4mAK{Wy#g=9iA{YAjTt3W9SJ^7ap$J-?rXNAHLO8P9xUR+w
z5`}j5^c(OyC!!K$tg=K!Gar1!#H8o`yi$|PymWyeU&{X<9dq~koSFcZpprOgqz8a|
z69*&4VuX9{mWRvi`9kOFNJ)Ygg2(X0ClAk?*yt^WTn%tixJq=l=p5=$l`+}2W9J7K
zse6o#m{Pm97eT7^-*C97ilp%A`($=mM@sZ7ViJw?HAmhni&LEGOnY=eSW~5^$|myU
zx!~EkxF&!&F%X&tij)R*zLk*~(&+`FsI0pKgM;O&^gwzU5W&XdG{<ZEvdbm?{(W$0
z=>80EXJ;q0TJXQF)!saWWN4#sym=9_$lF7iS4CvS?-1JRPK_$>Ay8WkCEBoTvO&*!
z8NFOkT6$d8YIvN=C%Ez5e5TRevp~O}xrb^|($}d0)T!cjv)akTy_I&v;|@k$jAw4>
zH56U?)ceNy5?u@`w_(n%(_%}}zlSB+z&KPor6=Y(K8I&<z->_oP!f)1T1W1Rii*Ia
z`+$(e)UBLD;Cu4l7mN;z%&UnneSZbV>}vY1@yb^sTxa0w(JyM|vGwHxga@dE$LK<S
zJ>Q2eD7001uyexPqn+^XZa3Z~jR-4)IdxDX;==4vbR+S@kScp9{ykBRB*_J|qE^2r
zeD9c6Ow{06VL`zwF#2E4JL7vuln~r1pam_U9=FN-S5UCW7Pg%G?VGscmaxOz6h`}C
zGEC+`Hq&)cvKI+!XT&U?7MQW>SQ)+VuU9uZ1w-UtcMWv0Xfis}VV2!V&HfHuN_ywh
zo*i8!CC=_a1Iw6m?|QvpPIO0(nN&3ZNR#Y)a4YS129{01ngld7;+@Skz2}19FV__Q
z<*}_J#>HxMxTJqp{bPJr+%Ip23s8aTj+f+v=Y~S$g|>c165-OYVj#(Mh6Ky56R1R7
z9CgmMsX&+WGB;@)4nre!%<m#B2G>G0%>U$})c3JBXmAfe;F&r12sGo(lJ0L_!;m~Y
zIN?%oVjvlihKI`P-pV3ra5z$s3aWiyBL&7gF1FsLN0uVIRR)Qo-uQAMJp%x-??1%>
zsFz-HN(w%w`K-?0xm31e#!JT&u1l8!@o8UeNHXqL5^RWh``RDxwW&Oz3-CmM6sr3Y
zT;4?$PKm?4;W+WqpzDWu9ty@iL`BVSnv85*W&iI3#$5CEJCClQ7uYW`J0^pO5mvKs
zADA<3Li)Nvbss|H@jqY8sQm-P09f{?*>lf~mh~eqZ|1P4JKy|1Zf>C(7z1{eU%^Uz
z^QDBoKDlEfQB<!TX$p}7f*)+*)O%}d>)I{GEwg{JD5D=Hc5Q9e&qrY%fnWy5<+mW0
z$GIu@iy*@96XOW9{22A3E|KxNOhS^H`p<N+sP!X4F8Gi>0RY8QDKoXivV==%$LK0Y
zQY83S7MTa5Q0u*=3FPFvs)fUF0<Op}U%nvEfxS(QjaU1k$u(TI;+EnYzm{tL(~H~D
zu?{cTUvtyUdwgKWI(t4IHc2SZ0a~cFyG(O>A?i$Ko1cH<KdyZrvz``Ye8EHLK5Vgg
z(luJgN!7HHY^$<e>8VeQsDW-IOQHYZA;Wp4e(5)$R)ec@VPM_^Yu?qI5HZ&%rF!}d
zDfexpA&llvLn{H|(J${GVEz65uQ^iA6<ZwthGH=Ggo=T!(YRS$dhl@m0Y>mvM6R`m
zf-K=jpghg(TGm~m$U0W$=|pQKG)U-MRns>o2gf*TJC!oSd$}R}LTAWap6XZka1~o*
z8wll*x037_q&EKt(W+7SShis<#)Rzpxo<bCH{<TmA0<h7gg%Ke0C|NTlAb-wY$*av
zEq!}TQ6E|kIrPSlkB(0Op<#PA+PWPp&zCFUkvcyZByY7dkZ{!P^Z>FDBPQV7R@y@%
z*K>zsAzlg33kq%8anYaA)v$!GnUwiOt|*|-o@DnED`!Y*?EAV9GWUR!Q!SNkpE7j5
z_Wyy0AX>w@qDDXkc`$@`!Hz4VO3~b=U`>cb%nAy<yWBkF_s)7jkAy!oD)YKxffG`}
z()iV1jra^0u&$wvd<l0YAMB>+4NbV(3Abp`OP=y<jKiHn)R(_P9w?*$?+Cn5i`KXl
z*|`SOrdO_0{W*!<1aocezP8K%FLYYN+2IA^h#w+so!)!*jQzT!F$otgsLIPy?NY!h
zN)2KaT+mw9&(CePI_VyB3n4fVSY^~d4}_yfE7AK<gydvMY?fX^sdqbfHK^7enrDu;
z6lbm$+qr#O*jHqy0E!^5C^kZ_2{xrYT(xo>(Y!@iSTf;%_y|X}$em_6^pmyl;)XvQ
zKk6K8fOWM0Zu-#({$?6G`!lQxPf&58D*FP;NLrCvQYU0itw_~0U|w%ps64G>Q!G1C
zeV<gHXH<@JgWf$Iq_y0Cox>IkE{TA$O42WdI_xPLCBi~tjv2ES>%WS%hW2ch7z|Dv
z%xcBAHO*Si!z==YhTb#<Nu&>4Fse7!;$C(5U#6-u3gX)T%G<@~K5l&!1jt{sIXO8N
zA@VSQLNzgY^Xm^J?kDZ9#s8)s?i3dMK=-!k@AoL#NLF*g5OgHWYvu2GXuYp)eTNk-
zEr*>~a7X8~SgY}W%aXTzB<K80?@vUd<D|x68J;-2{3a_d0L(JH3h7@?B#V_y`7Et#
z;{f0;NXs&rb3M*s5&rqp@iV!nqUx!$n!;j(;7Pt_g6L!{#o&U)PM^<S^Sd<3o0G;e
z%TRP&i>|F7hb^cuMMHHU@hGT+qYG0Y%rFo(!-vyyJLHHY5n9%-A0Jl)JM!)A?cu(r
z{cF4LSpl0Ju>5&TT}z;AXmgig^r2iuJM(U>3nbq{`Y5SWS22X6I%C?OKp7=>3Ua1j
zw$DigPz~v}BsDO*pIcMe;T_HMGQYBJ^k7S~<hO(md?6+1wmf0b`T+?qB<1QQa;!UT
z<*?D%U7GnyLu6dNats@5lE54aBW`uBu{$-dxM;HVr^cpIl*IXJ{cO!X=MCF>>yJ36
zDRDQT6_(E-b{i4|MAfZm48?VgR#`d9^bbR`;C(F=SlqW~mHwdd?X%@nizY!Qp|Cu|
zvBY~~9w&bkM;+X@9QQ-A_0p>qua(j+5M5AbJM_49G=giH+xx@c=Q;@+FC3o-E+1d*
z9TZgYU0<VlWp3|cK<>9jWg3p%?lIDXH5B#mxD1~d^2s}Bn@^&Kr>vgyb^x;yfYl^D
z+mL^Gov!f9+^_Wie{b&RgLSD42dl+&B3oj&q(Rnluf{SsdH0KkkLGuen&j+VnF56$
z>?9f74rpDXpE}8sv#>;01y#5}C9k%wj#pOluHfPdtr?Og*6S%7%X%wB4(G)fKNY*V
zL#A6ipg;2S@x6op(l`d0lRSizgo5Fu^x=I{u_KKw1fF;LFz-1ZqH_ZS&r9S*89CNu
zoHw<^pE{{fC6)?sN1e9VHJB@f*kFIr9*a4#TX3pu9C8u|{l_KPR&1c_TiJTe$nwfu
zilPp=kE!tK;z!&Tv3knrx@C%kR7dbKe^x&)u~}kcPTKBE%q2b-v(n0~;r(}KkVHwT
zGRSw^w)n1(Ai;$z-e$YEOWcKNo>jUX=JvL;YrU^pma4}HG?&7byD&2ueUmbF_Ajn}
ztZ6DUc}BvYMpbgsrCv=7_E!|C)--=@uVdVQLq|u>#gzaCgB^P-D=H*qWH#r`N)L~J
zj;ilukfMTDn!+gyrHxPQ6nDFw56Nsx#>dAUOa1)(>TkAFc$`mOZ*4K8MD%ubG25(*
zI)Z24>g($_+PNj)C#9qe76FGK1_$rfqz-QBK_Q3yCvET^O@9Z#_xhu+oZy+MPVbC7
zYC>-z#qM_<$lPc|n=4)(as5el&>Ss{djGCF|D@I*>m;qWd?P)PRtWm(_b=IwGiD#k
zY*_Kph>bdXsGW!ODTa9C{GT94PS+N{k>P4?pP)nAuq7y?6zaR{7jNq+lE|&JxsT=F
zw$-nq_`=efG8dI*{l7RPME`f3k+ww(0%gnz^P)ku{()do;-Sz3eS&)%Cf*)flJe#z
zR6mRV(DPvd<Ilv>GB-aTDXQ16bL}-1Rjx|hCuL<;qoG8`mC_$SP6|i%Ycq6hAcbG2
z{IOEvN9w-If-}zd=W?`n=wDwqCpaI|gs0UfPR-$qVhfH81t6-P7%|%Qz7^5sG(m=(
zpVY+9XwKDG5QvG1SxB`_Z)#gXI_a30sCjuC7Fgk34rc-hb<WqPCWka(3U?~rJcup#
z@4E~?B0C(Cv0C#UU7D1u)&ZrHU}wwq5n;Gi+}U8fpbIMi_2O^<ashn+iqk1*X^kK=
zHT^V%o7}QJ-OY-^#KP(<_*CfXf%@swr&;qFtqdp9xP%1#a#dzLlqXN0vY5{@d!HY1
z!M~M~Li+IG!~JKFv$OMPz<+mC_RPagq4wDv<j{Si)${%0{r&mVO_AfK&V@k|@-Fl3
zmcvI8h2WY+Or$55mzPA4T5uY&fZzttEosL64fYGLfTX4fw=Pzm^(7b@(x40O=0TQ+
zlLP5j6>n4(C-XD3viV#&ja*XAsnrw8YV^zpZJ4;9<5xs-+B)`ci!TF^P;aH3bDb-}
zoSJ+Lc8aLnHLPhzR^qO#eV}MJrWi3a>Rp18&^L=!Av!wb%$fdH&#7KBugf(W*7QNx
z7bkj5$;dy<aH9qH>Sppf*K~R#i5A_@hb^S!jivl=sRY#rAqGGRHvZEtEdJZwtTZa&
zQLfX!+074p8VWF}kAMwMwP=f+plydrEqMRc!|MS{i8yt}$|0;Tr;{0iP;$SAYAh>-
z^aQqc2P87a*QA0qxJYSN|3)x9X)wWBI%wE5Z%9){T#^6OiC({b$a-MeGiucI6)CrW
z%`xTEAoO?e5uWBI3F+x00C$_)cC#;&>had~P{7<`zF4^45wKdfwze#!mmMJuwaUex
z#bjhqq6BYg7!wK)>;6eZz?B;wBcCJ@lCyT^&boEk`bOYchwd#vz_p%VcrerOi@sdd
zCha*r`4f+@f400>f-D5(YH5!(@tO32{UJIT!<vE;>RS8HS>c76#Ryb(^mk<>Y>mI9
zjJ!OxfIzba&Zf@pK{Ygb<xnwGqcQkm_{WE=5gr^YtO?7TsmRhszFImWtjzcSp~U<m
z5U2tmjqu~))!rba*vjUHV`f#*BXnHF7TWCjD*@xpYD@;{+S(JY2J4Tt#QC|oJx&RW
z;sr#-do2hBQOY9MswI)39pl#CS;Z5t(Z1Sb+R)EL=BT$oHFERvViOa&jiuUJwA>6x
z7Lc=n32rI>yl`A+QLZ{4-?&t+FVW~B#DF7Ry93GQfW2*lM+2l88qMD`YYY3yL-k2p
zVple7zR+H87|gZ71l23~v{zp^fmP4w@4ax&M)80X<C{=va%rT8t066`^}^-F2~h>p
z!UbW9{*JB1C8zDO-|SN<(H<bsai*)~YRRU*BYL(x&u^+nqW75#>LGYO#I^&ro4Y+{
z8|Cjj+ZsgNrRAI1F*_Df_i;QV8|SjIu>s88(nAMXSyV(c;?31|zr*;3G;SL*z!2U^
zT~IGnE?&Q!(MDV?X*}B3pZtqSFs?4~c*&IM1vru%j66wwQZ^rt>2faOG)kbO5{TIV
z?>^cG$GTsh?0EHbN{oI`Yq-;{GbyIUKPWe@thiX1-j4XyAfFntbHyt?kWsm-<x79j
za`Qvhcm}sfN;EEXLCOg5lwHVvZvInb93W}NX5{qZ!rroeD;~D4j`-qo9{PH<L{s#Z
zf}cNCDwe96QkZ~%;0C(#xLhIwa`Ti+W)C^B7Mgx~>>rc<*DK@3AB2ejphRSNBypJ|
zrq_l3nP-)EbIL<X9U?0dF^gW?JfLXsX*%UH1eZ{L<qrVFGFe$!XMSSB7ZQ1HT@HB_
z6)`OOJ@z-AfaEMaXu|uNkbt$+DboAP7Ggd5%MLtJnfs6>ZgaKdgk~-J0DvPMMwO_J
zcuTZQOuc|R!HoCp`E$M5GF_ORB`XBqm>A6O-)|ve$t4#Y<$s-SkVdy~#`Qe?f#btU
zOI%9E?WK3kWls}g{<6yZyCxFr&JGe(V|B9e>f2k_MN6lQ(V6RT6pplrv6{$<8q>3?
zyOAf0=|GLEaW|(G53X1$+5PgxY^hi{+P_yGnE>DCkI#UW=c9Hutunse4fC}nM%wRu
z)4LV`zs6U7K^ypFmQAPPKypJT&=ilu^y9)Q&?^>`af)Am`(@_^WBkPslhh`>UxkP1
zp`b!_R(}+7b0Wc=^4Ph5e98tt^aF(zPu#MJ6k%NWE1sn9uqoC;kE2=X)Ka36NujLl
zyz}AKc7a8#gI%S`ym>=@eMQX}ByTDCprF6U+(F$!KRM=OtSQ-YCM;I)I_f|K^L{w9
zHyeDb5Dby!laHH(tM~5w?)<4dK!A~r7Q{~?xDo}8-=o-C7T>*ddC_!t#vzmuj6(8F
zY3IaUL3Ycn+BuRPt08;_r`W~+lNd~Qk&6Mg*bL3a7JeVS(QQMZ(D^TuKAMixXb2CR
z`!5!1V07hH5RcapA<OA$ms}z<%}#2I0aDz`Y_|k~mi~T6fGFPv!d4R*t0;#v&qJjj
z;oKHA9;C`ak!<Es1mR7r1-xT{uo$e_w8d618u*A1hrT6>e#e`L*vf>ZrHWn=k<r%4
zM{io7G8WuROtGMA9k2U7?T;E|RG+HdxM2EgmjsP>2osXTY?o2q?Tjj23~IlacM&sq
z#(TW=GuG`UTY3%awR2VAICU7e=ccWzu#Yr06mH90qY`z;H_zqa2Bem((n)uKe5xgN
zL_AgQHn{K=iU{@=sLWxZ_Ik0`{8A8+VUU^QM_NX7bTj~sVi6GuB<3~e0tQL>XQ(HE
z#M#X6<2O`tP36^3?U=Vc0tat09^3lU__(h#N?9G&-hoT}-wLz_qoAUy3vSPj#REb7
zE1PTFPvLHiPu;F3w$#-cOT0rf(`LV#kNd4*kG|dl0#GhcBzIW4{K|7Rerk9LF;dD%
zHTq%W!dFy4tnh-tN^yPEP`ostYXokJPqoz&nKB(_c4>1+yU%0pMX0v=;PlyZ)l-y(
zwE9gZX;}3yXTBWfOO8+E$?Ga`%eaM7{N;LKQ|Mx!hMo7z!O$2ju~8a~qE<L~kfvXV
z@k4c-8FEsG3u|Mck-<v7e{%uWF)QGwz^bj042FWwydBO2=+$DRHEZeZBo7`FxYtol
zw`kwI35lha$3$@~enit$F2t@~SlaO<zxf0BqMI1I;lVo>?Cb{g#jOfkzOxgbSnD07
z%Ziu1!YC7&NIOr#gT~5^7DL9z4{o#pNHf(!7&L~R^F(zxg2Uq|h(4jkMb0Dg;GwXE
zLFe$^blGm4A37VMQ|6K`$#>#t5l1qN4>W;cle4_E1>aWU+J$)tR4lq{R&CNpZP9<w
z84M$vy|EVR0Yh=VC{-X`RTvK0!o5^Nr^y*=49^jg?8E?`W=A)tm^}PFyk?_p^#jmu
zok62JN_$y+phC?e-~#{`;EZgvgU%NciW!c0<ob<jo@}37SI%)iTfIcEUT<4s2-Aps
z%it+4CdQ)sWjco|CHk)VAK12Ui%(P8Rd;!3H#_^S(Bp-bM@pzu?fI!!^T=cXGJf0-
z@n;xFGolmu4~HsV&v$7&mBG36jyNkO$E#I2+tCR%NioRKyy%34`I_5ehPXKwM$fv&
zRAE>26ow{|$-pTb3cR}TKI{On)6hDf+To5|pW#T=usKbEJ|s0=>x=j@n4R!YjdjAj
zY423T#SPaK+V%kiL7^&L8Nqm@$0UTYG#XBs+G&zY84S4Zd*K+L%gja&o2LXXi0C^_
z|2q)G@-4DtbP_*<bMx+WZ%?M_z%sJ=oD=GGBW*<g2okXk4pvhukAxe6RBIb7coMmL
z-bJc1a<cPU&v%A-I;QFl&hn-@!aazWsUbb-pi6`Gg{7NjyzJO79z7k}e%>a&{T-wh
zL*U4qf!0bMabh$u`vkFtcZIUTX=L1S8s^&Fnbz^V<IFc~bYamzD;PJdP>3ic|6HxX
znLwSh*x<&M%LVx?DI-UDv@mD=cYr4t37_MbZLt`QX>FFzO6hhbB@r@gRRC2I?FjFQ
zv)tM&5$w6|j_8gfgm6#$bRKsiA4<<6oH+4{l4}Xsf26rz7B_#v_o9}-?JcT<L3K0Z
z>bH&^ilwO=`y-yHQ^hFFRAF=T1UtXdk*K9Tm^*>i+&rV9S=Ce%?e#Ik$~uGmiVWG*
zkt(%Krj+icP&nmMci<doCd0t}3>C`pU6{XAGw@?vQ(^}+e&~c3-_B!#87p+<0t2~U
z#|_*<$6%{qv3$##<;HL(hRJ6|R`R1PPcbk0XyNT!7xi)$h343_oHe4fEpw(HuVK(>
z@^l)5hEmxjhbj5W{CpLK&@)R;WCt{O47B9FF<T(;_*gWlfi2uLRQjgxUl<uQ!XnD0
zBw(d`7G<R*53*aqs)sgP@F1-gA6(xXo+v9VY1ui{DOoSTANJOT(~n2+{&D(|Ozx2m
zQhSfMo{~~|qlQQ8>Z=Bae$2?GO9{cbiX@YjJ1YGcC6r-uGAdS==Sq*?LcV8AtsX1q
zg>{|Y(C2!ZeB8;iP@`9M_N_ihUw3;;;CRJeQK{+7%h?EGo+wY+iO*=mEsII6{nD+*
z`8uv1ZNy+HndD4B8zzM=<!PAPUK98OtsP0~V4wq?>ce|-*us?5r(sEl2-dM|)Nyfz
z36=buK>_jxTDQzK?AuI9gMpVqMmL{@U<vE&a8Il~A%<H>&Y`NcH8ApRfx||iGl8)A
zM!`m-`l#^1TV9EpU?4MA*?W3g`Lnt@Qoy?>esB4S(ExBO!J#ZP^m$JdiI=P|kkoPV
z@zW<UQ`3Sm7FWPa4IJF+Fs;@rR|TwZn7aLgTzo=qYw!M8YP4OJ-f(=j%-;Xf;PFEQ
z?^>BEp&%j34Xf=Wz3FX8Ui#(<f!FFSlY4ZM{A1fLH(93^z)DNFiBABP9gq6UrF}CU
zv@spHOGQ%+dGE;jaGp<LG*^ydiiuz1+90uDlTjl=GYhd2|CjQdU^$+!SZx}$uI0Z#
z4_di~|Md-Ae`ydB%f=dX(3f)2p}!q@ZN$9VJz7vu;3Js*7s?B;ih^xzcjRDtR!k$;
zcM>;WS|&mb1?TSgAVr_ML7o>yW6^-6?#iyyJqnCcOl&NV*8{(gus2W!6*zngVgCe(
zB!-KMi(}&BhYTB$)6#}cPfuG)zx?a@;UDt^`C)_?H~Rxep(sv+B50@m+bcGk#X`1&
zerRi{?ESlvz|L4gQ9Z5P$gLhW>NKs!d>(+X{}XsFN<isgNylFsy-y5qb71OZ$1mq}
zKYmXMcR7EvR23~ysA6*!^*H?3Q?4s&0lf~>5Y0eF*1TV*_19ZSf{4xqds7USL3QfH
zuEFE71U!(Dg;Yj5azTNm|1?cQF+Q!#TAiDp5AD{&?-L0N?qkl%vHZ(Aa-AN#N%|UV
zW*u_`E_ov8a11Bt>H+WOb!sQrxc)SY8~_9DZDr>z?b(3(bGP5k0{;8Cl1@`l2plsc
zkRUiTf`eOjG*{pR1_t}sa>rgRsoew^SKf(azu)qKYHaM1XW0PIq;r}`2Fs6EFksI;
z5JDaRv+l`s{}JhkWj+TcdxF>*M*8DRYNw;jn(SF%De1v6T=p7sKM1yvyBTwP#K#Xh
zTZ|=3sD65)FqABz{J}ngRV&?RNH4e4>{{vccNT9Kg(>6^eu(FoO{0n}GUW*R9L7zh
zn3X#s7;pcMbfoE?M#A&_N!)SKcOz)4QoYL?3C}A`kUSU4^<GnV>FE%;d_}ol8(Ktd
zRbpsc8%b@fFv~%@hDh|v6ScrM*nbL>%nEB<m=bx9=Y^fR*2yhPcbBC=9PC?#bpo(b
z#S4Ct?$<ofIbeTU;uTOIaTh+E&amFTxEbWjJyaxs`}nfRpgZO5VhLT}d>*f(l}pN*
zU}%iWaC}ed9Z&Yvt%c{83KS*fEck!ccJQ;0$Clb>(_O%jit%mqH9a2BJr+J@T5q+U
zcWW21@WuqARGcHu*Z_yN9ftUHIy<)X?zXlxD#=c0x5QN+Jpb`*K18;kN&v5gL-J<&
zllihIoOav$eXu*uXn&gzDs<CLm3Kn6f54VsC6Py=+3)h8MqwSvdr5ZWE?_a?F!Q>)
z+MJ=(8+){DDM|XF;$_*>H%zLX(-smZ?7nnvuwmzwQoHtqW%aCTW!xFyC*FXCtn?1D
z_*#7icU?-ms}e0RVPjyf$(663iIJ2~VL0;gU{-P44@Q-Gr89=Ie$ru(HK>a2&Q*f!
z-@|O{M5^=PlCf6N0&#e+<q?n!ptrR22JR*G2?yBGKK3Xp-!?psraoUWUS2w}Iod<9
zd=!C9dmpp43Ho7c^dGYWp*we7BTaS9;l0k_xsT>P&pAs}hXcRnseLshCuM*?fm5j?
zHqT6rD6G*_Kj9t)@jRQvuGkK!epyGN5Ai_mdo$<nHpgnj0~`A0*;mDF&7N_R?6qef
z%TDX#%-;+feGp%;Q9Ypn+MVK*toJfmksHnx)pYy-Q4=8VoUT^hWY5n>PU)w{44Wej
zt(}4@ZP42eP*=Nr8r5;?2|q&sp4DGpT{>@DGv?8Rp0uTTgteR8GMQc&TRzOsz|P)}
zkD|ztllc`!3VS?4%wDXN>TwyCSJqKySuCljn-aUE&A*!H8<e&<cv+pp$~P+3e{|*(
zqVb{6vzPv;-&Dxy9iv_D%^UiH#xCUXzLd1UECFewWYmmaw5@=z+(xH4MKuH2Y;Fj#
zbP&7E4%X`b7+G4^P3(VLS<@J8ffFVVl%qj#4u7N?;T0KqVZdxuR0MVbyI4*8{#AEr
z)4Qd1Ou3^)DO;^{K;jxGaF>a~%6c4v%oa-hMx$0R2D<~r5#`*R<9^CHqyAj0!aCu?
z%uKM!)GeqL>}5-#gCR%?OE;9VoNad(yo+S-NO_}=MR>jMp1}QihaLtNZuNXEe|8vo
z5SdZX$}ZOB8z~2liWe`Z(oUuQDQAuO=l-)x%QKu!HX-Tabd|#1b&#3afzA$qO0aNf
z68u*TZhkJ<PrOQEyNHjdo<Cd!_HL!qCGB&s8pUq;XbgS0NShZ;*bmE2Vf7did8S!_
z5(>hVgn8{Pg!kYp-sHLaL*ceLVwMo%i7g1bXh*z}!;>(JN3gK9xLSCw@5JjZ?M@_+
z#?6TXnon@HpQC3~D*%IZK=brx3B!6?Vz7lOEklvL39KTQqlMoMt^N|tz$!pduFlK4
z=CS|frrizPi}IzV-fUvgF1w8aGLe-=oP`(4_}#UbeJ;5EMmoI0Um%V*!hYq&^MQrX
z2%r5lFg<F<n%W4&H?$@{-N*KMja%Q)UKQg}oOH@tIUNEk9JdAH8SDy&RzLhX%Ql~h
z?f;9hw}7hhiQ+|%q9P)obfcsQh;#`@q`Nz%yE|2+OPWI+>F$#5E{Q{TclROQ2l&75
zu6yr#@6KAfJj?I<W@gWxJ$wIl%*xM9k|TaOTgWP%wpekc`=t@cGV$z?D$FG}+oG_F
zbDH|k&i7MYbwTV6!JgUwH^mJ1-TIlF<Nh0vNac)$RUFOm=ylbv8L&oI5{y2~Wi3%q
z2tBOnl_!aa<EZsv9oq9UyBVXF==z@rY!vp+oPke~rHUM8<lN|uT6U8J9V(EeIt<QU
z8gQ~6O&?;MKUS1I!Y*OYZE%OWi|Frq*#ar!PkXeC$+hhxO0^kEXFwJ<t7#=RCpOU?
zt3~_%y<#No(d}0hz;ibpv|3wK-w+&k9~1WjHBzaJ&>km|j^@)fViW;UHW0Ugl+%KN
z0+n5|rJVZRFp8Aq<b`HV51<_O&o6I(G`%4X^#yP%vQpp_jQygbf(OLX<-&kt^erP}
z_=9HUdu4wF+&dti^vU^iC<lP?KjKch7t)<pN(Z|RH)Y#g<OYUEZMT;BgVqJgSyhm+
z`eT8(I?dgiO6bP}CMY1OJAc7OM)==Yt!Q|9xqD`$-;lW>&ZX5?1Za1DhdFZ><DGq+
z<dzis)%|VVC6twv^as#^B>d+O^IL;zdk>Qg2#`56U>E#QL?q1g>pMUnG4v0igvSS7
z%zI;PJ8u}i_Xr4j6P5}Vm^O!!_OHJowS!zt$VJHmJT|$``46lfYnFzd;q7J=PKVB{
zG`nuU6S_U7N?igJspodd=M%+lS{-|I*vQG!okiNf(QfeSg?Eu^equpb#x}@2=j+&>
zXHTK#HA;hvJ3Uo!KiR|Se{D0nwq&P*2io1J#7{8L*7LMw0Nv>qUJ<~Dg-6V@SN!~*
zlai77`};R-o#2Ow@bkAa_a||S0T4By@lftw9+%#tO=WeR6VCm)wY+Gr8x~;&j<@@E
z++($Qxox#HH{+TNFLm2ed>HQVQb{GCTJQ@9Sg-ctZEkLkJObi5$s|AGrd3p67mfw?
z8En}FGZXE-J@sL%G7V^1|CbeJ1M%sp9VoE47_EHdwC6jp--Jx_Qqp#iN{#iXy|SSV
zkv?z!s>)Wd<I(&$^tP8^?go4BW?m~Y8z-|z)OiVrte$tBV^PTXvF9Fh_vf-(6c~{(
zmuZJ3r^Tv|V?_`?OF(<O;NASh!~z+RfW7|mZ}E#CErW{E+sb&!OZdha>6TvQEX-W$
zgy+`;gr=xpg9nyvp^&^sM-LR`YqZ+FdV=dXECKr2&t|(1)=FQTam2HqvG*}}!Frhu
zKi382ob56QWJudGl_QEx5^sBVqw&09rGWhv&rg1p830ZzPk(ya+(pD?C7GaSMENc5
zTEHCg?KZA5w0KO*(ki7NVq~s=D%C5uj)T{gw}8gE8mmGZE!j{xVfOP&GBTTs#KZ|O
z7@Mf(LR;)W@6JwPU;&F&^KlA-iKhC<aZNI29h3Zz>KlV%-%#DwhOvpFSAmaosEnMQ
ztG?gO8E9!#5}8uA6}5z7b}z>y5)JGU9>L0)1{_m<*iuR1MrKGn$!~1C9foo_H}8wv
zbuEJx0vjqu|FHjMK@UzEW=`TUS58P`cCC}&n=-WvlKiBfE-3UW%poxVO2lT%WpVjM
zZ7r}(CmD!l7?zmZ55Xy&c>)yi+6XNeE7{*t?>H%3Qqt2~_BJ=r4Gy8SxWWwA1?7=T
ziT++#=a|<yV4|bT?-(Oyx6+noe2{a(jtZ`4p!s@=sd;h)dLC}CVz%i<h!jr~zV2Fo
z2T8}S4IWV-nquDkadL&YBP|?N_vLQMlkrj)mQ2*`4&b3t-v$Xc7oWi}_WeUn$@*KK
zQCu!LoDZZ7Q|F6UO(=!d+lh{#*qa?+iLi}`zIcvf-#G-U9=^FdZPl*G!98VZ)p9H(
zCPY$tz8M9m_a3&8rt5#Uf02Y8m_Ce#2nmC6Bdzs^a^TfQ=$ZbC5Zb~8;wT1-?}^Qy
zhIVIT1U1+@(K#c(VljB>S$d-&850$k5<9lwS*ueo?pb#lGoqx($VuI`{toAlWnXfA
zNq826t{=W`i0ey(KD)c2C{U7>pQBlix+WYYze{PK=1*Wsx>1Y>82!{7GL54Wt^sJ{
z6%p`7bf39U@0V+Zed^U%;02vWWx5qA=e1Hyee8h!h$p<j#N9$tSy2&Jv5)k*7sc&u
zp^wCE)pvtNMvM2hEz!0Aa2wm|k9$mPWAo%=A&`I|qTbjpaqj`t?h&v-FZ23iM2_M!
zju1tKS1(;BH){jSHs;=TakzYzTBGv_jxrVNR6j*nC77#q*MHoW=W0MT5y~y>Kwo)K
zo8ERlR3coCqFJ`^yJL~+?+!rLHTfr4cLc38O~^)u?g&a%M-)mha{jY+j+Ih7y!Otm
z^BlO4*!1y<g!q@cf1=9X%#snFJ*zf<;WC%JU1y@Y>lTJ-D1RI3-1SB4Tfh%k9<@!F
z$<_Nwr4B%kccUt<JEb4F!)=vu48t}F^R!!9C<6Z{pxDM-9((t(_EkP0CxI}~?hCYr
zzq$)YKN^K1am*>cj>h;Sd1_oJjuz1TCN-jBrHDV)c4}k#|5M)4+5cDFy3`8c`zBGI
zR;4$(6lfbbJL#9}x1aouWs$Pzh%#SleT}AR2^!0D?tQtv+=ou`s1T<kNZ`{aDipQM
zrEh&vT|e3`^r-AmWcycPJ7V*vvD7iuW1}VIwT~4)wKy1lxae8^<v^iz^xUp%(eNDI
zbAjmN<~e}MFJvuUju!WtckFRhpm^{8v-$8ia~vw^oVSR5j(7z0(%AV=4q5>9-Nt~%
z{)RqcXmADh{}xUaP+>(MVg%9u6>BQT`ToCX*H4~DmRiFU&5()LE@%<ISAQ9;EsB18
zrrYa)P|qm&2Wqh4M&(pltaD*f(d+r6Bf6?dt2HjOLOQlG60iUN0Ib^OdY;C0eTUaS
zU5+$st~0|c9l3B;aiR5am_9Z)H{UsRodID3bAEq?kE8iyr~2RB8p|dMJ0G6BF~%K$
zV}>mh#8G<Qp5~q*5VZ{i%tW^JFLL3TOO4AOb&5@icX?mmYw&8<qtV^lpK!p_8mKBt
z;KH$0o3G#!uf%lf-d^Fx4YNJ={C9c{y4Z7FCIgYbdJ>G|C#2;&wmHlpHYHOuzxw56
z)w9_%tEPy#WQA>=vriu-eGw%rRgQyI6y7QLW0q@vp4dn+%8RGrkmUe-8V?^FE;Uuv
z{R=msB*Wm)5aap+AVGov5Jbezj#)A@qO-FTxlJ1D^FPhm1g4}Qqov{xvj801o0hAA
zez>~KiUfbB$2?@r;r9C%2V6Q;<Gt&R#%Oa*AxwGF>sFIU=LAT9d)WVegsDN7AbnWh
zf_nu9O32x^wf}cWbmhqdr24Gq9#YkUlhK4oQdJI8+Xw+wczrW<*yw5L|NLoNr7W!!
zgo){g(~M@HPn7SgsHusms}nADgaU3mTy&tsSL^d+X+NOmm$Z^nhy9p_WAc9X<E#fY
zLOnl+8*q+O&Uw@{0s2QlJLck&kc<lKFWh2qqBRuNm2j(Z;cUVCG+i6v+-rf}sCCOX
zL^N$~%CGP1p3(wFBljAEW}NND&i{^;3IYJD_&+n?^mO#*iC=IV<dlL~gEg>+TI)1c
z<Ya&b8}H_gTZM|dJNLoC!5{SxSUf;rb}JCUPEJn#3J0g7%66@~@6kV@SS1^GMorq%
zVuWsS#h6OwI@KX)b~%SZqG=$SC|GTY_;kfwpzZUCq(ih%rC@Yv-S3qA7)EKyCI>VK
zhcN=igqnoCE8XydWRp2sSt8Z{fK;cH|ASQN_s+Ac#E-Cx(#NM}k?|YV)^^;#Y@{<T
zG#Ve-G~4PQNeGo7CjzIeJ-{bM=H}_e#bK?j{4GE3wB+x@8_Pgo$(@=5;Ao^|uGh?t
z0&$WsX_9#1FE9Vf3vDzlIi+HV3<y&ebZksNXf%wGiEf@$zn!4~Fvd<oYU;v*cv|n(
zFm=pN5F#QKZh!srgOp*h_5#vqfos6tQ}gke;m&@Cg^ls;q$cqWgCw<k?80RB3$`Ij
zFJbSuOh0>5<ozdR<7N(&bER2zEsS^YtA0y07OiJ`*f*F&|Btrb`rb*Z|1+>k!Np6T
z*d@`QAg@@U*?%}rh|Ob7qWZ4RlN28xUo|=Zd_o3<^5pTz=xBISl7$ga{_8c<I~p3@
z=|9%vX67U%%}S!r{{gN8Sek6^+m|OUvkud3WJeer`<q*}3Pg{!M<hJ^z|&00@Nc`1
z?B*LEQA#C!`rSbYT#WOLSnB@B)?+_Vkl&AQNE8~0Wmv|k)wLsh%>cwWP(J=nvv*Fg
z4QHaeA<aR%#mST;S##?#N)ep<>3TS4t??uNyCuc1u&lhimoYuwFq1Z&V!+rPG>@v6
zF4~zBuY_j<_Dxxt9nApX<q0w(8teGJclD{KYxoyC3sT6gfsnnQ%$R2!BpRXC`uG(U
zq_Oo8PwK-y!Ohg2H4I;M59s`ezR^j!v1%3`gi88lymuhvg|X1t9iC}7IypJHB!#I#
zmy3lTLcE-RhB~M%vRE)7Cjw=D7RSeovJQDrNm`9yI{<cRIt#qk$ugMjp02y0c8@05
zjWS@k&U*^K3p@6AsP#Rw{>}Q+bdyLg<gpYC4_Dvt7zF(%P=oAs)=)w1Ygy-j4P!%R
zr*?X(YF7pf<E8!B?j^27JNMDWX4;ESqfdsI(2IwHSnN5qV#7rbS=j%Z(b9GpSpwKG
zB=+1X0fPz;INSO4l&k+<WUt&oq?d-;g%Fn7x(y;xA&IXpf;z65hRg|<KkE=p*txzL
z{tIo>RdDQu*Y2?1nKXVcwZh!@80AM~_Iq#j6l59!V+*Jq*c6(X6CURyJ#NeUqc3=b
zFuze(`NKnyDV~wS-Hs-;>9YrhZ-Z6n`V*zN=e+4^1bIMVPq{0A&f$>6{g>GqEUAh8
zrdc8H1VA=MU)_)bBCTxm^v1`2&(#R^(bK}i2y-H}FU)MdjbWle-!C4htf#F2Xcf$R
z04BPux><a5WMUBK95`BJgV77`|NFu12ec%GEGrbS1m`ykf@9Df-9Io5W8ghi&cn`&
zuFzr_L{;AvS)Pf=h5S=hT3R7|z8`wwgb@ik0873O`?{6G1#Y<z)6!jWAt{adpfC94
zJeo5=(-nfk)pPKKFio%jt>>WG5FyOWeHBmC0Nhi8heMNolcGR7H?Ol%YFlisHgL%%
zmbL$+sI6KgzV2I_Eu+;jW}^Xu)Y~m3v*e;_F<?f!wF1inR=TN$wlhMLZHCmEw}e{`
za3flm03lXhGff_*?$MLO%Lzhf3kn#MA;!4M=c>#wL3KTk?4>LBIvj+3L|`HK0$?29
zr+DI9f1W$C<ANh<s00Xz0EvIs3c_+`yg_Nbv0tr#bq!lEZ#3|@q^T&eF~{3L1NUyr
ztBps4Rtod=yr_JAq3&T?pBjQVDgdV#O>1C$0$z6H9&Iy0h37;FqfTbun|vJ_(+cMB
z%3~GH%eKHzb!LwoGizKwxIKP?KhaR`7x^^wXi<#*aC^}#hb>Q!&lq&csg#Mp(b?@8
z^c129+|SV$2t@g#?e^@zPrl<<SaN(hT_oA}GK8*8q*pn8NN6ZL`@+vJNJ+E10hL>L
zK)m&0hid`7Dy)g&P1}IB{UcK)i{=QP&<hPUTm%ZUnT`3RE0r`(vw5osE=S5@3NGp+
zzAuu*##mg`IW>PgzpBtqFmW3AsTQjceM8CQ^2#fl9UUqUk7bKd$=-n*_I~C4fVoRc
z@!7K<R&%2#0pVC{wrOBJGh1EZm4RQtUFd<Wqi2#c-m|qedN6&f(iht7neXN$n+l}k
z+_lbc>j22+CX{q{#`61AK2kXyl~e31t71B^aPvNC3oU&|lLu1OkhEWVed>9uRy(xO
z8*y;){ioUC5Nol!CsC;Z)vI^ZY2>W&`q?1cPH0_RIas~_bQ{tO;f~lInH}?$5Vm)8
z*-qLfEgEPlT=_2+V8)BYiqn-#34FYC0z|wWUC3#ibM?=SxhAIrV4L7?P6tf4&l7ma
zsqNLcL>~GTL2uiO)c+k#(w|5?#fyr=7^tboYo@^f$P)IQ1t4#0t=n#VqG+Q1Q?Q#e
zk#{KlTee!>Vb0(-0L~s89nMYETT3ra)&|>`8p>)Y3!0tEPHy_6GOp4tUDUpK;b@_M
z6tH5JSQ@EsJG6cv4SMp%%=Gtg#cV%}#Jz!M{N(EU2jBIRx>v8m!a7375d9rzdlsjQ
z1$`exMwsbu6DfFjC5P(aU0SXxK`aEi<6ZkxB~T^O<L8NK<zO)*ZGrrB1x93)WBy~!
z<<0~V7yGyHT(JoagT4Bf`AkvM9B7BFC6Mz<Y-yVfJ{hG2Bv;Jem%=Qlm0Mrr^nozq
zl&$Pb7x%FvCBp3XQR^FzS{%S{HPp&rUF)sg;`~EU=)a+)<P^R7`@nY}Kei1ZC+Mxw
zQ;ya6m#fiCzVHn(GgxZ|!2JoCg*KA?rTh=+MMVk7x*v!jy}ifMf2_GEikV^ui*3v`
zsJ+{;oDe`BIW#%OcCF}BVq<BBYm_g#>z+KHr<>``_(Cwj#Ps1*M{`qshTW=-Giz4s
zi^iKguhP&lUuZ*t6GHq8^JRyG2JjwWwgr7uOjuG+n5hiI8N2qmJ-f7|znT0K6CwD|
zff<&oSZ7HOTC%l4kpxzn@d~B0q%x76QF(u!FiEZ0CwN23N-Hin=xT3&za7O)wJIUT
zoj0%8UvGIO!g)c}l8lT#BF3{iV%+(tN?Gbyrp%abE7zS_rz0w^D+YUjVn=qZBAwCk
zD={qIqxY<v`w3x0mqt<KQ{x5LkXT}FO%OfZ8`l$;q)XoucEb-V6IVgAT9&0@9GN{A
zM=b+$(EH6DjeknaF7W($B1hW+)7N-fnGpgkv3ps?|BT<<ngMWL180`;{Q>$0xW346
zGzF(?^Du$V9#yKAooXBMq-2%;t?5mAsIHh;hk5=RCa%1M*k3(fQpc6=V;g~ZB~!F0
zF%NpzQ>OxAG)PYhm5s{C+!*5H`EE*270b0f_&o#aF&;&K`dpOBVwsPv^Nc(6elz>M
zOhZ26u`OQ)YAJVW<Id|_7A7<pv0-I1b#9~*8~fOz7$^d!{!QMf(Y}Jse#@6xkHVk2
zec1cZ)cT2ay@%apQw~^vIAE5$(@9S{Hsu@-h<Ry=elfJR9HxEv?-O|a(X~wjW0oty
zXFPgyzK9&FzH!ZTdDk<%{rE(Z59BBiT|wMK_!a3Ie=l1EeZE5hd+h!Ad9N*|Q$kvw
zdT+}FDhAZ_V=3VB?v!aMI16oVow_hdirOh80p<N^52djC^9=2kq1BfMwyt7i5fA_c
z)p@*-DK5VEQ{v&h{NRznc<Ud7n{W`L<XTX#32oe_($qP{BGCdQafSgtJ}vnyq^s4s
zV~W0)_XjuXKb1W!nIAB2`T3tgo9<klVPPLamd{^VUOUrxvad7}m{2Mo;;@qNc<WCG
zlj9RTXn*_#v4ENdXcIhgy?52!@TznmJaC8bFHzf5?$6QIIBphrLn2ydN*Qs@?LPe*
zvkq)05xT3EK>*+f{CdmM_hsUm@|H4>f)O*Uw)rWDJ)Z}Xh4@E=`wuIq-cwGmb94RD
zPJcQJP`-hrK;cRSV4%HkD5L%5bRb4{s1IMpdxf*=zG~D3<Ozi}rQHXpG{xnJI&IY<
z5OU3ke{}P*e{9>}%r-`VCH`+g#=V`P0O}0P;QhS=@1;UV2wSD?{7Yq88D)F@hkE*W
z*pfT+56X#N(FS%dz*)&xPVV#FRWWUzQNNKNN)vZ}v^u;#dxRSU@rEsY1kf;G3DJ%1
zKzF31`(76L?nj@-f0$9&+g#n*Of|7P=fq1+7NA<7A8t3V!7k?Pb>ZB>;sX1kpvni$
z1UeD7-5V~5k=}o#GrQA8BjoQ%ZFfIz+)bda3sEcbJUFm}q@s(_htf;--#HeAba_1z
zjfwEf4o>vI8_xG{GK_GTNP2Cp(jUPFD48Y!AI*KUQOG&lc{*QhJn@VQpeG)L`3T_m
zR%vT-LXxM7Gz|Ykl;$eJ>X&x_gpP)kROk7<DvaA5(3ALicsID#>6jB;$Xg?hE_<5W
zle4Sc`ymn|tVcfme(ii@@BH4a(k$DPN+Jl25II6HMnxC8Kpk)P!;&l?CZ1jFM|!;c
z23NdalAz!BE168mWZ8xA#EaXkM70dF;C^>^z8YfKlk>g<X_g)`&YS+fH!?@gsnMMr
z@*5nvt5K*^R7zo4v>Pfk6<x3Ya<n(Qm2kW{H#75S2cC&;X!T$AH8kf-9~|IrhPeB{
zoR<p!ZOlz2p1vo@->}Bci+}cy%rmh6D;#+|;0z6A@<n@OHB)BhH4O9@r2ep4IS`*`
z$o>$BIH94XR`^@tqK>z}AIPtx80B3960W{Rz1Po!%<g@x0Qt!~e4Vxi)Gk`65oe{D
zn!+23F7~Numn_H!*PR|-9iqS2%ym#V?-+wYo_5%9PEs~2+`R^EVc}B;_*18K_#aor
zXQ{y<K<MpVyOu4lsXKSh4Y=D*g0lZNJ5bo@*lC}bI{;>3sIC}2Xbr5EAoGkOVD2+`
z#VS)u`s=3*a{ODuk~{pUk^5Tleky+Vy?7P)5E0C+S!IRJ&_3{nSNMM_ZREWWiS>PW
zuz#QnBZ_dZ^c+v%`uFm~)(*=}zGt7+<U3~Q{2kw0OM&+4<!Ny|>`U+ec!&nJeqgoR
ziUc5_1q7DNoFTxYewp{|^9W#!yst_N8FE7GPTS-#O~kP^NqwDl+LJ-+)^$-JTm@)4
zCRB5CNS}wyEAM3!|L6OdkCsF_XD@rtPofAQ-68`?iq%GJO>XW)%Q<iqyVudb&6cha
zdzMXc=M)ux`w(+RriM~83x0uNxt6PS!Hhu*QdD2+K<AY6>X^5??~Qb*27}81^pQvC
zz8fa#hn>;K%&aWj+pD+8?g|fo$@{|{6##wjTWVtNCz0WeVg6vemT_vippZM~)x&kB
zUTtB7B#ZfA%N4XtLMOhyCt^3vt1X#DK{a9gsZ0OHNTGm*{rG`ZDF3fnB_{2G@TvWG
z+ssR)Lu!oxO?+Y8U-Z+>D{LV`3@QqY%-lO;7HHWDyOU2Jb{OR4#8eKD&B4tx2Sm98
zp-Po&z;J=u2Gyg*{LAkXxN(-(y98@b%u7*qg;a2vHizai;sz>Z9Z#>kI~Zhui^R=h
zrop%->Fu`Gw?=B@NV@cO;KnYwzC>awEu5LHo6JvZNIzBKb)GX2P~Z1x<WP*o6u*#w
zKg&0>wr@8Hysl?&)%jj&@vS#60fpHzR<S?Lf<Q8(&lxF0NoObEu6A@l__3qw2hQrV
zGn>vpfBnTsWlH?Se<|#jZH`yCfa?bXgCx{;i2TlB=O<kAR_$s#yAjC>fI|AA;JF>=
zz_t{Cy}HWF$__m}l|;l`>Gmt)b@8Ue7U*!zR_FoSb!1x6tae4NSbc4?PWmjy-7wpd
z{#k}Zk!{Npp+fi`w^PXEu=$)EC3)MtB|dEHh9rv3s<s5_TXC_XMf~Qr{cUQLL}WA@
z=%Y)dx6~Z^*xke*ow_e0G@AHpEAA@ijcNu!Pu@CUCf4mc8SE-=55{O7)D~BH6S)qc
zo6*mEc=!a;_lvKy443~MK0CO<0wXYA;%8Z!Wl%8U!`Ee6ClMQ*OcUO~_AHjiU=TO>
ztT-J6knBLSK~dPTP&;I$K6}6ng#Q5Z2M}SyvKCP><TCW8)VT!Vp+EJ38qm6yHbfGa
zs;@u1mRsx3Zp9@(k$BjIIAsP?yJPY^s<$$HT*Gs$6Ix+q>oS*~Mn4T{^wmFMX7&BE
zvpS0mB|;@Svz;WEUnOYQ4&89YJTlz#TZ>ro$jAuYRZ?0tJX++CR-D_r21hVO&(+KI
z+=Om9-+mkWwYa8lYMgc|ObsQ>Up2E8%aj-_77?$0>(%A&Acs<o`pio?AHfw5Rk3b>
ztG<|A_1SUJ{lrLzyt-$+zdcBuV8|{)VCQosm$ZBYMmmZNEpI81t2jBdi)gB_*|6iL
za%Ov5X`!^moQ(^vaK3G2d%5m`!}BOZ+{$XIum3KVA{-<2LVS1JgI<VWuT10gX6`(m
z9KBuj0EXynnwhCp$Rs|`oW9o}^wn5@t=Uj-3O=!&n`Sq_>VP>m<j$axI<kM-bK5j9
zm;b20=yqVQxbpq@TCNMsE*!l3(ppV3+@s_{Q0l#s_t<}Q2S5UD?NoRwsSZ9#IsNTr
zcG+x9bX3!UBUEg8jX-k0qrs^&9=pTH7jFuQfJ3Itx5W@4F{!*wL&{<oWjyC}-@}@&
zuWX*H-j_S|HUKZ8cmJ$MijU8a5(>Sf1nVR6q)~ft4tHp6=vP5nrcS^1#kZUcrf*jV
zDGBafI(Ap;M^qRMVkNoG6M9^;J*o2qy|KCh?k}fhV1F%tRSdd4Q1UB#YGm=Jg&ERM
z<UthQBDDm`7I$B+5fs{t%&s>;uXMXb6ckFakb2F+HHwb4m6}Wm+1|U&9Sk#KS7{pz
z1~Y189HM|JDQ}o1GMB0@JR6Mc(kviD*q^$ymJb9wbZ({U19hjV`{6ne=3A&lSoZqd
zjlYaPl|+>BTmyI4dTZ*FE7XFTohkC^ICHx+Nl3f8Cw(>)YHml4T6>PMt&8>-y=WnJ
z|16_ZzSab5Fm*PQLc3-2igauaUI~oM3HIJh#ua4bpU{;_tZZaOdcF?Uq%6_r(oPzn
zA%Z6No;s&5F-1~?3lplptJR<V91P2vl55S@0FN1F@%;4kIULjMDBHVfT^BZoDrvfg
zOw}g^G>nSq{p7f5xEdU|MasP<Z)(>oxa|hN#=<eRBR9Dzc{Z2q=pO?8+|AwNAGCRk
zmWn2rkydl_dTZSp7*d55w;@`+zrEdK5yxw?!2^uoke``GWSM8TmD!9JsC8m}TBEP<
zR^F^6c`{05Og5i@$Y)MM$7i67>|uT&e&AA*vd3i=6+@GgqVF(CabGSTI05-?Y@BoY
zTvqcSAj4qyw6;yBY2o9|;(OAV(-AS>gCyj`8G#64>$AcLxq^IX0l0r5K=806ahk1z
z+h~p3aaX-^tvv{Dc&F;K#B0x4IT5FgVeA;*U7|4z9Hg>@45ukLq2=~Cdq_5utw>dG
zgQmW|KHxXVQ=|dB@qT_49Jxv!GoM;Qv~H>PMu4MSAKkO^7+LSQSnWEwa$MaW`RqpF
z@u&~FraQ)J|K6vg(%RbEjxnFv>lhCM;+Of2>4xL@%|T(RZ%Jw8p5&L|6PB1#%B`cn
z|4{*!BrC6|&^*6+wA!iX^U@tis4DP`7F<8Ak3AqsL8|w4xF$Akuk3ocC+E0|tRKy9
z&@~7_l7ldWBZ2uK2k!VUfHiJ>xhJO8`>WXW8Pk=@CX@W_I@3rLut1GJtH6XsOF-({
z>*r4{XAjU_s$(b_BTwu?E4J(@FwNj>cV{JoH~xTg?b?r^5;ggA<}g>_BD3j9vTfQ!
zMj9$&$1jnCVa-pnI5cOf_BX2ir);TS6CjnHv#b7D(*ZJUq<aqH1Z6455jjkibgOm(
zq3IrLypoq!PB{bULH1#PPYUbxX&Ky!dj=K|Se)D}i%&m(W-@f&-wJ+vV{jwSDLQIw
zY|LGM8R6J>Kq9?<2&Im=8ps*GO&1T(rfIR99K61b&-eow_a0>P0FjcBiihcDF)X<n
z_<(x~*4P&6NP6SC&BTvBcx$bxlJ&mMk)w=I_mzN9Zx8g4L&T5HR6nSVfw@u(9koNY
z3SPbh=!5TmlN5V&E4A8f%R6r0&pZ~lFP?93ML@~Om<^!b8NVqk`??ZewPjlRF9FBm
z;blDRs_+U)Q0RqiNNIf_6Hg5`4;qfg=j=?lRL6zn*f3+0#ra=T(<>CWn?g%a90zdW
zZe)f>$beLJcyoi7@liu}S%`1U`c-YD!5*#|5)&TyEKtd6H%Vhd3R@A7LVFzq{$)@7
z{gS>0r0+B{m6u5}^)cEQ2D0fEv&B)$%_NaZ)?b^Nr4GC{t8c;-n_@}GTl`By<A>+^
z>=q)Dp*;EFlUyp5|F#ei`y{KDadImu?v`)N_-OmKvcu26Fn!~gJ;VK$BXtQReY`|f
zRP)}LlRJd^;?^jD!hl|nlPQ|ov!NFgawl$5ggo`C#Yfkrp0iBiflb4xqZjEk%L6+7
zu7Be1wCeY<^Z`-Rui?f>%GR^&bHF<dHw1B8H%2+)3s9643?9pXmG6C*c-=uzrJRa<
zCWVasfoFXuP{tX<ccpHuf7haJXy7m@V-&1GWtK-$gNfqjhfge&oxGAECXUzmfK(~2
z0ei#yeZ`Bn^8t|oh!Nu)ap3PRh?g3`&z<&_EAcwin!tkxnC7jlE`&=KJ#2mGrAaBl
z{DK@-a~Hp;8DS)Id^-hNTAk#itG|KZzgA4e21VYD*I=!9t|T?4V5rDjoQrr>Cl}aP
zK#SYYe@g8o`+Ik;q>=^Ge1=aSxzUKSFSbj<+FT7kbWdCDKt*-^gN-^XbU>myZ*i@W
z-gQcWiAwCng!S(q_@2*mTiSm1ZcKBt6q6)EHPj6bj%3IBa+CEH9t?~ixg$-Kw%bhH
zM$D(uud5gVQz@;q2f%69+ktXGAkonCM}Le(J-b;LV+k3;rjLwqKn>2h?eokFDgM=e
z->D1?x(mox&|8~AfAyG0=(yH)s-&1_)SN5e+(h4=b)Zq_@`$;6kw~4$oMK%?YvGJ)
z+%yU5+jxSJ|9KY}uK)-|c=Wda@%;H-h+K8W$UHxAD0}soop}oAJ=s(~bZ9=u-5$KG
z&=Yi=BOVx6rm;7CTw8gTH)uWCwuo<9b6!*&o<iixKKS?XxL?D@De;TnVXYLcC>Fgu
zup-Ao#Ocb?^#xyNvkkthqn4vCTfV+objkk#yZ9uua$!I&ud_i3PD@Wn@^3mH`WI4o
z_L^Z@$d_f$_T4#&qZVT0Ugg-($n@}!5-+-N>xghJM|RdRtNCkg!UkzjpUw|%vl?#i
ztr^zdbjYd!E;kQkIfTVR7rhI2@7wATGhW<32bNEcb!DjT<e@Q0{w6y-Jc{BO)m<7Z
z;hj;t!1KNkQT~d#W}BenBLlThdj|H+pBBIm2qFcHRMVmLew@-()quIVmcijnKpP27
z4JIPkPSewWWm!$5McB2}=xRj}|3YkB>yp70d2TV-Ypp0qtX2O%ya=xZ-9lnMn#%Ig
zZx^-l7l66UNE*9~UE~);YdG*Un;YW|C1<!u*J-`h8=vYkVm6Sar&ZkW?C&OH5UGE|
zhJ!`oE3r(E{#8{}Aeae})90ID2<6HsS1f10nFbV8EPmU&L%y&u?>aSc=<DdTRL3`>
z3|Pyj60zoC|86+JQ(eq#bA0~|yFuE_iWI<eOnXcKTnBF=04y`MCLJD*+m{b1-lje{
zsBx4mUbhSn3VFiM^kGZVAR}RZeIYd=>twL_y``QV?NYmx_TdS2YrIoZp8b_w{XwH%
z2vKg+Fk$neu=Zja|Ds*g1LPF;=oOeQX+ugXb6rSa<SN}KTD!*^at9T(1Y6_=_$Bka
zAFCZmUhQ!V)|K)PO$i;aE-UdD5n*s|FnYz`k^alt^ab8$u{WPPby^H&T?`!=bRn?}
z(f)#W5ye0Y`)X`9s+<94NvxCFOF#8e4e*fXKLr~S5CO=oUL#8SR5Re^cDKpPKX)EJ
zNd?g7>lH%tl_RD}N}2i_gYqV07i?n!oqOoz?sL5JwS!&9nHjqN#q$$e$-tn2U|N7f
ztXAt-rsZ1-=5C|4>MjX9PA)Yi@e_skpG{MB04X+Q;dUC#sYKYROP%`XW=VlE4#-rd
zaTBh84eb)%eh{u36LOEhGspr^GN5%@t=)H$sasr$_4$muZs0z11fe^vO$rRZEeehc
z8aN1s-$q+bb0z8lNg<uzhQllQlp^VVR5=DC%s0#xu(0<@D|M;S7p~2*5iREp$~?#u
zJ$}DL^q%~I=>Yr4s9{9O(zC9*hw*=0rS)(@D`t!A(vTw*qym<HUFSefY!+3(QQSU!
zJ)l{MWH~>PICbgeSAX%oq87+fg4svTe|d>Pn7WjqZ`Xu4l!a6{<ZOKEq;}I++yd`|
z-3sDh>mY8V(b2!#R@U=pmR5NjKUsJp2HXu8tpyP=!XC-(p~)yri35YD#@H6@2&1vv
z<F@d)6n)w-r`XZNhvK%=v*hnM>Ehm3fL3RAIZVCHfL+f4hAg+P^NN}(zSU`$qTJZ$
zy@9VNO|bM^A1s=Qtn6N>UIQ1i-L-;Xne5cg3mH_`r14=z&~;4R^x-m{vJP{SFyQq1
zV2cgr>l=ahGg;5##J<K@UWT$A3W|`P8RlTf>-~AhBaimEot(~@D{=y$^KYzgWK;ys
zfanMK^YUb}eHEMaCfnyW3cR2yNch-f{9w&X-Urk#>r85PpeBZSBG~rek`8<QwidKW
zcT#eeT_^5o!invBzrC3uCFjQfr*KC=0i4cqB4q^eaOMG4koo@v3Hsq3e*$_38siXq
zIMMQzDXJ^+oY&s3&>5+1$~6e#T_}*AFr(qY@c$lvD4ywl<9WKv!=3~0Ke`s$B(u*w
z2?C;8yk4O{7vn`WZ^XqYDqg{z(tCz31<}Y1XV1oqVRPKAvp20Yp<;^f`UIP)vETb-
z=3wApz!+inNq1oU8C6KrBLak`Z{D;zU%Q@@9e*PqaWUgA8=*^7oCD({iL56-o!N|b
zYRJj@l0V0>mb<sXvo?0UGq+c1F;k6KnO{(#8T9JWboxNS)ArIR%;MQK+2|N^SOMJz
zr^ZC?bd;j|TCOv%gsba%9V&&guKm3Kwm<-LHJ*=xfs~g?yee$gP-$V5aRsi9UzX8@
z9pz{O0$QU@#IMBPbe<IgQ4LDjP3^o2H@xY@S501w;ZC|QK+38qNB#P0g>`6L_UGlE
z5lZ0{x#IBHLu_SMd{rM7#!V#$!P=ql)FZ~9^F&TM>8PKI8P`vzSkq0WGDbcMmL2~w
z3EAxEz{kQxOQcOL6R+6RT89z)YH}*K$Bo_f|4ra)Pl<64^l3&Tkr|=<%AV3@6WB%C
zn%dTL5D)at2)$gvH?5rO<fJ?-<nd>AH-}(q%kOFlIqY-qR={aE#H@CgCnh33jEd<!
zN_+B^{0A6!UoA2+Q>pN0`8+c=lXImB%x4J^3yMv$@fQSoE^3yB0J7S{qxY~#J4X^e
z?B1z(S5qc`p@PKL5T)0hVEtP9?h~Nqfw-@*Xz&!NYk>xzIbY6IooMhMK~f@Y5QsPV
z97$US1@*$NZiY-`Qu*@%#;>8s%H~W{sySGgZSdxi^Ge=@w58ViFA5r^ynq*X-}C!<
zUgl(eG5q<F-8e^H_grpd<rKk25eO8kq#OWELd~rHv;?-xF31tZV#&8*@O%1aO~XRF
zTTMF$lY`h(xT>C2Bd<2cA~@?pHa{*Zm%An~3UdR<UIW@$-k(Tz;L~)X>WR4TzIhbN
zCP@xl5j+OH;{B?8RH_B*K;8Ix&2UYESfb#5{wt&sPA+1omNe+tP)q58ga7oE1ICs+
zw(QlDcD!7|%h5m}vC>%X?3Wa_Yuw@3Ds?ac<y|jtnipjk%T}Z+)|d7?^X^&Yj<gYo
zQNI#j-H|p{23OFddSsGJA7@207{|V1CbP9!sLYYCWI9+0hJT6hSow=d0jg;Du2zQ=
ztM&`EfWtu6oV+w;G)$TECwE=&qmgy}jRw!AM5bUmyVmAh4MgEPpbBx)f<OkC(V>bc
zd^T*On@+b1RdiJ@rw5E!tgP!sbyDI1py`@8OQ+?75Na0S+G-c|w3bIHLRzJg3768a
z;15;q;j~EInrayx#EyQvLw7xWGtw?rTR#8Jr!ZG2dkgbWxLFhBKJP&5PBIL&GXjCc
zU;BhXCnkSEf7f3I=IkC*r<&D>Vx;d9)XC~RHjR07R@B3mSvymfMDxf>tl@n~ZLaOf
z2j@KF?*1-mAAA1(%h2P?0n_CGJEyzeK+}4~Phb4bZp+5sAdp!(d%se@8)B#YuNy@y
z&x>!G%B~tSf*GushCRQO+D&{<vGY%US<n9$3!tdEj`m#JKUR6qmWXfSo0_`G&T*IO
z`A^Nu?#p;Bbo?PIUriXj>f}hiY`OsZm-|lJRm`wCZvG}~-F6ki)P{4r_Y}Gh5PZXt
z!^w#7L7?zv#=}wt!?{95N1X!EfKp2jKT`!wYY3s~FrOzoNUXWYQ5+@zd-<EuHMy%N
z7F{Dg<p+#;iW8K?rJV-Kk;=-gF+TVG$WXEJD29M-j07fLKrG})Zksyrjd1<$<|q83
zr*q(S`KZQF)T9`viNtU<O51yynXE;H(|y{HFSJFnOrHl`szWW6+|<Q?ramI=%P#fp
z&z&_4`x>@f+LPz01g;HB4&vv_s1Y;2?s`9gN6$2r{P?chkAZ!2b9sT_KUqne#O_y!
zBs~YdsOgyL`~bH!a({Sv(g}O-xr?+irlBC=9$%nwDLnSUom{M26w7ivt7M22tDwl|
zrU;ZWc^+9w;T?4OB<*c^MOpR)+lh>&rSEjz64*ZXRJ>f2(D}XQ_QO7VKD4@LIa+vo
zJhoY|sR%pEExSNtrLosFNo#ownr>;9zG9B7FsZA^S1mLT74>2>Id19-%rV}RHrMwx
zp#jS;y6aEg9y>4`QCRJrA0P3G3|()9lM*7mLU~bkyMm+N&z3h_Bp&wy=Wc%A){oov
z++|?5QstcBO?env&i(HVEo~%b&}Y4$`jo1}GwGL?xjFf!((Zv`nj+Y)KCGBH)Ge+G
z3gtK_m-NHOL*Ii_UOuMvG*8s5@^u##FM3DC#51%2l4<&w#~6!7eAiErc;t0viQ3b@
zdrDmg2#8OmL7(}5F6fRuBf1%^sa}jobJEAL2v5zEr!XD14AG>PtJfSfwI5r-Y?GST
zw7OW0tc+*f4?r|ntddDxGR%REEG1UAXBG>>>+6KP!(P0+pUcyCa4G%E<6F3VKU(5<
zYOC8GgM24#fqS~?($2wW&u**^5j+~SfU<1(#Kek%g6%}xHlHQN1j{dzh06A_JIYG!
zf)&###B)l3>r06tNLBCE<KMzHZXOMDBub`d&fNs3jE^g~wY7Pl8-adUFDq$mZV)J3
zgoq1zkiH`$Bdg>#C>OM-Ti@NanAmY>Yj1zg%Bsk~z<|+E1BV;LNH#djlQ=r*g|vw>
zcm!Wq-pEz&&dL6^s+Xu$JYwta^!Qv{oa|~oyHUj`glM0Cx(6G!<~?0zVO%7=^+vL_
zlQs{w%*{VAr%1;Z&=6;J4OuiFJmCEzb{#K65b-*OJf53sXhAr9GTt*g`jU-81bFpz
z2<01m-OXxi!9Hlid)txxw2>5HUovV=T^svr)!-OU(t%%c)HI@`L?LPGLB>UUIR&tr
zx=(zP6A@$YM$s>BjF{V(@l2GKR-jp#OFv{4BVP^Erj$3J2Qvt$c~ao(hNqO?|Ioer
z5fFXT-R-Mn0-QZf8N3{YiLz=_Tll-{3I;O9tvYdeE6sSYq$`3d{P?nx@z)zx<N}7`
zMCGt*yKVYq6Ej)SeonlKPWoPqV1^S7%c1mCu>4eJW>j%CZ5jh4BfGe`m}{0N9Gd=U
z;p4DjSp+yUiu|^3Ogw06=Tz)Fn&q`egBuT2d|2Mmu@a~;Y}LW*#ECCIHIj46Q}d!S
zntE<+=r@Z5#D5`iX|FHG@nrc@$ij76r?}Gss%m0RSeyKzP)v<+7tLfY*o$ps*<vg@
z2p(nB>-l=?_&BF)rT{L7{KG<PYAh>!q`bSN4@~iM>Uh1h{@DuE>XVuJ5;zm^4<qxT
z9Oo%9S^YD^?y`)hGxZgPynGpkyc`<q9P5YG*pb7Oj;?<>RE^*Vwy(@Ws%Q8(C!{lB
z)OeE>lz&1F;-Q-I0W7>LTWrr@H|J|HusxztrG_GotW&JMzUtYzd?Dn3s4({1vDes>
zH>Ibj*RX+H{XfGew;p53=YL{3rhMUqv}JXePDJA<@uITGKTHP7^*xR>)Sf+iX5mW9
z!NHN`?%NVYqZAny_O|7tUa>NzMNV>+CF|C{Rvp>e>e_K4P{P8H=aM7AZHqxAh#z1B
zZ!;)%;7Uk^?HP-aT^W558X0ewaogL#4M`LfX4BRwGLeAb;LrfHL*JSFLsUo6a2*|5
z(Y|ra1;586lCD0J6i;<TRb*0PW4T<3e+G;VXD>93`a|UuBY&24dQu72a^vG0C7pBN
z>);b@MAS5VU0ho((@_cf`CJh5+{&eBZ?kn^aK8-!%8~a-X{L1mVCsNM!Bf7Y;^NmQ
zXCsnVgmerj$D>_)XCmR~;fH$V`U1?94Re_{Nt6Duc}Oav!o7h;;^8A>?#84UPFn$4
z=YMM(G8J`oztjJ2YfFF6&{=QEj`C-7naP(zL{ME;-t9me*ap3Wyds0cT99eqJEmUd
zkuN(|$~a3-$!|c%(3P=qv2KMw6H7+JLb;CGaL+Q@E+o&ueD{He<;QE0UBwu|{9p`l
z2dX}GdklK96S)XOhMR~)r3YcZbRGn|=^ME*?JK$7KGHF(INH@jw<^vuHxZOdox`+F
zM*InnMDmMmiSU)x1eIBG6~PiRf?pZ!m~8t`xerfniA&sFKM@Cqgv=hChF#I3Jokn0
zq$X-!9Yem4i32KLL0szPL9yUdN&xyBU4trFpU}9JcO=K4MpGwLMyyHQ*1y>1crO9D
ze7k!b24yKQt)9mDGpMgJTt;KK`$cBTDzo3-?Y)R-u-FJj)zqrl+=~5%JX}CTRy`;=
zbJtb*pt#gCja$#<Saa%W@TEjs8?FnfWA3&sCW~OZc-@qZWa>?$x4mP(fxhZm|F)|+
z)+PZ;LKGs?-q>VoRYRR)^>qqo-3O7O_7S(JjK1rpb1H7=*5>Cxa%wPxkQ(FKhpXuw
zj`66aSf<S3fhISOL^o9OjROU>C~UB6hrM3!2;3ZpdHF~<oLKYX=?Z1<4AQyEH3vlS
zxBF$MNq)s@|HMtn8dI<`oI=EZmKJMrl?U-8$<#&-!E$x6j(XB49!{u!R*}tiQ%&B*
zXd-8Pg<xB;hr1!`s$NG<JsKoeoGxx{o8Wab$jgGy@}0yDn>+gYw<0-Z|D?wyN9>-n
zJJp)@;nthjHGBOrLlYZBp1<^>^-^eg%3wpdH%}qK%+BSXEhdqkrAhQ&j#xMI3zHjN
zmk+lGQ<KwbZ3A!JZPpd8->*=+ulawXJ9WgCsy`VgC9!t!XuxDTJ0rs;Vt7i0ulxAb
z)2r~5?a5ccV>CK1B+FVc>8!;C#hd)wV^a<|k=`7p9JmOG^WuvRr{3;bbvg(gV8p&}
zZj;IkxnBQeGE6db<BO8$QKvdFQ1_cC5j?DwRJ?T&)6-JzFmaUW3C;q#yRAs0&2kTV
zoH#Nu*;9x+;|!mwfbLdY_YLbNjd~<|da`paBZqvgeg*ZKvMFn{E&7Y;y+lZRoY62p
z)^z;p%QdH8n9lAZA?-+WAp-BR<9Df_-kNF_T%ThL>5wfN8WU!r)rxbT^IVnO9+p^O
zila;F>m7n}{IX1Hx<MP$<4g*r6-3APU}n$uAj$fZ*de9ezum9_A2TQtlH)1e_UWo4
zZ1ze_WGEm?t=yoc0a-=dF()(iOP`Wv6lNj=MFysc`-CGIVc5u+tq4l_?K_c@3ET3)
z0}?Vq8Ew6OnAk0!?3;`e{kh=t=ik3N=JFKYB)7XIW%(PoPNnuJ+)C*3gzC_-Mp<0b
z%is(Pc6bJz`w0RfCJxz?`StK+$)2Fw@$Uh`(KQ%2(lAS+7(0G6%8l#2V4Ft4rRCwv
za*^-=)@$Fa!0g}40_g>QSI^6QCP}gjsrK9YSqM-~+PbS6K$W<0g;#+toF9b44@a*v
zN^Bg3*h#ZbCcoNOBu0}1##@Qa=qIcNzl`?Cs2VZnt<$^zF5QV#Ev%!U=7iH^)71a|
z5pF5Oo{~PO<sTgjoXqcXE@>j*(#J{$Y;_IjC=9`W5EWc+8bn8VFZ$S5$ldw6@D|*B
zxf)~&)g<~nsU{Fohf8Vc-?2~~rk)pi+^k_Rq=ynow{OlH*db?LRyRb0H+;yc_3a83
z3uay~_@%Y?6n2WE23du)$IA8<8Xb+@4E)-OU!?k|@G}tF$9bi+*L}2Nxvu@SRP%Z(
zH1c5jXwqTH@RDRr4m<t4iu8j37i0a$m4gj3Fuk37#%g?O)i!qg>Fn8l0zC0kT#sL|
z(VjckDxo=xb7TtnPM@n&|Da-okgdp3XaznaH|MP4+oM%^k*1*KE0v=S|I?-*C)dKA
zAD0%AYo(Ncd|1Qla;{hkw|MC&63&>PJ(<XKc6A&f6!6RzwE(qjJtAp<;%Psx^KJ!)
zZS`N<d3?MPINJyDt50*!E4VlieK!X>EuUz*0iVyqyWp??)0ia~&!$0OX4^nn=v2_D
zyAy>uE!^KlCZOBPZXOU1Pbhaz+zhaMdG!%H_vA)GG?pwA=uC7-7c#X<bm3ffGTl0W
z%#8@_{=$@H`05owNJT<CE;W9yaKGG+!sg+#j9;ozzp{yF)^3W-4$CQ6K8Q#yTO^iV
zADi}A=1s5|!hycLoQcF6Dtg&coRinI0RcA{U5Z>?A<l#7dPF?R_5xa!-&dz_wGEq4
z(i}!iWV-4uQPhIZ)V)}nDhiAeQjo7@N`u$N+p_RPsjIHy@Zk>5yv>*ol5!^iG_)3G
zy(K?t_9eMFL0v#!lpM+P1jLA~{Wa%%Kv&CF?-0-xUmDiN7@kfkwtNM=V0*8{Wx%bN
z+xa~y*pql-steq5mJ?v28blM#Yk!P_L|){<@q!uJs4|T7MO4!GAXfBk03dQFe+E1h
zY7YlEcl%+h=rwUP@lk)Wg>woOwgNORcWu*O7&^`iMOki6q|B74WqerW8jgbssSb3T
zqi$`~3jI)J+e<4IO-$0{j@x-|LR5=9Q*HvNWJ6{4y!lwlQ)9pJ$5`?uRMYeEjtU0{
z*`4@ss!gNx#l})6j_7~RY;3?p45QG4pKvF#-B#*MX9x+Yg5^`fe$PyVINL6>a&xZa
zsY*+B4Dc3l5P=cZm_&c5s(p;>Z}Jayu{$^O613e?2!|%m&3M4&p~LnyzQ^F)StZ#7
zja!f5mZO5=i5=o0uoh=#)8O0dkfnp)qsv#hM|-ALcESVZ(*-9gM*}mrQY4;P1bo~s
zq_^LHkJ7m>$wn3YQ7vaNbeG<WKIBxMEkrOjku>B&JX1V4T8)EJXbmDuEqk93b3|-z
znqXo6bdaFuyoakmAV=T3E!R4B#cV0Rk?9MTjdvXKI#rL_^Awy??B`Ks#591va?Dty
zDpL0Oq<h(<HP*w$m=WW##bd6{245Efov9v_YAF;p6a?fMo+JvDV$Iep@4WN4w`oEA
zBmvMyd1Pu2p9LmGxo(?vHG1sq>~x74J|2~A<8H0^OmfGDXHg~VsjA<ExooQCX2Te;
z@{8rppL`5X4oVPrevh_6kFWHe%X%n(qD0jdl^t_J0Z1sgZ`vEr`3{b%L+WR9!V9<M
zzsdwWW{Px$Y1)1%Og!8yj%lfJz<XuR=_+KO(M=(8IT<nWI^@~sW9ytno%reSk*Va>
zS&@d4R@0APWF9?yu~8P&XE9S?vo38+)7p6NCUaTXZgZO+{C6Yc(S@ui^X;Z%<Kf|`
ztE9-#DWYst1RlwP5r`l9c*pZX0J8eBfsuBa?cb-g9|7jGdg@^zcS=(W$>zFg;d&lJ
z9*<>hi5T&4X${+Zs$;|_DWkB}x3G~KEW_4y$c#!DD&prz#+SK4ZJOKnxF0a8=;R`|
z5fe3)46gyIt<EVbyW-)L=^4ahIw2Q!)TjLAY#~nt-FXhIe8P94p9>+p;bd9g*CJ7x
z2_gd{14g(_Mj+zD+`hf>&N|;1nc!Pf*dw@|AZ;PVJ7uQG;WJ;GgGp`egzJ}|5?Z~Z
zXGVOQGI_DdQ|=i2j-u;tlCL5^Cm~3NMpLmyLj>bYT8{XvsJ8yeN;D=lS$Oh)bVJ8T
zSzP<2sx~>Y9ltWB855_b9!{a@mCW(x6--d@`m(JHAX#ZmDW+j7KRYRCkVZ<%^T<0J
z4N{lG?j~$lCo8M><AGy9-zcd0+Xfy;$|Nztwqk@m@x}J@o18k&dNnUTo)x`z)2WO|
zVP6F8Y=)tz7>g))w?cW&XYa6(e=`L|`~AwlFveBH`>Mi=sjPbWOagdUDEzpbs+5cn
z<=gt2eA@thmd7EEpBsXSIo>bX(Zlq&4^#pvgSw+W`&}>UWr{<!(gj4`tLlc@v4c`(
zf5qV!ZcQF%FXiLCpX%eB`1gF#tG6^BaT(NJ$<RL?<z=q+3&S2FLzX=CjLm}}W&9Uq
zdzB4uZBx#T0R-q}e3a$8|48<@&BuUEGV#0%ylLsV5;>A9C7C1x3%<YxJ&lI4g_Mhh
zJ8%v~MiJuxEJlmP8m}SZzjT{d@()=A@DwielmSKGWe5232FcKGLt&*H`mWOEw;k_!
zs@v+8hSt1H%#J$oNpdqC^#$&ha3DLtF=vF?y?UyP)_L+k98YfUAIU!hx2`3M%bmW+
zKJBi#?4e;Jak-_s96rlrDb0h8c{mmZ@Yzbg$szP8<O@Gu4tY6Y{uW;zMH`Pm)^yk&
zCKdm#=_75p+o6klxWIck75)^2e;k+o4p>P$bJt5Gl%!k*)7xLwQyPqNjFHBPqrKrD
zrhc57=3FcJ9*eqWYq}K3izFjqKd+LDs=EU^M8lIc)P~52P`^<me}-$_>==ilWS3w5
z2uaLUh$k1*VLapcZ^6F(>Ju{s&P6Jy3Vl~@h8B_1%%%-@m4nNP?blv{wG&>?>JqwS
z|JTnELmkB%J`Dq+ppRQ6fJujx@b$O!j>z0%)eb4eP0>QB5`!$gGqU&eJ*nqN|Gtj=
z%13}Bzx!6UDku)w<r=nSgL<Ji&Qz8$lFY3?(G+@hT(&vR0j=PU%MFM~4n=?N9U$h;
zX;Ur6m&EY@u=n0!O)XKpC`XTajs+W_AVriSU7AQ&k=_X*^w4{e-h+yObO{{<q(edy
z1VV3$(u-0h0ir<YMM4h*-bRm}^X|Rxec$`zefOWczlhn{Gka#%%v!V7Z>^aj+87Y;
zC`WiIQ6*p3Y`4z5?`3+;D2!dTe8dT+M8uEs*qVdb|0#!xCV8r82=>jEypZOy$7aAw
zw?{rRGyyYlo;*qJ8|k^Z{S{0pi4tOlsf3P5fM48J`pS=$Xe6ij;5cFYJ=KbL8K_h>
zF*1I0CQQv!aL9Vs<oB0dKFN1vMR}`j{wbt}^ToHTdPN9CUBT<{&0Y#Mag5FHwS?QQ
ztpo&|H-f5966<F^jmgpr4XV#FvQ}D6!yDIo^9?;ac}{3~OMP!_dcAkx3YE>&K$3q-
z1H9B=Ol1p;n4;KZW{!X87)E36&o;XLGp49c0P=6MYbgn?M?7^l8*bIDx6WPP=M~!_
zytXZez<49-k7^EcWXfbA&6{1U*|3cVY3?pnhJbe{+6V%Hgipm$&4Mf2_%lTHnAcLL
zqOVKWdCBL?ohZxKx2kCCUQ8HT(*+%=sV_hLEpw@+fil%VrpdZS0V?5FRk8dZZ$Xc|
zz{AuXaByL?Uv>4;vy%ez&(>KcME$o?2AWP5sGJQdYhk)Uztug>lt7awOD04nn#IH%
z_gSJSZby<Z(xepr56e<@D_xJw=5m)JzjB}s&c_KCfh7;iq#?w(lskNYG`}^aVrix^
zD~c=yLPCG_YwiOe5BzOcj%%a-n?jDFx<+8;O9N&;RHdZ2p+yNb^Iv{1TTJ$s4d3k6
zx|vwKxcxipQ<}o5BDT(C^ud%TF?<C8NrU{owBWjremaGYOSs8>7sC1EjD)|!keFGQ
zP0TQ^;RPTWe-%y@TCi*HP=<kqFbi+ipU(Y2T<3B<cYW*E=%%{F2T;sua6S8=;*j(N
zWt>A0zeL+My5Eq^<@&oGxeC`u4tn$q+@3ouWehL!gBY-^ymHeY`v-FK|57|b1((tQ
zXG&l+{nhpYWeSp)Kf@Glu3y_e{j(NN=V`+F<%7ym+*&R{s7Z1s646mkka+pee6xAx
z6kRVd?7=r-p8~M5w<-XdQz@6<vD^TWM^unj-U}ZbSrB#K#b%UZJdOWpS6K~EYhYsT
zG{o+)brw`5D<=>Pr$ny<9+{{`A<*QBm-njFh<KMnf|6d?L?Zs$=a>KFym<@A$@}Rr
z1)6Bz=P459BrJ8Fm%Vi7@0*CN;S!wD8xn0i^$*t#kbw@WpL|mIJhCV2^zc0_qOl+S
z9%bFNQ!8Spo)B}YqwGcPX*KbBMH-fCdAXw7$7BZ`b5rTV&^Xz=*Y?eI-YbTWAN`uv
zKGG!X<RfQ`VS%OE&(_^Kg;ct&kcXkBD{k`zA=WDA+8;iX*D_*Bt*Q0p%ai%zF@1$9
ztzuvI_+g@VX#-`u>DX&3hD4*OeXM?w!OlXiS+$6}PfTU+;zH;g%V&ltHu^68Bz`Cc
zG?62Fv&;_gY(CHxs@L_Jk@FJo+M022%m?WE<9hn?@74}Y%(zQbxlb~;EOKx554AL5
z{u5_;`MfSXo3d5b)&a&M;F%dN@~m`wP?8zGDW?pVr_ab9c&O<A;`T2g|B*Iq$~K*(
zx9fQ@Q!g=K4$1E4shE{(G$F96jwo1%A3kl#EpC=6jn{70L%)O=3Pp{cc*$%Zi&+ea
zRZ{#l$l|Ys*}H;fd=FTOWSr+)5~5BtcUBeapoiXG=BJw`mgxq0^Oa57DzgIJ`%n9+
z9_N*vhYIV7Z=$Y64Gj$xuCiwHZi^5xy&#4VV%dur%ua3m)_+)0XSXZ9iiUWt;7-4Y
z^>tn8x0Qg;b7*l>1%8iC>)=<nQ@vF9R-&>ky7ZysB6wmRj_2%zzgfmw`!BnNrwY=j
ze%>wa->3f%4`JVz&D#Dy`^?T#{&-e)1G<(l#rdn^4>r#Nv`;aV3@WFS$w_G{H&uq`
z|3qwZ0p*w*Y&d`M><h3nr8ho1RQYo3@2XK%0G-ya=B$51pw%JCc}g(KDNH^hRKDxn
zaUl*48y(Y3Acyjt(#@Lxh=HdDFYIQDK(-e%A&vcj;@4@LVsM0p`QDbJj|fxqNx_j5
zz~#cGHg?p1@ushD$%vtBhyJar$T{tG4<!_zv%|J}&=4Na>a(`1If0M{p{^)q9cu<=
z+R^_br44~KF{f}xq$r`e8zc7m9O|Lx9ygn>rKaPg;Q1H!Xk>r&J5{a$kQ8pNZ~el_
z^?_$iphp*eYtQ>*`^U%k0iWJKR}VWcQKdhIfk_sGDr8<85|xPog!76t_j!P8?p}wk
zZNLf}PW?*#(%<|J%zI&3KoeO9Dc7H(zYxiensqR1)Qrsjm4@oG!1;ns)~zj7dZVmC
zpQc3mtek?DTXrkoyQG&v7SH98<)wf+{yX``%L^2KVeD#?Z`!0iFa%Y5cKx$6?y<?=
zzw$fHpSRDS6kg$;FwBQGu6t1AgVG1C@KsY=bb|NZWp-VpJbd=bvQhI_@}~vt=RfwF
zf?p%R*=!eThonUoAjwvKkAffEoB>qkIvk@f$wgoFUs-R)1(-V?5Biw7EC(T*@2~n<
zyw~ED_lkL@oqcMD{mwgvu(4nII2F|;ck|-Ke6C<{gVpu&P}p2c?)7X^)r<c~_2lTg
z(SUz1K7mV<$V!o)R<Y*Pka+R0RDOh*U3|l~aOf3n@{c5^qSEI+7QFwH{RGT?j}Upb
zkAqGYUb)I!C(zEY@Z?uBsV?Q;rTJlsT(eFWX6n5%u3N)ggwV(w<&-W2d?-4q+jh;j
zg&E(SsHV>*ZU46)^>yCsXo>*lP(7~Vhuo>wGi0w&<uu*b8V+q{Rdgu6^{0*4+eus2
zkN=@68$eaS*S9o{$Z(sneYV|fjGo%_Ht*Iw+`XiI+koC1<N|%7C=0dJ_Ak`5?@SiQ
zUkGU1TutM@5YS#3pjt;NpUax`{32W!skslx1|aZ*2Czu`Z*-S*nVL8=3{<I?;3~}z
zvA22nx0W0>UPX?4!8(Jw8dd~M=yg99$j}n;*Z@^>!-`R+X(nPBY+41zH@!mqX|()$
zC4j83wVLJvgtKf7_4WAS<K}eX-mdDSkwZ0p_-r7tCc#c??!nm^Pu96NQ##H3CiH)i
z8I9|Nio3U5xHuGcu9Z*zX3Q3yD}dx}DD|#~b3`T;O0Amv1^wN{$EDNu$Y&H%<ly?O
z3-ae^LsjP|?5IRig5Q3&&D(MAmlE}j42%p3Y~Y{~%mLU#vjaaN#tjL6lWVkRpH1?(
zN+YSr_r$EDD0cO-@<2iVnWSvT1oMbAY-77*;RrQ`tz=3kTO)8N@576+i)Q2lK<20|
zA9)ry_B~(wk~%bWuT-!(Uv*%AE+8>U#>cIEAxyDwA%)GPcwrFHQyT^BjbVBr;G}pY
zTBPGwEP(V*geuZwwr^p^12{K6`|PS}YDJ@COOeZH$K(BBB=BI<qf7!{xVt-skBi>*
znplXpVC%#n)#V=2s{IxumzaRD*)upu2sB@mv%zpvvkVwuD&Oe9+e@ytGwAN_3U{S#
zBOOQ4y-i~ssSJ39*>Nmk4Wg#@=8{c1Y#7QyT}MfUI@o0vH6BEMMm@s&=D2TfCm5-U
z)kzI9rx~R<KAu3=8mdh|2rb3rGqwy_lEORRzch%aJ6U;t6Gt_##?NFoHo8z~Ef3Ay
zB}9><ndc<W@G&v}N9d?3>5m)$yB#ldsaAId5fO&qH}B1=1nYI(W*T}{H0|5F@U6yx
z2F!b7q$K}SVR&~T9m>Me(i%I-Q0rU!4z<&_r38;0#ethFR|QKh@U{BSd77z=Mpxcv
z3iS6E_eP*6wVC|;OMtmnXkg0oYlM@*+;y+}U+--##(T#^lW74}B}5aW<36=q)Gj$S
znzQqI(L07)hF{@KR)^lK)NOI7^Z?prw3uySY{Fn8wo(dKW#knj2hSIfPDKmQ^_%>4
zFt3x%Z@ieomPE^GKN{kp`B8F@k!FS+z%SA~s$5sTFMbbTg44mM;VX2~N1F)o{%1ZP
zFxdyC;M;jHgK5jHPaJe<zeTmaip97~HS}!s`;C1HX)jPn9W*g9fh#j_Wm+C6iOhy-
zQDz>7HvNIEs+mzA%XftZ6p?1}p<@Mz+boF2Qe#a_X0S<nr$*ME?nRkb!T4#qD0%Pw
zp&-CCV%R1>H<Z*lTl#ElP^|9jwjYo420Df7)JTid%6Hxx$}!K4jxzdS{p{YYTrEw0
zGcuicLOiMR&9>?uBh_DV&z?QQGplN7#6DpA1A;czR!|5#-}>sKMcQ>NbNarG6&M0R
zzIk&qe?NMr_NPXoPc6k9r=X~~<{KcB{mxw&a2!u(55{gB`^$hxBI=To^*Z!kp|n%4
z)|gBCL8zuOdJ!anyZ>gWPmY|!)|ngKtGV#Tay9-1yz-Vc@4Qk7-zW9ufIsA0CGE4#
zqAt`G`*5zXhc;3kdDIQ{{~q{Mxr%^^aSFGCC%h8ZKB(*{Qwr;4*nBs@2p!&G%!&IE
zvG7A2w~%O)MP;4uDfIoDS>KqI7bXE-*GNh))bx=|W7m|-;yUNBX!KivQ|Z6FL?;_Q
zg!44nnyox}olaTCuTiG+R#FMCXZXLG$<vHS`ae|b-~gPZoCB)qjpdxfFh?gmwKV?|
z)1`l3$MM3tSF`i~-RuTL1Mefi)#zzF5&@d?dTXs;&gR%V8?M_F)adS%BlGX1OErGw
z{gmzh((qLaQT?}_X7EdT942)-Yj6l$l*g!~Ne|pWD6Ig+CL>LtZg&Jc&-@;gR8-2W
zd@#fRyOl|LvHJAiHr!=>@v;9O`|#7se;W6k?#9Bu$*6A9{6a#Hf7GY@KX*Tg^Z$hs
z(Mo6T3WH2US>{)w8sWSuJa|-)b=qeJAc*dAThK3@G~bSCZvj2{IjR%4f8e@cB#_91
zSxw~jzr{oYtcs1?=lG{rlp+VFipB<bU19O==ap5omEY!&+YXh&Pf<P4oof1J82_Pd
zaKPvp*OBg!y*p-8-8~`8_ztikUz+~L8g80(@}Kcu!C~oHG*wh|Y;EUmDW0VItGcgG
z17%drKVZ&l5amahk@?Aemka`v!vYL+>0}dhmPwP>;WXDjPSG>KMcK_&GR90RN6{wJ
zry6_QVpC-M1Z{+j)~UzEuATHdOZ`86m}~zRKWbFYM)VIn5s2!tcZ~rflfJlvR|?s-
zkX3!igMFPJF`n8Hze(`tV`7IUyUUPi``?WeT!s)4q|@oL0;OMg1GG@*cMBirRMN?^
z7tpSK9*w%q1aODy$sP57sQ7Zg{$G56$}H!H6o((cnt{)M17j{N>;mts;enumm?gO|
z^A3x*cQ`l{;5ENsqLy2!3&Obde*5;l9&P35e~mC8j_W@r8C4nY^>}Kko#(LO#vSzJ
zs=%PnMW;md{{`|eJH%;4n3M2E=xJ1QVF1iL2#-DbEUE%8L8o8b-2MoJl@%ndj5L+o
z<NI(Nsm^Y;kAku?CAO#Y>TV&=D~Dkp1YC51OeR{oXZ_JLON~+Xz^>m1uOIpiZ)U)?
z-*9Go@P;_**lo-pWDwN|W1)7uU$_;WEOJdIUE1D~WYvKzJlF0ug@C{{6-M+{0&*YN
zgJNrGHrPVhA<Yu#X?0Trt2-VW{40Fw(9;wda{If#y|Qe^=4fWPxKf=v6X3IfSuwXY
zt4Zen!A29MCWP05TfYYyCI`854b_r930x$JV~zKT<{ejqNc3vW)qJBe;$@F(CtR9=
z5T%RM)Z{a#Pap87bQ6Y$i5Mhu<D?I!|7a<@@tdr!+rUwrD{Pj9IoP*mkTAdb=b<ca
zA^51sbx+n?9q(D$PmsKS7=k}qZ>AuRf{F-hEC)kJ%`pGIU`vs*qqxJB3rFD-gH@R*
z^}F~f>KEUn_A?G-k5W7iZ+I{zZ$!)MKp=B#i;JXsWB#L-mZ!l_p1j(((XEei94K`j
zKZG{#VGgr{SF<Q(s;lWVu~O=@>(IlGHx8jy>H(=zdz1;5{iAh)%+|$S%He~o!{MVo
zcz*(cCDu6RUiRh@r5`=s1I|9079$w`LqEkM_v9cAg{<fJWU1bDsf-s=6J#$u<^V81
zEf0^jW_KyBS4cC^EP#UXMZ_<hJNvDBxN~oyGLBiv*3D9zez}@58_X{C)qLGD;+ITp
z$kE;nZQ_TR=6>SZn#W$+Hl2BL?f_@7+`gFF{=HXxpgkVcv!ffGU1b@hUA8UoQZ~%<
z(N-bbZF&0$F?@Zd!xjgRq_&VzI<Z$kC-(A};GZ&v3*R?lGve%)@+dgV+Mg&0FABP?
z|Js)7Va*T9pb=dVM0?~i=pr^Bqio(WXcYtj3s#!q^&+IyT`jTQHq>^X64@~0rpSR(
z!zn-b`*<ErjOqy1Pi+4r7dKZ`ag%k)&i*{h8P4;R?y+s<tioBYm(HDojByD?_83X!
zEIlU4xxuP%57(6xsfm*SHC`22k8!5F-^SfgY!2L(;_HU_&2K!;HU@35_4>LRWd*sL
zEm+KmyzeWcheN6haj9sG#_;5cB+M%-^awh0tgC6SM+B2Ss;OxL_G#9w*{7%FR0&zV
zYyfig@^tpDALnb;nL;_+ItmvXRDo4Gj#dNIi~B3aWzs035(i{(T4AC=oe9x;tlTZ@
zk3YY;pp}KOf*1)R*0z|Ondd+vTb14c@8z9RF`639*P630-;NS3PogN8b=@I}@M+$_
zj=CAUHjvJ-8#b!ACpr=;ol`8b@;}XWjb!t>#(+YsPpRlMFD}*3Xt2~4WrKEfj_%L=
zB#le=U?3h|B+ksKIY^rMFR~uJ7Ct&5y?!V*<Y$Nmn5|*dolJZN?R{ND922<cm!&hG
zpxHavvr|RHah^%$j?8|^8wcWy6)pb0Zku>pS)uN1lq&_N55Qmk=Jhjfi_7?SFJ9tP
z@181*GQRHp4N<y9>b{LZq}bxuYO&J{sf~!;y?Ti(((7#$QR-xk>V|QGjl=Z1pXe9a
z+yhDgw$%o)HN(n;>Ku7DU>&Gl7a}#`-|%qGupH|=w<~7TIhc5_5QG(#>+(wEA_N%F
z4i7tY5lRB_LVXFIwzY=!Cd5pZ#T7YGczofbfb!Cab$EPvpojd?{rf&c&98|o0)FY@
znjTK7SttC`_uNP#;w<$IMPPFRdQOiX9x%}4E3<yMLrtojGhI$l_3`5?g37qGNud^-
zcF05@I45}qL=y4!N)Es~C2uTIzqC*bi0b&SLF2dhy~-(x#*nzosG}2UGTD?90rd+D
zvr<=19SE$t_s%KmQhn=&RA@XJeyhIDzfh*n?{t~jJAevymij0aBXGV{1^{XrWpMe-
zwIuc?4~s5PZ-}^jSHae8s3ys_7S1S>hD@|37ES!?N*@#$?JU+#xn$N1Nm^G}Cvh(D
zXMwzlu6(2KPWCT;g;eq2=Rh_iLnW)pVDvGk&``P!UKQoMsbbfZdnm1uRR@Ny==xCH
zD6MhOVL}t^p*r8S&8{2=tfqrT*6O>RW}noe0JJ9m#Fj@SZ0|e=aUp9dg|NO6A+yIP
zS22k{y@mxu2=NZ=mQW8rm}yVTBo=T*;UpH;O@~LtMelTa?sN;UN5MozskuBtP1+E{
zDo(WsZ{hF0&Y6(CodUHn@2YzhE>YiWqBeL3C5h`~q^Y&-n0P<cs_~`K{4v~hamOV8
z>2gDLWual*mx2$aGekf2x+tkro+Y`4?)Qak$CIU$g?LG|iok)#BwuxUy>3!Z0?qTe
zq25`hVTp+fg;;PKsfU&_{dHXZ$bBRTUQ|N)zE{nzxh+mo%yJ>#mb=L4`;b7Heb~6!
z8{)rEi|T52MVj8%Dr6+(2W(T;CdSuR3uJ0(o(C{fNPZih0$bg3L*coaF4<d?-h{>>
zfGem98|5F@AT$^3rl0CaUR(%=vqcHrlPw4d9rYrsrFhfY@YEORV6r{BY(I40;wrI<
z+eV4fq{bb+n1rpUr;&hPs<$zTLq3l9{0|1Wo+`fgQ|LYqMXaf;9w+8RTv5{U$mH<p
zIr<i+bF=AIeIspeO#@iG7r#3mabVa~_0qPJa0N}s?$vZpA3v3pF?|%zf;D+|1{*fs
zy@m^d_;KUWsF<RyK?u8CVPd&95vmbCKHSZ(IWQqpl#lSyK-zR9+INn`7Wr`Ze=1+T
z_(_(!Z-Qt~w=*y5P$gB1m?b1j(UXRHNmA2Z?Mtyc%^r32bAye8oGGh^SU{E@N{#gd
z6hUD={Y9qanS}j^6%&&--S32Yu9ne!r~&3^wmk~$_!B4t1RDb(+|FOhSO?bspt|Jt
zUsF?CO)Z+ujqs0+^;G^i6#1t`nFmkZ1{Uu8bF~OP{1+yqYAFZS@BDi7zvoUhs_0?(
z(HvnxVAB2-=fGRDg?Z$NEM<={e*`OH9f&`!T~ySLR?XFhaKLtMxnlEJf@(ak$8^}F
zbZBhRMton9&9Pi)%?OFYS1&$G8ZlZSGw5o&em>pKP@oJqhb%^lSm%Gaw$mvo9c$gO
z?D%N`1V%V7=w(Ax)cV0=c>$HSC=<AdFQs7;)~ujT0gjT3)IB7caGShiKPIO>O+$F3
z#E-(Ma<AT&eY-1#lGw&A`PaAU9&Wn_Q3$d{uB!n`?8!?KWE?9~?P{hS&i|VnQ}d@c
zP3vc(omTu-t2eg<tOXWt?BJ*L!_Gr7>4srRzR>u4DOTO{&1errjgr3Gos`<xrXcOn
zumN4;*F1R@8m>$wdI9+%$B63cDWDE2zv=)L|8Q#qu}YanlskPMWvNCk&iqZO47&dv
zMTCb}Ht*hUTtAc-Z>p6?_$y+d46k&Nki!POI@grLogg}<!;FhVua8m>F(+?WZy1kg
z9?hOiGhzn80t&bd!>sZ#BU$a;Gqq0)ZH-Rne=uJ0Cv!O)(fZZ}xacm;?}HIbjLGrk
zIv*u>>|EXI&R3{rACMAdiq~Elt*i7J<}t;|7LF&=Px+#ig1|*y%NEGjlvcR3+(#oH
zN6hVjZ-Ns}1PJMs3fU3tWvQf~_jX&R(dc8z;J~%Vc!Q&+4E*ByN%!&l1=C&wRo7su
zl6vFgJ7>e24)N6VVQguL^~1bL1PkD1@iSc1T}yKJNpWm$Mf*4Ajyf#q;=gJ2bt$j+
zrnb6^>-Ak8_3hzA>Jr3x2bDmRBhnHzqDD4~F|kd-+FO}&LMVG~Z>d}o%1@<kui95k
zI(K~1VYuqNGFL5b-Luxa^laeL1lZ@1>+1#tKeU{rT3$5k7JDDS2%gTr54bZax6XXL
zvQ7Ul1(=0fEe4T0sWsL*h7cz`TSQSa9kgxu3)w1}Nb4NV-m>1TM$~GSqdN4$z;LgE
zDw!tLewW@P=j4ehFsyi_RA_}uIbjT6oafq*hx=f$!rh%r#w>kElenM)FM6mLe3;`f
zk%rrz;ZG_!Urg?(mzZGnTkKn!Pof?>%kp_Lv!JWGtvmg`5u=_#pea|8Qh>K?{-Zo2
zY>~#iQ#;cKPY~1@`&v8$i)53t2|!KCZ0(ggl6r97vCXc=OP$#ZD|MIIt*v=lWxSfh
zz73l}n{k*?1UXD|<Uj|dnrO^)lEh`2#-jsFtfoo4_7D0@J-W6lh)?=zq%QdHe-B5j
zRB~gi61r9^czUyVTL<6dxxUtOE|TA4XXn<S*IG&Q@vNx}p7QNey*8sJFqp+xD+Dwz
zWXExcU3rzEk<u+8-q_hic*T=f@X-0)hhwYy@r`5pM($_<-&>yFC0&i`YWQ5JXYH6V
zQ39<^0Fyk^ND$wXu4bsP^GK7hK%t<pff2epcz^9)o5IL$l_UXW=D8k84FNzQwC)nT
zsteu8LK{SZ53R#VNnEzh8HoLWVb0DGcLOguo$bCA9QZYd^@VwyEOaQT&U8iJKA!Eu
zws$A*L~dhjV#_%;x3K$cM5iD<Lfzic1&2>bpozs*v4X_VkBK6OVpd5d2dV{Kx`oE-
z;hs5fwNbPFw0)c0nFY>=jKPE~)HC&<HV4YA*fzqmPz)i)Ki`fq(aC00^#_K&VZMkm
zN+z2viuV~!XPG|xo|V6%2vNwQ=e69%;<DR{p`XE)DVL>cEj5g5W5lCiwS3V<=5Rbk
zh~1~|^wDZ%x+4P-cZtO=Q3uhenaHJB>plz}t<73}pkc%?w3t!ZpJhd9)s#8gP?CLH
z10d#2-1lR${*)thVNKk0Nef#lBUWRjdImFK=+Ublnj*9(IUihT%-8E~Ae@vUbktO+
zqy|c7qgVKv(Hqfuwm|@^(J+?C*8k~MApEth>1eRDu)W9HOQ(-<c1JOnnNaA#^;R#5
z%nIfH6++2DS`)YPHe$9XTmnL1PZ{MLWQ?~;!*O(^a_Fy!5k7F<>E$mWARmH+n^kP>
zB}WNjtjGtU6+v=hjk^2WMEfTlC5z{-ZAC%+i9z3xhPH2kHLG*=dvp5@a9*KO(9x?g
z_f$be<B&<#z0IQvpCdQzNuS9z!d>C>=kK39|Ml^^zuvyOBltn-iju2yrFw^6J+hZ$
z0>2W`n6WIbY{VkH<++q8X|H*2jM2lpe&wxfd6Dvt`F1IO#CdvR*jY(O-5R9+;jzVs
z(+Il{EGK)YgoRqq3!j{e`{Pe~7}wncUul+$%ss}kO`~&lVKXG*?4^AQgH?B$STSne
zy)${NUdk(Lpa*_nx;K>Z)o3sPh>05T$AI*8TCOcS3pe`I`<2rVW!J<lRU8ZXsh5ln
zc50N4oYPo&>SKiQvG&1-M4`fT>+|GcbJJYWZpW<(LPPGg#9VpRlsm}PYI1OYALttn
zT=)6T1?3ltLRKKl9@$l^3i;E@2GzlO7irS=eeUTGu+xJ#OJu>?_6d_m6B+)fLpi4V
zwZ>3GL6O+l1TZdOId>o#W*BTB0gcD0tVrQt>VjJvbwm7}Io<Al>}kC!H~8ZjZSe8^
z80XZQ(@K4xVpN6Lh&+vZi3~EHOP;FwJnjS5TJ^>#Q~S5_tEwsN23FPS7>5>y4F;H?
z*KQ3w(}tcVzI`dhv!GE#)ssbYi8$|0u=e_s-CBS6s4;|f`{)B4l;=!tNMW~DYSQp}
ztPr=M%G0(Va~Yt*-P(>Eg$LB^?stG2vpbR5sXA@TQhY;ez@`z8gV#&KH-pDlAT4$g
zGH!KbX0HyRn+EEUGVx1Nc?bf72%$=gSZzAD?%H4=pIjkf;G@Q(pVE=@#+WZfwAm9o
zut+_RRfqx(OgDi)JWX#UqHuJzRw5SPV=m9e<!f-Qza9)B$h_BX?+DO2+92FEq;VN?
zYqn~#kD!b7z{mIX3wC|W9Bv+QOyNy;RgV|^f+p8>!{4EARKy4wy6DC4m1;C?6mD0h
z4(pC`8MqFY-#A_US+GZxQ4l@OZfIvWRNI<F7Sqhq32_lEKo6y?nig6E)r2jpQ;hCv
zwk1nsCOnKv=F=m;8M6&j@t%R&52h5&sCv~E^AHTqUpsd2-JN(P7xR=clJR&#ddVs{
z`G;AovPo`0_w2$nWxuj|`?*A7zKEqhQ}3MT%*u4#T{}x;a`FV?R5E|2q(Ko`^<gMx
zXSZ|Du=$%QUw=bsf-7VJ8`7>z;AYQY&l|hhzcB5;5mUW6+kUwhTBmZ67yBW))!4VX
z%N;c2MlPmqAQWck5m55ez8w;DA(jzzr*3#1G(bCJjj-m<O<@6ceqWpw?>B1;s4LV(
zqpo?9cEb^9N4U_nrOAF2$j_#7;>-x4;Dl=ZqK2vNO^*m>{otKf0(4=GVYfdf`B&Tv
zT=k~ar$|t~g-gI>iZ^e}DtAV0wuA*>r6hCXG-1UOYf`i@QU$Io@Vq7+K60}K$DZ!m
zP&&wYgVxkL&V{86|2<pum`=T~<Ss=0q7(bOxs5F)9Zk(Re}8|Ph{rV4;Y9Cxu)hBF
zwcWcsr@X%Hu5Gn_1J%v1-B4`5>ERuJPpZaHtQRXTcY<Z%C}5p0vwq#wdBS(2tdm?*
zed@0H;?k0JHQri;!TRp?#8<CwDj$QREi|m*3@?84Osa=PkRpCZ+BsY4K3jyj>*Z@U
ze8x=*P{SsbKeC}r54pxHv<-!VV}Y7d-K7x+kZ3BZXxg+ZQys-Kx=1)^n(0S`LC>Ev
z$I~L!U52p6Q&eU&=L60i-vZaVaF)62)#=MOf871}qbBknha#2DssG>aLQ_BXXJuuT
z#Ga&jYVVvMaQin3oN8=IVNTBaH>l!&tWN0Rl<lKO&n+4OQ7E^T@Eck-Ta4b49AlN1
zO{+dn_4JFy#O>POfbh`u?wz+Gk=c+PD?l@Yd{|uX{0;IKw&^z|tO&riH#avSssaA~
zR(G!h{mdcuh>EJPR*CIa-sk)C%;MjRT<QO<q;G4GqU3AV)=3UFwmX7?+MS)9Bwwk7
zYg|-R!Vdxh>VYGNlTuT!Z$#W$&G?7Rcl{LhW49dy!yDC=l(cko;J{%TGw!wXohPVL
zJ>GvS19tnIS@*RPN;^Gqd;iIA1FcgqdCksJ891~jgd7Ug@ea*dF5q(|;`qz;^N9NT
z039Gw;psv?My%+wUE({lSDjXi&F`o`{B9w~q<(YW%GJNa*_7L!o!f8g5WRjr#56;V
zL;hC$;krlrKmiTa(=?l}L49U-j~fFV*GCZ>MXrVXOWUdF9Z8)2X<FI+d&`bmk$T_@
zr$g%M>(7YZe{xH^Y3LMH&tnLo`}E`-c{Mml_V@)$r&kAeGJg99qWiaCiZ`Ox7f%IU
zfSRbUEPcLJ((DFoS&-0_<8UUH$@T8_)3oB4e|;|;ZP-A?04(dr{w5}%Qxa2Ci(kBW
z@o*#gLTSqhs=FDR6FX=aVQ^4*N<Ha!DaOr?lvwXKsUJ0;Mc+*O6$_v&$I#?Y51l;$
zlor40W?5U}{+qmxK8=LW+w@gHaBhpSkg*%dKQfs{>JO@l;U|AD_|9ROU7)Ku$31v=
z=lt@7_>;r_^-Xf3!W|g3lbzX=@|7RkR(KdeP4C~OXG)cgO-_XW9Ca48lYt<H!d>w)
zxc}DDx*p_*+pwbliRO%HBmW32sJZiJSU;qGB(S0%*p{<pM)*oZabBL>J2S0sPke7p
zAJ6qvJy!r~3T5<`k2$HRsV!@2U^JA@%w_-{ZIXZE**{M#uCB%^emPG0)ZV3ZZ}!38
zGTE4BV}Gw(xPgJ(o*p#=lpg*0uuj<@v2`ucS0f$+r`vE~Mv<>yGb%G|CZcI132K^}
z5PyG(J&xn|+$?-MlR?3U$$ciCjLIHJdb~*@cB?2W1K#R3-4E2qNm9Q7Cy&#fKb@4E
zJaY7S^})=KLH^WH(6EWigbT*8%{QL`EvT<Il9rZUTwYEbcF3$N{y_lY^j;ef;MjUI
z?*8@S&+@(+o=<UYgWvzIPPkqhuk<)x=|xWXaVb=mHUKM9htozpCeN8K$o=%B)#%+O
zW<XRM{2v1Aq=7NWDf-|zZOgK#v8nPuNti7=d18VD$Zc&*B|1O4s6~HsYm@Q*#dH6Z
z>Ho1y><oj@vNJ)y_BcD0ag_cB=GD)>Lyy{R1gQvyHU7?R7uL=5Pk)VC^7>f^uP1!_
zS;wo+m7MNBnpQ*CN=%pYhglT5mH3Z(2W{{`KSP?DOp;>OW9R&9Dv!o6^X;PRfXD-`
z!n1xqJiKab(~m`I5cq<%WxFAqZI!+A$YZR;)%)1seQHr%se*PDUJz{aQ-m}Qy!2^y
zuDayI6r@9>i9#8c9qB$)$CcymbtSJ$|A<xc7#;5wD|!?HTc0^6@in&bUcs_}uHI3_
z<&j`H0>L={s$?^IVgyCbi1ACf#(i9i=!ZR1bGvh9e*;^pD6mF(mLaqq=XA?0!G{QN
zx#Se+(xyl)ZI=ns`kr#RT_9GodC{@&j_&<r=jni~<NP+U@$M?5-i5*kH?qlDBdYKN
z1Z-UrVOXVZ1R2Xis?()C@`<hav4uimm%e*f#KPVJ=JPYdaPE6VhodZR(NaSGi3B!r
z@ZNF-0=nN&l?Yuhn8!@!aPG`H;0aENa{R*wQ?x5G<2QXea>uP{ag~0kv%K(`fx{Jn
zu8mJNV>@d@Sqw#t7p3!@krgx!QpG0qJIJcfe8C;J_RG&YuM#xRiX*X(bIij5a-{mk
z#YDCOJK|^)radyx`C{-mD`#<ANPXqfmZ4~!oR9$%xBmVsX4D<HJS=mp8RC_U<#tPD
zvn{A{#Uxg^j%pQ2I6H2l=2-NewFMX}v!*zhQXq}~l^W`>gk?W=!)p74u8l_$>x<nu
z6EB5teVOFhQJ+r3D*51zC-1IX_Jdl{D>%O)WMBH){8GSBeY01pBl_JOSIV|4fprdX
zcHuj0xK?tQUWnUurEqddXr$l#&m4sn!dtm;cb3tS@N-u5+c^27K8H~m4C*BCKdh9~
z2ahH0Z3$i2-#Z?JsUtQ)O@2xDXC88NC!MiZ=jgOji3iSxuX)$8bo|_mA??*v5z@bz
zfz-9BWdBSmz{f6lLXP{+J!N-0>sq;hxREZ9DcVkA7Sj9e^jJ3wT#i-rz#`ncespnt
zuKJFq3wRBebIr$aYv^i0BfcJ7;gM3_C1!`0^D8&ZRaNJrPAUy}bmJ^zc_@Q!t!213
zm~U{9mReb3CD^{Y0ohbA2eIXvkt$}wBP*TogNP?e41;cG>`I4J_a(62OB=Y^yPeZc
zT6u)a^-pGtKUJ+kHk;PxKgG^f%2peHwoPdFGY-|Q-e;+-a4TRw8ky!U-y42nmts1(
z4p-BZ&KZa?nkkb;t_`6^3DVkE>PP3w-WusP*k>@i2ZO?00~Cz*!yCOWc=Vdc;i*MS
z9H1y>O4~i>E+OSCIr6#(#!mBa1E-rW7)X8Ft%O`~4NIs~CivGpNY+MAbdjW1q>XQD
z?k!F(UDu)H_#3$55zpIHf&xmjSpd>LwYMIb%LwUDmii00qe6qGw#2>-edaDY+ofU+
z%IZ?p(KQ0!4qn5R;=7VYpXg(=CQltQFgZUd4lIy6JB%Qe$?v!tqNJjf%kS&f!IDa`
z;b6k(gJMwTsijR{`L~SsGI)b%n@Vpb(TH0KE0@#QS(liswoRVMEYiUC1tujaa)t<s
ztALZ|be-i~^DM<zFDax&(<yU|G0JoEUw4jG>-3nXU0F}G-yk>GnY%Z%Z;jdoW3`d@
zoOQL6m4(K1%ls2Y#2v6lcF`6yWo`8PPe!E_>T8iBND-vZNuv^#4JijH*|vUjedb}x
zl>EwS1JvkV%HxDxZM4Zqmk_N8vz|J^`tM;x9k6ze)WrI>?dZptd|6!!cU75rcubYM
zg6QTs+t!ER+H=?(Hu6DnUW4(rEmC)dYuF(pzch)v8;@)iWlq9Wb%H!}FU0ClMtPNE
zF1UMVeLfRRX<me$kxvr9KqF<~4!V=&&siH8C>PFPi%4Y*uVJBVC4(p}^ZRu|`Saz-
z&FXKA-EL<(ke>>%0*l1CEM0IXH@MWK0N$XTm9nMlILe%&Cv#XsB2!CEPS@Qao)_1Z
zDNe~(_p9|5zwvqiR~m0wGx8<8cJ}R;<?V-S>TQ3F!Ycb&=@OJD<uLOfFXl(u>U9eO
z1|2xJ{JAuO+)^;?SV4n8>7lTXjW*a84AI97_p~PC++N{h<{x<b)p?1iY}U+T32vVv
zh-C8~?aHzV19dpq>r2Tnz$EvQ5{dTx-x&P#Qi`|jLP%ZA+QDOez8TDv!>im(Ik#*?
zOt1r9S^}$I1ojI#D^WwN32e5+3jeCNK0$iV&aUk1dUce*hp9XL^usex85-Qb`T0hx
z8>Xzd*aCToF4Z0m=fUpOYa+@mqN?=HLvC&s`;WSaLuAnHXVEwd<MzzIrehk#dXSjC
zGJH&#J8yRD@S{xkx)npO3{X=2MSEg0N$?Q$MOR1f&BVU!E5{XXapaOU-`IfU_;;+y
zk7;dP1VU1eKXcsjmOty7%v~v>2!vqC^1AJ2k1zz*gk^>HAwm|rFF3PXbK6NF(%TG~
zobPBED6eTrZcB-)&4CG*mTJeoh4zgi-Wld%8zYKo;N1&MW%5}guKWqMJKoZJGYS6N
z1rkJAQnB8Sb=;`0@fb<ha6L6^vQFi&i-KUX@zLz%U-3o{&Bj33lcuH7jSr|3Ko|NR
zqLAwiM%&M|IeQsBmZuxePT%dCyOf|Ex+G>lJ*%j@IF5o)Z)Y7`M`v1(annj5x1LpK
zC@z6cpWhmCjQ)qm%`}J^{|seqG;(*L1g+B;l*FyV*wxjwc*La-&apns!$C(gzy>P1
zdh<iyCcqB7cR)~nZq<m9WR-C5m4O_ExC7Q^sXhrXM9eO~L`zMt-f7i;_#T;kk61c}
z3c{Y;`K!d`$lTzb%P>e&y1?0pWsp4ehet;AP7PWDoNbrLnLoeIkhxf?ZymE$Q`)Rh
z?;{Q_x6ebbZi=r?8zz_Jsv&S&h(%*ot{Ls=cP6+wUY(C!g6I7t9hT|FP;}z5#YsGD
zp&U|wGZQ_oM-(Vsls4q(&&ou2IyjB?m8&6>YrzzUBnK1`5_XQcf9}|xG&4*U29!%-
zsf%ZQ{AWnMGYd!Snp3S+z$2<lc&`fq0hI{tQ;saduVh{(TO;lW+qWMY?nS9s#mjeh
zZD5x^`qRqPIknJma?m=H!<d7;s<)SYbuhlILWXn5VyA@Uq}V54pKtkFtwi|~>yPTU
zUzB$785F5!sBF1!J-xK7C%OvL2yU!jQ$ukZ?-w%@^x3)rJPh2Mm4fYF02k?4^&1s>
z#i1b&qxqzV_q~RelGi`FB4ims5zLhOUT)?cH+61b->7@dWDIWW{pj$FSZ5X_cfVRH
ze?V~Ll44Y&9WV|0xurC144agraJh40V~S4B4GM>h3O3wdihGe&j_s-#hq0;{%NlPE
z+9bX~9@+c6OJOl55Bb{<e@?#4vl>m}U)1_S#=)|mj*1z|ZWgFP_YZAoHKzoRS>mh1
zv2v~m2atrJ!NEKww%jN8d8_fL_wV2Pw)?0XhkMVnPzwy^#bLnD<l&D<VtNZ7*O+xW
zL7I*$*Co}b$RCIv-&qEHnrormSujJ|X-4|%z-wE!kQhwLgiFc~^G^#fj@jZ}H8@B&
zfoD`64@v_o1m+U+mF`Py_iXj<iSzAw&Dv!$T3Z9m#g=B(*`3mQ1zsea^|qINeUI@#
zRB<>Jf=*&PIL^&6zS$$z8FKvfYovib5C|$mC~Qk-5Z~vx_IIr=q*hV1&6=B){`D=;
zk@ySaVO%3dJCxQs*Fylv@ian=LQ?-(jq6T&)B!xfdDN?u1*49cBvp8+J593VMA%u{
zgbNy(T>Fd+TZ<KVEWsJ{4x!j4l6?%~J?#|4hc{-*>~Z{1mY>#Im$pv!_5ED)a+BXC
z=%-Ke(lrm?zTeUMK$9>38@o?MRdM3~+#UDd{{~7t2QbDTCEwk8?|wLkBww2oqPPY(
zso6tN9>YxqjqNx#`oyL{?1(@=+-<!3M`BRSPw?ldIA`DjQzNnWQ=nXQQj<iZw^J7L
z?t3}%02HQhZi#wPX-Sm#2h^n|{u8fyTFd_Ap(|tTd|&w~!2sK^{%p|qHg@;x?45`L
zd4)`wC8izs<La~w{alONBWTjgBtdei;655GxNTcEBpMs!XiBbw8Q)gs+#DDUE=^aC
zyqqfaFjK}?t*t!3GeLZtj;V=1%{lpSr;{!!aI()$;J5~}>8rCKhoGIOuaEYs4Erk)
z0gU@_SBu=9IxZ#PTv-eLi>E`l@7%fWA!)O5*WfOY<L>DkEv1Qxydpmkc}*i5(mcK%
z@6Ej4EoSDnIK@aAPJR@`A3QY>qBRX`tgO(nZP1CdEMWHEG^fRLl=^*5_j-*OxZFKK
z-nbFXu*veC?FK(2Nd#?73%vTT@Ycx3xAI)XuzR!0nS{3{ws9idQf6=6)*HFMkS_3b
zXl9hjsoOLylt{9=K7313Yh^lk;Vl!O&yHsXMOddgU-GFy?}{4__#W)Kd3nW9(!76=
zw}$!K6MX=e7+PuDUh8`$(J15PeVSH9gp1udtCXwN+M;!yw8*JBJa20oPG=Qlo3Yhc
zbYjsT{rKW+oaK{L^MrS&8_5F?$L>kzHS-8{dd<sITG0+cOA$KSM~?&dyvV)@<C9`r
zBzxtvhzTA_H}W!Ntc~ct>5^oFz2n;{z(saeXjw}cOBY%tp1hEPjMb$%_I+6V9r|dH
zmmpOVR@8*{u$7b33+-<zAQ!z}gstv(^=dK%WVm&TnMl;FJ&lf|<8iHNQ#*zDVwI5e
zey;M~(vOz4EML}L8j}d}B<JEnLZXs6mIC>>YYejWUr7|!^7gHu;tY0|=XMr3kLHIs
zq57YoRB*OnxdPM4T4>BS8Uqhi-RsP$&%%ba_AFOW5(2Ir#SPeuO*{E`-k4zowsa&p
z*X~{_7}k7trx9%!T+*d{=`w_FqH0~h%ZOkEMZvb~Dq+(?1%8Lc1jYotpv9{y^{kpD
z!$mXaZ9C037p+XR#L!h;sS-^@puH`dqHcSI!E3S~cmqwxzFu_LZC9~w{4UOZ(U=hv
zC_FQiV<L&gO!9=XSsqgSry_J}Ve94GHy8@mWRToOCHI_r!NV0;ZUYuQBHE$$oY>M{
zdo*s}B1xtB=!J^sBY~j(vSs4Ho+0J{7MECU8t1|fPJZMdRRgL=yw>SJwsByrdWUiC
z*&_<4VQHQ}7TrBvD6TgtLL$L)tExAzCKaz9?&&<5<j6$ZYbPvuPhbO^6ku7^a!IaU
z(f%D;jUZPsflndgLFX1L_la`lvZUxL8Uq@K(jlMfeQOgh>!8Led;Er<P$)1X_&|qN
z$89SC#a^Rb$a<^V36eEjpismHmr?_LO9n|4(W)fm4`pn%M4rU$Z$P<9Uk)UrN5TML
zYweiT%^1=@1#Tq1cFkm_yxK}~7Y){^9lS|6KfF5Jq!pUw-}IO+bY}g9Rf2qMILkm6
zPTJjR0x^6~St5tB+Uk$>4`B{~f!4HYI8TesqCTf3+E#iwCbI$Ndho;jMHTEAOsRgy
zsPfxF5!i}^oGn;E@K30G^N2hSGB!Ic;Z-OnOD+Pz^Dzh2?1n-QH#k1=uV~2EUypjj
z&m6F(a?3#lqHSM7Qcu~Ol;j+`vW!O?G0nx5NMMbLVg`!7x5RGRZs^C}_*7z}9Mowy
ztvzf6S-R1vIh0Q7($y=2U@7=(#ihIg5)AQNnvUJe{;PH&k3!AU)J|r95$&`)%OmwZ
zq~(EeKK~%pDY~iQiA?VMf{lGh!8O$9Yf)jVLX$tolhEhALeMioVups7T0-EURW%Q>
zhm{H4J&efZ9do*UVPomj;ss=Q_DS7S+&n8hA8okA`tuE|p#y%k6=wr>D(+Ob<Th$x
z$c0@kGr7k&>iNyh?W^wh&af%R1x?TAGlqEE`@G@PWFCYDZ`mYGX65LfJ9_cjX@bv-
zEC&j1;{wfE@TrJ#X-9dsPee#;_qmB)P*Q3PJ_zX(s8Nm5vAD<CSzM{BypqQxE?8&6
zf`P)KyjmK#=*CX>QsB4nPaAqIRJA(@Txro~Lr>dev4+Yi(6@^_pTC<#2Xn}zYm+=S
z$j#vDflX-~)2XE1{CV#n4sn8~p37)Ozzz1aN~ett|6I=pmVP&|#LpqPYTNLvaiZ3k
zTt?+v-x_5ZRC(O}G`mP%2$N*~tC^0JR&btwaES^pb7si~k84s;e%Re-Z9>Mv0Q_Qu
zlQuayxus^-E#2BsI8i(4VtcdH_OMBB>0ToW;}QTpBDu04SBHpyOVOeKDj^ytJU^Kt
z!ZcdXX+#T8Oif2hcBMETwz!4YO-T5B7JHOoUsv(uy!_Ip=Y)6}*%I3^wbLbh^Iov;
zSL#gCE~a54K*G8_zhmmjosVN|kRultQGe&I+x^G3*wg#z(SaTjLgzq=`UIZF$7!Hc
zR|)Q_1w~nMJZv*>?IM5Rb~$b7NFgdX&z6~IAPr*rnYI6wI{Ny`!%6)mXCh8(bp$<E
zwNy_Ck{6ZF*wPZz{8N*b8Gi;C+jW8h>Rv?+@O;;x6*_RKo0?L6(wW!(-_Edn=3k+<
z-^r4!AiA7e%#$_M1A-8-UZ#{yX#brF8y$P)!d2t=k^#8dSm}Y>A$f0R+f>?Av%0}H
zZhm4_(i7rVrN&iTmnWqyx;8X#Ve1(c>m65@B+)Y%qYy+ocg}P0t%rp4vetu$I_v3M
z6KNu5+LO-Qo2#D>!-S-b&9plJ+jr@a%0fnn`~?J#P)v$B79^F;T`21tXY-|^R31rU
zo6%|)ucgf(U?y8YP~Y9D!E%6HfU+q{zh{$P-t=9(fN4KXBCJ<Tz1-yh)AgEvudtn~
zsFO8ZzWlyBQK>{*#52l?Bd)JrZs4Wdw^;c+1d<Q;eTXhecwi;*ShZ+5KfNACK9?<f
z)H#u!ohfDR3;{@_|1H|v*0z4K+nh;!b|iks2y8Nl@YYmvWp*0KIFrGqEU!AdfTm5W
z1A;iaBTKI`4~~CAJ-NT_zE&$+%sPtB-F(bt{VbByzc|%7|K-udx3Wj@p10mf`3EPY
zcd$<n$!B^U7~!utxYrH~{9Pzu`m_@Li_-3<0&54cP4xG;KDuS7s4Tnhpu7`-t*0<m
zvVNwMueANF<K{nGB;-q>f}N7Qn>JrJEnMid68J0^ho-~+P^w=Rb#{pzseFWbEbd;M
zga<1%*~5v4u1H@>E|RWYfN;Lnv2ue*aSvA$O4CUUKC(%|vvuYq(E|IyOeOda)ak?l
zM`SaiO!?%gjY3TKW+9c`R`5<M@WU}Ve=AGD+I1Qwz`G?4KQ@W7vY6#>T@GzE2NoUB
z(gCd7^tT6~h7jlG;{5jgHfGf=L;$G1K6^#HDEq)8WVMD*F8C;Tl5XwE-S*+^rcxh*
z>u~*AE!b#|sgj>>_zQt&6QF39k|sl8(pX7F1?bxs1L94&qlpEu$uM4G!fh*=%TUX`
zT7~X0r{UjKuRqnVWr7raJe{YWOL{^(547j7^A0W$;^c;e)*8eyMLVrl4?LcY6#dwl
zZj^nALp3O<aoM{*S|RWJ>5wZ|uCUqb&1H<{<>Wj(b?VeQ^)Vj`cX;-S)n_=)jPI+8
zj%I@(kaW0vN|)PFNEerP&s*{9at^y6y;r(%rHZ4oowt+^C01}vM%$cOdLKW?Hp|$4
z=n~s^*HDgpkvHt)4{U*TxAlOGJqOR<+TnZY!S+<wcTkFUQbZGauyMny_I7C=OXXt6
zK1#y96pV5<@n72MJ^lyJXWz50+t^m)<5C&~h90|eoK%B;?CXf7Mk&dBF3E|~L8g;7
z=E`c?t1CpqNy+uD;fUhI;^>}DLG}b?@dfgD%HURQ1oe$$PPyBw?$VT&3d%hN<-bhO
z51nyZO!P`Kp-l6HHjugt4-$RbM16kFf#Tcd_34JsRjSh}>!c(nzfpzss0uGm2Dk$U
zGl;|ULADa)fKb@(nK+Hig-<2IAuIwY@y}=h*RIj223@{R%_zk$gIc*l*94Nc0yD|v
zf%NheM2)~@X9=`VTqet_mnuS%mAhf)XKwyjEeZIcKp%4lF6<z^0sl)toH7RhYhssk
z6#c_TKU)3d%<`SBD0sfCL4e%r+kYrjv&pKfk_IamHlk)W6gMZ&eD-^^)96+be8bk`
zLGXT~>}E5x@>8ySEgevq!I;{Tu4X~7*sP(2sBFE#2KJy(Rl*a8bWzSJyz0MJs+@f{
zYw+##wPA5P%L+OgLhfGS?u#Gpr__fXVnx78c`P%&N@CKy$KY6TN@Z<Gk)yPR!?uOb
z-+Z3NK5X#`2-HLYaed;QZ=frZ0?OPCT<Qx|Y?*ssis*c_=J<ELR-Z#%o0k|WkKhL)
zd|lW(!P*W-{U_R;n0Yv~M{;#0N_I9U7raAhbh|r!hJ>stMELGB<pulRI_@_r1%;-F
zvAARNS@<#Wk0Q2(SR%dQSF_m1J;qQ9=?Wmnl?LAAxJaJ7oGCpwnD&RPZU5ek%TlDc
z6<Qpao;PwE<*v;YAh0Oa`lCi|_$CT7F&-Sf1omqwxd!|G`9-y)M1@dP7j`i$N&^2x
zZ!UA?>^8M@qMb%U(4obICkQPBY7^S{K@h5-4l%)c?PEnL?8}aVX9wPE=kwB4VQA@|
zGzfm7uHX~G=qxHEdH=vXQ|1QW3s~S}QCM7FsCJxKe%)XS*oRDd1)Np(PLXn|J7P00
zSVA=PWB;8BuV;}ebj3<KK6mn8zGJ((2Q(ExE+pbzEvkO1Cf^^T6l1PQT4&e}6s>l~
z`rL0xRKZ@y29~IIr{GTW?U+&{zfH#;GUsBLYVx&;i+r5p@?ZQN`BlZJgs$~Zte^80
zb&mMs_+kJXVc6raxq56t^iTyg%CPKi4sG8*Sttwy6sbfGf^}Z=D;owMouGU#3QlAT
z+Um}JIaa@E_*!C6u-N1{Kd`es^v5um4LmG^84a^3lPk{9wTUyBkqzP5g=?}t`_aH5
zOh2xxai%>$dJkZdh3C_D3ya7~iuZl~`3x`#<N+WAaR2tZ0(*6iO!yoR?Vrz{F2o#n
z_u!WZSzpg@Iz>(!YIQqVuYG@S=QD`ge7zz3DSzi;Q{F|xW6QCe&m`{xPq~$@J{nhD
zxuc)K7BY~686gu51~=KLsA^#QlMQUj2>m5M`utOYyA)v4`kaT`c%IDy#tItmg_izc
z%(NJ#MDP02Cho1D|JQTb@vZa2@xcKgMR!>YsmHhd997GQjlEWX3Ti$udr79^=6{+a
zCJh8h^bN#_&(1qeOO5fFpSq>9dmw(w)%aGpHoVl(&}wL*V$xUPELBUs-?Wc9JRk3>
z4q1Jkcpq3U`SThiZ1TdWXG#Xw&6@Ie2lIZ#0-O~ppoXUO+*3V5SVhUpxY{y?oTM@%
z9XJsDln2QB^S`%XvHZW-d+(?wv$k&(E2E;!GopY}bOezm9i*#_V(3z(1W-!oK{^Bo
z>HuQ{4ZTLBcOejZ5eASNX(BC=mPkv0&_YSR9dw@eIqUu2^_@S?I{%!r*RbN`&b{xw
z_tk&bb?+^u8`-dY&S~I@Lf`kCN_3ot;Vze-vy)TeQXX*he2{rt3oY4tqr@a1ijem-
z??GN1JiF(Y!K!U;zxhva{QYh6$vDy<tvVPBj{4aIj^%ysm0bty8NTBmz)Rka-W}2W
z=pj#_2ks#V)z`q1&iu!cdh6gG!dtI5Fj5HJmD4h{61a(`uK^nAhB!1zMhs$|R&;8i
z-O6>M1xS$e(Zm00z!HQZ79DS@nDa03T0n<p5!|cIgs|$xA4;zP%?sE^bg-NR+g*JY
zw7ldnYGFOhE(ke33NQU^Q&ervUUcJKgE}Lw<;6Akc^7wEftxJNV$^m@vH(P|ZN3Zo
zM!M?@vuomSBX#h_J-p3kQz)s`POGb;+X)i$@zL9Ult`waNd%ryhPMfHzyDsbrpcXT
zS=t@=&M->uoYw>bS+57m^uE>VbWg)}Uf>pyMO=>1{tF>xPA)TtSZqc1aU)Fj9b9C-
zXwZDEB^2EfO7N|GsFRZWM+^k&UX04xJS*qLuPU}E<neYiJv*yMEJ<cb8s;D>)v2Q8
z3hr8!6MxB+M-$)N>x(^#XhZSi#WV>vICJ2(AByVKggY9xx@lh)%kfr4Dg2CxAb~qU
zFW)^x>rd&Se^*1dJkbkRzAn17B|I=sff6$QB9wk;(zpyDTMlxy%IppC$TJ0VpFdvi
zJ{@nIB(p3Ha}*W6Vni%*1LNpF?Cfaj1Kr%awOfJCyN_6A?W(2nWzR_@#V$U5PEuM!
zKn%a6ZT+qI8w*Q2*dP-~<tMztbuE<IE_YA}Q=|N~OcWpYp~kzP{bK!T@T$#>A}?c{
zQ9{0%`&&#;*Z$JoJ5LY!R@R*JspD|-75?sG`ZpzpK#5`O)%<H**4$ls9258EO<wou
z4OEslA~dI^1AEPV^*2EWM`7VB-YtEH&My9aitu(ZO$1^{e4*?+^9(8M9Rck;<7EO=
z2-t)fsF2@({mThy;?t-faj^A`q=^oeEqh$rn7-!Wo2r;yu_q{<lhZaKKkFQQ{<bA_
z!Ns?*u(vp@?hdq={N1Zc`?7w@ZEJlbZa{7F<2$vTDZ*(BM=VTKco0ACDl4kg<8gOA
z#1O7;Xg5}$Saviy?PP_lu=}cRYx~Qx6M<tx7T(6oLM}r=MHaXGwHdWvwxaVk_OI+y
zUgtaSqjlG1UTz*H?@sh=iX~wp_&cwCUW%2HdyQjbk#uIh1TU$(hb=IFVq4{5>1YJB
z!4EBG8zq&KBivAJ|F^pi)+fnrKJ$#tMW3o`-~IB7iFti{OK1VeiQ}0?ceKydE}57W
zYCp8mr1*(nP+B3M1BZi|5qW!Go&Qq%><~0>uTr2BRd=tuX&)&{E12?=s{cU9-JGEm
zF1Omb?0!?FNmvcXC`jF3Ajb<N5zXVuFG*NTcsLt=9m)7mszGnZT;XfA*N#44#>#QW
z(lx5f(o7Vx^LIj1LHMGYI(IHBOXAFrc`PmRuKDpc9Beby<LQXN_H4SDpMt+_sL(0#
zC&b(7hNHZBo?%bjkP!K*T;Tx*{n51QX|ec8Z0#<=pY_N|aN%1$7xe+1N?Px;3Ayz=
zM<8iHCN?%bBWu0qP}8opjk(8%tSBzzyHQ1fFG)ppqIsJ!9m9TmA(i~<Io-L7$BXrK
zv{1`L%eb=OaOwC`gRZAmX@p&EZll532S!qP367r@xmV0<jyI4IgyAm*Z*rlR_3M0y
z#yyD($Q_OS)m(L+fn5dRLB9Rnd9=3QHol34<!|OLb79W!rtHuQdN!s7ZSV9;r=1;`
z(uvWuprallUR+f^|4J#^{_DuU#6MJ4ihTFD4<=Vk;lIDzIn#gox8Gu&WDAssvTe0v
zo{H;cwhx(IlY=>S+E;FH-bMWWFX(o(*|`(PW1(2BZu(BrV>AWqq7tYwhM{inuB}50
z4*@F2SqIli!|OEWtMF>}`_mF`QKKcDE-{@hMhnv^cU3|w-c5RCOD_23uZ}bs=-&{7
zXvuO7oqhhQc&k)+zTkach(SgLU>r62T+=nhj*Mw{T-2BhH;d#CXXe7T@7yuS06KUl
z;s)5p4zxjS!rq(s`nLV<^C6)zeU$y|!@YVAlN*q1&V*~feK$5kq|}aC3=iYC26GG$
zmW;*5xk+dyr<Uazvw8oE<haM_mB>$%0tm`PR#HgAZ>9B7k${<C$ki7ujc4X!i{mMK
z9WJ{oA%S|KdH3FVf5zs&T#I`=&fE2%@%DV1ptOKK*+<k7;gdK1Bt+huOpEQK2j{-Z
zceYrYEA2{5&bc|5P3LPmLW){;sava6<}!FUk2<WIa973g-Dtj@zQ@~2PiOc;S=UdW
z>#p=_o@7bnW%B5+uqQYFfY;9f&xTA7e;jpCtL7LnvB7>O2!2oR{);PjgfrI#;<ElC
zaEeC+jSUYIqt4$^U3Q`4jx5ysgnq_Obz6r^Am)_)9sib(k(SQXsLp|Hp4lC@^ufSH
zr?=*p$Vk)AlkZa+w-d|B*4gBecfUiS3*?iVbRXe?-8w`wrO{zwp4+R3SjGMcnQ<RA
zt74$&1TD9FBAr0USf8sB&D{25io10}XMB9qA8m~Nnp@o{65-t}?TY#@Je#{EY^95Q
z1_JKB!k?FnHCy?2t6m>f0y5C>uW=c3_kLUfl5f;a(7|3rQB)IxWfL65#KopxCOy$o
zBm_Y_70-y%;5OW{dlD?RJ51;DW-4z$9aH_pOH>N`f1FhdJgB&R!xnFx{lE|?1OLx!
z^|<{SwXrhjWt+&gFY0-~B8`q8=`Sw9KlCr{@t$8mr^wE3{DDZtRz?La)gt%O7wD^q
zvtE3vsNas)<7!CO*%D3AB*AQqOP?XIws*A)#A+1Uttcu6`7-JRVQ<Iy^9&ki_Mb<O
zL3<Zm;3n@%A1p+j`FL@yLU?xL+Uy3KGQYD}g8r~@om-p^cHQZT@)e`2mOj_bHC{Np
z*E`1|dFTgm8LN&yU(+|XUekS~nM`cE#$_}Zv96=j^+8m)Rc)d1Nqo+sRxCEJu)*Y(
z*~{9o3767B6Me~mxf{+@dr2WtDPaiEIfBW({abfqe(NQQcE|KcC-!RTNN+Xjzi6aD
zNBs6wp*zcP0Z7fFTB)E7ec^BGH{2~{Ik$ngV24-x?n0KZ(mXZZ(AF>S&w!oZ^kp0C
z@F(|tXh5Eg>FE!&lflFSUAoEFTOryRe?3P0ip4cu+!7^jDQL^RCTh<b@IG)l7?tQ7
zESIh_z4X8Dw|1zd6>W)tI4jo-7wvz8IkPa=*i==U&e1Zk>9b7k`V?a$7HF1Qnk(Ug
zS%!yzBE#YJd3xt@NdILADS2X1s#NcO;G^BDxu7lexI}wXGE70_qtg=a)f#{LS3JIX
z5_;<xFl(~Pn(i`Eokiplr^^$-1JZ3m7;#rkO4;+7KNH-j#hqm#g4evknED%;E&$&H
z<+Z(o;>)lkQE}w+uFy3q#PwoKX23Y%m2(}iG9_5k@G;ACZg7*lhGnfMvUf9l-eG4b
zZK;_<Z&Kf9_23mDGMM+J%cIh;^>dJA4Wia*S>?IlMPEg71Jd*~f{kV7AV|0oG~?f&
zdz(@5=;1#>!pM8Lo}qZpMc?t87$XXNw*XKR(8+ZwWN|p=9lpjsvz2l@Iqe0Ijlk7<
zC5d!?+E+m2z8;jYd-|9@UxGl|K22{9zEds@x8xR&9m8CmRXJpv^X@<<>gn-DYREsT
z@Q?n>B!k$=+$&1MpKhD0)R$`L6=nC8FL^4eyPsya`|^E5>G%#Y&NshsINP(s0r+F=
zql}&s^aA+XY|`)g!2bQ#*m#O;W|e|7<xO2q;FtgOB!GLO+Y`<b24S9Z7j|R*;+o(7
z{;6r6ADgfwinI^O0=@gHUUy7|dypvXd!PQ-xNqg1Q<=Oly?k;9lF&4<^W2hS{-ns)
z1;g!f1tl}*6iX$L7wA-sqThD5iSE~i(<6WX7{(@iev;OTj8_~~!=61Bb^{!D$8wV=
zwdrgAS^mH{7pd<ug`^H;9wv*iNFEV%_!<}caHL-FPFMBv8AWzu5#W&Ado1^PAgct=
zm$}~nv1DzE^4ZC3P)SLXias~LzPOUWAA4Exjw538vmyjR`dzmiCaRc1QDXU<ote;{
z{x%ZFDF8X=>hVv|U@L#G@3GS=r+kNXf+}+8slC7CyRbq*3xVZ*XLWj`g=^F%+)gs(
z+zFp9<W%Y&XW#3u>5tRp?mm{?QM!Ej)`mI_$>Ad>+ED$6ATAU>K|00K`eRb{SO!X9
z9>@29i*)Z`J}g;(c$bTvqS~7$jx@RTM>M^m-psb5G>Ug5pJZA#h#{~cwPWK$bIwL)
zmW8!ryP;!2NQ-kW@EFR>ahjS3*J?HJ^L%Ct883nUvgY<u7%a)c*Fbu?{kS8OqB&R|
zF`wMbvAg{7DsAsylR+<aYfc&d6J#}i;BggUdLd5cYkL=CRgi9(=Dtc2B11M@ujw9z
ziX!?@cZNLu)ax}HC!VsjSsqQF>d99+NlfAR8aJe@kgqs+9iwXboM@j$*b-$rwiCW+
zGvI)%q9wz)4*(J)H$n=hAY_qj`RhNEzH0Wu?ujAKv!)}RP{upG{q@KNH$Rcx5`7W>
z{bx)^7O1TKNw2xex;ux=sDDx4ZbBq444*xtjY=*EEd-XaYx==8Z_}tAb49Hriotuu
zz=6JV&Fjn;tHXqS=#O&M@;0sk-4uep5Lj~hV4=gnu5!saDOGM4D~jOOhT~x8$2uEQ
z+udV9r!sGuVGfr#9<vNW)+L`i<0F#cKc4RS;58zYkNTDAF@mS`b-h)r+w!-0GW4(A
zha13acxV#|9LJGhJWI}TCKKg+#w)yUP@^;@Ag}$1oL^~nJyppT`*hJS#CsU-yM{oD
zLbS?ZovZn~nc;^1FAt0Bo|J_yNIcr<OXJ4!#)zu|r`|Ch_@{T2_FWWx4Bpz_1PYv~
zKa*Fyk4Qc~aA?Ennf{-~Pa{zm|5;4Ogj5rB{08w6(3V;f*Pqwunjyx&rDqmjXR6Oy
zC;*Nyz-o!kI*-iZLxQsCeA#_R;=K6sVg-_l<dcf#rAG(i>?=EEaaX|@YJ<~tA@khQ
z*}XBq7I>TL^#m{#%e!odxj$Z}jPpoh>%lng;DhSSfi`MWu#Bs_BzO=NgN5!<0@D4j
z$Q)fQoPl9b1W{c0f?tZQ_TalIUx|7;1x)xwiO#(@A5)9&y)y#QAox#-v6}cuTUMys
zzEZgJg7}-`me943iA#{K+Qk?V{N~bEeU9c2Kc2Z0Q4jUES*p46Lw0^e5|?PwFdPMm
zYz<lTS;$p4hGC3oHeV+Qg%v>Oy&1_Y!T;{`X`C;F;%xTai&Bms0m1LWnd2O8C$4=R
z5ODU4HUu%a{;K(54CetAZyIUe>`-$vD`;yD21bS1Wd4$p(^Y_v%G(DTI>w`<F|kVR
zel3kr^hZvg7W+GzcFY17T?8TdFX73}e?6%=K#7dLjg;O&gy6S?PyX!1`z`2&sWPvb
zq3kVdtpEv5?kdIB(LdhMWbNTQK(7ur(cFEkfB6wG0(;6K9$~nC^eP`1S>ol?-a`#*
zFEOYrO+ITeO+D%5zBhh00JU4QIx~Ovn6pUr<Dw%OKSm6q;+G&Q?)g<>@7tB(RHp=i
zhW!$41@ZL6-^b=LYQEbo70Sn!kJr@-W&N{b)J-=q0^5l1qQP2*krGAhE~;lk*~Zc)
z{BUVo`T_sEcoQZH=+Mk|A3IResyT_uGVzDGw!%2|?$sgaGfxZf&KZ-!PFvJPum9HZ
z0|5PkTP*wur^j{z`v0u7G)yf4n6&@|V8%}V5f%TuQpNS+VC4Lv9J~>}zUF;@R;ilb
zQDlzfCl1H*Ot4)Upc>z6YioVW`$QoC!+Pxvav49Gjy`iD$G5)^IY9dP{*33)Nd0F^
zWft2YrgJIN9EtqvOdw)W9Q!k_0C)ZX{v5;3G70gcam5|f+}z!|<z6Q+|0R3=F>|9|
z+X(93eK?Ow{#Ba?AMgD^oT#guGI|*+@09t$suJ!@DU*jB&z7($-sr~I^ZYE5F}}ii
zB+Qw-q=;5J@~>W;yr?LZ0i)pG7dDbrJ|fSiUAp|_SF=OXe_8%|3v2jAwk+-9i8GK7
zGX)>xhF+K{8qL`U`Q|8zx|-rzReHu%dKVIsBGXHf%%PJddbKgv&88P@FLvB$^bJ1Y
zm-NSj7k7SDIC3|v`WFH1?bHF4U)cOE5#P7=&rt)Xm#7TJmOkQPR8=F4qFOuvlGZwI
zzOQLRll=M`P!t<+LzAz2GgBM$@T1@en-6R;Drt1R_qF+h@3>7(ti!H2GFjiu#%?$D
z<o+wLMn;M5@I&o2r${0A+V*&WmMIh&Al0^Yq(7%<w8{)V*rIE{U}d+j4m3G`9+jo$
zYI$;gbOhPE3~rqWHVr-e%A2!A-x7bA<<;wH%hFj^97WFtS?;yp;7q%@9q9MXssJ|J
zxK*2jl|RBt=p41OL>StT`Hum?VE>hQH|T=pRdEYSnfm#e|5c5KK<93(iU|@)HaEo2
zucoUax^{xWv+kZyKh$0}Bh)wdsXs%fG{39M!IwW2=xDRj94S{bQ&PX(vrg2@LRr|*
zh~xJ1M}f>j#mM8VMo{(r<Z+40M{O^<<1aA_WVkH*_KtFOC=pbe=9Yzuc8;=eooahR
zXKUChP~Y7;?TAkun_Z`@{q5b<Jt`1>N88Zf(?5zsvvhuePme0TF){&w&E{U%oKW+P
zO?)7_MV}>1O3G)YQf18xt`+W_uO)4_95GQ<^k$kosrY8I=N_t7ZghyQgWcN}63&U`
zb{&CHp9<7`@dK0cke_09(;iM$3kMp;?$O=u2$i9=-Q~zL@#R6_rION%7V@)}2{mMk
zalp{kHGiU6W`=6K8L{Ma83?Mf&^_fii-Df5&9+6d2$We;t<aOi{K-WUZr6&snv^8p
zt3Cq0W?@-*xF^qRo9gv*Yg?;}%qROkoFf&xf=-#uQ;ylYu_noBo2FSMZ(I#<InWZh
zm|uS;H^98flSr+>mic@%txPN7hj~2vbmgoqPY|UZSBd?xIW+LF!1_kww~MJib_M@t
z!6aP<!6#h{HL-bO>L3NdVkOQTz#ziyMu-s3AxPIG9&czl?{)A<+m>s_wPB)*`dfqg
zj@n4eMt?@~kN_lzI@D^35gis55H^;;<*<@<j2uoK<1$i4D%UPhqdna7JOvN#mn?fV
zxPnn{qK#sg%!d+d_7kw|u<9V)MtXCa`Gfocmae6iKy+1c<(&Az@2y@wu3dHyv1r;8
z8m$l7+#MX9_KY|wBa><9aA@MFvc#Y0f3J~v`+OHJ%fRSfM9g&d>(*?JU1jR`D|JR<
zSE&}1o_1_I)pGi<PVh5IY&nc^6E*uq|Cb-C=$pl>@fB+M!k5`6lp^kZ?^Sy&W2w`v
zka3r6DPI=K7A9KrVQ#tDbwSkXhik5*a#lf3tfz0xq;g(GDp9PC>$jy*OzzV=hb9sg
z@CVF$LFB)FE4n9k29{?K5}GnjUti+Wo2eb!f|fJc9zWLKe}8k0#bXGtnfs3zoMpu0
zQ8-#iiTcTClDn_MSkU=Fomxt~P7(j1Z|w66Wc^3umIq5y%{Qa0m^vIENp70mc)A(9
z_;K?^+z|skIGwE1*RZQ^9;EHQ01GW*Y9Y{?|1`p`cz^$n_gPkty^`yS@q$_=Yv+1l
zYcEq5+Wqk-4TL$d^$opDJp-C2v<vk|`octVBzi32i9lx$hsC(z;Oc`=pZBVSkayyz
z=e~2;K1Iyv{$!eozoMh|uOKk{aUl>YZ{SJ_x^tjFK-ixAepEPZNtf`|{})N&y`9%F
zkbii(q3hSsGcenCBCm^!ozvC#_XY+Yy=a^M>VHfU!lSmPw}ay_Qpdb$JC$oz`y)0<
zeAD$|*<B-<7+bzvBSihXe=PO->D;fhN7!{9-QhhsXP(_NhpyHGeM#>x#{8RFRt^tn
z=IG5j%BSgpsigpS{~a%|b*10j&GWF<o%kNEA2&?_adZ2J1chv(>M<?vH&xb`O-7L`
zo;%02^9$VXQOk2=W3v^)o>Ojb&(|MR9DpQ~!(Uf+F-=s@2%?03cY&O<8bQfty|=!i
zNvUuIynJ3p;jnF4P^WsF;o<42hz^l;Ra3+Kn<yp`?(p66eNG&a!WfKRd&cm)l-pNz
zhIhUPBhi%9SVsBP_BLXsmoCsb7Qb`S>;R@?Icv$?g1bLlnavZlyt-G%uNFh#;k|CA
zz;YIU@gG^2x{o!wK`N<J-x~Iv<qz$T>j(|L@sh+5GZbH_9CpH$1lJt-bn2%Bw8y&7
z!A_bajg+e~W^5)>B=CkkQ+AZtV$rbYOD)){|I$QPx<0I7F1!0rzRd_9&Xib;Ck}3@
zzd4syN}LPXNRry*J*@Kp@Da48=z8T~p@`Lw;6TUC;TLsSuEXRKdxZ(?;UWxE<GX}7
zlK9E5QSm}3*ri5@rP)^*;RD}9r^XZGui8`tbC5XQer<0F2j@e|Lr;-=6ut<KBX_id
zv=VBHTp;ojg!G)Ud9bu~AJ(YY%G2jcKz3<*VKG3B@p(A0v`RKRd!P+4vcY{jj?nbZ
zjAxM;<cfWSM`<7Ur}ww=DN;o$Zwla-a9(A7!Ll`GCI|R+EnMMf-5QcIp)bNXH|LET
zy%3)Jpxz2@lF!Zjas3fiR%)Mtus2L!duDIp-?|q6HH~JT7b@{pEd53tX5)2|S&aSn
zfZDn<vp&9drd6^)&-RT6hIWtZW5?FcvwUM$ej|>g>I7Zi5*!z3oAUSYPy|nZWogG5
z+L)`(tG_Rc8w!<TQ1@TY2dw9g`q}%iPb8edr%*y1oE4RhC3@lmyk+<5H_kH2y=~BD
z_##2sS`cz_&=6|kUINtAO+{ivuGjZJ2EJl%jBZ(2D;a7{cHw5JCcLAyaQ`z7&dD8(
zMqwvluo0*2z?7A<EZ;Q5dP5k~$~C0}4qzyf<d6y;c5x2WlMv|WX7?m_o<*tzelmWz
z+wp2^Hd|b#M%alQMo*oh&up5`?pIBW3+)wiH6;5sh}me>cyV4KQ7E&RZN>`lYI~7K
zditQM^1$Pw*cx~LoXYF-h+TU_1=Y|t_BTK)7(q~2(?VdB)Fy1tEF(l!HCg|CH@2Zz
zuiK1_d)AHDvUz9?7BlC~6i0joY_LGk`2tgTQ@8qdt*(Ile6>Ye41$`{Cu0`i@0e_v
zGT><>3M9t1URYy0Da!y&{PIP+Z?j0xNIT`**>Ck}O}@b9HdkIytCor8t#3&&>0a|?
z>a*rpv-Fj-VWLX@Wb_)5a@S1k0qq2f=SBf%NiWIL(T3i8TjK)!2gx*A^utn$T+NWE
zEQh%sofOlE%!ETMSMyu;OlZb+s^MS>s>`MKzU&)V@6aTuJB=~i7j`3$=mfx132U3C
zO!v$x+c~Mu=~gn)*sPZMrfqwTbkUwlg2tpWrqC6JHC3>0TZpfyEP-^tx9HY6Gz~OQ
zn5)@6U0+|9lO}Q3fpZb|xP&cm7Uj0ro-i=cpq!=}iGh(y%fX+aNz*0q!jY_EUlY?E
z>~+a-=r8K<rs9m2IN+OdJX5To6!R4D>Uf3AFjc`NhZE|joFA;O2D|ikQ1c}OU<7gx
z2Df~V^fq%oXxXXO8X@IdRpCHY_0OsCSVFLJ;es|#&!%M<o|pTQ6-w+7ft~@D#!#h3
zp=n;lJKP_ZQ&TD2Xbm8D$;vnfp|R=a)%EoyJ+m$RI*&@+lz>U4H>TFXgm{M1w+K~U
z`-Ho=Hn}@ue^>D&3s){afVvlmKG4dZ#S!e}9y`|3702Q7U?_+(SS07-F7HjGXflYM
zOCo}u6|yDu;>+&E=5=m<E+_$a=RS7o47q9mcvF&<OG`>|0yXZ%Og^_Tk+4d^Rare8
zAO8<30{v8IsDL#8Qi;t8*%;_4r0riPl~~1$7n0gb=}+>BEnT?rA|{VHhSLhy@;7s|
z0GU~uZ<t1`csr8=ZJi^c$hsqaHjcaVV?|aY@x+1r)MAfM^|iMzm`)}kOkaoKSY}37
z&yog!V>Rdss%P>wq7Si@;46Bd6_=8Xp!2r@>A6T<UPMxUUvc1e{`2Q)plsq23*?Vm
z#v$DIP(3;smEv-|(Q}$YW7J93vDA-;bs#|3?%Nk4kAa?ajpT!8^hFPx&9lv#9rU*i
zqx7!EELxPxb}!D}*#yNQ?ccu?tGAg0Us67r_^Tg%b1%LM{o$vt6{`Uxb&8G6IJ>M;
zu9upNwz06#DSN=PTf%bn%_(3XfkVw~*Ir7yA;#b2C}z7M$ek*WE97&vTZR1^6U9|E
zjpUHJ7djd>!XCp{(hU75swo2I7#GLzLQp#J^<ahQ8j4=E@}eV^*)={Qu)>Sdr6poQ
zb)Z|xC$SG5A299oJyK><SJcQ|%N;*I!OEAI$06E|uR<bOW~|Npktln2?T{Q@(bo3}
zfJIFklfJ0z4K=a}Kpb;EkHsfPb*yEcU8a$bxIeB{0`wUI^uZ+dz;PM`>$rVZ_FVXf
z*n+VLSqay!S5N4vx(zHGiC*}C!9d_?E0idV+l(g265g^>L}tS^m3}T*P|#q)fv=cT
zEiI-VBx=b|a|qJfaJH_z3K)(yTM)>-5PFqCR&Pkuup?Y<uJ)g**9Ur}`88Kx^G%Zr
zmX?Dm$Q>G-dfrIvyr>l?nC#3QZqraxK_P!)hq_9fZc0<~W-Y#coeHD2&}D>&OLcph
z4imZIGT=C_Bd48{jk>U;^q#YtuHLn>sgFo6M+dxRO{gPTWdn174GkUx{!MV48BveH
zL^mcDtJ5D^i`2&qwhj(dZ@#3B?Z}zm0H*nsYh6&^>_i<SR`6wR?myys)bxM9=r6CB
zGO4Y(oirro)P01Ink0l(iQ(-iC=b}*56lbkQ>;DAwRPPs5K(BtT)m<Xd8+Io2$M~I
zmDI+Mh6OGc2kMK2Pdg+{0v#;b|EhoegM!5Vdfa;K_4*R63=!cW`K;@j-rI3P)Mx2q
zS^r_vZ&wH4VH)A0fN8!*kv7mxNwv68dGW%9!9AdWI{f{!XO<sbh%eF_FW(W>_lpdo
z?odl-6@*?0$7v;1`f12l;dYxh+IT3z@|J$7I)-r(*o~S}ck7csLqz$z-en(olmc$B
zYMBKfwvEpKU1Y4=Jz6&Zt8L5IGOGP=qCgvZOeC%QP<k@#8Up>c(>N9q>?bGD5Ld=2
z+EhH5O`y|NdB7WYgmzbZ`CR(_xSA@Y9J_d)-ir=uPqd9rN0&NeH=9u?|2eH#+0k)O
zLBa81hWa@FX#8^3p0gS><n^+5m-_Euf$Ist<><!HN*mK2t+oagf&<-sev!OfKdBr`
zmuVZqiP?8f&&OQ{rObw0Hy(?G?<}x2OagDtG_Gi=_a>3}5=kHKnOw!F?Cg+JU7Wie
zwkGqE5{ReH4z~346pK54J7O~{&ZqKbis)<p;2vtH$X$50KV+X~JXu+Z4AKi3Z3lx0
z>%NGA2Am9E;8>bJvI36jRIHtIAGi1c9wgO-P!+s!sN2#jj-e|GyrbUIkl~)5G$V9;
ze4DUJe@f%*+7u~U&p+2LAW%NkHk>&6#5+IT_wk&QuDkp3GmSBr8tmpDOr`CKc`kaW
z%Lz8}GvM)@$;mDWl8mg|azwhw__)D$w4QO3B?PmRxJ9nE#iH29<E}v>f~Y-42+SH8
zf%&lHD}>lwsyWdB27PJo=(WsKqUvzyf$@L*+Sz9OP1HzwAG?1Pc1YYRb-D~cG`vY1
z)vU^KT`6Y6(O|S^j4czD^kw~e)O4CnZ!YH^y&~Xlh<gNqPe-~o+1trea(H8~v}WH>
z)U>GDP5AbGur_5T|8wLtTiiS(xveLRU}v)*>rhLs6vwI@VX1x`F19zZPa~H%jCwCw
z6%b`}97gNyZEu86<J|(++txWq#1e@rM|>RLeU<bPbbwUHxB@X<aF}ykpK)D(>7E)R
zJQ~*iUN9fw3m^`X1K=I#WUI5a4f-}98wl_{sd0kORfcQi*wrf~jzCaJ!WG!;oSCw{
z?|&c~cW;hIqU#Pzp78NW(?S)|wtJY7gJcqip^;gNd22XFq<&8B?yQsd@RHkJH^rVB
zIT2DYLvx$-zlw?4mt{DvxA!#c7t-$TlX>nT90eeg$!;#ltCpdAF&su+uPPTYfwxdr
zt^g%uQDBB5csHbj%|NgwUwz>lPQLkjhMy+xV2l>#b!~p%JDT&SLg*sXWhwL9+d$7w
zk)j>9pTUibyGELtq{R8Xz`o*WBGQ$yzo~(XV?rx!iwDR`;MYnlbE4kB%<~-RQT6d;
zB8|1r-{7ZJYA;J8wc;!f@R=;2x>b`O?Uzpso2KlSHpX#RiEBR|Y3zBxps}A;W4y_c
z2o~41Gi5>?acli$Nc)30lEjQ7yLY{SQpNXiV&;Z3^OKuyyyg#5Z=U_!FLxmnTU?3f
zWwCW*a}2oQY*D3l@k?=6eSx#H%f1`gQb9GXY2xin+;w)qB`-uZw*Tiav!80ja<!&}
z3<9~eY~TDeYm+G#kXwA2lwYX5gI7y`RA2<X5f_!9JWxi_(b|W3)&8T{zi!G4i@E%F
z`=zB}9(05Y`O|jU!L2RE;~g%UaBFE;B)d`<`Z%d>r~=FLFpunRu#E4fyMEQ=!!4>K
zWqi^5ZWgA)xwMAOM^O~AR>ydoteANm)?s4~Vtq(tsS_48Tgp#{p!Npug}($k*!V?K
z<&Mng1854juzfox{RaE>u>_6mB=fSMKpuIppf|bKI%MYO@ktsTLDZ!cW#J)-&e}Tl
zm@jnBwN~*-;Jb|YWs%ZZ*IvhusjsBcebo2uvFlZHh^<lxsEACQNy9mIN5w!220mle
zwkmtizCS$E#n`9#H*Jw%p`$5`Iiv;jBXhlCT1PjlqH|s8ur&#OCvA-kwccX)gy8w}
zfB^X=Y_QO%3qVJ<70fP;Lj#v!rCHQsJe$2o<2DJIURqkLhg+=kUU=cZMN&{7k1sKQ
zO(9^N-YHx9_w?kz>E?Vvo_5K#Xx!%6xt$X%CHljHn!$ZV)D5snSJ_}9Hh#Xd^N6CX
z!Mp{SGgoxix+U%ZhH5-H{@ZZwMmG|rf5v}~6%KX#w=(8xaCFzc98F%t<&uUHNF6NI
zXS7om$}tRM;7!jW88+}j9}pJC+!L0284r7`Z$_VjBV(7Tt`d4Kh4J>S`^(M+_JLq5
z#>^PYIlqvvXNue~iXLO*9ZzW-u#MQ&hB!M$ynsk$XKh~&ALc+!ZQ1x8;J(lak*XiK
zF9e8adt_q_shnDs8xt&m+%ILAI}Rg@1_TeW==|OgIA2r3b6v1ApGPgAGxWB}pcfWk
zZ@{2?#9rQW)7c%1@TuSQ39a_7$o80;=7`?NDZwh>)N19R&)^OLed^ssWfT>lvV~iX
z4wdxHjN|oC!Q{Tcr%Z6RN+pG{FfMFO?yd+g7@AlQVy-J3;6mriSG>1Kb={kexH9kj
z<iW&v2P*2x6vqn$X0D%e&?q&fu5ltcaAbRyd!v#&6d~F9eF2y8@uTsGK9V5ERNYGr
zyu7?4s~8rm6voahI9+H&{(1=$gp4uDFi4wz-Y`Fgyr!u);y71}l}*r_bMw`3;i&=u
zG6*Z2T^`)ig}OVQ<}~C{OG+olWcHe1Fsl+xF})+ZLjZT)S|IZX_jR}2M%LCw4%Xx2
ztD3i0#!B^xe|LH($sjD$hShQpz<;e=r7Gf7?xw>fh_p=j7wnLaN<4p>6V9K>yWxvW
zxh(JcEtC(rFBG^<%jBkiyJ%9lwn2gGbZ@9td+5qns>g_{(;+W}9ook>M(e+|yBy;Z
zjaCo20a@#?DO)(p@=hh_-<Vs;ZR>!nE0D|HoV|Maxe6iALAb+W%hXGwDa)mNx@Do}
zWS7ETx*4JC)p&e%wX2O|5o53N7#cIS_IaNIcX1kh1BdztoiyOf-6iyTOYmu<f|t9Q
zIQrTTPxhw<)^~a-Y`yub0U%e-dnWG3Dx;DrTWpCwy=dxSJzODM87jY3oRZ#WL;kc1
zAgp)Oq4cG<0-d>IBzy9b^SP4aEVkt?_Xbl9H&wRm(*pu+^b#Tl#{rO69|XKw&fNd-
zYGFAgOt2u}MZTWzl(CXE`Cdn(jPM4!bN--XtcqOi+;W4Bh4GXY&<~iM3POnH`GhmD
z4%fQD1aHL;7*W>p8yCM++28#~4}Mr)uCKs~ci$|Kj*Y009U%^<Nf1W`Osd5CCYXJ`
z#|L24S=pOn%w^Q$aRj-h15&z#-&qd)K3-VP_%^kEI^NJ^{0-4T*ZErO5>xj)&t)5I
zedJh7*O50JalCsnX*FEE@7c@EIRj8>TV$OcanLazLB4judoba=DM0YUI>`oD#$GXp
zg+;mFaI)+Vl(Rie`cHHuW*N?}KeC6LwNd*VA8|V**>YS*>j}i!DKAzC&8<qIrb~#I
zc!C`uV<u~sDEPNfsB(E_kOz2D%qG^vyyhL2Cx(d<UwtRt!+vq_i?k|KmDS4$z_z}2
zgd@!XWy|4sfleVym;>-Fe~`lxrAw$+5Uumi#lYa3OTkhI5YZLvv^l%isiG~bhCDPt
ze@0A2W9V{T95<a_ve!zWUmGXcteu`H5FGVHB9hwyr1T;nczhg!Ds``5a_8R3q%vFQ
zF-|evT@oteEP^`FU7DLo@>H@;j~`~nlVQT8Y*R2eH~?ETQXAqW63L!kyKOoQusMM2
zh&;m4pZHMJVrs_<f}KO`vcYTji5Fh%D-K~K(k7d_OF}fgYh$xqf-WS8_ZDf50GQ!s
z8*mq_(tD8`%N#Eg7K=sXKty))j>_iHlt5=f(}xcSz{fe(weL+KD$s0!{H~(#LNBxN
zv5I21E|nN&y4Em$MMjvTz(}P`0lLdR_vt_5`FpzNK}V};=|SXss99GVEC`*Odks}#
z5D%Mils;BW-)OS!gyUmd$+lXHpCD$}Z+HG@9KDxYtohHab!r1QmzYCu2h8z~H}qhZ
zzsD2PSrZz!3T}9+sH(zqGQItSqU0Q@TMF6PPluTyU!a2`)q7WT7e!QF`vwiKU%97=
zx=p;EoMxyG-}w!o9#g9HbwCM3lRXn&?e)35va~RfK)wPqR3ccbBK;hVE0_gy?au(m
zwQ_UiY0bbupvq{boq2H}-GHgLz8Zw?x91NTBV}!N_MRR9e8<>`2AY~!e{v&NfT^xN
z)K^-v{>DYdG(OlRO6DM9)ZQNbKcE9C3ov~?J(SzFm7R-A0TU%|HvXKFkUstv8eU@_
zGR|w>;NonGmzD^@siyM#>2`~KWIAr7xQ7w{148i9{jabSlvVdkOMIyN%=-g>w~cMf
zfkA(1qbAB`_5nyKOM7;CuqyU{AEq|GI;G<&;h~;B2*dY^zsx0_EnF03qFEeez)DR=
z4>q{^E7khvGI2FmQfXh4zX+5UA>%rS5-XCK2N+!9LYJhBO6;;aQZzh1z6e@*wbzbt
z=w=&Wz3&A$MyQd|K|pJ95|cboTOwS%_yzWTJ!5@oK~Ix}Us4Pdfi?w5LviBWz%LdS
zkGl?bOAUJ=qOl!#eYeiv-fSewtvEg99Dwo~+)Yfc=ZWK_jlxp0D6=*7YtbP<;5;5Y
zV7in!CCOV)Kihx*JHuzoCpWXMD-{@lFt47|3HE~ul-@4#<owcTimI|rPkNd}PC@8n
zi*XMe>5I5->sSAi27dY~svu)W#);p97TXjbVtK_X=bgOPsi;evt<_?tADROUA_#a+
zX}gaD6%r4UH*ta*LYu_w1RH%#+>}qfig;l-y7}nFHntV8p282C3zoilE*3U#Sf(Bc
zHblbg`j1vpob(b<#=815<=IIl@n;ToE%GD1r5idT25&SeRS}4yKkL!>fIO?b(PS*o
z%!>#@Ouz=Sadl%~a@-w^h{LZ!;4BKQGvjxw>i1_#WletOMZalvm9Jrf`cM;%SV6R#
zd3sLmODG5HaigNb*K8b#_l_Tb8MxV&c`&{LrWR$6FAlgfR>=rHs~vpd0ZLh)6xBC5
zulOagmq3V(2U(nVZdm#>5POV&Pj}Hyv`O`k19}ghM!o%Qbht)hQnN41r?DZ3zSMI~
zGm^z&-3F}^`**<)+>DFTF1g3klMxl=MwtkaS}96SuU)XW4R|b1Z)>0prIy<lvp5Wn
zPNJVh5;{{y2fav0g{q&4A{JybSI%3eGsZh=l9)1FHTib9Fy3)aoI0>I(Mo$bQql8U
z@ZqzcXU5M6K^h%_z%$z`gdO_c8Kw{vyyRtz4rFIhX!~q1-#}HP&`?b00JQcxDK_;4
z7}aL)ajpNdp5_*LeQD3cZ+UN+wxyR{Xa{#JwnBybnuZ-d+d3%0ql+rq%~W(wwJ~Bc
z8)#wdGC2_Yho(jrBXZfklRIo_YO(3i$@%XSDXK#H*^8X|Ig2$8v>l+h9K@85U5n{J
z^G&X8S~H;q(3<}=z&a$#QI2JFetxboPoCG)^f#d?9p%zMY_iYx64E-0lK8uK^l_z3
zSD1N&Nwu)KeQ#<`u$P{ZS`FE8{kZ4MfnlW<UOX_Y%wK(T38@%3#_~#29k~fehL?~y
zaQ>M05C0Z=IJkLGV%^d9L+rSkl&JQ3{r~Fx;NlN2wf8685)DAgGU2<be5_5=V-ep<
z6WSW*1*U3XHqX<{i`%0(b|Hv-iOmD17Xn(CD@e6h|2?Ds+9MD_F#9L5c=q)Q$UAUW
z@#E%YC^;ZsP~=o{;Nyc^n&rT=Q@6IU{U+!w532)zhS}31zyR+J_^(-6hZajf${&Z=
zG0{|JD~Vh=d#UqFuBKUtM=j#vPfg0a;;9No1>qa_y8-c{w6`&HW6V}<-J);Xg=m<u
z4~jlbif<bn95b}}nb{9p6acY$eMc1-@ve}Kd%@3)ee-Kj3t}|ZY%7J^TXRD7|12E{
zd+yrxCz`QSst=<)@o!%WtlLWORcDx$&Y>BFBjpH+Ic~!Wm-Y^~-%V*s7N89+dmEZr
za$#V==LJoHpn3fG@w+H{dwYQ^SFQluPWb%G`NhTVh2cU`C?SzHO(cmx4@*Y%Iw!`X
z_agPpYS~z>zV*ik3bj32)hJC-^d{=&9rs9w*7-S*Cu+bx!}$dTU7BiZZv~QusJ$1<
zV7T<62W9V>$t=kyiEwEXs7GVq!@eYe?CCm4&gU-N{VNVZ@uZ*<lHNM$3|jQ{l=s1^
zhG`{ABUHW^3o)jV57O(@6}AdW7$4w&sL*=e?xi%*pr}~{ffmqM`_QfL<hm7ZW1>ry
ziRc0Y@HM9gTLr=n^TuGBi49y46m2WC$p4{Za@KBq{Qna4_EH*bdRF^j7>ABd0TX8@
zOZ4s-G263unZFMU^6yrnRNWkrai)YcQ|58-P^>r<bHTeU<jL_`jBiJe+YS*um%*x#
zlfO%IQ-92RQ1Rn)0MF;V*{KMn>6Zs?EQyx%h#la5Cgu;g8bU#+sk*yUTEh!?Dn*|O
z#x=(p=5fDPEv>l!^#HIl*~Kp=kBzadH+laoA~N$n3Vz4pd1P~G)M%brb&_+GnIL1a
zdh|boW;Q=SGlzpZg&X^IDytI|FL}tre$)`}MB0@$fq8wiEze|leiP9Tbmh@_0=tG$
z&{wUOt20cyjk>+D<`(p=Pu8SX3|zfhF<th5F4n=G04MJLR~^Z`A-FTK+OcvjV^^Ya
zN%cY3Lgi~pg9kIdsobNxkBl8u3dxnV;10@3G@G6?%j4{_=1<vR3PB34SwIq8n=*W{
zpBA|Oc2f9!OklCUqn)LliwN`wu>s_MR&=k(GKRGg<G7A%iy5V3gfPYQi#71kHhw!?
zy6QQR9~y!sFYEcaQ0oFoWmmJ|9O~b;<wf)c;yF=MtIf5jsHhYZZt!T(3=Z)Z`y3j{
zx{;c(WxbvY+w#0X8ZrHF>EI&BVJ1EhRoC|+zRj(bNd>h`10VcC<i(R7s2`|Na68{w
zQAMlI>2TGr*7G7iZVG$s^vM06&D1@Q9WV&EVrvLQ`o}L~K#|aoe<gDKEX)8essdp3
z$Cp=+9Z(zmkEHO=Y8g<kev8RG%%*el|L^kuYik*<#p&t(LJ?1M!!F%O$`U#4zUXZ;
zUjKZP86QgKCl&(Edc}Fxb&hn?A4^V5(k1L+RMx+>%lfLLmxV;2%tHW-l4}5mHdjk!
z00I1XgxkY9E<9WyA2$|%J7{ym>_G5yB)v_5rdqYT9gc>v_GJfw!$eD6U0h{8GxUxf
zWc3SV%#H!PNd4;MzXX^$0k_>(+%jHEU&{(Z`zoz~K#webEweK(dvqte8`PC)c@MKA
z08m?!K)Y%*{O3vaf0rW?@^~-s==kohZ$Z7Y8E>|hMrAVSSI|xyda~_R^{?Q8+=Mmh
z#yN-J?(S_po!jh*+gBH?hDmps-%DYCd><cOCN43fER_T-jc%Sh{M5_%Eb=!16J3QI
zfJDLCA=%wvX>3paGwPu(+)#06&L*sUu0tI_bUn;EFHYmyYhZzLWDh3)*bbC}K`t=i
zaPhbjrpR8GKA1EA)gh*xIA~^TZ^2pJZw0uyxjR37x~G+G_@eF6&dyGG(8hw+2rF3U
zqvhb(_ntImh49;#O-xK^pET7_0>l(>_r#m-UImFB#h5JPV1?&#KdKFZ_G6|U58Bo6
z+u5fQRdxpV*JDNp2=SE3rmJ!g>7kSnG*Ylh@xD&JaaU30#qydE{4VQ0J5**UWw|Lp
zFm1mr>w}67{VpOIKLV5LP)7I0^9scnXJ@#FkX=&}TF#9Nm6!1mrk0Stmg%Fasadft
zd%iUk?e4*qMzz<J$SBG@VJ@FkH=u0L<C!13U`g&FN{IEoD!g!I1~EB<klVUIxVXKG
zxFw}YAJ?b0UMZ%L6)Ys2`9pBq_~z}M;JUvbM3>?e!a8vinBX4e?(TX_J^1KI1s{st
z9l>W4TbK?A^RF*mRoRQ!ll0aoSMN2CdT4MKIH=&yLf@d-5yl2ZGqiTU<}H#DLx`&P
z&Y-2)UD*wayvx`lm%X*w`^JBlzB<I}(J(D{<Vq906Uj{*r5rDrSRPflOP^u4<_p}N
z?7tAY;g3{bdqm)OLVxIzYz$%CSfen=uiwf5&j%a}d<CwyX>*rPeeVeZ%siS>m#e9l
z-mvn>c9x$(ZhE!%-hXz%!McV7&U;Q{)&jJD+O}qFTlY4!Z|!t!wTwqH#y=rLm-62-
zwqs5)Os!geu0S5!%p&zP7c1C!UNeecUCnD@DF3YttnXE-D&kA9cTXZBJ~|K<nB*Uy
z5D23sddDXyf)DuNn87(>3a3{eldI^1xp#N;(HF{=mlN~!7ZVr)DQ37(MwN*RF+1?q
z#&`578JQ|<Vum4Vke9~JtY~_H{GL1+*f5kVQBn|sG)tJUR0+7$+FMxuLDHi2hk)CZ
zg-naIZkvwe<OE!Wy@W`oKABpOHSXB99t)P6vCPxgn4~ST26;OLI9^yRQSocv`b|Ny
z(agJawc*LCE-FJKaAD3+&39z_B~Gr9bMh0D+<$PlkB}}l3&6<cYQ(fT2fVp8_^|5(
zAE|S8jVE;6P2;2A-qyX$t@pyL_M4BtQbYo5CRLzKkhTZAIJo_>ziBpknv7=~>C^3)
zvBV&&V_Q<cxb3y9$qqs5x0ae~jB&Nwx2%mUQ=UAd%(`7Cqz^@}>W5HYZERn4Ezb|J
zq|+m#K`!%#%$NePk$u87SYnm6y=wc5DD5M)Zg2!$WQBxVEP&~(Zf&iVJPs};TF)S!
zy8<CtS82KuUe}l$H#|8SI;BXbTjS-TN^w<N7k8VQ)CeqBmA!FmQWP->YTuePMU3AY
ze2~QWsk*izXG8I9pfH=5-(ViN)nJ||5I$-?x)xc=EpnRV#;B2n<74$lIK02tpdDRd
zc6?3^0hIidU87evBT|jRn>mHvk}t={2UPYPvHm{xNGfd5$}Sj*i+lxt*qIji{iAYB
z2EM++!7{y|NgdrdfH~Q|wPn?@jmKoIWB>`Ime>WWtMA>$j^LBvVj==Z5>&dk>5YqA
zgwtw-68y&A?uR@apo+2M|3nopY=d~!^r{<jI*x;~=c3l|?W8%?p+wl&Ecao5fh^c)
z<g#uz(c#<Iq^(K$%travTvh@?RrW^W!p^*z8#=bcJ2<k|Mt2K^Bc)^KoS{|11gH6K
z8D;%Oiu_DU;YGqJmkSs_2VW5HSPye?6Rfrl1V>>+u`y(R{=2RX4!c(uiHv2C-kM<;
z-wJ6{`pRCjsP5PBl3fZQL7`6?Q;2}p-U17Lu>4FaNRh-O02QPNM{`)FV2bCWNgG1e
zJ*%6qX=|tj?J<yDty6$8n&ra7yQLSG6}<Bj1=@JV{8fCZuto~L1>|*=tCclhfS0dJ
z$WyWeLuA_~gmk=JA-o{=cwa-+a_eVLsqh7n8AN^|7h(D)G6Ijt{HFw7H2Upo!}sIu
zTP|d|#u4R4Z))c*f6o?u?Md*K1pg=hrn2k3RYl#;wyGR5zz^@zLsn>;Qy#MfRy3T&
zD5eI;_<_VT1wUF5$iH`dH0`S7ov)kNS9-oG=;GZz`!8i^A_452BE7X)N_-Lrp9{AE
zn=6~i=LBTCj;W{X`fm{X`5DlN7~@`ecSvz%=lmpPQaSU#CoC>;Pa^ldmSeh4zlM*e
znO9N5_r7UDF1KZc>dJ>^t8ssqY$QQ@x8?bQ#iQ#dQVbtj6rg}1yu2kYI{U)TXGeSn
zfq(sql0Txp2c+c+5?N~7ylw4i2Z*xVI`L`y3r9%fA)PzK^f|j95)TAl4M@C0ANWXV
zHeUUI$~J;GF%Ar3807Z<d)}|r>x_m#aOO8-4XN6wpb=LR{(QzqlitdpjnLHj2$u5z
zYzTYa6&$<xQ0-(hhiRVAAr=LbRr^~1`uGH;Gg(y(D??Qos)u>JuYXCm5T~(CJ$W7P
zM#=A5*vxjmhq~?V*z5dhVrML6mz~7AnE2<5+$~}_$wq(VV`D0x-h!iq-Z-bceQWuc
zK<8+cb!WVdk0TN(EJrnSm@!jBe^FFx1OqtH9_%wA#eXcUv$IRzc7aPNHaB$d6N7-?
z-@ogN59C1(Dn5!RQ{5JlCq`<lNPjwS{c!4LSRzYyot{QjmUcz|@ydy%WosYCbL(XX
z@LCx-&tvS~b1jPtsi1VrVC>h2!=J9Sw@pR5zmjTiVr5spLJ5EU>{-W?SpK@rU0(-Y
zRgxlsB&8G?jfVAkf?d{z<5hXKJNEbNDUL3;(`1_%+EG3^xhZ~V_3nPE8CNax(lyu!
zT|se0izahAg?(6x{n+TC65mNdxP#n9*RB&0%8LH89G#DCmvFND9#h@MmsbM>Z`q)t
zqbj_pft=zH6xc1YRb>Z>3N%J#(K?H@Q0M=W?X=UZ`E~5?CzJQDr>gYTDNyvt6~&`H
zjobXRl?SIb)JKnUsu7>PymIsD7G3U;=tUZ-;qsXV@286<%Cz~5i_c%#Oi%jjy&0{D
zDM+zd2{e20&gop8--uKwUABpG;Yq#L1)E(<YYVl&LSBk<Htp*%REYnHN8NwH33rU@
z|GMOzqQ1Y$A*AFX)&3|xzSwb*oM!CTYuG_|iMXCh9E|q}ilp4G_%opOO!7iEe^XBW
zriNTfKDVA{hR_{@^SSetyniQzy6^C1xc9B<rgf7Q@+gXJ{Q~vtn<;MM=?it$=|>pG
z`oFT+J83h7_<ggux?2LwP*JkR<gcxbJJ)#YJ9eK7Jh$917DK#iG$(noZ*&v$7DIc5
zBtG~1C+HY_dJzGwA2!e<nqKVfu=xI6`|SzN-%1JX=@I8<^<N7%JiHipq*$QV@Yh27
zMOVbv+F-BTP205_{OR>Q%Wj8E<mO~ZkE4_X!P@tl5${v;m`e}q)DP9N;A+244b;3j
z**#amt9VPZI=w1%k3G2b_qJtagUYgG6gXF%{Z>|WDoXNK>$|PwyVmeL0aWJrMVr*@
zx}qqkT)6%5l7YRc4uQ34*)MUeo<bcs0q$d5O}D9~I24!YTsB3{kn>{3#wVfF#$z*`
z>Ypb<Uw#^Mmvt}A7O7A4v@TI<`Lo<PFVAr#s<-I$4kT5nj{*;QnViEWXfa>>^`4#X
ziKLVhXV5#|eU!JIqkd7VlOrK(W;}ZMD@{eIsP8?Y&o1?T|17DXe70iK{)E}^+9N(T
z{DsTikF;Le-MmR#J8b(W{z=a(s(0^Hs_$!?sg(?jz)nk1-ssKAu501_ho7#B$|3`j
z|FHS1Ao;>{*}r~+sSynpSJpRzB+_%M@}i(AB21osT=aUJ#m=3F?vBFy95PuHIZ<2U
zIddNzGXp`%B9k<GGl};hsB~d<ny~Y&PwNx!QoO8RY_8Rn9d@xU%q+N}%3a%X=++Ib
zoAEmG?^eR)Vk0f9(}e}C&9u)o2T+!HIfu(h!%8C3+TZVmwkJ&8K+tp2MYQI1C*Ju6
zgk8Qg;QQSEWLFhDL(2LWhbzG}8}SMu)~~f<N1MMlyGvK5I2A<e;!~-P`A71c0@9ut
zsh7^2T+ZE@=kL3@wCd8;q#jYOv{`ScEu76}y(>s6wa!+iniZujpLm<;KFl*SJ}epN
zBLAQb9F+6NvfESvNktvW_+8^>-Zj0!!eNfXlcQq4{w}L{=V*rH8^M^yj#ruwBzJin
zL5*+W<55AS0fTa9c6fu~&Tv!QtRTv$W2?#Vq}`oY^j+tYDyW0!<aFoVGK=I!OU+|(
zY<@moWIe`gsvk5%dG{vT|KxTwK+mQB>bsu{)-sFMt>VHb7p;X_ccZ<Eskmf6;QR~c
zuO}i;ymfTCap&q6ZG_GFco^4GZJ%v*?71>H*)^j6_Q^v}ZM_sctPjPQi>UCvVQDuK
zF26}hV&5K3V%5_pT=|XA-k6S%t-7ihbggs##pxwNRa(I)cFXa&ld^ZbH*XcU4y@Cj
zd?+Kyov$p%dFs3Iiq-9h99()b$qzS${)obQzlK|kUid;BGqEu4#y5y^>23@JHHL$n
z@6DZM{?$j<j%IZ_=0>1(k6eDb((`0CxfP|ja6vcs({GRF%b#+G=<-Eow;6R%Pkv%Q
zlK-$h@nm*cOMc)39r}=pL)dEBx-mN3X!+!W3y+lC)V@$GfQ}rfx8)0|&T%I8bB82p
z3POUUt@dIoE*%Yg_|)e`zo%T?!q_(DO4B!(*h61kx$I8dc2(iAqVdUlCM@jXRW&L@
zvWXk*7fxuNIFx;{N#96CCFFmtNF$1a<w*Qr>qoqMV=OACJp0xy<A0@a!@q}CZo<ng
z?-Vuvnf3ltnX~21ZT>%giZ|b1wJh`Sc1ad3iHF||1o$S;*Z%V)!}|LVwxTOv8$1L<
zueu(P;>wSGcDnm-$(Pg>@nIevj(PVb+r$@r`QF12=#}(veW}3gQa=7CPuFP|8T)kT
zI3L!0u=?Mp#gm`&+?AYZV`p|KLrSB|aPCy+&Grt;m6L1xc>5V#4a%lpd}DsSa>KvE
z|ECmzW!B68+@D{_oLM{r6bzpr!H~K-;$UQy^`<>vU(Nn=dYZ^%$C9GyPx^9uglZKM
zbm!f1t@_Nh+@3pdUkPip`JdM7>!bW_s;0VZYPCPQYNf*2xBCQ7NtaESZ{t^-K4sO@
zR)-D&#ioQ$-~N2H`e!vqk$ZyNL$`4Iliv<nuKU%|CS3F7wa#kexm%Vg?AbO;wEt$=
zx{skXho9!p`!9OdHt<xkH^-&sE$Z$HAx@!@4g#_MHZ@a^$oCbk(D%vzq<6$DV0TTL
z{9?;z1?P5!g>6>4a`J2O{0|2&Xnnf$_sg@~M-Qe&Wi1ZR%(Xnl{xX!M)^nY3Qt4Z6
zk#j$eO=)-4x>j@b`3)^4ThF`?q36zp!ZL{!JERz2{=oYDZU)aPwNI;V{w!j=-uJid
zaPHlnO*8%|9DcF(bxqx}sqZ9vldtUA(|GEI?K<^ITfQ$j`Df|%{xym3_szW`+CRaf
zc-FIE-7WVUJtUe6Iu`bY_0?51Exx{K%5{@VA;NRF_I=o;yJt@k=VICTf<K2CvdeQ4
zzb5DK%=2BbXx7!2eo?!FT(rzK<bRhc%H47nR6^H2z9J$jbmyho#j1&)PsVA~HO{rK
zn7j7q<iBQb@1E(t=s2lUx<@?x@|N<`&WRS!WzL0$->dreH$hqdSWrpK9*^wsS%;po
z3Pk!|20CzR>dt99Jc@QSl-}Nde%~(l8@#(s{4T%CI@K&_B{VlBYx~BJjhBo5uLD<Z
z(a$c<IRhz)+gy{AlZ6?Cg@t{5d?uU)9vx-$<@@)|d3Sd`kDae#>zKJK`uwMtJ5S&7
zxLg0-yQ3g-PHp}E=B?astM!iQe|%@Hz9Vky<oWwH+NB?;d9!VjN~U9We*W?$OIj2-
zI9i=_qPB1VPo~anH10o_AU9RT^Zucn%FlJrSWcw<WB;&q`y{a`2HLO63OB5q_;I7i
z;>-@0#ZTP#h<X7t_M~}gpH~3$_vT0cH>l`3FizYfF>%lH*mj_dN@k)Vu;f#*&E5Ac
z45akSksr6BK`o|Bmp`mnzxVIC&sqT>aR{2HB5n`zHUypJ)~f@X59ZGj2j&yFN)!DZ
zKQ!SgGvf+A2E()g3z`RyK#2;1mQ)@*>JQ_ncz$l`o)1?!=~-)}xV^fX+PqR(kl>Qa
zq;)=-_rTWFM)yzB{QCsAL5IFPdcMfDd&b*zu<3HguYX=z33kO76&tU8f8rgV-F))!
SqSbLwN5Rw8&t;ucLK6TtSdwJ`

literal 0
HcmV?d00001

diff --git a/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/dashboard/sample_dashboard.json b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/dashboard/sample_dashboard.json
new file mode 100644
index 000000000000..0370f58706a6
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/dashboard/sample_dashboard.json
@@ -0,0 +1,38 @@
+{
+  "attributes": {
+    "description": "Logs Kafka integration dashboard",
+    "hits": 0,
+    "kibanaSavedObjectMeta": {
+      "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"version\":true}"
+    },
+    "optionsJSON": "{\"darkTheme\":false}",
+    "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"h\":12,\"i\":\"1\",\"w\":24,\"x\":0,\"y\":0},\"panelIndex\":\"1\",\"panelRefName\":\"panel_0\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"columns\":[\"kafka.log.class\",\"kafka.log.trace.class\",\"kafka.log.trace.full\"],\"sort\":[\"@timestamp\",\"desc\"]},\"gridData\":{\"h\":12,\"i\":\"2\",\"w\":24,\"x\":24,\"y\":0},\"panelIndex\":\"2\",\"panelRefName\":\"panel_1\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"columns\":[\"log.level\",\"kafka.log.component\",\"message\"],\"sort\":[\"@timestamp\",\"desc\"]},\"gridData\":{\"h\":20,\"i\":\"3\",\"w\":48,\"x\":0,\"y\":20},\"panelIndex\":\"3\",\"panelRefName\":\"panel_2\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":8,\"i\":\"4\",\"w\":48,\"x\":0,\"y\":12},\"panelIndex\":\"4\",\"panelRefName\":\"panel_3\",\"version\":\"7.3.0\"}]",
+    "timeRestore": false,
+    "title": "[Logs Kafka] Overview ECS",
+    "version": 1
+  },
+  "id": "sample_dashboard",
+  "references": [
+    {
+      "id": "number-of-kafka-stracktraces-by-class-ecs",
+      "name": "panel_0",
+      "type": "visualization"
+    },
+    {
+      "id": "Kafka stacktraces-ecs",
+      "name": "panel_1",
+      "type": "search"
+    },
+    {
+      "id": "sample_search",
+      "name": "panel_2",
+      "type": "search"
+    },
+    {
+      "id": "sample_visualization",
+      "name": "panel_3",
+      "type": "visualization"
+    }
+  ],
+  "type": "dashboard"
+}
\ No newline at end of file
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/search/sample_search.json b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/search/sample_search.json
new file mode 100644
index 000000000000..1b34746cec89
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/search/sample_search.json
@@ -0,0 +1,36 @@
+{
+  "attributes": {
+    "columns": [
+      "log.level",
+      "kafka.log.component",
+      "message"
+    ],
+    "description": "",
+    "hits": 0,
+    "kibanaSavedObjectMeta": {
+      "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"dataset.name\",\"negate\":false,\"params\":{\"query\":\"kafka.log\",\"type\":\"phrase\"},\"type\":\"phrase\",\"value\":\"log\"},\"query\":{\"match\":{\"dataset.name\":{\"query\":\"kafka.log\",\"type\":\"phrase\"}}}}],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"version\":true}"
+    },
+    "sort": [
+      [
+        "@timestamp",
+        "desc"
+      ]
+    ],
+    "title": "All logs [Logs Kafka] ECS",
+    "version": 1
+  },
+  "id": "All Kafka logs-ecs",
+  "references": [
+    {
+      "id": "logs-*",
+      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
+      "type": "index-pattern"
+    },
+    {
+      "id": "logs-*",
+      "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
+      "type": "index-pattern"
+    }
+  ],
+  "type": "search"
+}
\ No newline at end of file
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/visualization/sample_visualization.json b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/visualization/sample_visualization.json
new file mode 100644
index 000000000000..5d5162436e6d
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/kibana/visualization/sample_visualization.json
@@ -0,0 +1,22 @@
+{
+  "attributes": {
+    "description": "",
+    "kibanaSavedObjectMeta": {
+      "searchSourceJSON": "{\"filter\":[]}"
+    },
+    "savedSearchRefName": "search_0",
+    "title": "Log levels over time [Logs Kafka] ECS",
+    "uiStateJSON": "{}",
+    "version": 1,
+    "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1},\"schema\":\"segment\",\"type\":\"date_histogram\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Log Level\",\"field\":\"log.level\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"@timestamp per day\"},\"type\":\"category\"}],\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"times\":[],\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"Log levels over time [Logs Kafka] ECS\",\"type\":\"histogram\"}"
+  },
+  "id": "sample_visualization",
+  "references": [
+    {
+      "id": "All Kafka logs-ecs",
+      "name": "search_0",
+      "type": "search"
+    }
+  ],
+  "type": "visualization"
+}
\ No newline at end of file
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/manifest.yml b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/manifest.yml
new file mode 100644
index 000000000000..ec3586689bec
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/fixtures/test_packages/filetest/0.1.0/manifest.yml
@@ -0,0 +1,30 @@
+format_version: 1.0.0
+name: filetest
+title: For File Tests
+description: This is a package.
+version: 0.1.0
+categories: []
+# Options are experimental, beta, ga
+release: beta
+# The package type. The options for now are [integration, solution], more type might be added in the future.
+# The default type is integration and will be set if empty.
+type: integration
+license: basic
+# This package can be removed
+removable: true
+
+requirement:
+  elasticsearch:
+    versions: ">7.7.0"
+  kibana:
+    versions: ">7.7.0"
+
+screenshots:
+- src: "/img/screenshots/metricbeat_dashboard.png"
+  title: "metricbeat dashboard"
+  size: "1855x949"
+  type: "image/png"
+icons:
+  - src: "/img/logo.svg"
+    size: "16x16"
+    type: "image/svg+xml"
\ No newline at end of file
diff --git a/x-pack/test/epm_api_integration/apis/ilm.ts b/x-pack/test/ingest_manager_api_integration/apis/ilm.ts
similarity index 100%
rename from x-pack/test/epm_api_integration/apis/ilm.ts
rename to x-pack/test/ingest_manager_api_integration/apis/ilm.ts
diff --git a/x-pack/test/epm_api_integration/apis/index.js b/x-pack/test/ingest_manager_api_integration/apis/index.js
similarity index 90%
rename from x-pack/test/epm_api_integration/apis/index.js
rename to x-pack/test/ingest_manager_api_integration/apis/index.js
index 3dc4624d15cf..ef8880f86078 100644
--- a/x-pack/test/epm_api_integration/apis/index.js
+++ b/x-pack/test/ingest_manager_api_integration/apis/index.js
@@ -9,7 +9,7 @@ export default function ({ loadTestFile }) {
     this.tags('ciGroup7');
     loadTestFile(require.resolve('./list'));
     loadTestFile(require.resolve('./file'));
-    loadTestFile(require.resolve('./template'));
+    //loadTestFile(require.resolve('./template'));
     loadTestFile(require.resolve('./ilm'));
   });
 }
diff --git a/x-pack/test/ingest_manager_api_integration/apis/list.ts b/x-pack/test/ingest_manager_api_integration/apis/list.ts
new file mode 100644
index 000000000000..200358cb6f8f
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/list.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../api_integration/ftr_provider_context';
+import { warnAndSkipTest } from '../helpers';
+
+export default function ({ getService }: FtrProviderContext) {
+  const log = getService('log');
+  const supertest = getService('supertest');
+  const dockerServers = getService('dockerServers');
+
+  const server = dockerServers.get('registry');
+  // use function () {} and not () => {} here
+  // because `this` has to point to the Mocha context
+  // see https://mochajs.org/#arrow-functions
+
+  describe('list', async function () {
+    it('lists all packages from the registry', async function () {
+      if (server.enabled) {
+        const fetchPackageList = async () => {
+          const response = await supertest
+            .get('/api/ingest_manager/epm/packages')
+            .set('kbn-xsrf', 'xxx')
+            .expect(200);
+          return response.body;
+        };
+        const listResponse = await fetchPackageList();
+        expect(listResponse.response.length).to.be(11);
+      } else {
+        warnAndSkipTest(this, log);
+      }
+    });
+  });
+}
diff --git a/x-pack/test/epm_api_integration/apis/mock_http_server.d.ts b/x-pack/test/ingest_manager_api_integration/apis/mock_http_server.d.ts
similarity index 100%
rename from x-pack/test/epm_api_integration/apis/mock_http_server.d.ts
rename to x-pack/test/ingest_manager_api_integration/apis/mock_http_server.d.ts
diff --git a/x-pack/test/epm_api_integration/apis/template.ts b/x-pack/test/ingest_manager_api_integration/apis/template.ts
similarity index 100%
rename from x-pack/test/epm_api_integration/apis/template.ts
rename to x-pack/test/ingest_manager_api_integration/apis/template.ts
diff --git a/x-pack/test/ingest_manager_api_integration/config.ts b/x-pack/test/ingest_manager_api_integration/config.ts
new file mode 100644
index 000000000000..bbef12463ed0
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/config.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import path from 'path';
+
+import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
+import { defineDockerServersConfig } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const xPackAPITestsConfig = await readConfigFile(require.resolve('../api_integration/config.ts'));
+
+  const registryPort: string | undefined = process.env.INGEST_MANAGEMENT_PACKAGE_REGISTRY_PORT;
+
+  // mount the config file for the package registry as well as
+  // the directory containing additional packages into the container
+  const dockerArgs: string[] = [
+    '-v',
+    `${path.join(
+      path.dirname(__filename),
+      './apis/fixtures/package_registry_config.yml'
+    )}:/registry/config.yml`,
+    '-v',
+    `${path.join(
+      path.dirname(__filename),
+      './apis/fixtures/test_packages'
+    )}:/registry/packages/test-packages`,
+  ];
+
+  return {
+    testFiles: [require.resolve('./apis')],
+    servers: xPackAPITestsConfig.get('servers'),
+    dockerServers: defineDockerServersConfig({
+      registry: {
+        enabled: !!registryPort,
+        image: 'docker.elastic.co/package-registry/package-registry:kibana-testing-1',
+        portInContainer: 8080,
+        port: registryPort,
+        args: dockerArgs,
+        waitForLogLine: 'package manifests loaded',
+      },
+    }),
+    services: {
+      supertest: xPackAPITestsConfig.get('services.supertest'),
+      es: xPackAPITestsConfig.get('services.es'),
+    },
+    junit: {
+      reportName: 'X-Pack EPM API Integration Tests',
+    },
+
+    esTestCluster: {
+      ...xPackAPITestsConfig.get('esTestCluster'),
+    },
+
+    kbnTestServer: {
+      ...xPackAPITestsConfig.get('kbnTestServer'),
+      serverArgs: [
+        ...xPackAPITestsConfig.get('kbnTestServer.serverArgs'),
+        ...(registryPort
+          ? [`--xpack.ingestManager.epm.registryUrl=http://localhost:${registryPort}`]
+          : []),
+      ],
+    },
+  };
+}
diff --git a/x-pack/test/ingest_manager_api_integration/helpers.ts b/x-pack/test/ingest_manager_api_integration/helpers.ts
new file mode 100644
index 000000000000..121630249621
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/helpers.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Context } from 'mocha';
+import { ToolingLog } from '@kbn/dev-utils';
+
+export function warnAndSkipTest(mochaContext: Context, log: ToolingLog) {
+  log.warning(
+    'disabling tests because DockerServers service is not enabled, set INGEST_MANAGEMENT_PACKAGE_REGISTRY_PORT to run them'
+  );
+  mochaContext.skip();
+}

From 64e87cd6b5300ad229ce640ddc754decf3b9eb83 Mon Sep 17 00:00:00 2001
From: Shahzad <shahzad.muhammad@elastic.co>
Date: Mon, 29 Jun 2020 15:36:59 +0200
Subject: [PATCH 76/78] [Uptime] Use ML Capabilities API to determine license
 type (#66921)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../__snapshots__/license_info.test.tsx.snap  | 44 ++++++++-------
 .../__snapshots__/ml_flyout.test.tsx.snap     | 29 +++++-----
 .../ml/__tests__/license_info.test.tsx        |  8 +++
 .../monitor/ml/__tests__/ml_flyout.test.tsx   | 51 +++++-------------
 .../components/monitor/ml/license_info.tsx    | 54 ++++++++++++++++---
 .../components/monitor/ml/ml_flyout.tsx       | 12 +++--
 .../components/monitor/ml/ml_integeration.tsx |  4 +-
 .../monitor_duration_container.tsx            |  4 +-
 .../contexts/uptime_settings_context.tsx      | 20 +------
 .../uptime/public/state/selectors/index.ts    |  2 +-
 10 files changed, 122 insertions(+), 106 deletions(-)

diff --git a/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/__snapshots__/license_info.test.tsx.snap b/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/__snapshots__/license_info.test.tsx.snap
index 2ba4eda82a39..09c58b633687 100644
--- a/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/__snapshots__/license_info.test.tsx.snap
+++ b/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/__snapshots__/license_info.test.tsx.snap
@@ -26,22 +26,24 @@ Array [
       <p>
         In order to access duration anomaly detection, you have to be subscribed to an Elastic Platinum license.
       </p>
-      <a
-        class="euiButton euiButton--primary"
-        href="/app/management/stack/license_management/home"
-        rel="noopener noreferrer"
-        target="_blank"
-      >
-        <span
-          class="euiButton__content"
+      <span>
+        <a
+          class="euiButton euiButton--primary"
+          href="/app/management/stack/license_management/home"
+          rel="noopener noreferrer"
+          target="_blank"
         >
           <span
-            class="euiButton__text"
+            class="euiButton__content"
           >
-            Start free 14-day trial
+            <span
+              class="euiButton__text"
+            >
+              Start free 14-day trial
+            </span>
           </span>
-        </span>
-      </a>
+        </a>
+      </span>
     </div>
   </div>,
   <div
@@ -62,13 +64,19 @@ exports[`ShowLicenseInfo shallow renders without errors 1`] = `
     <p>
       In order to access duration anomaly detection, you have to be subscribed to an Elastic Platinum license.
     </p>
-    <EuiButton
-      color="primary"
-      href="/app/management/stack/license_management/home"
-      target="_blank"
+    <span
+      onClick={[Function]}
+      onKeyDown={[Function]}
     >
-      Start free 14-day trial
-    </EuiButton>
+      <EuiButton
+        color="primary"
+        href="/app/management/stack/license_management/home"
+        isLoading={false}
+        target="_blank"
+      >
+        Start free 14-day trial
+      </EuiButton>
+    </span>
   </EuiCallOut>
   <EuiSpacer />
 </Fragment>
diff --git a/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/__snapshots__/ml_flyout.test.tsx.snap b/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/__snapshots__/ml_flyout.test.tsx.snap
index 7a61eb7391a1..5c7215edcbce 100644
--- a/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/__snapshots__/ml_flyout.test.tsx.snap
+++ b/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/__snapshots__/ml_flyout.test.tsx.snap
@@ -17,7 +17,6 @@ exports[`ML Flyout component renders without errors 1`] = `
     />
   </EuiFlyoutHeader>
   <EuiFlyoutBody>
-    <ShowLicenseInfo />
     <EuiText>
       <p>
         Here you can create a machine learning job to calculate anomaly scores on
@@ -67,7 +66,7 @@ exports[`ML Flyout component renders without errors 1`] = `
       >
         <EuiButton
           data-test-subj="uptimeMLCreateJobBtn"
-          disabled={true}
+          disabled={false}
           fill={true}
           isLoading={false}
           onClick={[Function]}
@@ -158,22 +157,24 @@ exports[`ML Flyout component shows license info if no ml available 1`] = `
                 <p>
                   In order to access duration anomaly detection, you have to be subscribed to an Elastic Platinum license.
                 </p>
-                <a
-                  class="euiButton euiButton--primary"
-                  href="/app/management/stack/license_management/home"
-                  rel="noopener noreferrer"
-                  target="_blank"
-                >
-                  <span
-                    class="euiButton__content"
+                <span>
+                  <a
+                    class="euiButton euiButton--primary"
+                    href="/app/management/stack/license_management/home"
+                    rel="noopener noreferrer"
+                    target="_blank"
                   >
                     <span
-                      class="euiButton__text"
+                      class="euiButton__content"
                     >
-                      Start free 14-day trial
+                      <span
+                        class="euiButton__text"
+                      >
+                        Start free 14-day trial
+                      </span>
                     </span>
-                  </span>
-                </a>
+                  </a>
+                </span>
               </div>
             </div>
             <div
diff --git a/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/license_info.test.tsx b/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/license_info.test.tsx
index f3ac27c0569a..55ca4d453d06 100644
--- a/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/license_info.test.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/license_info.test.tsx
@@ -7,8 +7,16 @@
 import React from 'react';
 import { renderWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
 import { ShowLicenseInfo } from '../license_info';
+import * as redux from 'react-redux';
 
 describe('ShowLicenseInfo', () => {
+  beforeEach(() => {
+    const spy = jest.spyOn(redux, 'useDispatch');
+    spy.mockReturnValue(jest.fn());
+
+    const spy1 = jest.spyOn(redux, 'useSelector');
+    spy1.mockReturnValue(true);
+  });
   it('shallow renders without errors', () => {
     const wrapper = shallowWithIntl(<ShowLicenseInfo />);
     expect(wrapper).toMatchSnapshot();
diff --git a/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/ml_flyout.test.tsx b/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/ml_flyout.test.tsx
index 31cdcfac9fee..4795042ed845 100644
--- a/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/ml_flyout.test.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/ml/__tests__/ml_flyout.test.tsx
@@ -9,47 +9,21 @@ import { renderWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
 import { MLFlyoutView } from '../ml_flyout';
 import { UptimeSettingsContext } from '../../../../contexts';
 import { CLIENT_DEFAULTS } from '../../../../../common/constants';
-import { License } from '../../../../../../../plugins/licensing/common/license';
-
-const expiredLicense = new License({
-  signature: 'test signature',
-  license: {
-    expiryDateInMillis: 0,
-    mode: 'platinum',
-    status: 'expired',
-    type: 'platinum',
-    uid: '1',
-  },
-  features: {
-    ml: {
-      isAvailable: false,
-      isEnabled: false,
-    },
-  },
-});
-
-const validLicense = new License({
-  signature: 'test signature',
-  license: {
-    expiryDateInMillis: 30000,
-    mode: 'platinum',
-    status: 'active',
-    type: 'platinum',
-    uid: '2',
-  },
-  features: {
-    ml: {
-      isAvailable: true,
-      isEnabled: true,
-    },
-  },
-});
+import * as redux from 'react-redux';
 
 describe('ML Flyout component', () => {
   const createJob = () => {};
   const onClose = () => {};
   const { DATE_RANGE_START, DATE_RANGE_END } = CLIENT_DEFAULTS;
 
+  beforeEach(() => {
+    const spy = jest.spyOn(redux, 'useDispatch');
+    spy.mockReturnValue(jest.fn());
+
+    const spy1 = jest.spyOn(redux, 'useSelector');
+    spy1.mockReturnValue(true);
+  });
+
   it('renders without errors', () => {
     const wrapper = shallowWithIntl(
       <MLFlyoutView
@@ -62,8 +36,12 @@ describe('ML Flyout component', () => {
     expect(wrapper).toMatchSnapshot();
   });
   it('shows license info if no ml available', () => {
+    const spy1 = jest.spyOn(redux, 'useSelector');
+
+    // return false value for no license
+    spy1.mockReturnValue(false);
+
     const value = {
-      license: expiredLicense,
       basePath: '',
       dateRangeStart: DATE_RANGE_START,
       dateRangeEnd: DATE_RANGE_END,
@@ -88,7 +66,6 @@ describe('ML Flyout component', () => {
 
   it('able to create job if valid license is available', () => {
     const value = {
-      license: validLicense,
       basePath: '',
       dateRangeStart: DATE_RANGE_START,
       dateRangeEnd: DATE_RANGE_END,
diff --git a/x-pack/plugins/uptime/public/components/monitor/ml/license_info.tsx b/x-pack/plugins/uptime/public/components/monitor/ml/license_info.tsx
index e37ec4cc4715..2461875d502b 100644
--- a/x-pack/plugins/uptime/public/components/monitor/ml/license_info.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/ml/license_info.tsx
@@ -3,13 +3,48 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useContext } from 'react';
+import React, { useContext, useState, useEffect } from 'react';
 import { EuiCallOut, EuiButton, EuiSpacer } from '@elastic/eui';
+import { useDispatch, useSelector } from 'react-redux';
 import { UptimeSettingsContext } from '../../../contexts';
 import * as labels from './translations';
+import { getMLCapabilitiesAction } from '../../../state/actions';
+import { hasMLFeatureSelector } from '../../../state/selectors';
 
 export const ShowLicenseInfo = () => {
   const { basePath } = useContext(UptimeSettingsContext);
+  const [loading, setLoading] = useState<boolean>(false);
+  const hasMlFeature = useSelector(hasMLFeatureSelector);
+
+  const dispatch = useDispatch();
+
+  useEffect(() => {
+    dispatch(getMLCapabilitiesAction.get());
+  }, [dispatch]);
+
+  useEffect(() => {
+    let retryInterval: any;
+    if (loading) {
+      retryInterval = setInterval(() => {
+        dispatch(getMLCapabilitiesAction.get());
+      }, 5000);
+    } else {
+      clearInterval(retryInterval);
+    }
+
+    return () => {
+      clearInterval(retryInterval);
+    };
+  }, [dispatch, loading]);
+
+  useEffect(() => {
+    setLoading(false);
+  }, [hasMlFeature]);
+
+  const startLicenseTrial = () => {
+    setLoading(true);
+  };
+
   return (
     <>
       <EuiCallOut
@@ -20,13 +55,16 @@ export const ShowLicenseInfo = () => {
         iconType="help"
       >
         <p>{labels.START_TRAIL_DESC}</p>
-        <EuiButton
-          color="primary"
-          href={basePath + `/app/management/stack/license_management/home`}
-          target="_blank"
-        >
-          {labels.START_TRAIL}
-        </EuiButton>
+        <span onClick={startLicenseTrial} onKeyDown={() => {}}>
+          <EuiButton
+            color="primary"
+            isLoading={loading}
+            target="_blank"
+            href={basePath + `/app/management/stack/license_management/home`}
+          >
+            {labels.START_TRAIL}
+          </EuiButton>
+        </span>
       </EuiCallOut>
       <EuiSpacer />
     </>
diff --git a/x-pack/plugins/uptime/public/components/monitor/ml/ml_flyout.tsx b/x-pack/plugins/uptime/public/components/monitor/ml/ml_flyout.tsx
index 8c3f814e841f..3e60f0945258 100644
--- a/x-pack/plugins/uptime/public/components/monitor/ml/ml_flyout.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/ml/ml_flyout.tsx
@@ -20,9 +20,11 @@ import {
   EuiTitle,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { useSelector } from 'react-redux';
 import * as labels from './translations';
 import { UptimeSettingsContext } from '../../../contexts';
 import { ShowLicenseInfo } from './license_info';
+import { hasMLFeatureSelector } from '../../../state/selectors';
 
 interface Props {
   isCreatingJob: boolean;
@@ -32,11 +34,11 @@ interface Props {
 }
 
 export function MLFlyoutView({ isCreatingJob, onClickCreate, onClose, canCreateMLJob }: Props) {
-  const { basePath, license } = useContext(UptimeSettingsContext);
+  const { basePath } = useContext(UptimeSettingsContext);
 
-  const isLoadingMLJob = false;
+  const hasMlFeature = useSelector(hasMLFeatureSelector);
 
-  const hasPlatinumLicense = license?.getFeature('ml')?.isAvailable;
+  const isLoadingMLJob = false;
 
   return (
     <EuiFlyout onClose={onClose} size="s" data-test-subj="uptimeMLFlyout">
@@ -47,7 +49,7 @@ export function MLFlyoutView({ isCreatingJob, onClickCreate, onClose, canCreateM
         <EuiSpacer size="s" />
       </EuiFlyoutHeader>
       <EuiFlyoutBody>
-        {!hasPlatinumLicense && <ShowLicenseInfo />}
+        {!hasMlFeature && <ShowLicenseInfo />}
         <EuiText>
           <p>{labels.CREAT_ML_JOB_DESC}</p>
           <p>
@@ -80,7 +82,7 @@ export function MLFlyoutView({ isCreatingJob, onClickCreate, onClose, canCreateM
               onClick={() => onClickCreate()}
               fill
               isLoading={isCreatingJob}
-              disabled={isCreatingJob || isLoadingMLJob || !hasPlatinumLicense || !canCreateMLJob}
+              disabled={isCreatingJob || isLoadingMLJob || !hasMlFeature || !canCreateMLJob}
             >
               {labels.CREATE_NEW_JOB}
             </EuiButton>
diff --git a/x-pack/plugins/uptime/public/components/monitor/ml/ml_integeration.tsx b/x-pack/plugins/uptime/public/components/monitor/ml/ml_integeration.tsx
index e66808f76d24..1de19dda3b88 100644
--- a/x-pack/plugins/uptime/public/components/monitor/ml/ml_integeration.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/ml/ml_integeration.tsx
@@ -8,7 +8,7 @@ import React, { useContext, useEffect, useState } from 'react';
 import { useDispatch, useSelector } from 'react-redux';
 import { MachineLearningFlyout } from './ml_flyout_container';
 import {
-  hasMLFeatureAvailable,
+  hasMLFeatureSelector,
   hasMLJobSelector,
   isMLJobDeletedSelector,
   isMLJobDeletingSelector,
@@ -35,7 +35,7 @@ export const MLIntegrationComponent = () => {
 
   const dispatch = useDispatch();
 
-  const isMLAvailable = useSelector(hasMLFeatureAvailable);
+  const isMLAvailable = useSelector(hasMLFeatureSelector);
 
   const deleteMLJob = () => dispatch(deleteMLJobAction.get({ monitorId: monitorId as string }));
   const isMLJobDeleting = useSelector(isMLJobDeletingSelector);
diff --git a/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration_container.tsx b/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration_container.tsx
index b586c1241290..df8ceed76b79 100644
--- a/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration_container.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration_container.tsx
@@ -14,7 +14,7 @@ import {
 } from '../../../state/actions';
 import {
   anomaliesSelector,
-  hasMLFeatureAvailable,
+  hasMLFeatureSelector,
   hasMLJobSelector,
   selectDurationLines,
 } from '../../../state/selectors';
@@ -34,7 +34,7 @@ export const MonitorDuration: React.FC<MonitorIdParam> = ({ monitorId }) => {
 
   const { durationLines, loading } = useSelector(selectDurationLines);
 
-  const isMLAvailable = useSelector(hasMLFeatureAvailable);
+  const isMLAvailable = useSelector(hasMLFeatureSelector);
 
   const { data: mlJobs, loading: jobsLoading } = useSelector(hasMLJobSelector);
 
diff --git a/x-pack/plugins/uptime/public/contexts/uptime_settings_context.tsx b/x-pack/plugins/uptime/public/contexts/uptime_settings_context.tsx
index 4fabf3f2ed49..142c6e17c5fd 100644
--- a/x-pack/plugins/uptime/public/contexts/uptime_settings_context.tsx
+++ b/x-pack/plugins/uptime/public/contexts/uptime_settings_context.tsx
@@ -9,11 +9,9 @@ import { UptimeAppProps } from '../uptime_app';
 import { CLIENT_DEFAULTS, CONTEXT_DEFAULTS } from '../../common/constants';
 import { CommonlyUsedRange } from '../components/common/uptime_date_picker';
 import { useGetUrlParams } from '../hooks';
-import { ILicense } from '../../../../plugins/licensing/common/types';
 
 export interface UptimeSettingsContextValues {
   basePath: string;
-  license?: ILicense | null;
   dateRangeStart: string;
   dateRangeEnd: string;
   isApmAvailable: boolean;
@@ -41,27 +39,12 @@ const defaultContext: UptimeSettingsContextValues = {
 export const UptimeSettingsContext = createContext(defaultContext);
 
 export const UptimeSettingsContextProvider: React.FC<UptimeAppProps> = ({ children, ...props }) => {
-  const {
-    basePath,
-    isApmAvailable,
-    isInfraAvailable,
-    isLogsAvailable,
-    commonlyUsedRanges,
-    plugins,
-  } = props;
+  const { basePath, isApmAvailable, isInfraAvailable, isLogsAvailable, commonlyUsedRanges } = props;
 
   const { dateRangeStart, dateRangeEnd } = useGetUrlParams();
 
-  let license: ILicense | null = null;
-
-  // @ts-ignore
-  plugins.licensing.license$.subscribe((licenseItem: ILicense) => {
-    license = licenseItem;
-  });
-
   const value = useMemo(() => {
     return {
-      license,
       basePath,
       isApmAvailable,
       isInfraAvailable,
@@ -71,7 +54,6 @@ export const UptimeSettingsContextProvider: React.FC<UptimeAppProps> = ({ childr
       dateRangeEnd: dateRangeEnd ?? DATE_RANGE_END,
     };
   }, [
-    license,
     basePath,
     isApmAvailable,
     isInfraAvailable,
diff --git a/x-pack/plugins/uptime/public/state/selectors/index.ts b/x-pack/plugins/uptime/public/state/selectors/index.ts
index d08db2ccf5f2..4c2b671203f0 100644
--- a/x-pack/plugins/uptime/public/state/selectors/index.ts
+++ b/x-pack/plugins/uptime/public/state/selectors/index.ts
@@ -36,7 +36,7 @@ export const snapshotDataSelector = ({ snapshot }: AppState) => snapshot;
 
 const mlCapabilitiesSelector = (state: AppState) => state.ml.mlCapabilities.data;
 
-export const hasMLFeatureAvailable = createSelector(
+export const hasMLFeatureSelector = createSelector(
   mlCapabilitiesSelector,
   (mlCapabilities) =>
     mlCapabilities?.isPlatinumOrTrialLicense && mlCapabilities?.mlFeatureEnabledInSpace

From 81022a320660fc9b40008e74cde91d5f3134fbb3 Mon Sep 17 00:00:00 2001
From: Sandra Gonzales <neptunian@users.noreply.github.com>
Date: Mon, 29 Jun 2020 10:01:59 -0400
Subject: [PATCH 77/78] [Ingest Manager] rollover data stream when index
 template mappings are not compatible (#69180)

* rollover data stream when index template mappings are not compatible

* update error messages

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../ingest_manager/common/types/models/epm.ts |  2 +-
 .../epm/elasticsearch/template/template.ts    | 83 ++++++++++---------
 2 files changed, 46 insertions(+), 39 deletions(-)

diff --git a/x-pack/plugins/ingest_manager/common/types/models/epm.ts b/x-pack/plugins/ingest_manager/common/types/models/epm.ts
index 599165d2bfd9..01cbdbb0ea03 100644
--- a/x-pack/plugins/ingest_manager/common/types/models/epm.ts
+++ b/x-pack/plugins/ingest_manager/common/types/models/epm.ts
@@ -273,7 +273,7 @@ export interface IndexTemplate {
   index_patterns: string[];
   template: {
     settings: any;
-    mappings: object;
+    mappings: any;
     aliases: object;
   };
   data_stream: {
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts
index b7760a9032ac..9e8f327d520e 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts
@@ -330,11 +330,15 @@ const getIndices = async (
   template: TemplateRef
 ): Promise<CurrentIndex[] | undefined> => {
   const { templateName, indexTemplate } = template;
-  const res = await callCluster('search', getIndexQuery(templateName));
-  const indices: any[] = res?.aggregations?.index.buckets;
-  if (indices) {
-    return indices.map((index) => ({
-      indexName: index.key,
+  // Until ES provides a way to update mappings of a data stream
+  // get the last index of the data stream, which is the current write index
+  const res = await callCluster('transport.request', {
+    method: 'GET',
+    path: `/_data_stream/${templateName}-*`,
+  });
+  if (res.length) {
+    return res.map((datastream: any) => ({
+      indexName: datastream.indices[datastream.indices.length - 1].index_name,
       indexTemplate,
     }));
   }
@@ -359,18 +363,40 @@ const updateExistingIndex = async ({
   indexTemplate: IndexTemplate;
 }) => {
   const { settings, mappings } = indexTemplate.template;
+
+  // for now, remove from object so as not to update stream or dataset properties of the index until type and name
+  // are added in https://github.com/elastic/kibana/issues/66551.  namespace value we will continue
+  // to skip updating and assume the value in the index mapping is correct
+  delete mappings.properties.stream;
+  delete mappings.properties.dataset;
+
+  // get the dataset values from the index template to compose data stream name
+  const indexMappings = await getIndexMappings(indexName, callCluster);
+  const dataset = indexMappings[indexName].mappings.properties.dataset.properties;
+  if (!dataset.type.value || !dataset.name.value || !dataset.namespace.value)
+    throw new Error(`dataset values are missing from the index template ${indexName}`);
+  const dataStreamName = `${dataset.type.value}-${dataset.name.value}-${dataset.namespace.value}`;
+
   // try to update the mappings first
-  // for now we assume updates are compatible
   try {
     await callCluster('indices.putMapping', {
       index: indexName,
       body: mappings,
     });
+    // if update fails, rollover data stream
   } catch (err) {
-    throw new Error('incompatible mappings update');
+    try {
+      const path = `/${dataStreamName}/_rollover`;
+      await callCluster('transport.request', {
+        method: 'POST',
+        path,
+      });
+    } catch (error) {
+      throw new Error(`cannot rollover data stream ${dataStreamName}`);
+    }
   }
   // update settings after mappings was successful to ensure
-  // pointing to theme new pipeline is safe
+  // pointing to the new pipeline is safe
   // for now, only update the pipeline
   if (!settings.index.default_pipeline) return;
   try {
@@ -379,36 +405,17 @@ const updateExistingIndex = async ({
       body: { index: { default_pipeline: settings.index.default_pipeline } },
     });
   } catch (err) {
-    throw new Error('incompatible settings update');
+    throw new Error(`could not update index template settings for ${indexName}`);
   }
 };
 
-const getIndexQuery = (templateName: string) => ({
-  index: `${templateName}-*`,
-  size: 0,
-  body: {
-    query: {
-      bool: {
-        must: [
-          {
-            exists: {
-              field: 'dataset.namespace',
-            },
-          },
-          {
-            exists: {
-              field: 'dataset.name',
-            },
-          },
-        ],
-      },
-    },
-    aggs: {
-      index: {
-        terms: {
-          field: '_index',
-        },
-      },
-    },
-  },
-});
+const getIndexMappings = async (indexName: string, callCluster: CallESAsCurrentUser) => {
+  try {
+    const indexMappings = await callCluster('indices.getMapping', {
+      index: indexName,
+    });
+    return indexMappings;
+  } catch (err) {
+    throw new Error(`could not get mapping from ${indexName}`);
+  }
+};

From dbdc3cd01a6f0444ca010e59b7696944ec8ce3f7 Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Mon, 29 Jun 2020 16:17:32 +0200
Subject: [PATCH 78/78] [APM] Run API tests as restricted user (#70050)

---
 x-pack/plugins/apm/readme.md                  |  25 ++++-
 .../basic/tests/agent_configuration.ts        |  11 +-
 .../basic/tests/annotations.ts                |   6 +-
 .../basic/tests/custom_link.ts                |  11 +-
 .../basic/tests/feature_controls.ts           |   2 +-
 .../common/authentication.ts                  | 102 ++++++++++++++++++
 .../test/apm_api_integration/common/config.ts |  42 +++++++-
 .../common/ftr_provider_context.ts            |  14 ++-
 .../trial/tests/annotations.ts                |   9 +-
 9 files changed, 197 insertions(+), 25 deletions(-)
 create mode 100644 x-pack/test/apm_api_integration/common/authentication.ts

diff --git a/x-pack/plugins/apm/readme.md b/x-pack/plugins/apm/readme.md
index cb694712d7c9..778b1f2ad2d9 100644
--- a/x-pack/plugins/apm/readme.md
+++ b/x-pack/plugins/apm/readme.md
@@ -80,19 +80,38 @@ For debugging access Elasticsearch on http://localhost:9220` (elastic/changeme)
 
 ### API integration tests
 
+Our tests are separated in two suites: one suite runs with a basic license, and the other
+with a trial license (the equivalent of gold+). This requires separate test servers and test runs.
+
 **Start server**
 
+Basic:
+
+```
+node scripts/functional_tests_server --config x-pack/test/apm_api_integration/basic/config.ts
+```
+
+Trial:
+
 ```
-node scripts/functional_tests_server --config x-pack/test/api_integration/config.ts
+node scripts/functional_tests_server --config x-pack/test/apm_api_integration/trial/config.ts
 ```
 
 **Run tests**
 
+Basic:
+
+```
+node scripts/functional_test_runner --config x-pack/test/apm_api_integration/basic/config.ts
+```
+
+Trial:
+
 ```
-node scripts/functional_test_runner --config x-pack/test/api_integration/config.ts --grep='APM specs'
+node scripts/functional_test_runner --config x-pack/test/apm_api_integration/trial/config.ts
 ```
 
-APM tests are located in `x-pack/test/api_integration/apis/apm`.
+APM tests are located in `x-pack/test/apm_api_integration`.
 For debugging access Elasticsearch on http://localhost:9220` (elastic/changeme)
 
 ### Linting
diff --git a/x-pack/test/apm_api_integration/basic/tests/agent_configuration.ts b/x-pack/test/apm_api_integration/basic/tests/agent_configuration.ts
index f6750a8eca24..9f39da2037f8 100644
--- a/x-pack/test/apm_api_integration/basic/tests/agent_configuration.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/agent_configuration.ts
@@ -10,11 +10,12 @@ import { FtrProviderContext } from '../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
 export default function agentConfigurationTests({ getService }: FtrProviderContext) {
-  const supertest = getService('supertest');
+  const supertestRead = getService('supertestAsApmReadUser');
+  const supertestWrite = getService('supertestAsApmWriteUser');
   const log = getService('log');
 
   function searchConfigurations(configuration: any) {
-    return supertest
+    return supertestRead
       .post(`/api/apm/settings/agent-configuration/search`)
       .send(configuration)
       .set('kbn-xsrf', 'foo');
@@ -22,7 +23,7 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
 
   async function createConfiguration(config: AgentConfigurationIntake) {
     log.debug('creating configuration', config.service);
-    const res = await supertest
+    const res = await supertestWrite
       .put(`/api/apm/settings/agent-configuration`)
       .send(config)
       .set('kbn-xsrf', 'foo');
@@ -34,7 +35,7 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
 
   async function updateConfiguration(config: AgentConfigurationIntake) {
     log.debug('updating configuration', config.service);
-    const res = await supertest
+    const res = await supertestWrite
       .put(`/api/apm/settings/agent-configuration?overwrite=true`)
       .send(config)
       .set('kbn-xsrf', 'foo');
@@ -46,7 +47,7 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
 
   async function deleteConfiguration({ service }: AgentConfigurationIntake) {
     log.debug('deleting configuration', service);
-    const res = await supertest
+    const res = await supertestWrite
       .delete(`/api/apm/settings/agent-configuration`)
       .send({ service })
       .set('kbn-xsrf', 'foo');
diff --git a/x-pack/test/apm_api_integration/basic/tests/annotations.ts b/x-pack/test/apm_api_integration/basic/tests/annotations.ts
index d4b4892eaf91..c522ebcfb5c6 100644
--- a/x-pack/test/apm_api_integration/basic/tests/annotations.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/annotations.ts
@@ -10,15 +10,15 @@ import { FtrProviderContext } from '../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
 export default function annotationApiTests({ getService }: FtrProviderContext) {
-  const supertest = getService('supertest');
+  const supertestWrite = getService('supertestAsApmAnnotationsWriteUser');
 
   function request({ method, url, data }: { method: string; url: string; data?: JsonObject }) {
     switch (method.toLowerCase()) {
       case 'post':
-        return supertest.post(url).send(data).set('kbn-xsrf', 'foo');
+        return supertestWrite.post(url).send(data).set('kbn-xsrf', 'foo');
 
       default:
-        throw new Error(`Unsupported methoed ${method}`);
+        throw new Error(`Unsupported method ${method}`);
     }
   }
 
diff --git a/x-pack/test/apm_api_integration/basic/tests/custom_link.ts b/x-pack/test/apm_api_integration/basic/tests/custom_link.ts
index 910c4797f39b..77fdc83523ca 100644
--- a/x-pack/test/apm_api_integration/basic/tests/custom_link.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/custom_link.ts
@@ -10,7 +10,8 @@ import { FtrProviderContext } from '../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
 export default function customLinksTests({ getService }: FtrProviderContext) {
-  const supertest = getService('supertest');
+  const supertestRead = getService('supertestAsApmReadUser');
+  const supertestWrite = getService('supertestAsApmWriteUser');
   const log = getService('log');
 
   function searchCustomLinks(filters?: any) {
@@ -18,12 +19,12 @@ export default function customLinksTests({ getService }: FtrProviderContext) {
       pathname: `/api/apm/settings/custom_links`,
       query: filters,
     });
-    return supertest.get(path).set('kbn-xsrf', 'foo');
+    return supertestRead.get(path).set('kbn-xsrf', 'foo');
   }
 
   async function createCustomLink(customLink: CustomLink) {
     log.debug('creating configuration', customLink);
-    const res = await supertest
+    const res = await supertestWrite
       .post(`/api/apm/settings/custom_links`)
       .send(customLink)
       .set('kbn-xsrf', 'foo');
@@ -35,7 +36,7 @@ export default function customLinksTests({ getService }: FtrProviderContext) {
 
   async function updateCustomLink(id: string, customLink: CustomLink) {
     log.debug('updating configuration', id, customLink);
-    const res = await supertest
+    const res = await supertestWrite
       .put(`/api/apm/settings/custom_links/${id}`)
       .send(customLink)
       .set('kbn-xsrf', 'foo');
@@ -47,7 +48,7 @@ export default function customLinksTests({ getService }: FtrProviderContext) {
 
   async function deleteCustomLink(id: string) {
     log.debug('deleting configuration', id);
-    const res = await supertest
+    const res = await supertestWrite
       .delete(`/api/apm/settings/custom_links/${id}`)
       .set('kbn-xsrf', 'foo');
 
diff --git a/x-pack/test/apm_api_integration/basic/tests/feature_controls.ts b/x-pack/test/apm_api_integration/basic/tests/feature_controls.ts
index f3647c65106c..42cbef69abbe 100644
--- a/x-pack/test/apm_api_integration/basic/tests/feature_controls.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/feature_controls.ts
@@ -9,7 +9,7 @@ import { FtrProviderContext } from '../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
 export default function featureControlsTests({ getService }: FtrProviderContext) {
-  const supertest = getService('supertest');
+  const supertest = getService('supertestAsApmWriteUser');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
   const security = getService('security');
   const spaces = getService('spaces');
diff --git a/x-pack/test/apm_api_integration/common/authentication.ts b/x-pack/test/apm_api_integration/common/authentication.ts
new file mode 100644
index 000000000000..9c34b4791114
--- /dev/null
+++ b/x-pack/test/apm_api_integration/common/authentication.ts
@@ -0,0 +1,102 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { PromiseReturnType } from '../../../plugins/apm/typings/common';
+import { SecurityServiceProvider } from '../../../../test/common/services/security';
+
+type SecurityService = PromiseReturnType<typeof SecurityServiceProvider>;
+
+export enum ApmUser {
+  apmReadUser = 'apm_read_user',
+  apmWriteUser = 'apm_write_user',
+  apmAnnotationsWriteUser = 'apm_annotations_write_user',
+}
+
+const roles = {
+  [ApmUser.apmReadUser]: {
+    elasticsearch: {
+      cluster: [],
+      indices: [
+        { names: ['observability-annotations'], privileges: ['read', 'view_index_metadata'] },
+      ],
+    },
+    kibana: [
+      {
+        base: [],
+        feature: {
+          apm: ['read'],
+        },
+        spaces: ['*'],
+      },
+    ],
+  },
+  [ApmUser.apmWriteUser]: {
+    elasticsearch: {
+      cluster: [],
+      indices: [
+        { names: ['observability-annotations'], privileges: ['read', 'view_index_metadata'] },
+      ],
+    },
+    kibana: [
+      {
+        base: [],
+        feature: {
+          apm: ['all'],
+        },
+        spaces: ['*'],
+      },
+    ],
+  },
+  [ApmUser.apmAnnotationsWriteUser]: {
+    elasticsearch: {
+      cluster: [],
+      indices: [
+        {
+          names: ['observability-annotations'],
+          privileges: [
+            'read',
+            'view_index_metadata',
+            'index',
+            'manage',
+            'create_index',
+            'create_doc',
+          ],
+        },
+      ],
+    },
+  },
+};
+
+const users = {
+  [ApmUser.apmReadUser]: {
+    roles: ['apm_user', ApmUser.apmReadUser],
+  },
+  [ApmUser.apmWriteUser]: {
+    roles: ['apm_user', ApmUser.apmWriteUser],
+  },
+  [ApmUser.apmAnnotationsWriteUser]: {
+    roles: ['apm_user', ApmUser.apmWriteUser, ApmUser.apmAnnotationsWriteUser],
+  },
+};
+
+export async function createApmUser(security: SecurityService, apmUser: ApmUser) {
+  const role = roles[apmUser];
+  const user = users[apmUser];
+
+  if (!role || !user) {
+    throw new Error(`No configuration found for ${apmUser}`);
+  }
+
+  await security.role.create(apmUser, role);
+
+  await security.user.create(apmUser, {
+    full_name: apmUser,
+    password: APM_TEST_PASSWORD,
+    roles: user.roles,
+  });
+}
+
+export const APM_TEST_PASSWORD = 'changeme';
diff --git a/x-pack/test/apm_api_integration/common/config.ts b/x-pack/test/apm_api_integration/common/config.ts
index 83dc597829a3..e4dc2a78ae01 100644
--- a/x-pack/test/apm_api_integration/common/config.ts
+++ b/x-pack/test/apm_api_integration/common/config.ts
@@ -5,6 +5,11 @@
  */
 
 import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
+import supertestAsPromised from 'supertest-as-promised';
+import { format, UrlObject } from 'url';
+import { InheritedFtrProviderContext, InheritedServices } from './ftr_provider_context';
+import { PromiseReturnType } from '../../../plugins/apm/typings/common';
+import { createApmUser, APM_TEST_PASSWORD, ApmUser } from './authentication';
 
 interface Settings {
   license: 'basic' | 'trial';
@@ -12,6 +17,22 @@ interface Settings {
   name: string;
 }
 
+const supertestAsApmUser = (kibanaServer: UrlObject, apmUser: ApmUser) => async (
+  context: InheritedFtrProviderContext
+) => {
+  const security = context.getService('security');
+  await security.init();
+
+  await createApmUser(security, apmUser);
+
+  const url = format({
+    ...kibanaServer,
+    auth: `${apmUser}:${APM_TEST_PASSWORD}`,
+  });
+
+  return supertestAsPromised(url);
+};
+
 export function createTestConfig(settings: Settings) {
   const { testFiles, license, name } = settings;
 
@@ -20,14 +41,27 @@ export function createTestConfig(settings: Settings) {
       require.resolve('../../api_integration/config.ts')
     );
 
+    const services = xPackAPITestsConfig.get('services') as InheritedServices;
+    const servers = xPackAPITestsConfig.get('servers');
+
+    const supertestAsApmReadUser = supertestAsApmUser(servers.kibana, ApmUser.apmReadUser);
+
     return {
       testFiles,
-      servers: xPackAPITestsConfig.get('servers'),
-      services: xPackAPITestsConfig.get('services'),
+      servers,
+      services: {
+        ...services,
+        supertest: supertestAsApmReadUser,
+        supertestAsApmReadUser,
+        supertestAsApmWriteUser: supertestAsApmUser(servers.kibana, ApmUser.apmWriteUser),
+        supertestAsApmAnnotationsWriteUser: supertestAsApmUser(
+          servers.kibana,
+          ApmUser.apmAnnotationsWriteUser
+        ),
+      },
       junit: {
         reportName: name,
       },
-
       esTestCluster: {
         ...xPackAPITestsConfig.get('esTestCluster'),
         license,
@@ -36,3 +70,5 @@ export function createTestConfig(settings: Settings) {
     };
   };
 }
+
+export type ApmServices = PromiseReturnType<ReturnType<typeof createTestConfig>>['services'];
diff --git a/x-pack/test/apm_api_integration/common/ftr_provider_context.ts b/x-pack/test/apm_api_integration/common/ftr_provider_context.ts
index 90600816d171..aee3d556605a 100644
--- a/x-pack/test/apm_api_integration/common/ftr_provider_context.ts
+++ b/x-pack/test/apm_api_integration/common/ftr_provider_context.ts
@@ -4,4 +4,16 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { FtrProviderContext } from '../../api_integration/ftr_provider_context';
+import { GenericFtrProviderContext } from '@kbn/test/types/ftr';
+import { FtrProviderContext as InheritedFtrProviderContext } from '../../api_integration/ftr_provider_context';
+import { ApmServices } from './config';
+
+export type InheritedServices = InheritedFtrProviderContext extends GenericFtrProviderContext<
+  infer TServices,
+  {}
+>
+  ? TServices
+  : {};
+
+export { InheritedFtrProviderContext };
+export type FtrProviderContext = GenericFtrProviderContext<ApmServices, {}>;
diff --git a/x-pack/test/apm_api_integration/trial/tests/annotations.ts b/x-pack/test/apm_api_integration/trial/tests/annotations.ts
index 0913d0c4b90b..d5b6b8342e5a 100644
--- a/x-pack/test/apm_api_integration/trial/tests/annotations.ts
+++ b/x-pack/test/apm_api_integration/trial/tests/annotations.ts
@@ -13,7 +13,8 @@ const DEFAULT_INDEX_NAME = 'observability-annotations';
 
 // eslint-disable-next-line import/no-default-export
 export default function annotationApiTests({ getService }: FtrProviderContext) {
-  const supertest = getService('supertest');
+  const supertestRead = getService('supertestAsApmReadUser');
+  const supertestWrite = getService('supertestAsApmAnnotationsWriteUser');
   const es = getService('es');
 
   function expectContainsObj(source: JsonObject, expected: JsonObject) {
@@ -30,13 +31,13 @@ export default function annotationApiTests({ getService }: FtrProviderContext) {
   function request({ method, url, data }: { method: string; url: string; data?: JsonObject }) {
     switch (method.toLowerCase()) {
       case 'get':
-        return supertest.get(url).set('kbn-xsrf', 'foo');
+        return supertestRead.get(url).set('kbn-xsrf', 'foo');
 
       case 'post':
-        return supertest.post(url).send(data).set('kbn-xsrf', 'foo');
+        return supertestWrite.post(url).send(data).set('kbn-xsrf', 'foo');
 
       default:
-        throw new Error(`Unsupported methoed ${method}`);
+        throw new Error(`Unsupported method ${method}`);
     }
   }