diff --git a/src/plugins/dashboard/public/dashboard_app/_dashboard_app_strings.ts b/src/plugins/dashboard/public/dashboard_app/_dashboard_app_strings.ts
index 8a6e24a183f3a..9c6526ce3403e 100644
--- a/src/plugins/dashboard/public/dashboard_app/_dashboard_app_strings.ts
+++ b/src/plugins/dashboard/public/dashboard_app/_dashboard_app_strings.ts
@@ -78,21 +78,6 @@ export const unsavedChangesBadgeStrings = {
     }),
 };
 
-export const leaveConfirmStrings = {
-  getLeaveTitle: () =>
-    i18n.translate('dashboard.appLeaveConfirmModal.unsavedChangesTitle', {
-      defaultMessage: 'Unsaved changes',
-    }),
-  getLeaveSubtitle: () =>
-    i18n.translate('dashboard.appLeaveConfirmModal.unsavedChangesSubtitle', {
-      defaultMessage: 'Leave Dashboard with unsaved work?',
-    }),
-  getLeaveCancelButtonText: () =>
-    i18n.translate('dashboard.appLeaveConfirmModal.cancelButtonLabel', {
-      defaultMessage: 'Cancel',
-    }),
-};
-
 export const getCreateVisualizationButtonTitle = () =>
   i18n.translate('dashboard.solutionToolbar.addPanelButtonLabel', {
     defaultMessage: 'Create visualization',
diff --git a/src/plugins/dashboard/public/dashboard_top_nav/internal_dashboard_top_nav.tsx b/src/plugins/dashboard/public/dashboard_top_nav/internal_dashboard_top_nav.tsx
index bf2be799dcc1f..47a84b620ede3 100644
--- a/src/plugins/dashboard/public/dashboard_top_nav/internal_dashboard_top_nav.tsx
+++ b/src/plugins/dashboard/public/dashboard_top_nav/internal_dashboard_top_nav.tsx
@@ -33,7 +33,6 @@ import {
   dashboardManagedBadge,
   getDashboardBreadcrumb,
   getDashboardTitle,
-  leaveConfirmStrings,
   unsavedChangesBadgeStrings,
 } from '../dashboard_app/_dashboard_app_strings';
 import { useDashboardMountContext } from '../dashboard_app/hooks/dashboard_mount_context';
@@ -48,7 +47,6 @@ import { getDashboardRecentlyAccessedService } from '../services/dashboard_recen
 import {
   coreServices,
   dataService,
-  embeddableService,
   navigationService,
   serverlessService,
 } from '../services/kibana_services';
@@ -195,16 +193,6 @@ export function InternalDashboardTopNav({
    */
   useEffect(() => {
     onAppLeave((actions) => {
-      if (
-        viewMode === 'edit' &&
-        hasUnsavedChanges &&
-        !embeddableService.getStateTransfer().isTransferInProgress
-      ) {
-        return actions.confirm(
-          leaveConfirmStrings.getLeaveSubtitle(),
-          leaveConfirmStrings.getLeaveTitle()
-        );
-      }
       return actions.default();
     });
     return () => {
diff --git a/test/functional/apps/dashboard/group1/edit_visualizations.js b/test/functional/apps/dashboard/group1/edit_visualizations.js
index f065748f09b00..9e91ed1ea112f 100644
--- a/test/functional/apps/dashboard/group1/edit_visualizations.js
+++ b/test/functional/apps/dashboard/group1/edit_visualizations.js
@@ -10,7 +10,7 @@
 import expect from '@kbn/expect';
 
 export default function ({ getService, getPageObjects }) {
-  const { dashboard, header, visualize, common, visEditor } = getPageObjects([
+  const { dashboard, header, visualize, visEditor } = getPageObjects([
     'dashboard',
     'header',
     'visualize',
@@ -114,7 +114,6 @@ export default function ({ getService, getPageObjects }) {
 
       await header.waitUntilLoadingHasFinished();
       await appsMenu.clickLink('Visualize Library');
-      await common.clickConfirmOnModal();
       expect(await testSubjects.exists('visualizationLandingPage')).to.be(true);
     });
 
@@ -132,7 +131,6 @@ export default function ({ getService, getPageObjects }) {
 
       await header.waitUntilLoadingHasFinished();
       await appsMenu.clickLink('Visualize Library');
-      await common.clickConfirmOnModal();
       expect(await testSubjects.exists('visualizationLandingPage')).to.be(true);
     });
 
diff --git a/x-pack/plugins/canvas/public/state/actions/elements.js b/x-pack/plugins/canvas/public/state/actions/elements.js
index 57b7da1ce1fef..dc21cf1b8f2bc 100644
--- a/x-pack/plugins/canvas/public/state/actions/elements.js
+++ b/x-pack/plugins/canvas/public/state/actions/elements.js
@@ -65,9 +65,12 @@ function getBareElement(el, includeId = false) {
 
 export const elementLayer = createAction('elementLayer');
 
-export const setMultiplePositions = createAction('setMultiplePosition', (repositionedElements) => ({
-  repositionedElements,
-}));
+export const setMultiplePositions = createAction(
+  'setMultiplePositions',
+  (repositionedElements) => ({
+    repositionedElements,
+  })
+);
 
 export const flushContext = createAction('flushContext');
 export const flushContextAfterIndex = createAction('flushContextAfterIndex');
diff --git a/x-pack/plugins/cases/public/components/links/index.tsx b/x-pack/plugins/cases/public/components/links/index.tsx
index f1e8ca5cdb4af..9b610db63ed10 100644
--- a/x-pack/plugins/cases/public/components/links/index.tsx
+++ b/x-pack/plugins/cases/public/components/links/index.tsx
@@ -12,7 +12,7 @@ import { useCaseViewNavigation, useConfigureCasesNavigation } from '../../common
 import * as i18n from './translations';
 
 export interface CasesNavigation<T = React.MouseEvent | MouseEvent | null, K = null> {
-  href: K extends 'configurable' ? (arg: T) => string : string;
+  href?: K extends 'configurable' ? (arg: T) => string : string;
   onClick: K extends 'configurable'
     ? (arg: T, arg2: React.MouseEvent | MouseEvent) => Promise<void> | void
     : (arg: T) => Promise<void> | void;
diff --git a/x-pack/plugins/cases/public/components/user_actions/comment/alert_event.test.tsx b/x-pack/plugins/cases/public/components/user_actions/comment/alert_event.test.tsx
index 60d5759de6e21..d060f1d9d71ac 100644
--- a/x-pack/plugins/cases/public/components/user_actions/comment/alert_event.test.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/comment/alert_event.test.tsx
@@ -47,10 +47,38 @@ describe('Alert events', () => {
       expect(wrapper.text()).toBe('added an alert from Awesome rule');
     });
 
-    it('does NOT render the link when the rule id is null', async () => {
+    it('renders the link when onClick is provided but href is not valid', async () => {
       const wrapper = mount(
         <TestProviders>
-          <SingleAlertCommentEvent {...props} ruleId={null} />
+          <SingleAlertCommentEvent {...props} getRuleDetailsHref={undefined} />
+        </TestProviders>
+      );
+
+      expect(
+        wrapper.find(`[data-test-subj="alert-rule-link-action-id-1"]`).first().exists()
+      ).toBeTruthy();
+    });
+
+    it('renders the link when href is valid but onClick is not available', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <SingleAlertCommentEvent {...props} onRuleDetailsClick={undefined} />
+        </TestProviders>
+      );
+
+      expect(
+        wrapper.find(`[data-test-subj="alert-rule-link-action-id-1"]`).first().exists()
+      ).toBeTruthy();
+    });
+
+    it('does NOT render the link when the href and onclick are invalid but it shows the rule name', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <SingleAlertCommentEvent
+            {...props}
+            getRuleDetailsHref={undefined}
+            onRuleDetailsClick={undefined}
+          />
         </TestProviders>
       );
 
@@ -61,10 +89,10 @@ describe('Alert events', () => {
       expect(wrapper.text()).toBe('added an alert from Awesome rule');
     });
 
-    it('does NOT render the link when the href is invalid but it shows the rule name', async () => {
+    it('does NOT render the link when the rule id is null', async () => {
       const wrapper = mount(
         <TestProviders>
-          <SingleAlertCommentEvent {...props} getRuleDetailsHref={undefined} />
+          <SingleAlertCommentEvent {...props} ruleId={null} />
         </TestProviders>
       );
 
@@ -131,9 +159,28 @@ describe('Alert events', () => {
       expect(result.getByTestId('alert-rule-link-action-id-1')).toHaveTextContent('Awesome rule');
     });
 
-    it('does NOT render the link when the rule id is null', async () => {
+    it('renders the link when onClick is provided but href is not valid', async () => {
       const result = appMock.render(
-        <MultipleAlertsCommentEvent {...props} totalAlerts={2} ruleId={null} />
+        <MultipleAlertsCommentEvent {...props} totalAlerts={2} getRuleDetailsHref={undefined} />
+      );
+      expect(result.getByTestId('alert-rule-link-action-id-1')).toHaveTextContent('Awesome rule');
+    });
+
+    it('renders the link when href is valid but onClick is not available', async () => {
+      const result = appMock.render(
+        <MultipleAlertsCommentEvent {...props} totalAlerts={2} onRuleDetailsClick={undefined} />
+      );
+      expect(result.getByTestId('alert-rule-link-action-id-1')).toHaveTextContent('Awesome rule');
+    });
+
+    it('does NOT render the link when the href and onclick are invalid but it shows the rule name', async () => {
+      const result = appMock.render(
+        <MultipleAlertsCommentEvent
+          {...props}
+          totalAlerts={2}
+          getRuleDetailsHref={undefined}
+          onRuleDetailsClick={undefined}
+        />
       );
 
       expect(result.getByTestId('multiple-alerts-user-action-action-id-1')).toHaveTextContent(
@@ -142,9 +189,9 @@ describe('Alert events', () => {
       expect(result.queryByTestId('alert-rule-link-action-id-1')).toBeFalsy();
     });
 
-    it('does NOT render the link when the href is invalid but it shows the rule name', async () => {
+    it('does NOT render the link when the rule id is null', async () => {
       const result = appMock.render(
-        <MultipleAlertsCommentEvent {...props} totalAlerts={2} getRuleDetailsHref={undefined} />
+        <MultipleAlertsCommentEvent {...props} totalAlerts={2} ruleId={null} />
       );
 
       expect(result.getByTestId('multiple-alerts-user-action-action-id-1')).toHaveTextContent(
diff --git a/x-pack/plugins/cases/public/components/user_actions/comment/alert_event.tsx b/x-pack/plugins/cases/public/components/user_actions/comment/alert_event.tsx
index 42e5e6b9d4427..a8ffbb987a021 100644
--- a/x-pack/plugins/cases/public/components/user_actions/comment/alert_event.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/comment/alert_event.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { memo, useCallback } from 'react';
+import React, { memo, useCallback, useMemo } from 'react';
 import { isEmpty } from 'lodash';
 import { EuiLoadingSpinner } from '@elastic/eui';
 
@@ -38,12 +38,18 @@ const RuleLink: React.FC<SingleAlertProps> = memo(
 
     const ruleDetailsHref = getRuleDetailsHref?.(ruleId);
     const finalRuleName = ruleName ?? i18n.UNKNOWN_RULE;
+    const isValidLink = useMemo(() => {
+      if (!onRuleDetailsClick && !ruleDetailsHref) {
+        return false;
+      }
+      return !isEmpty(ruleId);
+    }, [onRuleDetailsClick, ruleDetailsHref, ruleId]);
 
     if (loadingAlertData) {
       return <EuiLoadingSpinner size="m" data-test-subj={`alert-loading-spinner-${actionId}`} />;
     }
 
-    if (!isEmpty(ruleId) && ruleDetailsHref != null) {
+    if (isValidLink) {
       return (
         <LinkAnchor
           onClick={onLinkClick}
diff --git a/x-pack/plugins/fleet/server/services/agent_policies/package_policies_to_agent_inputs.ts b/x-pack/plugins/fleet/server/services/agent_policies/package_policies_to_agent_inputs.ts
index 807312fe5e7cb..f2a39c6f8800b 100644
--- a/x-pack/plugins/fleet/server/services/agent_policies/package_policies_to_agent_inputs.ts
+++ b/x-pack/plugins/fleet/server/services/agent_policies/package_policies_to_agent_inputs.ts
@@ -112,7 +112,8 @@ export const mergeInputsOverrides = (
 
 export const getFullInputStreams = (
   input: PackagePolicyInput,
-  allStreamEnabled: boolean = false
+  allStreamEnabled: boolean = false,
+  streamsOriginalIdsMap?: Map<string, string> // Map of stream ids <destinationId, originalId>
 ): FullAgentPolicyInputStream => {
   return {
     ...(input.compiled_input || {}),
@@ -121,8 +122,9 @@ export const getFullInputStreams = (
           streams: input.streams
             .filter((stream) => stream.enabled || allStreamEnabled)
             .map((stream) => {
+              const streamId = stream.id;
               const fullStream: FullAgentPolicyInputStream = {
-                id: stream.id,
+                id: streamId,
                 data_stream: stream.data_stream,
                 ...stream.compiled_stream,
                 ...Object.entries(stream.config || {}).reduce((acc, [key, { value }]) => {
@@ -130,6 +132,8 @@ export const getFullInputStreams = (
                   return acc;
                 }, {} as { [k: string]: any }),
               };
+              streamsOriginalIdsMap?.set(fullStream.id, streamId);
+
               return fullStream;
             }),
         }
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/docker_2_11_0.ts b/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/docker_2_11_0.ts
new file mode 100644
index 0000000000000..67bde1882cfed
--- /dev/null
+++ b/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/docker_2_11_0.ts
@@ -0,0 +1,230 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const DOCKER_2_11_0_PACKAGE_INFO = {
+  name: 'docker',
+  title: 'Docker',
+  version: '2.11.0',
+  release: 'ga',
+  description: 'Collect metrics and logs from Docker instances with Elastic Agent.',
+  type: 'integration',
+  download: '/epr/docker/docker-2.11.0.zip',
+  path: '/package/docker/2.11.0',
+  icons: [
+    {
+      src: '/img/logo_docker.svg',
+      path: '/package/docker/2.11.0/img/logo_docker.svg',
+      title: 'logo docker',
+      size: '32x32',
+      type: 'image/svg+xml',
+    },
+  ],
+  conditions: {
+    kibana: {
+      version: '^8.8.0',
+    },
+  },
+  owner: {
+    type: 'elastic',
+    github: 'elastic/obs-cloudnative-monitoring',
+  },
+  categories: ['observability', 'containers'],
+  signature_path: '/epr/docker/docker-2.11.0.zip.sig',
+  format_version: '3.2.2',
+  readme: '/package/docker/2.11.0/docs/README.md',
+  license: 'basic',
+  screenshots: [
+    {
+      src: '/img/docker-overview.png',
+      path: '/package/docker/2.11.0/img/docker-overview.png',
+      title: 'Docker Overview',
+      size: '5120x2562',
+      type: 'image/png',
+    },
+  ],
+  assets: [
+    '/package/docker/2.11.0/LICENSE.txt',
+    '/package/docker/2.11.0/changelog.yml',
+    '/package/docker/2.11.0/manifest.yml',
+    '/package/docker/2.11.0/docs/README.md',
+    '/package/docker/2.11.0/img/docker-overview.png',
+    '/package/docker/2.11.0/img/logo_docker.svg',
+    '/package/docker/2.11.0/data_stream/container/manifest.yml',
+    '/package/docker/2.11.0/data_stream/container/sample_event.json',
+    '/package/docker/2.11.0/data_stream/container_logs/manifest.yml',
+    '/package/docker/2.11.0/data_stream/container_logs/sample_event.json',
+    '/package/docker/2.11.0/data_stream/cpu/manifest.yml',
+    '/package/docker/2.11.0/data_stream/cpu/sample_event.json',
+    '/package/docker/2.11.0/data_stream/diskio/manifest.yml',
+    '/package/docker/2.11.0/data_stream/diskio/sample_event.json',
+    '/package/docker/2.11.0/data_stream/event/manifest.yml',
+    '/package/docker/2.11.0/data_stream/event/sample_event.json',
+    '/package/docker/2.11.0/data_stream/healthcheck/manifest.yml',
+    '/package/docker/2.11.0/data_stream/healthcheck/sample_event.json',
+    '/package/docker/2.11.0/data_stream/image/manifest.yml',
+    '/package/docker/2.11.0/data_stream/image/sample_event.json',
+    '/package/docker/2.11.0/data_stream/info/manifest.yml',
+    '/package/docker/2.11.0/data_stream/info/sample_event.json',
+    '/package/docker/2.11.0/data_stream/memory/manifest.yml',
+    '/package/docker/2.11.0/data_stream/memory/sample_event.json',
+    '/package/docker/2.11.0/data_stream/network/manifest.yml',
+    '/package/docker/2.11.0/data_stream/network/sample_event.json',
+    '/package/docker/2.11.0/kibana/dashboard/docker-AV4REOpp5NkDleZmzKkE.json',
+    '/package/docker/2.11.0/kibana/search/docker-Metrics-Docker.json',
+    '/package/docker/2.11.0/data_stream/container/fields/base-fields.yml',
+    '/package/docker/2.11.0/data_stream/container/fields/ecs.yml',
+    '/package/docker/2.11.0/data_stream/container/fields/fields.yml',
+    '/package/docker/2.11.0/data_stream/container_logs/fields/agent.yml',
+    '/package/docker/2.11.0/data_stream/container_logs/fields/base-fields.yml',
+    '/package/docker/2.11.0/data_stream/container_logs/fields/ecs.yml',
+    '/package/docker/2.11.0/data_stream/container_logs/fields/fields.yml',
+    '/package/docker/2.11.0/data_stream/cpu/fields/base-fields.yml',
+    '/package/docker/2.11.0/data_stream/cpu/fields/ecs.yml',
+    '/package/docker/2.11.0/data_stream/cpu/fields/fields.yml',
+    '/package/docker/2.11.0/data_stream/diskio/fields/base-fields.yml',
+    '/package/docker/2.11.0/data_stream/diskio/fields/ecs.yml',
+    '/package/docker/2.11.0/data_stream/diskio/fields/fields.yml',
+    '/package/docker/2.11.0/data_stream/event/fields/base-fields.yml',
+    '/package/docker/2.11.0/data_stream/event/fields/ecs.yml',
+    '/package/docker/2.11.0/data_stream/event/fields/fields.yml',
+    '/package/docker/2.11.0/data_stream/healthcheck/fields/base-fields.yml',
+    '/package/docker/2.11.0/data_stream/healthcheck/fields/ecs.yml',
+    '/package/docker/2.11.0/data_stream/healthcheck/fields/fields.yml',
+    '/package/docker/2.11.0/data_stream/image/fields/base-fields.yml',
+    '/package/docker/2.11.0/data_stream/image/fields/ecs.yml',
+    '/package/docker/2.11.0/data_stream/image/fields/fields.yml',
+    '/package/docker/2.11.0/data_stream/info/fields/base-fields.yml',
+    '/package/docker/2.11.0/data_stream/info/fields/ecs.yml',
+    '/package/docker/2.11.0/data_stream/info/fields/fields.yml',
+    '/package/docker/2.11.0/data_stream/memory/fields/base-fields.yml',
+    '/package/docker/2.11.0/data_stream/memory/fields/ecs.yml',
+    '/package/docker/2.11.0/data_stream/memory/fields/fields.yml',
+    '/package/docker/2.11.0/data_stream/network/fields/base-fields.yml',
+    '/package/docker/2.11.0/data_stream/network/fields/ecs.yml',
+    '/package/docker/2.11.0/data_stream/network/fields/fields.yml',
+    '/package/docker/2.11.0/data_stream/container/agent/stream/stream.yml.hbs',
+    '/package/docker/2.11.0/data_stream/container_logs/agent/stream/stream.yml.hbs',
+    '/package/docker/2.11.0/data_stream/cpu/agent/stream/stream.yml.hbs',
+    '/package/docker/2.11.0/data_stream/diskio/agent/stream/stream.yml.hbs',
+    '/package/docker/2.11.0/data_stream/event/agent/stream/stream.yml.hbs',
+    '/package/docker/2.11.0/data_stream/healthcheck/agent/stream/stream.yml.hbs',
+    '/package/docker/2.11.0/data_stream/image/agent/stream/stream.yml.hbs',
+    '/package/docker/2.11.0/data_stream/info/agent/stream/stream.yml.hbs',
+    '/package/docker/2.11.0/data_stream/memory/agent/stream/stream.yml.hbs',
+    '/package/docker/2.11.0/data_stream/network/agent/stream/stream.yml.hbs',
+  ],
+  policy_templates: [
+    {
+      name: 'docker',
+      title: 'Docker logs and metrics',
+      description: 'Collect logs and metrics from Docker instances',
+      inputs: [
+        {
+          type: 'filestream',
+          title: 'Collect Docker container logs',
+          description: 'Collecting docker container logs',
+        },
+      ],
+      multiple: true,
+    },
+  ],
+  data_streams: [
+    {
+      type: 'logs',
+      dataset: 'docker.container_logs',
+      title: 'Docker container logs',
+      release: 'ga',
+      streams: [
+        {
+          input: 'filestream',
+          vars: [
+            {
+              name: 'paths',
+              type: 'text',
+              title: 'Docker container log path',
+              multi: true,
+              required: true,
+              show_user: false,
+              default: ['/var/lib/docker/containers/${docker.container.id}/*-json.log'],
+            },
+            {
+              name: 'containerParserStream',
+              type: 'text',
+              title: "Container parser's stream configuration",
+              multi: false,
+              required: true,
+              show_user: false,
+              default: 'all',
+            },
+            {
+              name: 'condition',
+              type: 'text',
+              title: 'Condition',
+              description:
+                'Condition to filter when to apply this datastream. Refer to [Docker provider](https://www.elastic.co/guide/en/fleet/current/docker-provider.html) to find the available keys and to [Conditions](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html#conditions) on how to use the available keys in conditions.',
+              multi: false,
+              required: false,
+              show_user: true,
+            },
+            {
+              name: 'additionalParsersConfig',
+              type: 'yaml',
+              title: 'Additional parsers configuration',
+              multi: false,
+              required: true,
+              show_user: false,
+              default:
+                "# - ndjson:\n#     target: json\n#     ignore_decoding_error: true\n# - multiline:\n#     type: pattern\n#     pattern: '^\\['\n#     negate: true\n#     match: after\n",
+            },
+            {
+              name: 'processors',
+              type: 'yaml',
+              title: 'Processors',
+              description:
+                'Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the events are shipped. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.',
+              multi: false,
+              required: false,
+              show_user: false,
+            },
+          ],
+          template_path: 'stream.yml.hbs',
+          title: 'Collect Docker container logs',
+          description: 'Collect Docker container logs',
+          enabled: true,
+        },
+      ],
+      package: 'docker',
+      elasticsearch: {},
+      path: 'container_logs',
+    },
+  ],
+};
+
+export const DOCKER_2_11_0_ASSETS_MAP = new Map([
+  [
+    'docker-2.11.0/data_stream/container_logs/agent/stream/stream.yml.hbs',
+    Buffer.from(`id: docker-container-logs-\${docker.container.name}-\${docker.container.id}
+paths:
+{{#each paths}}
+  - {{this}}
+{{/each}}
+{{#if condition}}
+condition: {{ condition }}
+{{/if}}
+parsers:
+- container:
+    stream: {{ containerParserStream }}
+    format: docker
+{{ additionalParsersConfig }}
+
+{{#if processors}}
+processors:
+{{processors}}
+{{/if}}
+`),
+  ],
+]);
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/redis_1_18_0_package_info.json b/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/redis_1_18_0_package_info.json
index 57c9b0c68fac9..5aa5c4a878baf 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/redis_1_18_0_package_info.json
+++ b/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/redis_1_18_0_package_info.json
@@ -139,6 +139,15 @@
               "show_user": false,
               "default": "20s"
             },
+            {
+              "name": "tags",
+              "type": "text",
+              "title": "Tags",
+              "multi": true,
+              "required": false,
+              "show_user": false,
+              "default": ""
+            },
             {
               "name": "maxconn",
               "type": "integer",
@@ -203,6 +212,15 @@
         {
           "input": "redis/metrics",
           "vars": [
+            {
+              "name": "tags_streams",
+              "type": "text",
+              "title": "Tags in streams",
+              "multi": true,
+              "required": false,
+              "show_user": false,
+              "default": ""
+            },
             {
               "name": "key.patterns",
               "type": "yaml",
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/redis_1_18_0_streams_template.ts b/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/redis_1_18_0_streams_template.ts
index 5ff46f358bbe7..207a48d7132a5 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/redis_1_18_0_streams_template.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/__fixtures__/redis_1_18_0_streams_template.ts
@@ -76,6 +76,15 @@ period: {{period}}
 processors:
 {{processors}}
 {{/if}}
+tags:
+  - test
+{{#each tags as |tag i|}}
+  - {{tag}}
+{{/each}}
+tags_streams: 
+{{#each tags_streams as |tag i|}}
+  - {{tag}}
+{{/each}}
 `),
   ],
 ]);
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/__snapshots__/get_templates_inputs.test.ts.snap b/x-pack/plugins/fleet/server/services/epm/packages/__snapshots__/get_templates_inputs.test.ts.snap
index b3a428c0e5a55..56e4f7ee09319 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/__snapshots__/get_templates_inputs.test.ts.snap
+++ b/x-pack/plugins/fleet/server/services/epm/packages/__snapshots__/get_templates_inputs.test.ts.snap
@@ -8,17 +8,16 @@ exports[`Fleet - getTemplateInputs should work for input package 1`] = `
     streams:
       # Custom log file: Custom log file
       - id: logfile-log.logs
-        data_stream:
-          dataset: <DATA_STREAM.DATASET>
-            # Dataset name: Set the name for your dataset. Changing the dataset will send the data to a different index. You can't use \`-\` in the name of a dataset and only valid characters for [Elasticsearch index names](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-index_.html).
-
-        paths:
-          - <PATHS> # Log file path: Path to log files to be collected
-        exclude_files:
-          - <EXCLUDE_FILES> # Exclude files: Patterns to be ignored
         ignore_older: 72h
-        tags:
-          - <TAGS> # Tags: Tags to include in the published event
+        # data_stream:
+        #  dataset: <DATA_STREAM.DATASET>
+        #    # Dataset name: Set the name for your dataset. Changing the dataset will send the data to a different index. You can't use \`-\` in the name of a dataset and only valid characters for [Elasticsearch index names](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-index_.html).
+        # paths:
+        #  - <PATHS> # Log file path: Path to log files to be collected
+        # exclude_files:
+        #  - <EXCLUDE_FILES> # Exclude files: Patterns to be ignored
+        # tags:
+        #  - <TAGS> # Tags: Tags to include in the published event
 "
 `;
 
@@ -49,8 +48,34 @@ exports[`Fleet - getTemplateInputs should work for integration package 1`] = `
             pattern: '*'
         maxconn: 10
         network: tcp
-        username: <USERNAME> # Username
-        password: <PASSWORD> # Password
         period: 10s
+        tags:
+          - test
+          # - <TAGS> # Tags
+        # username: <USERNAME> # Username
+        # password: <PASSWORD> # Password
+        # tags_streams:
+        #  - <TAGS_STREAMS> # Tags in streams
+"
+`;
+
+exports[`Fleet - getTemplateInputs should work for package with dynamic ids 1`] = `
+"inputs:
+  # Collect Docker container logs: Collecting docker container logs
+  - id: docker-filestream
+    type: filestream
+    streams:
+      # Collect Docker container logs: Collect Docker container logs
+      - id: docker-container-logs-\${docker.container.name}-\${docker.container.id}
+        data_stream:
+          dataset: docker.container_logs
+          type: logs
+        paths:
+          - /var/lib/docker/containers/\${docker.container.id}/*-json.log
+        parsers:
+          - container:
+              stream: all
+              format: docker
+        # condition: <CONDITION> # Condition: Condition to filter when to apply this datastream. Refer to [Docker provider](https://www.elastic.co/guide/en/fleet/current/docker-provider.html) to find the available keys and to [Conditions](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html#conditions) on how to use the available keys in conditions.
 "
 `;
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/get_template_inputs.ts b/x-pack/plugins/fleet/server/services/epm/packages/get_template_inputs.ts
index 8c63f4b093dd0..f76b739904f3f 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/get_template_inputs.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/get_template_inputs.ts
@@ -51,20 +51,31 @@ type PackageWithInputAndStreamIndexed = Record<
 
 // Function based off storedPackagePolicyToAgentInputs, it only creates the `streams` section instead of the FullAgentPolicyInput
 export const templatePackagePolicyToFullInputStreams = (
-  packagePolicyInputs: PackagePolicyInput[]
+  packagePolicyInputs: PackagePolicyInput[],
+  inputAndStreamsIdsMap?: Map<string, { originalId: string; streams: Map<string, string> }>
 ): TemplateAgentPolicyInput[] => {
   const fullInputsStreams: TemplateAgentPolicyInput[] = [];
 
   if (!packagePolicyInputs || packagePolicyInputs.length === 0) return fullInputsStreams;
 
   packagePolicyInputs.forEach((input) => {
+    const streamsIdsMap = new Map();
+
+    const inputId = input.policy_template
+      ? `${input.policy_template}-${input.type}`
+      : `${input.type}`;
     const fullInputStream = {
       // @ts-ignore-next-line the following id is actually one level above the one in fullInputStream, but the linter thinks it gets overwritten
-      id: input.policy_template ? `${input.policy_template}-${input.type}` : `${input.type}`,
+      id: inputId,
       type: input.type,
-      ...getFullInputStreams(input, true),
+      ...getFullInputStreams(input, true, streamsIdsMap),
     };
 
+    inputAndStreamsIdsMap?.set(fullInputStream.id, {
+      originalId: inputId,
+      streams: streamsIdsMap,
+    });
+
     // deeply merge the input.config values with the full policy input stream
     merge(
       fullInputStream,
@@ -167,8 +178,13 @@ export async function getTemplateInputs(
     ...emptyPackagePolicy,
     inputs: compiledInputs,
   };
+  const inputIdsDestinationMap = new Map<
+    string,
+    { originalId: string; streams: Map<string, string> }
+  >();
   const inputs = templatePackagePolicyToFullInputStreams(
-    packagePolicyWithInputs.inputs as PackagePolicyInput[]
+    packagePolicyWithInputs.inputs as PackagePolicyInput[],
+    inputIdsDestinationMap
   );
 
   if (format === 'json') {
@@ -181,7 +197,7 @@ export async function getTemplateInputs(
         sortKeys: _sortYamlKeys,
       }
     );
-    return addCommentsToYaml(yaml, buildIndexedPackage(packageInfo));
+    return addCommentsToYaml(yaml, buildIndexedPackage(packageInfo), inputIdsDestinationMap);
   }
 
   return { inputs: [] };
@@ -247,7 +263,8 @@ function buildIndexedPackage(packageInfo: PackageInfo): PackageWithInputAndStrea
 
 function addCommentsToYaml(
   yaml: string,
-  packageIndexInputAndStreams: PackageWithInputAndStreamIndexed
+  packageIndexInputAndStreams: PackageWithInputAndStreamIndexed,
+  inputIdsDestinationMap: Map<string, { originalId: string; streams: Map<string, string> }>
 ) {
   const doc = yamlDoc.parseDocument(yaml);
   // Add input and streams comments
@@ -261,28 +278,16 @@ function addCommentsToYaml(
       if (!yamlDoc.isScalar(inputIdNode)) {
         return;
       }
-      const inputId = inputIdNode.value as string;
+      const inputId =
+        inputIdsDestinationMap.get(inputIdNode.value as string)?.originalId ??
+        (inputIdNode.value as string);
       const pkgInput = packageIndexInputAndStreams[inputId];
       if (pkgInput) {
         inputItem.commentBefore = ` ${pkgInput.title}${
           pkgInput.description ? `: ${pkgInput.description}` : ''
         }`;
 
-        yamlDoc.visit(inputItem, {
-          Scalar(key, node) {
-            if (node.value) {
-              const val = node.value.toString();
-              for (const varDef of pkgInput.vars ?? []) {
-                const placeholder = getPlaceholder(varDef);
-                if (val.includes(placeholder)) {
-                  node.comment = ` ${varDef.title}${
-                    varDef.description ? `: ${varDef.description}` : ''
-                  }`;
-                }
-              }
-            }
-          },
-        });
+        commentVariablesInYaml(inputItem, pkgInput.vars ?? []);
 
         const yamlStreams = inputItem.get('streams');
         if (!yamlDoc.isCollection(yamlStreams)) {
@@ -294,27 +299,16 @@ function addCommentsToYaml(
           }
           const streamIdNode = streamItem.get('id', true);
           if (yamlDoc.isScalar(streamIdNode)) {
-            const streamId = streamIdNode.value as string;
+            const streamId =
+              inputIdsDestinationMap
+                .get(inputIdNode.value as string)
+                ?.streams?.get(streamIdNode.value as string) ?? (streamIdNode.value as string);
             const pkgStream = pkgInput.streams[streamId];
             if (pkgStream) {
               streamItem.commentBefore = ` ${pkgStream.title}${
                 pkgStream.description ? `: ${pkgStream.description}` : ''
               }`;
-              yamlDoc.visit(streamItem, {
-                Scalar(key, node) {
-                  if (node.value) {
-                    const val = node.value.toString();
-                    for (const varDef of pkgStream.vars ?? []) {
-                      const placeholder = getPlaceholder(varDef);
-                      if (val.includes(placeholder)) {
-                        node.comment = ` ${varDef.title}${
-                          varDef.description ? `: ${varDef.description}` : ''
-                        }`;
-                      }
-                    }
-                  }
-                },
-              });
+              commentVariablesInYaml(streamItem, pkgStream.vars ?? []);
             }
           }
         });
@@ -324,3 +318,71 @@ function addCommentsToYaml(
 
   return doc.toString();
 }
+
+function commentVariablesInYaml(rootNode: yamlDoc.Node, vars: RegistryVarsEntry[] = []) {
+  // Node need to be deleted after the end of the visit to be able to visit every node
+  const toDeleteFn: Array<() => void> = [];
+  yamlDoc.visit(rootNode, {
+    Scalar(key, node, path) {
+      if (node.value) {
+        const val = node.value.toString();
+        for (const varDef of vars) {
+          const placeholder = getPlaceholder(varDef);
+          if (val.includes(placeholder)) {
+            node.comment = ` ${varDef.title}${varDef.description ? `: ${varDef.description}` : ''}`;
+
+            const paths = [...path].reverse();
+
+            let prevPart: yamlDoc.Node | yamlDoc.Document | yamlDoc.Pair = node;
+
+            for (const pathPart of paths) {
+              if (yamlDoc.isCollection(pathPart)) {
+                // If only one items in the collection comment the whole collection
+                if (pathPart.items.length === 1) {
+                  continue;
+                }
+              }
+              if (yamlDoc.isSeq(pathPart)) {
+                const commentDoc = new yamlDoc.Document(new yamlDoc.YAMLSeq());
+                commentDoc.add(prevPart);
+                const commentStr = commentDoc.toString().trimEnd();
+                pathPart.comment = pathPart.comment
+                  ? `${pathPart.comment} ${commentStr}`
+                  : ` ${commentStr}`;
+                const keyToDelete = prevPart;
+
+                toDeleteFn.push(() => {
+                  pathPart.items.forEach((item, index) => {
+                    if (item === keyToDelete) {
+                      pathPart.delete(new yamlDoc.Scalar(index));
+                    }
+                  });
+                });
+                return;
+              }
+
+              if (yamlDoc.isMap(pathPart)) {
+                if (yamlDoc.isPair(prevPart)) {
+                  const commentDoc = new yamlDoc.Document(new yamlDoc.YAMLMap());
+                  commentDoc.add(prevPart);
+                  const commentStr = commentDoc.toString().trimEnd();
+
+                  pathPart.comment = pathPart.comment
+                    ? `${pathPart.comment}\n ${commentStr.toString()}`
+                    : ` ${commentStr.toString()}`;
+                  const keyToDelete = prevPart.key;
+                  toDeleteFn.push(() => pathPart.delete(keyToDelete));
+                }
+                return;
+              }
+
+              prevPart = pathPart;
+            }
+          }
+        }
+      }
+    },
+  });
+
+  toDeleteFn.forEach((deleteFn) => deleteFn());
+}
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/get_templates_inputs.test.ts b/x-pack/plugins/fleet/server/services/epm/packages/get_templates_inputs.test.ts
index 087002f212852..1a3738d8eaa82 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/get_templates_inputs.test.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/get_templates_inputs.test.ts
@@ -16,6 +16,7 @@ import REDIS_1_18_0_PACKAGE_INFO from './__fixtures__/redis_1_18_0_package_info.
 import { getPackageAssetsMap, getPackageInfo } from './get';
 import { REDIS_ASSETS_MAP } from './__fixtures__/redis_1_18_0_streams_template';
 import { LOGS_2_3_0_ASSETS_MAP, LOGS_2_3_0_PACKAGE_INFO } from './__fixtures__/logs_2_3_0';
+import { DOCKER_2_11_0_PACKAGE_INFO, DOCKER_2_11_0_ASSETS_MAP } from './__fixtures__/docker_2_11_0';
 
 jest.mock('./get');
 
@@ -41,6 +42,7 @@ packageInfoCache.set('limited_package-0.0.0', {
 
 packageInfoCache.set('redis-1.18.0', REDIS_1_18_0_PACKAGE_INFO);
 packageInfoCache.set('log-2.3.0', LOGS_2_3_0_PACKAGE_INFO);
+packageInfoCache.set('docker-2.11.0', DOCKER_2_11_0_PACKAGE_INFO);
 
 describe('Fleet - templatePackagePolicyToFullInputStreams', () => {
   const mockInput: PackagePolicyInput = {
@@ -330,6 +332,9 @@ describe('Fleet - getTemplateInputs', () => {
       if (packageInfo.name === 'log') {
         return LOGS_2_3_0_ASSETS_MAP;
       }
+      if (packageInfo.name === 'docker') {
+        return DOCKER_2_11_0_ASSETS_MAP;
+      }
 
       return new Map();
     });
@@ -350,6 +355,14 @@ describe('Fleet - getTemplateInputs', () => {
     expect(template).toMatchSnapshot();
   });
 
+  it('should work for package with dynamic ids', async () => {
+    const soMock = savedObjectsClientMock.create();
+    soMock.get.mockResolvedValue({ attributes: {} } as any);
+    const template = await getTemplateInputs(soMock, 'docker', '2.11.0', 'yml');
+
+    expect(template).toMatchSnapshot();
+  });
+
   it('should work for input package', async () => {
     const soMock = savedObjectsClientMock.create();
     soMock.get.mockResolvedValue({ attributes: {} } as any);
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/server/plugin.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/server/plugin.ts
index 81f4e24d4d21f..3bdff9eb17606 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant/server/plugin.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/server/plugin.ts
@@ -32,7 +32,6 @@ import {
   ObservabilityAIAssistantPluginSetupDependencies,
   ObservabilityAIAssistantPluginStartDependencies,
 } from './types';
-import { addLensDocsToKb } from './service/knowledge_base_service/kb_docs/lens';
 import { registerFunctions } from './functions';
 import { recallRankingEvent } from './analytics/recall_ranking';
 import { initLangtrace } from './service/client/instrumentation/init_langtrace';
@@ -164,10 +163,6 @@ export class ObservabilityAIAssistantPlugin
 
     service.register(registerFunctions);
 
-    if (this.config.enableKnowledgeBase) {
-      addLensDocsToKb({ service, logger: this.logger.get('kb').get('lens') });
-    }
-
     registerServerRoutes({
       core,
       logger: this.logger,
diff --git a/x-pack/plugins/security_solution/public/cases/pages/index.tsx b/x-pack/plugins/security_solution/public/cases/pages/index.tsx
index c873e48e4975f..82c069e1ed77c 100644
--- a/x-pack/plugins/security_solution/public/cases/pages/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/pages/index.tsx
@@ -12,15 +12,13 @@ import { CaseMetricsFeature } from '@kbn/cases-plugin/common';
 import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
 import { CaseDetailsRefreshContext } from '../../common/components/endpoint';
 import { DocumentDetailsRightPanelKey } from '../../flyout/document_details/shared/constants/panel_keys';
+import { RulePanelKey } from '../../flyout/rule_details/right';
 import { useTourContext } from '../../common/components/guided_onboarding_tour';
 import {
   AlertsCasesTourSteps,
   SecurityStepId,
 } from '../../common/components/guided_onboarding_tour/tour_config';
 import { TimelineId } from '../../../common/types/timeline';
-
-import { getRuleDetailsUrl, useFormatUrl } from '../../common/components/link_to';
-
 import { useKibana, useNavigation } from '../../common/lib/kibana';
 import { APP_ID, CASES_PATH, SecurityPageName } from '../../../common/constants';
 import { timelineActions } from '../../timelines/store';
@@ -38,17 +36,8 @@ const CaseContainerComponent: React.FC = () => {
   const { getAppUrl, navigateTo } = useNavigation();
   const userCasesPermissions = cases.helpers.canUseCases([APP_ID]);
   const dispatch = useDispatch();
-  const { formatUrl: detectionsFormatUrl, search: detectionsUrlSearch } = useFormatUrl(
-    SecurityPageName.rules
-  );
   const { openFlyout } = useExpandableFlyoutApi();
 
-  const getDetectionsRuleDetailsHref = useCallback(
-    (ruleId: string | null | undefined) =>
-      detectionsFormatUrl(getRuleDetailsUrl(ruleId ?? '', detectionsUrlSearch)),
-    [detectionsFormatUrl, detectionsUrlSearch]
-  );
-
   const interactionsUpsellingMessage = useUpsellingMessage('investigation_guide_interactions');
 
   const showAlertDetails = useCallback(
@@ -71,6 +60,15 @@ const CaseContainerComponent: React.FC = () => {
     [openFlyout, telemetry]
   );
 
+  const onRuleDetailsClick = useCallback(
+    (ruleId: string | null | undefined) => {
+      if (ruleId) {
+        openFlyout({ right: { id: RulePanelKey, params: { ruleId } } });
+      }
+    },
+    [openFlyout]
+  );
+
   const { onLoad: onAlertsTableLoaded } = useFetchNotes();
 
   const endpointDetailsHref = (endpointId: string) =>
@@ -138,16 +136,7 @@ const CaseContainerComponent: React.FC = () => {
             },
           },
           ruleDetailsNavigation: {
-            href: getDetectionsRuleDetailsHref,
-            onClick: async (ruleId: string | null | undefined, e) => {
-              if (e) {
-                e.preventDefault();
-              }
-              return navigateTo({
-                deepLinkId: SecurityPageName.rules,
-                path: getRuleDetailsUrl(ruleId ?? ''),
-              });
-            },
+            onClick: onRuleDetailsClick,
           },
           showAlertDetails,
           timelineIntegration: {
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/components/enablement_modal.tsx b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/components/enablement_modal.tsx
index 974bdddc831e5..6c2528620eb4c 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/components/enablement_modal.tsx
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/components/enablement_modal.tsx
@@ -72,20 +72,13 @@ export const EntityStoreEnablementModal: React.FC<EntityStoreEnablementModalProp
         <EuiModalHeaderTitle>
           <FormattedMessage
             id="xpack.securitySolution.entityAnalytics.enablements.modal.title"
-            defaultMessage="Additional charges may apply"
+            defaultMessage="Entity Analytics Enablement"
           />
         </EuiModalHeaderTitle>
       </EuiModalHeader>
 
       <EuiModalBody>
         <EuiFlexGroup direction="column">
-          <EuiText>
-            <FormattedMessage
-              id="xpack.securitySolution.entityAnalytics.enablements.modal.description"
-              defaultMessage="Please be aware that activating these features may incur additional charges depending on your subscription plan. Review your plan details carefully to avoid unexpected costs before proceeding."
-            />
-          </EuiText>
-          <EuiHorizontalRule margin="none" />
           <EuiFlexItem>
             <EuiSwitch
               label={
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/notes.test.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/notes.test.tsx
index f70cd2aae3e8d..023b0202ecb63 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/notes.test.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/notes.test.tsx
@@ -23,6 +23,7 @@ import type { Note } from '../../../../../common/api/timeline';
 import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
 import { DocumentDetailsLeftPanelKey } from '../../shared/constants/panel_keys';
 import { LeftPanelNotesTab } from '../../left';
+import { getEmptyValue } from '../../../../common/components/empty_value';
 
 jest.mock('@kbn/expandable-flyout');
 
@@ -43,6 +44,10 @@ jest.mock('react-redux', () => {
 });
 
 describe('<Notes />', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
   it('should render loading spinner', () => {
     (useExpandableFlyoutApi as jest.Mock).mockReturnValue({ openLeftPanel: jest.fn() });
 
@@ -99,6 +104,34 @@ describe('<Notes />', () => {
     });
   });
 
+  it('should disabled the Add note button if in preview mode', () => {
+    const contextValue = {
+      ...mockContextValue,
+      isPreviewMode: true,
+    };
+
+    const mockOpenLeftPanel = jest.fn();
+    (useExpandableFlyoutApi as jest.Mock).mockReturnValue({ openLeftPanel: mockOpenLeftPanel });
+
+    const { getByTestId } = render(
+      <TestProviders>
+        <DocumentDetailsContext.Provider value={contextValue}>
+          <Notes />
+        </DocumentDetailsContext.Provider>
+      </TestProviders>
+    );
+
+    expect(mockDispatch).not.toHaveBeenCalled();
+
+    const button = getByTestId(NOTES_ADD_NOTE_BUTTON_TEST_ID);
+    expect(button).toBeInTheDocument();
+    expect(button).toBeDisabled();
+
+    button.click();
+
+    expect(mockOpenLeftPanel).not.toHaveBeenCalled();
+  });
+
   it('should render number of notes and plus button', () => {
     const mockOpenLeftPanel = jest.fn();
     (useExpandableFlyoutApi as jest.Mock).mockReturnValue({ openLeftPanel: mockOpenLeftPanel });
@@ -135,6 +168,38 @@ describe('<Notes />', () => {
     });
   });
 
+  it('should disable the plus button if in preview mode', () => {
+    const mockOpenLeftPanel = jest.fn();
+    (useExpandableFlyoutApi as jest.Mock).mockReturnValue({ openLeftPanel: mockOpenLeftPanel });
+
+    const contextValue = {
+      ...mockContextValue,
+      eventId: '1',
+      isPreviewMode: true,
+    };
+
+    const { getByTestId } = render(
+      <TestProviders>
+        <DocumentDetailsContext.Provider value={contextValue}>
+          <Notes />
+        </DocumentDetailsContext.Provider>
+      </TestProviders>
+    );
+
+    expect(getByTestId(NOTES_COUNT_TEST_ID)).toBeInTheDocument();
+    expect(getByTestId(NOTES_COUNT_TEST_ID)).toHaveTextContent('1');
+
+    expect(mockDispatch).not.toHaveBeenCalled();
+
+    const button = getByTestId(NOTES_ADD_NOTE_ICON_BUTTON_TEST_ID);
+
+    expect(button).toBeInTheDocument();
+    button.click();
+    expect(button).toBeDisabled();
+
+    expect(mockOpenLeftPanel).not.toHaveBeenCalled();
+  });
+
   it('should render number of notes in scientific notation for big numbers', () => {
     const createMockNote = (noteId: string): Note => ({
       eventId: '1', // should be a valid id based on mockTimelineData
@@ -180,6 +245,30 @@ describe('<Notes />', () => {
     expect(getByTestId(NOTES_COUNT_TEST_ID)).toHaveTextContent('1k');
   });
 
+  it('should show a - when in rule creation workflow', () => {
+    const contextValue = {
+      ...mockContextValue,
+      isPreview: true,
+    };
+
+    (useExpandableFlyoutApi as jest.Mock).mockReturnValue({ openLeftPanel: jest.fn() });
+
+    const { getByText, queryByTestId } = render(
+      <TestProviders>
+        <DocumentDetailsContext.Provider value={contextValue}>
+          <Notes />
+        </DocumentDetailsContext.Provider>
+      </TestProviders>
+    );
+
+    expect(mockDispatch).not.toHaveBeenCalled();
+
+    expect(queryByTestId(NOTES_ADD_NOTE_ICON_BUTTON_TEST_ID)).not.toBeInTheDocument();
+    expect(queryByTestId(NOTES_ADD_NOTE_BUTTON_TEST_ID)).not.toBeInTheDocument();
+    expect(queryByTestId(NOTES_COUNT_TEST_ID)).not.toBeInTheDocument();
+    expect(getByText(getEmptyValue())).toBeInTheDocument();
+  });
+
   it('should render toast error', () => {
     const store = createMockStore({
       ...mockGlobalState,
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/notes.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/notes.tsx
index a981a16117a68..b0e2008c04103 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/notes.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/notes.tsx
@@ -19,6 +19,7 @@ import {
 } from '@elastic/eui';
 import { css } from '@emotion/react';
 import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
+import { getEmptyTagValue } from '../../../../common/components/empty_value';
 import { DocumentDetailsLeftPanelKey } from '../../shared/constants/panel_keys';
 import { FormattedCount } from '../../../../common/components/formatted_number';
 import { useDocumentDetailsContext } from '../../shared/context';
@@ -61,7 +62,7 @@ export const ADD_NOTE_BUTTON = i18n.translate(
 export const Notes = memo(() => {
   const { euiTheme } = useEuiTheme();
   const dispatch = useDispatch();
-  const { eventId, indexName, scopeId } = useDocumentDetailsContext();
+  const { eventId, indexName, scopeId, isPreview, isPreviewMode } = useDocumentDetailsContext();
   const { addError: addErrorToast } = useAppToasts();
 
   const { openLeftPanel } = useExpandableFlyoutApi();
@@ -80,8 +81,11 @@ export const Notes = memo(() => {
   );
 
   useEffect(() => {
-    dispatch(fetchNotesByDocumentIds({ documentIds: [eventId] }));
-  }, [dispatch, eventId]);
+    // only fetch notes if we are not in a preview panel, or not in a rule preview workflow
+    if (!isPreviewMode && !isPreview) {
+      dispatch(fetchNotesByDocumentIds({ documentIds: [eventId] }));
+    }
+  }, [dispatch, eventId, isPreview, isPreviewMode]);
 
   const fetchStatus = useSelector((state: State) => selectFetchNotesByDocumentIdsStatus(state));
   const fetchError = useSelector((state: State) => selectFetchNotesByDocumentIdsError(state));
@@ -107,37 +111,45 @@ export const Notes = memo(() => {
       }
       data-test-subj={NOTES_TITLE_TEST_ID}
     >
-      {fetchStatus === ReqStatus.Loading ? (
-        <EuiLoadingSpinner data-test-subj={NOTES_LOADING_TEST_ID} size="m" />
+      {isPreview ? (
+        getEmptyTagValue()
       ) : (
         <>
-          {notes.length === 0 ? (
-            <EuiButtonEmpty
-              iconType="plusInCircle"
-              onClick={openExpandedFlyoutNotesTab}
-              size="s"
-              aria-label={ADD_NOTE_BUTTON}
-              data-test-subj={NOTES_ADD_NOTE_BUTTON_TEST_ID}
-            >
-              {ADD_NOTE_BUTTON}
-            </EuiButtonEmpty>
+          {fetchStatus === ReqStatus.Loading ? (
+            <EuiLoadingSpinner data-test-subj={NOTES_LOADING_TEST_ID} size="m" />
           ) : (
-            <EuiFlexGroup responsive={false} alignItems="center" gutterSize="none">
-              <EuiFlexItem data-test-subj={NOTES_COUNT_TEST_ID}>
-                <FormattedCount count={notes.length} />
-              </EuiFlexItem>
-              <EuiFlexItem>
-                <EuiButtonIcon
-                  onClick={openExpandedFlyoutNotesTab}
+            <>
+              {notes.length === 0 ? (
+                <EuiButtonEmpty
                   iconType="plusInCircle"
-                  css={css`
-                    margin-left: ${euiTheme.size.xs};
-                  `}
+                  onClick={openExpandedFlyoutNotesTab}
+                  size="s"
+                  disabled={isPreviewMode || isPreview}
                   aria-label={ADD_NOTE_BUTTON}
-                  data-test-subj={NOTES_ADD_NOTE_ICON_BUTTON_TEST_ID}
-                />
-              </EuiFlexItem>
-            </EuiFlexGroup>
+                  data-test-subj={NOTES_ADD_NOTE_BUTTON_TEST_ID}
+                >
+                  {ADD_NOTE_BUTTON}
+                </EuiButtonEmpty>
+              ) : (
+                <EuiFlexGroup responsive={false} alignItems="center" gutterSize="none">
+                  <EuiFlexItem data-test-subj={NOTES_COUNT_TEST_ID}>
+                    <FormattedCount count={notes.length} />
+                  </EuiFlexItem>
+                  <EuiFlexItem>
+                    <EuiButtonIcon
+                      onClick={openExpandedFlyoutNotesTab}
+                      iconType="plusInCircle"
+                      disabled={isPreviewMode || isPreview}
+                      css={css`
+                        margin-left: ${euiTheme.size.xs};
+                      `}
+                      aria-label={ADD_NOTE_BUTTON}
+                      data-test-subj={NOTES_ADD_NOTE_ICON_BUTTON_TEST_ID}
+                    />
+                  </EuiFlexItem>
+                </EuiFlexGroup>
+              )}
+            </>
           )}
         </>
       )}
diff --git a/x-pack/plugins/task_manager/server/task_claimers/strategy_mget.test.ts b/x-pack/plugins/task_manager/server/task_claimers/strategy_mget.test.ts
index e089d3b2d8785..92f2dba988575 100644
--- a/x-pack/plugins/task_manager/server/task_claimers/strategy_mget.test.ts
+++ b/x-pack/plugins/task_manager/server/task_claimers/strategy_mget.test.ts
@@ -1344,15 +1344,15 @@ describe('TaskClaiming', () => {
       expect(result.docs.length).toEqual(3);
     });
 
-    test('should assign startedAt value if bulkGet returns task with null startedAt', async () => {
+    test('should skip tasks where bulkGet returns a newer task document than the bulkPartialUpdate', async () => {
       const store = taskStoreMock.create({ taskManagerId: 'test-test' });
       store.convertToSavedObjectIds.mockImplementation((ids) => ids.map((id) => `task:${id}`));
 
       const fetchedTasks = [
-        mockInstance({ id: `id-1`, taskType: 'report' }),
-        mockInstance({ id: `id-2`, taskType: 'report' }),
-        mockInstance({ id: `id-3`, taskType: 'yawn' }),
-        mockInstance({ id: `id-4`, taskType: 'report' }),
+        mockInstance({ id: `id-1`, taskType: 'report', version: '123' }),
+        mockInstance({ id: `id-2`, taskType: 'report', version: '123' }),
+        mockInstance({ id: `id-3`, taskType: 'yawn', version: '123' }),
+        mockInstance({ id: `id-4`, taskType: 'report', version: '123' }),
       ];
 
       const { versionMap, docLatestVersions } = getVersionMapsFromTasks(fetchedTasks);
@@ -1365,7 +1365,7 @@ describe('TaskClaiming', () => {
       );
       store.bulkGet.mockResolvedValueOnce([
         asOk({ ...fetchedTasks[0], startedAt: new Date() }),
-        asOk(fetchedTasks[1]),
+        asOk({ ...fetchedTasks[1], startedAt: new Date(), version: 'abc' }),
         asOk({ ...fetchedTasks[2], startedAt: new Date() }),
         asOk({ ...fetchedTasks[3], startedAt: new Date() }),
       ]);
@@ -1399,11 +1399,11 @@ describe('TaskClaiming', () => {
       expect(mockApmTrans.end).toHaveBeenCalledWith('success');
 
       expect(taskManagerLogger.debug).toHaveBeenCalledWith(
-        'task claimer claimed: 4; stale: 0; conflicts: 0; missing: 0; capacity reached: 0; updateErrors: 0; getErrors: 0; removed: 0;',
+        'task claimer claimed: 3; stale: 0; conflicts: 1; missing: 0; capacity reached: 0; updateErrors: 0; getErrors: 0; removed: 0;',
         { tags: ['taskClaiming', 'claimAvailableTasksMget'] }
       );
       expect(taskManagerLogger.warn).toHaveBeenCalledWith(
-        'Task id-2 has a null startedAt value, setting to current time - ownerId null, status idle',
+        'Task id-2 was modified during the claiming phase, skipping until the next claiming cycle.',
         { tags: ['taskClaiming', 'claimAvailableTasksMget'] }
       );
 
@@ -1463,14 +1463,14 @@ describe('TaskClaiming', () => {
       expect(store.bulkGet).toHaveBeenCalledWith(['id-1', 'id-2', 'id-3', 'id-4']);
 
       expect(result.stats).toEqual({
-        tasksClaimed: 4,
-        tasksConflicted: 0,
+        tasksClaimed: 3,
+        tasksConflicted: 1,
         tasksErrors: 0,
-        tasksUpdated: 4,
+        tasksUpdated: 3,
         tasksLeftUnclaimed: 0,
         staleTasks: 0,
       });
-      expect(result.docs.length).toEqual(4);
+      expect(result.docs.length).toEqual(3);
       for (const r of result.docs) {
         expect(r.startedAt).not.toBeNull();
       }
diff --git a/x-pack/plugins/task_manager/server/task_claimers/strategy_mget.ts b/x-pack/plugins/task_manager/server/task_claimers/strategy_mget.ts
index 4e74454e8c982..cd3efdc783008 100644
--- a/x-pack/plugins/task_manager/server/task_claimers/strategy_mget.ts
+++ b/x-pack/plugins/task_manager/server/task_claimers/strategy_mget.ts
@@ -195,7 +195,7 @@ async function claimAvailableTasks(opts: TaskClaimerOpts): Promise<ClaimOwnershi
   }
 
   // perform the task object updates, deal with errors
-  const updatedTaskIds: string[] = [];
+  const updatedTasks: Record<string, PartialConcreteTaskInstance> = {};
   let conflicts = 0;
   let bulkUpdateErrors = 0;
   let bulkGetErrors = 0;
@@ -203,7 +203,7 @@ async function claimAvailableTasks(opts: TaskClaimerOpts): Promise<ClaimOwnershi
   const updateResults = await taskStore.bulkPartialUpdate(taskUpdates);
   for (const updateResult of updateResults) {
     if (isOk(updateResult)) {
-      updatedTaskIds.push(updateResult.value.id);
+      updatedTasks[updateResult.value.id] = updateResult.value;
     } else {
       const { id, type, error, status } = updateResult.error;
 
@@ -218,29 +218,23 @@ async function claimAvailableTasks(opts: TaskClaimerOpts): Promise<ClaimOwnershi
   }
 
   // perform an mget to get the full task instance for claiming
-  const fullTasksToRun = (await taskStore.bulkGet(updatedTaskIds)).reduce<ConcreteTaskInstance[]>(
-    (acc, task) => {
-      if (isOk(task)) {
-        acc.push(task.value);
-      } else {
-        const { id, type, error } = task.error;
-        logger.error(`Error getting full task ${id}:${type} during claim: ${error.message}`);
-        bulkGetErrors++;
-      }
-      return acc;
-    },
-    []
-  );
-
-  // Look for tasks that have a null startedAt value, log them and manually set a startedAt field
-  for (const task of fullTasksToRun) {
-    if (task.startedAt == null) {
+  const fullTasksToRun = (await taskStore.bulkGet(Object.keys(updatedTasks))).reduce<
+    ConcreteTaskInstance[]
+  >((acc, task) => {
+    if (isOk(task) && task.value.version !== updatedTasks[task.value.id].version) {
       logger.warn(
-        `Task ${task.id} has a null startedAt value, setting to current time - ownerId ${task.ownerId}, status ${task.status}`
+        `Task ${task.value.id} was modified during the claiming phase, skipping until the next claiming cycle.`
       );
-      task.startedAt = now;
+      conflicts++;
+    } else if (isOk(task)) {
+      acc.push(task.value);
+    } else {
+      const { id, type, error } = task.error;
+      logger.error(`Error getting full task ${id}:${type} during claim: ${error.message}`);
+      bulkGetErrors++;
     }
-  }
+    return acc;
+  }, []);
 
   // separate update for removed tasks; shouldn't happen often, so unlikely
   // a performance concern, and keeps the rest of the logic simpler
diff --git a/x-pack/plugins/task_manager/server/task_store.test.ts b/x-pack/plugins/task_manager/server/task_store.test.ts
index 2238381552861..cbb1c44dde3fc 100644
--- a/x-pack/plugins/task_manager/server/task_store.test.ts
+++ b/x-pack/plugins/task_manager/server/task_store.test.ts
@@ -1020,7 +1020,10 @@ describe('TaskStore', () => {
         refresh: false,
       });
 
-      expect(result).toEqual([asOk(task)]);
+      expect(result).toEqual([
+        // New version returned after update
+        asOk({ ...task, version: 'Wzg0LDFd' }),
+      ]);
     });
 
     test(`should perform partial update with minimal fields`, async () => {
@@ -1062,7 +1065,8 @@ describe('TaskStore', () => {
         refresh: false,
       });
 
-      expect(result).toEqual([asOk(task)]);
+      // New version returned after update
+      expect(result).toEqual([asOk({ ...task, version: 'Wzg0LDFd' })]);
     });
 
     test(`should perform partial update with no version`, async () => {
@@ -1100,7 +1104,8 @@ describe('TaskStore', () => {
         refresh: false,
       });
 
-      expect(result).toEqual([asOk(task)]);
+      // New version returned after update
+      expect(result).toEqual([asOk({ ...task, version: 'Wzg0LDFd' })]);
     });
 
     test(`should gracefully handle errors within the response`, async () => {
@@ -1183,7 +1188,8 @@ describe('TaskStore', () => {
       });
 
       expect(result).toEqual([
-        asOk(task1),
+        // New version returned after update
+        asOk({ ...task1, version: 'Wzg0LDFd' }),
         asErr({
           type: 'task',
           id: '45343254',
@@ -1267,7 +1273,8 @@ describe('TaskStore', () => {
       });
 
       expect(result).toEqual([
-        asOk(task1),
+        // New version returned after update
+        asOk({ ...task1, version: 'Wzg0LDFd' }),
         asErr({
           type: 'task',
           id: 'unknown',
diff --git a/x-pack/plugins/task_manager/server/task_store.ts b/x-pack/plugins/task_manager/server/task_store.ts
index b7f1cec3f5567..0946c5c18d328 100644
--- a/x-pack/plugins/task_manager/server/task_store.ts
+++ b/x-pack/plugins/task_manager/server/task_store.ts
@@ -26,7 +26,7 @@ import {
   ElasticsearchClient,
 } from '@kbn/core/server';
 
-import { decodeRequestVersion } from '@kbn/core-saved-objects-base-server-internal';
+import { decodeRequestVersion, encodeVersion } from '@kbn/core-saved-objects-base-server-internal';
 import { RequestTimeoutsConfig } from './config';
 import { asOk, asErr, Result } from './lib/result_type';
 
@@ -427,6 +427,7 @@ export class TaskStore {
       return asOk({
         ...doc,
         id: docId,
+        version: encodeVersion(item.update._seq_no, item.update._primary_term),
       });
     });
   }
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index 3ed262c0aa159..53ddb2e664587 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -1209,9 +1209,6 @@
     "dashboard.actions.toggleExpandPanelMenuItem.notExpandedDisplayName": "Maximiser",
     "dashboard.addPanel.newEmbeddableAddedSuccessMessageTitle": "{savedObjectName} a été ajouté.",
     "dashboard.addPanel.newEmbeddableWithNoTitleAddedSuccessMessageTitle": "Un panneau a été ajouté",
-    "dashboard.appLeaveConfirmModal.cancelButtonLabel": "Annuler",
-    "dashboard.appLeaveConfirmModal.unsavedChangesSubtitle": "Quitter Dashboard sans enregistrer ?",
-    "dashboard.appLeaveConfirmModal.unsavedChangesTitle": "Modifications non enregistrées",
     "dashboard.badge.readOnly.text": "Lecture seule",
     "dashboard.badge.readOnly.tooltip": "Impossible d'enregistrer les tableaux de bord",
     "dashboard.createConfirmModal.cancelButtonLabel": "Annuler",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 16b4b66d842c4..5b646ff86ce3f 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -1209,9 +1209,6 @@
     "dashboard.actions.toggleExpandPanelMenuItem.notExpandedDisplayName": "最大化",
     "dashboard.addPanel.newEmbeddableAddedSuccessMessageTitle": "{savedObjectName} が追加されました",
     "dashboard.addPanel.newEmbeddableWithNoTitleAddedSuccessMessageTitle": "パネルが追加されました",
-    "dashboard.appLeaveConfirmModal.cancelButtonLabel": "キャンセル",
-    "dashboard.appLeaveConfirmModal.unsavedChangesSubtitle": "作業を保存せずにダッシュボードから移動しますか？",
-    "dashboard.appLeaveConfirmModal.unsavedChangesTitle": "保存されていない変更",
     "dashboard.badge.readOnly.text": "読み取り専用",
     "dashboard.badge.readOnly.tooltip": "ダッシュボードを保存できません",
     "dashboard.createConfirmModal.cancelButtonLabel": "キャンセル",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 2bf1c18e4f4f6..739a59ef97477 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -1209,9 +1209,6 @@
     "dashboard.actions.toggleExpandPanelMenuItem.notExpandedDisplayName": "最大化",
     "dashboard.addPanel.newEmbeddableAddedSuccessMessageTitle": "{savedObjectName} 已添加",
     "dashboard.addPanel.newEmbeddableWithNoTitleAddedSuccessMessageTitle": "已添加一个面板",
-    "dashboard.appLeaveConfirmModal.cancelButtonLabel": "取消",
-    "dashboard.appLeaveConfirmModal.unsavedChangesSubtitle": "离开有未保存工作的仪表板？",
-    "dashboard.appLeaveConfirmModal.unsavedChangesTitle": "未保存的更改",
     "dashboard.badge.readOnly.text": "只读",
     "dashboard.badge.readOnly.tooltip": "无法保存仪表板",
     "dashboard.createConfirmModal.cancelButtonLabel": "取消",
diff --git a/x-pack/test/observability_ai_assistant_api_integration/tests/complete/functions/summarize.spec.ts b/x-pack/test/observability_ai_assistant_api_integration/tests/complete/functions/summarize.spec.ts
index 238be31220aa9..923e8b0206070 100644
--- a/x-pack/test/observability_ai_assistant_api_integration/tests/complete/functions/summarize.spec.ts
+++ b/x-pack/test/observability_ai_assistant_api_integration/tests/complete/functions/summarize.spec.ts
@@ -14,18 +14,32 @@ import {
   createProxyActionConnector,
   deleteActionConnector,
 } from '../../../common/action_connectors';
+import {
+  clearKnowledgeBase,
+  createKnowledgeBaseModel,
+  deleteKnowledgeBaseModel,
+} from '../../knowledge_base/helpers';
 
 export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const log = getService('log');
+  const ml = getService('ml');
+  const es = getService('es');
   const observabilityAIAssistantAPIClient = getService('observabilityAIAssistantAPIClient');
 
-  // Skipped until Elser is available in tests
-  describe.skip('when calling summarize function', () => {
+  describe('when calling summarize function', () => {
     let proxy: LlmProxy;
     let connectorId: string;
 
     before(async () => {
+      await clearKnowledgeBase(es);
+      await createKnowledgeBaseModel(ml);
+      await observabilityAIAssistantAPIClient
+        .editorUser({
+          endpoint: 'POST /internal/observability_ai_assistant/kb/setup',
+        })
+        .expect(200);
+
       proxy = await createLlmProxy(log);
       connectorId = await createProxyActionConnector({ supertest, log, port: proxy.getPort() });
 
@@ -44,7 +58,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             id: 'my-id',
             text: 'Hello world',
             is_correction: false,
-            confidence: 1,
+            confidence: 'high',
             public: false,
           }),
         },
@@ -55,7 +69,9 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
     after(async () => {
       proxy.close();
+
       await deleteActionConnector({ supertest, connectorId, log });
+      await deleteKnowledgeBaseModel(ml);
     });
 
     it('persists entry in knowledge base', async () => {
@@ -70,6 +86,14 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         },
       });
 
+      const { role, public: isPublic, text, type, user, id } = res.body.entries[0];
+
+      expect(role).to.eql('assistant_summarization');
+      expect(isPublic).to.eql(false);
+      expect(text).to.eql('Hello world');
+      expect(type).to.eql('contextual');
+      expect(user?.name).to.eql('editor');
+      expect(id).to.eql('my-id');
       expect(res.body.entries).to.have.length(1);
     });
   });