diff --git a/x-pack/plugins/secops/common/graphql/typed_resolvers.ts b/x-pack/plugins/secops/common/graphql/typed_resolvers.ts
deleted file mode 100644
index 7100801fc656..000000000000
--- a/x-pack/plugins/secops/common/graphql/typed_resolvers.ts
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { GraphQLResolveInfo } from 'graphql';
-
-// tslint:disable-next-line:no-any
-type BasicResolver<Result, Args = any> = (
-  // tslint:disable-next-line:no-any
-  parent: any,
-  args: Args,
-  // tslint:disable-next-line:no-any
-  context: any,
-  info: GraphQLResolveInfo
-) => Promise<Result> | Result;
-
-type AppResolverResult<R> =
-  | Promise<R>
-  | Promise<{ [P in keyof R]: () => Promise<R[P]> }>
-  | { [P in keyof R]: () => Promise<R[P]> }
-  | { [P in keyof R]: () => R[P] }
-  | R;
-
-// tslint:disable-next-line:no-any
-export type AppResolvedResult<Resolver> = Resolver extends AppResolver<infer Result, any, any, any>
-  ? Result
-  : never;
-
-export type SubsetResolverWithFields<R, IncludedFields extends string> = R extends BasicResolver<
-  Array<infer ResultInArray>,
-  infer ArgsInArray
->
-  ? BasicResolver<
-      Array<Pick<ResultInArray, Extract<keyof ResultInArray, IncludedFields>>>,
-      ArgsInArray
-    >
-  : R extends BasicResolver<infer Result, infer Args>
-    ? BasicResolver<Pick<Result, Extract<keyof Result, IncludedFields>>, Args>
-    : never;
-
-export type SubsetResolverWithoutFields<R, ExcludedFields extends string> = R extends BasicResolver<
-  Array<infer ResultInArray>,
-  infer ArgsInArray
->
-  ? BasicResolver<
-      Array<Pick<ResultInArray, Exclude<keyof ResultInArray, ExcludedFields>>>,
-      ArgsInArray
-    >
-  : R extends BasicResolver<infer Result, infer Args>
-    ? BasicResolver<Pick<Result, Exclude<keyof Result, ExcludedFields>>, Args>
-    : never;
-
-export type AppResolver<Result, Parent, Args, Context> = (
-  parent: Parent,
-  args: Args,
-  context: Context,
-  info: GraphQLResolveInfo
-) => AppResolverResult<Result>;
-
-export type AppResolverOf<Resolver, Parent, Context> = Resolver extends BasicResolver<
-  infer Result,
-  infer Args
->
-  ? AppResolver<Result, Parent, Args, Context>
-  : never;
-
-export type AppResolverWithFields<
-  Resolver,
-  Parent,
-  Context,
-  IncludedFields extends string
-> = AppResolverOf<SubsetResolverWithFields<Resolver, IncludedFields>, Parent, Context>;
-
-export type AppResolverWithoutFields<
-  Resolver,
-  Parent,
-  Context,
-  ExcludedFields extends string
-> = AppResolverOf<SubsetResolverWithoutFields<Resolver, ExcludedFields>, Parent, Context>;
diff --git a/x-pack/plugins/secops/common/graphql/types.ts b/x-pack/plugins/secops/common/graphql/types.ts
deleted file mode 100644
index 96dbb392b4df..000000000000
--- a/x-pack/plugins/secops/common/graphql/types.ts
+++ /dev/null
@@ -1,1209 +0,0 @@
-/* tslint:disable */
-/*
-     * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
-     * or more contributor license agreements. Licensed under the Elastic License;
-     * you may not use this file except in compliance with the Elastic License.
-     */
-
-import { GraphQLResolveInfo } from 'graphql';
-
-export type Resolver<Result, Parent = any, Context = any, Args = any> = (
-  parent: Parent,
-  args: Args,
-  context: Context,
-  info: GraphQLResolveInfo
-) => Promise<Result> | Result;
-
-export type SubscriptionResolver<Result, Parent = any, Context = any, Args = any> = {
-  subscribe<R = Result, P = Parent>(
-    parent: P,
-    args: Args,
-    context: Context,
-    info: GraphQLResolveInfo
-  ): AsyncIterator<R | Result>;
-  resolve?<R = Result, P = Parent>(
-    parent: P,
-    args: Args,
-    context: Context,
-    info: GraphQLResolveInfo
-  ): R | Result | Promise<R | Result>;
-};
-
-export interface Query {
-  source: Source /** Get a security data source by id */;
-  allSources: Source[] /** Get a list of all security data sources */;
-}
-
-export interface Source {
-  id: string /** The id of the source */;
-  configuration: SourceConfiguration /** The raw configuration of the source */;
-  status: SourceStatus /** The status of the source */;
-  getEvents?: EventsData | null /** Gets Suricata events based on timerange and specified criteria, or all events in the timerange if no criteria is specified */;
-  Hosts: HostsData /** Gets Hosts based on timerange and specified criteria, or all events in the timerange if no criteria is specified */;
-  UncommonProcesses: UncommonProcessesData /** Gets UncommonProcesses based on a timerange, or all UncommonProcesses if no criteria is specified */;
-  whoAmI?: SayMyName | null /** Just a simple example to get the app name */;
-}
-/** A set of configuration options for a security data source */
-export interface SourceConfiguration {
-  logAlias: string /** The alias to read file data from */;
-  auditbeatAlias: string /** The alias to read auditbeat data from */;
-  fields: SourceFields /** The field mapping to use for this source */;
-}
-/** A mapping of semantic fields to their document counterparts */
-export interface SourceFields {
-  container: string /** The field to identify a container by */;
-  host: string /** The fields to identify a host by */;
-  message: string[] /** The fields that may contain the log event message. The first field found win. */;
-  pod: string /** The field to identify a pod by */;
-  tiebreaker: string /** The field to use as a tiebreaker for log events that have identical timestamps */;
-  timestamp: string /** The field to use as a timestamp for metrics and logs */;
-}
-/** The status of an infrastructure data source */
-export interface SourceStatus {
-  auditbeatAliasExists: boolean /** Whether the configured auditbeat alias exists */;
-  auditbeatIndicesExist: boolean /** Whether the configured alias or wildcard pattern resolve to any auditbeat indices */;
-  auditbeatIndices: string[] /** The list of indices in the auditbeat alias */;
-  indexFields: IndexField[] /** The list of fields defined in the index mappings */;
-}
-/** A descriptor of a field in an index */
-export interface IndexField {
-  name: string /** The name of the field */;
-  type: string /** The type of the field's values as recognized by Kibana */;
-  searchable: boolean /** Whether the field's values can be efficiently searched for */;
-  aggregatable: boolean /** Whether the field's values can be aggregated */;
-}
-
-export interface EventsData {
-  kpiEventType: KpiItem[];
-  events: EventItem[];
-}
-
-export interface KpiItem {
-  value: string;
-  count: number;
-}
-
-export interface EventItem {
-  _id?: string | null;
-  destination?: DestinationEcsFields | null;
-  event?: EventEcsFields | null;
-  geo?: GeoEcsFields | null;
-  host?: HostEcsFields | null;
-  source?: SourceEcsFields | null;
-  suricata?: SuricataEcsFields | null;
-  timestamp?: string | null;
-}
-
-export interface DestinationEcsFields {
-  ip?: string | null;
-  port?: number | null;
-}
-
-export interface EventEcsFields {
-  category?: string | null;
-  id?: number | null;
-  module?: string | null;
-  severity?: number | null;
-  type?: string | null;
-}
-
-export interface GeoEcsFields {
-  country_iso_code?: string | null;
-  region_name?: string | null;
-}
-
-export interface HostEcsFields {
-  hostname?: string | null;
-  ip?: string | null;
-}
-
-export interface SourceEcsFields {
-  ip?: string | null;
-  port?: number | null;
-}
-
-export interface SuricataEcsFields {
-  eve?: SuricataEveData | null;
-}
-
-export interface SuricataEveData {
-  alert?: SuricataAlertData | null;
-  flow_id?: number | null;
-  proto?: string | null;
-}
-
-export interface SuricataAlertData {
-  signature?: string | null;
-  signature_id?: number | null;
-}
-
-export interface HostsData {
-  edges: HostsEdges[];
-  totalCount: number;
-  pageInfo: PageInfo;
-}
-
-export interface HostsEdges {
-  host: HostItem;
-  cursor: CursorType;
-}
-
-export interface HostItem {
-  _id?: string | null;
-  name?: string | null;
-  firstSeen?: string | null;
-  version?: string | null;
-  os?: string | null;
-}
-
-export interface CursorType {
-  value: string;
-  tiebreaker?: string | null;
-}
-
-export interface PageInfo {
-  endCursor?: CursorType | null;
-  hasNextPage?: boolean | null;
-}
-
-export interface UncommonProcessesData {
-  edges: UncommonProcessesEdges[];
-  totalCount: number;
-  pageInfo: PageInfo;
-}
-
-export interface UncommonProcessesEdges {
-  uncommonProcess: UncommonProcessItem;
-  cursor: CursorType;
-}
-
-export interface UncommonProcessItem {
-  _id: string;
-  name: string;
-  title?: string | null;
-  instances: number;
-  hosts?: (string | null)[] | null;
-}
-
-export interface SayMyName {
-  appName: string /** The id of the source */;
-}
-
-export interface TimerangeInput {
-  interval: string /** The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan. */;
-  to: number /** The end of the timerange */;
-  from: number /** The beginning of the timerange */;
-}
-
-export interface PaginationInput {
-  limit: number /** The limit parameter allows you to configure the maximum amount of items to be returned */;
-  cursor?: string | null /** The cursor parameter defines the next result you want to fetch */;
-  tiebreaker?:
-    | string
-    | null /** The tiebreaker parameter allow to be more precise to fetch the next item */;
-}
-export interface SourceQueryArgs {
-  id: string /** The id of the source */;
-}
-export interface GetEventsSourceArgs {
-  timerange: TimerangeInput;
-  filterQuery?: string | null;
-}
-export interface HostsSourceArgs {
-  timerange: TimerangeInput;
-  pagination: PaginationInput;
-  filterQuery?: string | null;
-}
-export interface UncommonProcessesSourceArgs {
-  timerange: TimerangeInput;
-  pagination: PaginationInput;
-  filterQuery?: string | null;
-}
-export interface IndexFieldsSourceStatusArgs {
-  indexType?: IndexType | null;
-}
-
-export enum IndexType {
-  ANY = 'ANY',
-  LOGS = 'LOGS',
-  AUDITBEAT = 'AUDITBEAT',
-}
-
-export namespace QueryResolvers {
-  export interface Resolvers<Context = any> {
-    source?: SourceResolver<Source, any, Context> /** Get a security data source by id */;
-    allSources?: AllSourcesResolver<
-      Source[],
-      any,
-      Context
-    > /** Get a list of all security data sources */;
-  }
-
-  export type SourceResolver<R = Source, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context,
-    SourceArgs
-  >;
-  export interface SourceArgs {
-    id: string /** The id of the source */;
-  }
-
-  export type AllSourcesResolver<R = Source[], Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace SourceResolvers {
-  export interface Resolvers<Context = any> {
-    id?: IdResolver<string, any, Context> /** The id of the source */;
-    configuration?: ConfigurationResolver<
-      SourceConfiguration,
-      any,
-      Context
-    > /** The raw configuration of the source */;
-    status?: StatusResolver<SourceStatus, any, Context> /** The status of the source */;
-    getEvents?: GetEventsResolver<
-      EventsData | null,
-      any,
-      Context
-    > /** Gets Suricata events based on timerange and specified criteria, or all events in the timerange if no criteria is specified */;
-    Hosts?: HostsResolver<
-      HostsData,
-      any,
-      Context
-    > /** Gets Hosts based on timerange and specified criteria, or all events in the timerange if no criteria is specified */;
-    UncommonProcesses?: UncommonProcessesResolver<
-      UncommonProcessesData,
-      any,
-      Context
-    > /** Gets UncommonProcesses based on a timerange, or all UncommonProcesses if no criteria is specified */;
-    whoAmI?: WhoAmIResolver<
-      SayMyName | null,
-      any,
-      Context
-    > /** Just a simple example to get the app name */;
-  }
-
-  export type IdResolver<R = string, Parent = any, Context = any> = Resolver<R, Parent, Context>;
-  export type ConfigurationResolver<
-    R = SourceConfiguration,
-    Parent = any,
-    Context = any
-  > = Resolver<R, Parent, Context>;
-  export type StatusResolver<R = SourceStatus, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type GetEventsResolver<R = EventsData | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context,
-    GetEventsArgs
-  >;
-  export interface GetEventsArgs {
-    timerange: TimerangeInput;
-    filterQuery?: string | null;
-  }
-
-  export type HostsResolver<R = HostsData, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context,
-    HostsArgs
-  >;
-  export interface HostsArgs {
-    timerange: TimerangeInput;
-    pagination: PaginationInput;
-    filterQuery?: string | null;
-  }
-
-  export type UncommonProcessesResolver<
-    R = UncommonProcessesData,
-    Parent = any,
-    Context = any
-  > = Resolver<R, Parent, Context, UncommonProcessesArgs>;
-  export interface UncommonProcessesArgs {
-    timerange: TimerangeInput;
-    pagination: PaginationInput;
-    filterQuery?: string | null;
-  }
-
-  export type WhoAmIResolver<R = SayMyName | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-/** A set of configuration options for a security data source */
-export namespace SourceConfigurationResolvers {
-  export interface Resolvers<Context = any> {
-    logAlias?: LogAliasResolver<string, any, Context> /** The alias to read file data from */;
-    auditbeatAlias?: AuditbeatAliasResolver<
-      string,
-      any,
-      Context
-    > /** The alias to read auditbeat data from */;
-    fields?: FieldsResolver<
-      SourceFields,
-      any,
-      Context
-    > /** The field mapping to use for this source */;
-  }
-
-  export type LogAliasResolver<R = string, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type AuditbeatAliasResolver<R = string, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type FieldsResolver<R = SourceFields, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-/** A mapping of semantic fields to their document counterparts */
-export namespace SourceFieldsResolvers {
-  export interface Resolvers<Context = any> {
-    container?: ContainerResolver<string, any, Context> /** The field to identify a container by */;
-    host?: HostResolver<string, any, Context> /** The fields to identify a host by */;
-    message?: MessageResolver<
-      string[],
-      any,
-      Context
-    > /** The fields that may contain the log event message. The first field found win. */;
-    pod?: PodResolver<string, any, Context> /** The field to identify a pod by */;
-    tiebreaker?: TiebreakerResolver<
-      string,
-      any,
-      Context
-    > /** The field to use as a tiebreaker for log events that have identical timestamps */;
-    timestamp?: TimestampResolver<
-      string,
-      any,
-      Context
-    > /** The field to use as a timestamp for metrics and logs */;
-  }
-
-  export type ContainerResolver<R = string, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type HostResolver<R = string, Parent = any, Context = any> = Resolver<R, Parent, Context>;
-  export type MessageResolver<R = string[], Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type PodResolver<R = string, Parent = any, Context = any> = Resolver<R, Parent, Context>;
-  export type TiebreakerResolver<R = string, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type TimestampResolver<R = string, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-/** The status of an infrastructure data source */
-export namespace SourceStatusResolvers {
-  export interface Resolvers<Context = any> {
-    auditbeatAliasExists?: AuditbeatAliasExistsResolver<
-      boolean,
-      any,
-      Context
-    > /** Whether the configured auditbeat alias exists */;
-    auditbeatIndicesExist?: AuditbeatIndicesExistResolver<
-      boolean,
-      any,
-      Context
-    > /** Whether the configured alias or wildcard pattern resolve to any auditbeat indices */;
-    auditbeatIndices?: AuditbeatIndicesResolver<
-      string[],
-      any,
-      Context
-    > /** The list of indices in the auditbeat alias */;
-    indexFields?: IndexFieldsResolver<
-      IndexField[],
-      any,
-      Context
-    > /** The list of fields defined in the index mappings */;
-  }
-
-  export type AuditbeatAliasExistsResolver<R = boolean, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type AuditbeatIndicesExistResolver<R = boolean, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type AuditbeatIndicesResolver<R = string[], Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type IndexFieldsResolver<R = IndexField[], Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context,
-    IndexFieldsArgs
-  >;
-  export interface IndexFieldsArgs {
-    indexType?: IndexType | null;
-  }
-}
-/** A descriptor of a field in an index */
-export namespace IndexFieldResolvers {
-  export interface Resolvers<Context = any> {
-    name?: NameResolver<string, any, Context> /** The name of the field */;
-    type?: TypeResolver<
-      string,
-      any,
-      Context
-    > /** The type of the field's values as recognized by Kibana */;
-    searchable?: SearchableResolver<
-      boolean,
-      any,
-      Context
-    > /** Whether the field's values can be efficiently searched for */;
-    aggregatable?: AggregatableResolver<
-      boolean,
-      any,
-      Context
-    > /** Whether the field's values can be aggregated */;
-  }
-
-  export type NameResolver<R = string, Parent = any, Context = any> = Resolver<R, Parent, Context>;
-  export type TypeResolver<R = string, Parent = any, Context = any> = Resolver<R, Parent, Context>;
-  export type SearchableResolver<R = boolean, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type AggregatableResolver<R = boolean, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace EventsDataResolvers {
-  export interface Resolvers<Context = any> {
-    kpiEventType?: KpiEventTypeResolver<KpiItem[], any, Context>;
-    events?: EventsResolver<EventItem[], any, Context>;
-  }
-
-  export type KpiEventTypeResolver<R = KpiItem[], Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type EventsResolver<R = EventItem[], Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace KpiItemResolvers {
-  export interface Resolvers<Context = any> {
-    value?: ValueResolver<string, any, Context>;
-    count?: CountResolver<number, any, Context>;
-  }
-
-  export type ValueResolver<R = string, Parent = any, Context = any> = Resolver<R, Parent, Context>;
-  export type CountResolver<R = number, Parent = any, Context = any> = Resolver<R, Parent, Context>;
-}
-
-export namespace EventItemResolvers {
-  export interface Resolvers<Context = any> {
-    _id?: IdResolver<string | null, any, Context>;
-    destination?: DestinationResolver<DestinationEcsFields | null, any, Context>;
-    event?: EventResolver<EventEcsFields | null, any, Context>;
-    geo?: GeoResolver<GeoEcsFields | null, any, Context>;
-    host?: HostResolver<HostEcsFields | null, any, Context>;
-    source?: SourceResolver<SourceEcsFields | null, any, Context>;
-    suricata?: SuricataResolver<SuricataEcsFields | null, any, Context>;
-    timestamp?: TimestampResolver<string | null, any, Context>;
-  }
-
-  export type IdResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type DestinationResolver<
-    R = DestinationEcsFields | null,
-    Parent = any,
-    Context = any
-  > = Resolver<R, Parent, Context>;
-  export type EventResolver<R = EventEcsFields | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type GeoResolver<R = GeoEcsFields | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type HostResolver<R = HostEcsFields | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type SourceResolver<R = SourceEcsFields | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type SuricataResolver<
-    R = SuricataEcsFields | null,
-    Parent = any,
-    Context = any
-  > = Resolver<R, Parent, Context>;
-  export type TimestampResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace DestinationEcsFieldsResolvers {
-  export interface Resolvers<Context = any> {
-    ip?: IpResolver<string | null, any, Context>;
-    port?: PortResolver<number | null, any, Context>;
-  }
-
-  export type IpResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type PortResolver<R = number | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace EventEcsFieldsResolvers {
-  export interface Resolvers<Context = any> {
-    category?: CategoryResolver<string | null, any, Context>;
-    id?: IdResolver<number | null, any, Context>;
-    module?: ModuleResolver<string | null, any, Context>;
-    severity?: SeverityResolver<number | null, any, Context>;
-    type?: TypeResolver<string | null, any, Context>;
-  }
-
-  export type CategoryResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type IdResolver<R = number | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type ModuleResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type SeverityResolver<R = number | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type TypeResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace GeoEcsFieldsResolvers {
-  export interface Resolvers<Context = any> {
-    country_iso_code?: CountryIsoCodeResolver<string | null, any, Context>;
-    region_name?: RegionNameResolver<string | null, any, Context>;
-  }
-
-  export type CountryIsoCodeResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type RegionNameResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace HostEcsFieldsResolvers {
-  export interface Resolvers<Context = any> {
-    hostname?: HostnameResolver<string | null, any, Context>;
-    ip?: IpResolver<string | null, any, Context>;
-  }
-
-  export type HostnameResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type IpResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace SourceEcsFieldsResolvers {
-  export interface Resolvers<Context = any> {
-    ip?: IpResolver<string | null, any, Context>;
-    port?: PortResolver<number | null, any, Context>;
-  }
-
-  export type IpResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type PortResolver<R = number | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace SuricataEcsFieldsResolvers {
-  export interface Resolvers<Context = any> {
-    eve?: EveResolver<SuricataEveData | null, any, Context>;
-  }
-
-  export type EveResolver<R = SuricataEveData | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace SuricataEveDataResolvers {
-  export interface Resolvers<Context = any> {
-    alert?: AlertResolver<SuricataAlertData | null, any, Context>;
-    flow_id?: FlowIdResolver<number | null, any, Context>;
-    proto?: ProtoResolver<string | null, any, Context>;
-  }
-
-  export type AlertResolver<R = SuricataAlertData | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type FlowIdResolver<R = number | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type ProtoResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace SuricataAlertDataResolvers {
-  export interface Resolvers<Context = any> {
-    signature?: SignatureResolver<string | null, any, Context>;
-    signature_id?: SignatureIdResolver<number | null, any, Context>;
-  }
-
-  export type SignatureResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type SignatureIdResolver<R = number | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace HostsDataResolvers {
-  export interface Resolvers<Context = any> {
-    edges?: EdgesResolver<HostsEdges[], any, Context>;
-    totalCount?: TotalCountResolver<number, any, Context>;
-    pageInfo?: PageInfoResolver<PageInfo, any, Context>;
-  }
-
-  export type EdgesResolver<R = HostsEdges[], Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type TotalCountResolver<R = number, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type PageInfoResolver<R = PageInfo, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace HostsEdgesResolvers {
-  export interface Resolvers<Context = any> {
-    host?: HostResolver<HostItem, any, Context>;
-    cursor?: CursorResolver<CursorType, any, Context>;
-  }
-
-  export type HostResolver<R = HostItem, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type CursorResolver<R = CursorType, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace HostItemResolvers {
-  export interface Resolvers<Context = any> {
-    _id?: IdResolver<string | null, any, Context>;
-    name?: NameResolver<string | null, any, Context>;
-    firstSeen?: FirstSeenResolver<string | null, any, Context>;
-    version?: VersionResolver<string | null, any, Context>;
-    os?: OsResolver<string | null, any, Context>;
-  }
-
-  export type IdResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type NameResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type FirstSeenResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type VersionResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type OsResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace CursorTypeResolvers {
-  export interface Resolvers<Context = any> {
-    value?: ValueResolver<string, any, Context>;
-    tiebreaker?: TiebreakerResolver<string | null, any, Context>;
-  }
-
-  export type ValueResolver<R = string, Parent = any, Context = any> = Resolver<R, Parent, Context>;
-  export type TiebreakerResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace PageInfoResolvers {
-  export interface Resolvers<Context = any> {
-    endCursor?: EndCursorResolver<CursorType | null, any, Context>;
-    hasNextPage?: HasNextPageResolver<boolean | null, any, Context>;
-  }
-
-  export type EndCursorResolver<R = CursorType | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type HasNextPageResolver<R = boolean | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace UncommonProcessesDataResolvers {
-  export interface Resolvers<Context = any> {
-    edges?: EdgesResolver<UncommonProcessesEdges[], any, Context>;
-    totalCount?: TotalCountResolver<number, any, Context>;
-    pageInfo?: PageInfoResolver<PageInfo, any, Context>;
-  }
-
-  export type EdgesResolver<R = UncommonProcessesEdges[], Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type TotalCountResolver<R = number, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type PageInfoResolver<R = PageInfo, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace UncommonProcessesEdgesResolvers {
-  export interface Resolvers<Context = any> {
-    uncommonProcess?: UncommonProcessResolver<UncommonProcessItem, any, Context>;
-    cursor?: CursorResolver<CursorType, any, Context>;
-  }
-
-  export type UncommonProcessResolver<
-    R = UncommonProcessItem,
-    Parent = any,
-    Context = any
-  > = Resolver<R, Parent, Context>;
-  export type CursorResolver<R = CursorType, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace UncommonProcessItemResolvers {
-  export interface Resolvers<Context = any> {
-    _id?: IdResolver<string, any, Context>;
-    name?: NameResolver<string, any, Context>;
-    title?: TitleResolver<string | null, any, Context>;
-    instances?: InstancesResolver<number, any, Context>;
-    hosts?: HostsResolver<(string | null)[] | null, any, Context>;
-  }
-
-  export type IdResolver<R = string, Parent = any, Context = any> = Resolver<R, Parent, Context>;
-  export type NameResolver<R = string, Parent = any, Context = any> = Resolver<R, Parent, Context>;
-  export type TitleResolver<R = string | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type InstancesResolver<R = number, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-  export type HostsResolver<R = (string | null)[] | null, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace SayMyNameResolvers {
-  export interface Resolvers<Context = any> {
-    appName?: AppNameResolver<string, any, Context> /** The id of the source */;
-  }
-
-  export type AppNameResolver<R = string, Parent = any, Context = any> = Resolver<
-    R,
-    Parent,
-    Context
-  >;
-}
-
-export namespace GetEventsQuery {
-  export type Variables = {
-    sourceId: string;
-    timerange: TimerangeInput;
-    filterQuery?: string | null;
-  };
-
-  export type Query = {
-    __typename?: 'Query';
-    source: Source;
-  };
-
-  export type Source = {
-    __typename?: 'Source';
-    id: string;
-    getEvents?: GetEvents | null;
-  };
-
-  export type GetEvents = {
-    __typename?: 'EventsData';
-    events: Events[];
-    kpiEventType: KpiEventType[];
-  };
-
-  export type Events = {
-    __typename?: 'EventItem';
-    _id?: string | null;
-    timestamp?: string | null;
-    event?: Event | null;
-    host?: Host | null;
-    source?: _Source | null;
-    destination?: Destination | null;
-    geo?: Geo | null;
-    suricata?: Suricata | null;
-  };
-
-  export type Event = {
-    __typename?: 'EventEcsFields';
-    type?: string | null;
-    severity?: number | null;
-    module?: string | null;
-    category?: string | null;
-    id?: number | null;
-  };
-
-  export type Host = {
-    __typename?: 'HostEcsFields';
-    hostname?: string | null;
-    ip?: string | null;
-  };
-
-  export type _Source = {
-    __typename?: 'SourceEcsFields';
-    ip?: string | null;
-    port?: number | null;
-  };
-
-  export type Destination = {
-    __typename?: 'DestinationEcsFields';
-    ip?: string | null;
-    port?: number | null;
-  };
-
-  export type Geo = {
-    __typename?: 'GeoEcsFields';
-    region_name?: string | null;
-    country_iso_code?: string | null;
-  };
-
-  export type Suricata = {
-    __typename?: 'SuricataEcsFields';
-    eve?: Eve | null;
-  };
-
-  export type Eve = {
-    __typename?: 'SuricataEveData';
-    proto?: string | null;
-    flow_id?: number | null;
-    alert?: Alert | null;
-  };
-
-  export type Alert = {
-    __typename?: 'SuricataAlertData';
-    signature?: string | null;
-    signature_id?: number | null;
-  };
-
-  export type KpiEventType = {
-    __typename?: 'KpiItem';
-    value: string;
-    count: number;
-  };
-}
-
-export namespace GetHostsQuery {
-  export type Variables = {
-    sourceId: string;
-    timerange: TimerangeInput;
-    pagination: PaginationInput;
-    filterQuery?: string | null;
-  };
-
-  export type Query = {
-    __typename?: 'Query';
-    source: Source;
-  };
-
-  export type Source = {
-    __typename?: 'Source';
-    id: string;
-    Hosts: Hosts;
-  };
-
-  export type Hosts = {
-    __typename?: 'HostsData';
-    totalCount: number;
-    edges: Edges[];
-    pageInfo: PageInfo;
-  };
-
-  export type Edges = {
-    __typename?: 'HostsEdges';
-    host: Host;
-    cursor: Cursor;
-  };
-
-  export type Host = {
-    __typename?: 'HostItem';
-    _id?: string | null;
-    name?: string | null;
-    os?: string | null;
-    version?: string | null;
-    firstSeen?: string | null;
-  };
-
-  export type Cursor = {
-    __typename?: 'CursorType';
-    value: string;
-  };
-
-  export type PageInfo = {
-    __typename?: 'PageInfo';
-    endCursor?: EndCursor | null;
-    hasNextPage?: boolean | null;
-  };
-
-  export type EndCursor = {
-    __typename?: 'CursorType';
-    value: string;
-  };
-}
-
-export namespace SourceQuery {
-  export type Variables = {
-    sourceId?: string | null;
-  };
-
-  export type Query = {
-    __typename?: 'Query';
-    source: Source;
-  };
-
-  export type Source = {
-    __typename?: 'Source';
-    id: string;
-    configuration: Configuration;
-    status: Status;
-  };
-
-  export type Configuration = {
-    __typename?: 'SourceConfiguration';
-    auditbeatAlias: string;
-    logAlias: string;
-  };
-
-  export type Status = {
-    __typename?: 'SourceStatus';
-    auditbeatIndicesExist: boolean;
-    auditbeatAliasExists: boolean;
-    auditbeatIndices: string[];
-    indexFields: IndexFields[];
-  };
-
-  export type IndexFields = {
-    __typename?: 'IndexField';
-    name: string;
-    searchable: boolean;
-    type: string;
-    aggregatable: boolean;
-  };
-}
-
-export namespace GetUncommonProcessesQuery {
-  export type Variables = {
-    sourceId: string;
-    timerange: TimerangeInput;
-    pagination: PaginationInput;
-    filterQuery?: string | null;
-  };
-
-  export type Query = {
-    __typename?: 'Query';
-    source: Source;
-  };
-
-  export type Source = {
-    __typename?: 'Source';
-    id: string;
-    UncommonProcesses: UncommonProcesses;
-  };
-
-  export type UncommonProcesses = {
-    __typename?: 'UncommonProcessesData';
-    totalCount: number;
-    edges: Edges[];
-    pageInfo: PageInfo;
-  };
-
-  export type Edges = {
-    __typename?: 'UncommonProcessesEdges';
-    uncommonProcess: UncommonProcess;
-    cursor: Cursor;
-  };
-
-  export type UncommonProcess = {
-    __typename?: 'UncommonProcessItem';
-    _id: string;
-    name: string;
-    title?: string | null;
-    instances: number;
-    hosts?: (string | null)[] | null;
-  };
-
-  export type Cursor = {
-    __typename?: 'CursorType';
-    value: string;
-  };
-
-  export type PageInfo = {
-    __typename?: 'PageInfo';
-    endCursor?: EndCursor | null;
-    hasNextPage?: boolean | null;
-  };
-
-  export type EndCursor = {
-    __typename?: 'CursorType';
-    value: string;
-  };
-}
-
-export namespace WhoAmIQuery {
-  export type Variables = {
-    sourceId: string;
-  };
-
-  export type Query = {
-    __typename?: 'Query';
-    source: Source;
-  };
-
-  export type Source = {
-    __typename?: 'Source';
-    whoAmI?: WhoAmI | null;
-  };
-
-  export type WhoAmI = {
-    __typename?: 'SayMyName';
-    appName: string;
-  };
-}
diff --git a/x-pack/plugins/secops/public/components/basic_table/index.tsx b/x-pack/plugins/secops/public/components/basic_table/index.tsx
index 55d5332c3b84..60eb7286bc98 100644
--- a/x-pack/plugins/secops/public/components/basic_table/index.tsx
+++ b/x-pack/plugins/secops/public/components/basic_table/index.tsx
@@ -8,7 +8,7 @@ import { EuiBasicTable, EuiTitle } from '@elastic/eui';
 import React from 'react';
 import styled from 'styled-components';
 
-import { EventItem } from '../../../common/graphql/types';
+import { EventItem } from '../../graphql/types';
 import { LoadingPanel } from '../loading';
 
 interface BasicTableProps {
diff --git a/x-pack/plugins/secops/public/components/load_more_table/index.mock.tsx b/x-pack/plugins/secops/public/components/load_more_table/index.mock.tsx
index ae1ff90731c0..f3b7d78d8516 100644
--- a/x-pack/plugins/secops/public/components/load_more_table/index.mock.tsx
+++ b/x-pack/plugins/secops/public/components/load_more_table/index.mock.tsx
@@ -6,7 +6,7 @@
 
 import { getOr } from 'lodash/fp';
 import React from 'react';
-import { HostItem } from '../../../common/graphql/types';
+import { HostItem } from '../../graphql/types';
 import { ItemsPerRow } from './index';
 
 export const mockData = {
diff --git a/x-pack/plugins/secops/public/components/page/hosts/events_table/index.tsx b/x-pack/plugins/secops/public/components/page/hosts/events_table/index.tsx
index db6f79f02542..b1e11e14f79b 100644
--- a/x-pack/plugins/secops/public/components/page/hosts/events_table/index.tsx
+++ b/x-pack/plugins/secops/public/components/page/hosts/events_table/index.tsx
@@ -7,8 +7,8 @@
 import { getOr, noop } from 'lodash/fp';
 import React from 'react';
 import { pure } from 'recompose';
-import { EventItem } from '../../../../../common/graphql/types';
 import { EventsQuery } from '../../../../containers/events';
+import { EventItem } from '../../../../graphql/types';
 import { BasicTable } from '../../../basic_table';
 import { DragEffects, DraggableWrapper } from '../../../drag_and_drop/draggable_wrapper';
 import { Provider } from '../../../timeline/data_providers/provider';
diff --git a/x-pack/plugins/secops/public/components/page/hosts/hosts_table/index.mock.ts b/x-pack/plugins/secops/public/components/page/hosts/hosts_table/index.mock.ts
index 7b3465323599..42dfd64e0f05 100644
--- a/x-pack/plugins/secops/public/components/page/hosts/hosts_table/index.mock.ts
+++ b/x-pack/plugins/secops/public/components/page/hosts/hosts_table/index.mock.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { HostsData } from '../../../../../common/graphql/types';
+import { HostsData } from '../../../../graphql/types';
 
 export const mockData: { Hosts: HostsData } = {
   Hosts: {
diff --git a/x-pack/plugins/secops/public/components/page/hosts/hosts_table/index.tsx b/x-pack/plugins/secops/public/components/page/hosts/hosts_table/index.tsx
index 20b7e10f4e4a..e0b4a86deebc 100644
--- a/x-pack/plugins/secops/public/components/page/hosts/hosts_table/index.tsx
+++ b/x-pack/plugins/secops/public/components/page/hosts/hosts_table/index.tsx
@@ -9,7 +9,7 @@ import { defaultTo } from 'lodash/fp';
 import React from 'react';
 import { connect } from 'react-redux';
 import { pure } from 'recompose';
-import { HostItem, HostsEdges } from '../../../../../common/graphql/types';
+import { HostItem, HostsEdges } from '../../../../graphql/types';
 import { hostsActions, hostsLimitSelector, State } from '../../../../store';
 import { ItemsPerRow, LoadMoreTable } from '../../../load_more_table';
 
diff --git a/x-pack/plugins/secops/public/components/page/hosts/uncommon_process_table/index.mock.ts b/x-pack/plugins/secops/public/components/page/hosts/uncommon_process_table/index.mock.ts
index 87dae8b5e329..6d4c4f5d4657 100644
--- a/x-pack/plugins/secops/public/components/page/hosts/uncommon_process_table/index.mock.ts
+++ b/x-pack/plugins/secops/public/components/page/hosts/uncommon_process_table/index.mock.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { UncommonProcessesData } from '../../../../../common/graphql/types';
+import { UncommonProcessesData } from '../../../../graphql/types';
 
 export const mockData: { UncommonProcess: UncommonProcessesData } = {
   UncommonProcess: {
diff --git a/x-pack/plugins/secops/public/components/page/hosts/uncommon_process_table/index.tsx b/x-pack/plugins/secops/public/components/page/hosts/uncommon_process_table/index.tsx
index 374a7e3805a5..f44b438572d4 100644
--- a/x-pack/plugins/secops/public/components/page/hosts/uncommon_process_table/index.tsx
+++ b/x-pack/plugins/secops/public/components/page/hosts/uncommon_process_table/index.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { connect } from 'react-redux';
 import { pure } from 'recompose';
 
-import { UncommonProcessesEdges, UncommonProcessItem } from '../../../../../common/graphql/types';
+import { UncommonProcessesEdges, UncommonProcessItem } from '../../../../graphql/types';
 import { hostsActions, State, uncommonProcessesLimitSelector } from '../../../../store';
 import { ItemsPerRow, LoadMoreTable } from '../../../load_more_table';
 
diff --git a/x-pack/plugins/secops/public/containers/events/index.tsx b/x-pack/plugins/secops/public/containers/events/index.tsx
index c82fcd9dcca0..05fb734a168d 100644
--- a/x-pack/plugins/secops/public/containers/events/index.tsx
+++ b/x-pack/plugins/secops/public/containers/events/index.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 import { Query } from 'react-apollo';
 import { pure } from 'recompose';
 
-import { EventItem, GetEventsQuery, KpiItem } from '../../../common/graphql/types';
+import { EventItem, GetEventsQuery, KpiItem } from '../../graphql/types';
 import { inputsModel } from '../../store';
 import { eventsQuery } from './index.gql_query';
 
diff --git a/x-pack/plugins/secops/public/containers/hosts/index.tsx b/x-pack/plugins/secops/public/containers/hosts/index.tsx
index 69c516290777..80fd1df1f51e 100644
--- a/x-pack/plugins/secops/public/containers/hosts/index.tsx
+++ b/x-pack/plugins/secops/public/containers/hosts/index.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 import { Query } from 'react-apollo';
 import { pure } from 'recompose';
 
-import { GetHostsQuery, HostsEdges, PageInfo } from '../../../common/graphql/types';
+import { GetHostsQuery, HostsEdges, PageInfo } from '../../graphql/types';
 
 import { connect } from 'react-redux';
 import { hostsLimitSelector, inputsModel, State } from '../../store';
diff --git a/x-pack/plugins/secops/public/containers/source/index.tsx b/x-pack/plugins/secops/public/containers/source/index.tsx
index 6ad8cade7b86..f1aa64755a4f 100644
--- a/x-pack/plugins/secops/public/containers/source/index.tsx
+++ b/x-pack/plugins/secops/public/containers/source/index.tsx
@@ -8,7 +8,7 @@ import { get } from 'lodash/fp';
 import React from 'react';
 import { Query } from 'react-apollo';
 
-import { SourceQuery } from '../../../common/graphql/types';
+import { SourceQuery } from '../../graphql/types';
 import { sourceQuery } from './index.gql_query';
 
 interface WithSourceArgs {
diff --git a/x-pack/plugins/secops/public/containers/uncommon_processes/index.tsx b/x-pack/plugins/secops/public/containers/uncommon_processes/index.tsx
index 429fe98c8b5c..c751f8ec9d49 100644
--- a/x-pack/plugins/secops/public/containers/uncommon_processes/index.tsx
+++ b/x-pack/plugins/secops/public/containers/uncommon_processes/index.tsx
@@ -9,11 +9,7 @@ import React from 'react';
 import { Query } from 'react-apollo';
 import { pure } from 'recompose';
 
-import {
-  GetUncommonProcessesQuery,
-  PageInfo,
-  UncommonProcessesEdges,
-} from '../../../common/graphql/types';
+import { GetUncommonProcessesQuery, PageInfo, UncommonProcessesEdges } from '../../graphql/types';
 
 import { connect } from 'react-redux';
 import { inputsModel, State } from '../../store';
diff --git a/x-pack/plugins/secops/public/containers/who_am_i/index.tsx b/x-pack/plugins/secops/public/containers/who_am_i/index.tsx
index c8553d7672a2..f8a67496adbc 100644
--- a/x-pack/plugins/secops/public/containers/who_am_i/index.tsx
+++ b/x-pack/plugins/secops/public/containers/who_am_i/index.tsx
@@ -8,7 +8,7 @@ import { getOr } from 'lodash/fp';
 import React from 'react';
 import { Query } from 'react-apollo';
 
-import { WhoAmIQuery } from '../../../common/graphql/types';
+import { WhoAmIQuery } from '../../graphql/types';
 
 import { whoAmIQuery } from './index.gql_query';
 
diff --git a/x-pack/plugins/secops/common/graphql/introspection.json b/x-pack/plugins/secops/public/graphql/introspection.json
similarity index 100%
rename from x-pack/plugins/secops/common/graphql/introspection.json
rename to x-pack/plugins/secops/public/graphql/introspection.json
diff --git a/x-pack/plugins/secops/public/graphql/types.ts b/x-pack/plugins/secops/public/graphql/types.ts
new file mode 100644
index 000000000000..da94d9724d9e
--- /dev/null
+++ b/x-pack/plugins/secops/public/graphql/types.ts
@@ -0,0 +1,664 @@
+/* tslint:disable */
+/*
+     * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+     * or more contributor license agreements. Licensed under the Elastic License;
+     * you may not use this file except in compliance with the Elastic License.
+     */
+
+// ====================================================
+// START: Typescript template
+// ====================================================
+
+// ====================================================
+// Types
+// ====================================================
+
+export interface Query {
+  /** Get a security data source by id */
+  source: Source;
+  /** Get a list of all security data sources */
+  allSources: Source[];
+}
+
+export interface Source {
+  /** The id of the source */
+  id: string;
+  /** The raw configuration of the source */
+  configuration: SourceConfiguration;
+  /** The status of the source */
+  status: SourceStatus;
+  /** Gets Suricata events based on timerange and specified criteria, or all events in the timerange if no criteria is specified */
+  getEvents?: EventsData | null;
+  /** Gets Hosts based on timerange and specified criteria, or all events in the timerange if no criteria is specified */
+  Hosts: HostsData;
+  /** Gets UncommonProcesses based on a timerange, or all UncommonProcesses if no criteria is specified */
+  UncommonProcesses: UncommonProcessesData;
+  /** Just a simple example to get the app name */
+  whoAmI?: SayMyName | null;
+}
+/** A set of configuration options for a security data source */
+export interface SourceConfiguration {
+  /** The alias to read file data from */
+  logAlias: string;
+  /** The alias to read auditbeat data from */
+  auditbeatAlias: string;
+  /** The field mapping to use for this source */
+  fields: SourceFields;
+}
+/** A mapping of semantic fields to their document counterparts */
+export interface SourceFields {
+  /** The field to identify a container by */
+  container: string;
+  /** The fields to identify a host by */
+  host: string;
+  /** The fields that may contain the log event message. The first field found win. */
+  message: string[];
+  /** The field to identify a pod by */
+  pod: string;
+  /** The field to use as a tiebreaker for log events that have identical timestamps */
+  tiebreaker: string;
+  /** The field to use as a timestamp for metrics and logs */
+  timestamp: string;
+}
+/** The status of an infrastructure data source */
+export interface SourceStatus {
+  /** Whether the configured auditbeat alias exists */
+  auditbeatAliasExists: boolean;
+  /** Whether the configured alias or wildcard pattern resolve to any auditbeat indices */
+  auditbeatIndicesExist: boolean;
+  /** The list of indices in the auditbeat alias */
+  auditbeatIndices: string[];
+  /** The list of fields defined in the index mappings */
+  indexFields: IndexField[];
+}
+/** A descriptor of a field in an index */
+export interface IndexField {
+  /** The name of the field */
+  name: string;
+  /** The type of the field's values as recognized by Kibana */
+  type: string;
+  /** Whether the field's values can be efficiently searched for */
+  searchable: boolean;
+  /** Whether the field's values can be aggregated */
+  aggregatable: boolean;
+}
+
+export interface EventsData {
+  kpiEventType: KpiItem[];
+
+  events: EventItem[];
+}
+
+export interface KpiItem {
+  value: string;
+
+  count: number;
+}
+
+export interface EventItem {
+  _id?: string | null;
+
+  destination?: DestinationEcsFields | null;
+
+  event?: EventEcsFields | null;
+
+  geo?: GeoEcsFields | null;
+
+  host?: HostEcsFields | null;
+
+  source?: SourceEcsFields | null;
+
+  suricata?: SuricataEcsFields | null;
+
+  timestamp?: string | null;
+}
+
+export interface DestinationEcsFields {
+  ip?: string | null;
+
+  port?: number | null;
+}
+
+export interface EventEcsFields {
+  category?: string | null;
+
+  id?: number | null;
+
+  module?: string | null;
+
+  severity?: number | null;
+
+  type?: string | null;
+}
+
+export interface GeoEcsFields {
+  country_iso_code?: string | null;
+
+  region_name?: string | null;
+}
+
+export interface HostEcsFields {
+  hostname?: string | null;
+
+  ip?: string | null;
+}
+
+export interface SourceEcsFields {
+  ip?: string | null;
+
+  port?: number | null;
+}
+
+export interface SuricataEcsFields {
+  eve?: SuricataEveData | null;
+}
+
+export interface SuricataEveData {
+  alert?: SuricataAlertData | null;
+
+  flow_id?: number | null;
+
+  proto?: string | null;
+}
+
+export interface SuricataAlertData {
+  signature?: string | null;
+
+  signature_id?: number | null;
+}
+
+export interface HostsData {
+  edges: HostsEdges[];
+
+  totalCount: number;
+
+  pageInfo: PageInfo;
+}
+
+export interface HostsEdges {
+  host: HostItem;
+
+  cursor: CursorType;
+}
+
+export interface HostItem {
+  _id?: string | null;
+
+  name?: string | null;
+
+  firstSeen?: string | null;
+
+  version?: string | null;
+
+  os?: string | null;
+}
+
+export interface CursorType {
+  value: string;
+
+  tiebreaker?: string | null;
+}
+
+export interface PageInfo {
+  endCursor?: CursorType | null;
+
+  hasNextPage?: boolean | null;
+}
+
+export interface UncommonProcessesData {
+  edges: UncommonProcessesEdges[];
+
+  totalCount: number;
+
+  pageInfo: PageInfo;
+}
+
+export interface UncommonProcessesEdges {
+  uncommonProcess: UncommonProcessItem;
+
+  cursor: CursorType;
+}
+
+export interface UncommonProcessItem {
+  _id: string;
+
+  name: string;
+
+  title?: string | null;
+
+  instances: number;
+
+  hosts?: (string | null)[] | null;
+}
+
+export interface SayMyName {
+  /** The id of the source */
+  appName: string;
+}
+
+// ====================================================
+// InputTypes
+// ====================================================
+
+export interface TimerangeInput {
+  /** The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan. */
+  interval: string;
+  /** The end of the timerange */
+  to: number;
+  /** The beginning of the timerange */
+  from: number;
+}
+
+export interface PaginationInput {
+  /** The limit parameter allows you to configure the maximum amount of items to be returned */
+  limit: number;
+  /** The cursor parameter defines the next result you want to fetch */
+  cursor?: string | null;
+  /** The tiebreaker parameter allow to be more precise to fetch the next item */
+  tiebreaker?: string | null;
+}
+
+// ====================================================
+// Arguments
+// ====================================================
+
+export interface SourceQueryArgs {
+  /** The id of the source */
+  id: string;
+}
+export interface GetEventsSourceArgs {
+  timerange: TimerangeInput;
+
+  filterQuery?: string | null;
+}
+export interface HostsSourceArgs {
+  timerange: TimerangeInput;
+
+  pagination: PaginationInput;
+
+  filterQuery?: string | null;
+}
+export interface UncommonProcessesSourceArgs {
+  timerange: TimerangeInput;
+
+  pagination: PaginationInput;
+
+  filterQuery?: string | null;
+}
+export interface IndexFieldsSourceStatusArgs {
+  indexType?: IndexType | null;
+}
+
+// ====================================================
+// Enums
+// ====================================================
+
+export enum IndexType {
+  ANY = 'ANY',
+  LOGS = 'LOGS',
+  AUDITBEAT = 'AUDITBEAT',
+}
+
+// ====================================================
+// END: Typescript template
+// ====================================================
+
+// ====================================================
+// Documents
+// ====================================================
+
+export namespace GetEventsQuery {
+  export type Variables = {
+    sourceId: string;
+    timerange: TimerangeInput;
+    filterQuery?: string | null;
+  };
+
+  export type Query = {
+    __typename?: 'Query';
+
+    source: Source;
+  };
+
+  export type Source = {
+    __typename?: 'Source';
+
+    id: string;
+
+    getEvents?: GetEvents | null;
+  };
+
+  export type GetEvents = {
+    __typename?: 'EventsData';
+
+    events: Events[];
+
+    kpiEventType: KpiEventType[];
+  };
+
+  export type Events = {
+    __typename?: 'EventItem';
+
+    _id?: string | null;
+
+    timestamp?: string | null;
+
+    event?: Event | null;
+
+    host?: Host | null;
+
+    source?: _Source | null;
+
+    destination?: Destination | null;
+
+    geo?: Geo | null;
+
+    suricata?: Suricata | null;
+  };
+
+  export type Event = {
+    __typename?: 'EventEcsFields';
+
+    type?: string | null;
+
+    severity?: number | null;
+
+    module?: string | null;
+
+    category?: string | null;
+
+    id?: number | null;
+  };
+
+  export type Host = {
+    __typename?: 'HostEcsFields';
+
+    hostname?: string | null;
+
+    ip?: string | null;
+  };
+
+  export type _Source = {
+    __typename?: 'SourceEcsFields';
+
+    ip?: string | null;
+
+    port?: number | null;
+  };
+
+  export type Destination = {
+    __typename?: 'DestinationEcsFields';
+
+    ip?: string | null;
+
+    port?: number | null;
+  };
+
+  export type Geo = {
+    __typename?: 'GeoEcsFields';
+
+    region_name?: string | null;
+
+    country_iso_code?: string | null;
+  };
+
+  export type Suricata = {
+    __typename?: 'SuricataEcsFields';
+
+    eve?: Eve | null;
+  };
+
+  export type Eve = {
+    __typename?: 'SuricataEveData';
+
+    proto?: string | null;
+
+    flow_id?: number | null;
+
+    alert?: Alert | null;
+  };
+
+  export type Alert = {
+    __typename?: 'SuricataAlertData';
+
+    signature?: string | null;
+
+    signature_id?: number | null;
+  };
+
+  export type KpiEventType = {
+    __typename?: 'KpiItem';
+
+    value: string;
+
+    count: number;
+  };
+}
+
+export namespace GetHostsQuery {
+  export type Variables = {
+    sourceId: string;
+    timerange: TimerangeInput;
+    pagination: PaginationInput;
+    filterQuery?: string | null;
+  };
+
+  export type Query = {
+    __typename?: 'Query';
+
+    source: Source;
+  };
+
+  export type Source = {
+    __typename?: 'Source';
+
+    id: string;
+
+    Hosts: Hosts;
+  };
+
+  export type Hosts = {
+    __typename?: 'HostsData';
+
+    totalCount: number;
+
+    edges: Edges[];
+
+    pageInfo: PageInfo;
+  };
+
+  export type Edges = {
+    __typename?: 'HostsEdges';
+
+    host: Host;
+
+    cursor: Cursor;
+  };
+
+  export type Host = {
+    __typename?: 'HostItem';
+
+    _id?: string | null;
+
+    name?: string | null;
+
+    os?: string | null;
+
+    version?: string | null;
+
+    firstSeen?: string | null;
+  };
+
+  export type Cursor = {
+    __typename?: 'CursorType';
+
+    value: string;
+  };
+
+  export type PageInfo = {
+    __typename?: 'PageInfo';
+
+    endCursor?: EndCursor | null;
+
+    hasNextPage?: boolean | null;
+  };
+
+  export type EndCursor = {
+    __typename?: 'CursorType';
+
+    value: string;
+  };
+}
+
+export namespace SourceQuery {
+  export type Variables = {
+    sourceId?: string | null;
+  };
+
+  export type Query = {
+    __typename?: 'Query';
+
+    source: Source;
+  };
+
+  export type Source = {
+    __typename?: 'Source';
+
+    id: string;
+
+    configuration: Configuration;
+
+    status: Status;
+  };
+
+  export type Configuration = {
+    __typename?: 'SourceConfiguration';
+
+    auditbeatAlias: string;
+
+    logAlias: string;
+  };
+
+  export type Status = {
+    __typename?: 'SourceStatus';
+
+    auditbeatIndicesExist: boolean;
+
+    auditbeatAliasExists: boolean;
+
+    auditbeatIndices: string[];
+
+    indexFields: IndexFields[];
+  };
+
+  export type IndexFields = {
+    __typename?: 'IndexField';
+
+    name: string;
+
+    searchable: boolean;
+
+    type: string;
+
+    aggregatable: boolean;
+  };
+}
+
+export namespace GetUncommonProcessesQuery {
+  export type Variables = {
+    sourceId: string;
+    timerange: TimerangeInput;
+    pagination: PaginationInput;
+    filterQuery?: string | null;
+  };
+
+  export type Query = {
+    __typename?: 'Query';
+
+    source: Source;
+  };
+
+  export type Source = {
+    __typename?: 'Source';
+
+    id: string;
+
+    UncommonProcesses: UncommonProcesses;
+  };
+
+  export type UncommonProcesses = {
+    __typename?: 'UncommonProcessesData';
+
+    totalCount: number;
+
+    edges: Edges[];
+
+    pageInfo: PageInfo;
+  };
+
+  export type Edges = {
+    __typename?: 'UncommonProcessesEdges';
+
+    uncommonProcess: UncommonProcess;
+
+    cursor: Cursor;
+  };
+
+  export type UncommonProcess = {
+    __typename?: 'UncommonProcessItem';
+
+    _id: string;
+
+    name: string;
+
+    title?: string | null;
+
+    instances: number;
+
+    hosts?: (string | null)[] | null;
+  };
+
+  export type Cursor = {
+    __typename?: 'CursorType';
+
+    value: string;
+  };
+
+  export type PageInfo = {
+    __typename?: 'PageInfo';
+
+    endCursor?: EndCursor | null;
+
+    hasNextPage?: boolean | null;
+  };
+
+  export type EndCursor = {
+    __typename?: 'CursorType';
+
+    value: string;
+  };
+}
+
+export namespace WhoAmIQuery {
+  export type Variables = {
+    sourceId: string;
+  };
+
+  export type Query = {
+    __typename?: 'Query';
+
+    source: Source;
+  };
+
+  export type Source = {
+    __typename?: 'Source';
+
+    whoAmI?: WhoAmI | null;
+  };
+
+  export type WhoAmI = {
+    __typename?: 'SayMyName';
+
+    appName: string;
+  };
+}
diff --git a/x-pack/plugins/secops/public/lib/compose/kibana_compose.ts b/x-pack/plugins/secops/public/lib/compose/kibana_compose.ts
index 5aa9c3c22066..15e95d8ebac6 100644
--- a/x-pack/plugins/secops/public/lib/compose/kibana_compose.ts
+++ b/x-pack/plugins/secops/public/lib/compose/kibana_compose.ts
@@ -15,7 +15,7 @@ import { timezoneProvider } from 'ui/vis/lib/timezone';
 
 import { AppKibanaObservableApiAdapter } from '../adapters/observable_api/kibana_observable_api';
 
-import introspectionQueryResultData from '../../../common/graphql/introspection.json';
+import introspectionQueryResultData from '../../graphql/introspection.json';
 import { AppKibanaFrameworkAdapter } from '../adapters/framework/kibana_framework_adapter';
 import { AppFrontendLibs } from '../lib';
 
diff --git a/x-pack/plugins/secops/public/pages/hosts/index.tsx b/x-pack/plugins/secops/public/pages/hosts/index.tsx
index 7fe2a0e9234d..0fcae8380449 100644
--- a/x-pack/plugins/secops/public/pages/hosts/index.tsx
+++ b/x-pack/plugins/secops/public/pages/hosts/index.tsx
@@ -9,7 +9,6 @@ import React from 'react';
 import { pure } from 'recompose';
 import chrome from 'ui/chrome';
 
-import { KpiItem } from '../../../common/graphql/types';
 import { EmptyPage } from '../../components/empty_page';
 import {
   EventsTable,
@@ -17,6 +16,7 @@ import {
   TypesBar,
   UncommonProcessTable,
 } from '../../components/page/hosts';
+import { KpiItem } from '../../graphql/types';
 
 import { manageQuery } from '../../components/page/manage_query';
 import { EventsQuery } from '../../containers/events';
diff --git a/x-pack/plugins/secops/scripts/generate_types_from_graphql.js b/x-pack/plugins/secops/scripts/generate_types_from_graphql.js
index f36979c15937..8466bd5d7ba7 100644
--- a/x-pack/plugins/secops/scripts/generate_types_from_graphql.js
+++ b/x-pack/plugins/secops/scripts/generate_types_from_graphql.js
@@ -10,19 +10,20 @@ const { generate } = require('graphql-code-generator');
 
 const GRAPHQL_GLOBS = [
   join('public', 'containers', '**', '*.gql_query.ts{,x}'),
-  join('public', 'store', '**', '*.gql_query.ts{,x}'),
   join('common', 'graphql', '**', '*.gql_query.ts{,x}'),
 ];
-const CONFIG_PATH = resolve(__dirname, 'gql_gen.json');
-const OUTPUT_INTROSPECTION_PATH = resolve('common', 'graphql', 'introspection.json');
-const OUTPUT_TYPES_PATH = resolve('common', 'graphql', 'types.ts');
+const CLIENT_CONFIG_PATH = resolve(__dirname, 'gql_gen_client.json');
+const SERVER_CONFIG_PATH = resolve(__dirname, 'gql_gen_server.json');
+const OUTPUT_INTROSPECTION_PATH = resolve('public', 'graphql', 'introspection.json');
+const OUTPUT_CLIENT_TYPES_PATH = resolve('public', 'graphql', 'types.ts');
+const OUTPUT_SERVER_TYPES_PATH = resolve('server', 'graphql', 'types.ts');
 const SCHEMA_PATH = resolve(__dirname, 'combined_schema.ts');
 
 async function main() {
   await generate(
     {
       args: GRAPHQL_GLOBS,
-      config: CONFIG_PATH,
+      config: SERVER_CONFIG_PATH,
       out: OUTPUT_INTROSPECTION_PATH,
       overwrite: true,
       require: ['ts-node/register'],
@@ -34,14 +35,25 @@ async function main() {
   await generate(
     {
       args: GRAPHQL_GLOBS,
-      config: CONFIG_PATH,
-      out: OUTPUT_TYPES_PATH,
+      config: CLIENT_CONFIG_PATH,
+      out: OUTPUT_CLIENT_TYPES_PATH,
       overwrite: true,
       schema: SCHEMA_PATH,
       template: 'graphql-codegen-typescript-template',
     },
     true
   );
+  await generate(
+    {
+      args: [],
+      config: SERVER_CONFIG_PATH,
+      out: OUTPUT_SERVER_TYPES_PATH,
+      overwrite: true,
+      schema: SCHEMA_PATH,
+      template: 'graphql-codegen-typescript-resolvers-template',
+    },
+    true
+  );
 }
 
 if (require.main === module) {
diff --git a/x-pack/plugins/secops/scripts/gql_gen.json b/x-pack/plugins/secops/scripts/gql_gen_client.json
similarity index 100%
rename from x-pack/plugins/secops/scripts/gql_gen.json
rename to x-pack/plugins/secops/scripts/gql_gen_client.json
diff --git a/x-pack/plugins/secops/scripts/gql_gen_server.json b/x-pack/plugins/secops/scripts/gql_gen_server.json
new file mode 100644
index 000000000000..603b62ff5b37
--- /dev/null
+++ b/x-pack/plugins/secops/scripts/gql_gen_server.json
@@ -0,0 +1,23 @@
+{
+  "flattenTypes": true,
+  "generatorConfig": {
+    "contextType": "SecOpsContext",
+    "prepend": [
+      "/*",
+      " * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one",
+      " * or more contributor license agreements. Licensed under the Elastic License;",
+      " * you may not use this file except in compliance with the Elastic License.",
+      " */",
+      "",
+      "import { SecOpsContext } from '../lib/types';"
+    ]
+  },
+  "primitives": {
+    "String": "string",
+    "Int": "number",
+    "Float": "number",
+    "Boolean": "boolean",
+    "ID": "string"
+  }
+}
+
diff --git a/x-pack/plugins/secops/server/graphql/events/resolvers.ts b/x-pack/plugins/secops/server/graphql/events/resolvers.ts
index 3f61fc406716..a0282c5c6121 100644
--- a/x-pack/plugins/secops/server/graphql/events/resolvers.ts
+++ b/x-pack/plugins/secops/server/graphql/events/resolvers.ts
@@ -4,19 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SourceResolvers } from '../../../common/graphql/types';
+import { SourceResolvers } from '../../graphql/types';
 import { Events } from '../../lib/events';
 import { EventsRequestOptions } from '../../lib/events/types';
-import { AppResolvedResult, AppResolverOf } from '../../lib/framework';
-import { Context } from '../../lib/types';
+import { AppResolverOf, ChildResolverOf } from '../../lib/framework';
 import { getFields } from '../../utils/build_query/fields';
 import { parseFilterQuery } from '../../utils/serialized_query';
 import { QuerySourceResolver } from '../sources/resolvers';
 
-type QueryEventsResolver = AppResolverOf<
-  SourceResolvers.GetEventsResolver,
-  AppResolvedResult<QuerySourceResolver>,
-  Context
+type QueryEventsResolver = ChildResolverOf<
+  AppResolverOf<SourceResolvers.GetEventsResolver>,
+  QuerySourceResolver
 >;
 
 interface EventsResolversDeps {
diff --git a/x-pack/plugins/secops/server/graphql/hosts/hosts.mock.ts b/x-pack/plugins/secops/server/graphql/hosts/hosts.mock.ts
index d7d3a2eae4f8..aa42b682755c 100644
--- a/x-pack/plugins/secops/server/graphql/hosts/hosts.mock.ts
+++ b/x-pack/plugins/secops/server/graphql/hosts/hosts.mock.ts
@@ -6,7 +6,7 @@
 
 import { FieldNode } from 'graphql';
 import { Logger } from '../../utils/logger';
-import { Context } from '../index';
+import { SecOpsContext } from '../index';
 
 /* tslint:disable */
 export const mockHostsData = {
@@ -49,7 +49,7 @@ export const mockHostsData = {
 /* tslint:enable */
 
 export const getHostsQueryMock = (logger: Logger) => ({
-  source: (root: unknown, args: unknown, context: Context) => {
+  source: (root: unknown, args: unknown, context: SecOpsContext) => {
     logger.info('Mock source');
     const operationName = context.req.payload.operationName.toLowerCase();
     switch (operationName) {
diff --git a/x-pack/plugins/secops/server/graphql/hosts/resolvers.test.ts b/x-pack/plugins/secops/server/graphql/hosts/resolvers.test.ts
index eaed24c91bc3..899266b01a2a 100644
--- a/x-pack/plugins/secops/server/graphql/hosts/resolvers.test.ts
+++ b/x-pack/plugins/secops/server/graphql/hosts/resolvers.test.ts
@@ -6,7 +6,7 @@
 import { GraphQLResolveInfo } from 'graphql';
 import { omit } from 'lodash/fp';
 
-import { Source } from '.../../../common/graphql/types';
+import { Source } from '../../graphql/types';
 import { FrameworkRequest, internalFrameworkRequest } from '../../lib/framework';
 import { Hosts } from '../../lib/hosts';
 import { HostsAdapter } from '../../lib/hosts/types';
@@ -63,7 +63,7 @@ const context = { req };
 describe('Test Source Resolvers', () => {
   test('Make sure that getHosts have been called', async () => {
     const source = await createSourcesResolvers(mockSrcLibs).Query.source(
-      null,
+      {},
       { id: 'default' },
       context,
       {} as GraphQLResolveInfo
diff --git a/x-pack/plugins/secops/server/graphql/hosts/resolvers.ts b/x-pack/plugins/secops/server/graphql/hosts/resolvers.ts
index dccac0bdcd0e..97d83c8cd514 100644
--- a/x-pack/plugins/secops/server/graphql/hosts/resolvers.ts
+++ b/x-pack/plugins/secops/server/graphql/hosts/resolvers.ts
@@ -5,19 +5,17 @@
  */
 
 import { getOr } from 'lodash/fp';
-import { SourceResolvers } from '../../../common/graphql/types';
-import { AppResolvedResult, AppResolverOf } from '../../lib/framework';
+import { SourceResolvers } from '../../graphql/types';
+import { AppResolverOf, ChildResolverOf } from '../../lib/framework';
 import { Hosts } from '../../lib/hosts';
 import { HostsRequestOptions } from '../../lib/hosts/types';
-import { Context } from '../../lib/types';
 import { getFields } from '../../utils/build_query/fields';
 import { parseFilterQuery } from '../../utils/serialized_query';
 import { QuerySourceResolver } from '../sources/resolvers';
 
-type QueryHostsResolver = AppResolverOf<
-  SourceResolvers.HostsResolver,
-  AppResolvedResult<QuerySourceResolver>,
-  Context
+type QueryHostsResolver = ChildResolverOf<
+  AppResolverOf<SourceResolvers.HostsResolver>,
+  QuerySourceResolver
 >;
 
 export interface HostsResolversDeps {
diff --git a/x-pack/plugins/secops/server/graphql/index.ts b/x-pack/plugins/secops/server/graphql/index.ts
index f88552d44b44..5f8ba6dd3166 100644
--- a/x-pack/plugins/secops/server/graphql/index.ts
+++ b/x-pack/plugins/secops/server/graphql/index.ts
@@ -31,7 +31,7 @@ export const schemas = [
 // stricter types here, but these should go away when graphql-tools using something
 // other than "any" in the future for its types.
 // https://github.com/apollographql/graphql-tools/blob/master/src/mock.ts#L406
-export interface Context {
+export interface SecOpsContext {
   req: {
     payload: {
       operationName: string;
diff --git a/x-pack/plugins/secops/server/graphql/source_status/resolvers.ts b/x-pack/plugins/secops/server/graphql/source_status/resolvers.ts
index 8cebac111595..307a1b1a05ea 100644
--- a/x-pack/plugins/secops/server/graphql/source_status/resolvers.ts
+++ b/x-pack/plugins/secops/server/graphql/source_status/resolvers.ts
@@ -4,35 +4,30 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IndexType, SourceStatusResolvers } from '../../../common/graphql/types';
-import { AppResolvedResult, AppResolverOf } from '../../lib/framework';
+import { IndexType, SourceStatusResolvers } from '../../graphql/types';
+import { AppResolverOf, ChildResolverOf } from '../../lib/framework';
 import { IndexFields } from '../../lib/index_fields';
 import { SourceStatus } from '../../lib/source_status';
-import { Context } from '../../lib/types';
 import { QuerySourceResolver } from '../sources/resolvers';
 
-export type SourceStatusAuditbeatAliasExistsResolver = AppResolverOf<
-  SourceStatusResolvers.AuditbeatAliasExistsResolver,
-  AppResolvedResult<QuerySourceResolver>,
-  Context
+export type SourceStatusAuditbeatAliasExistsResolver = ChildResolverOf<
+  AppResolverOf<SourceStatusResolvers.AuditbeatAliasExistsResolver>,
+  QuerySourceResolver
 >;
 
-export type SourceStatusAuditbeatIndicesExistResolver = AppResolverOf<
-  SourceStatusResolvers.AuditbeatIndicesExistResolver,
-  AppResolvedResult<QuerySourceResolver>,
-  Context
+export type SourceStatusAuditbeatIndicesExistResolver = ChildResolverOf<
+  AppResolverOf<SourceStatusResolvers.AuditbeatIndicesExistResolver>,
+  QuerySourceResolver
 >;
 
-export type SourceStatusAuditbeatIndicesResolver = AppResolverOf<
-  SourceStatusResolvers.AuditbeatIndicesResolver,
-  AppResolvedResult<QuerySourceResolver>,
-  Context
+export type SourceStatusAuditbeatIndicesResolver = ChildResolverOf<
+  AppResolverOf<SourceStatusResolvers.AuditbeatIndicesResolver>,
+  QuerySourceResolver
 >;
 
-export type SourceStatusIndexFieldsResolver = AppResolverOf<
-  SourceStatusResolvers.IndexFieldsResolver,
-  AppResolvedResult<QuerySourceResolver>,
-  Context
+export type SourceStatusIndexFieldsResolver = ChildResolverOf<
+  AppResolverOf<SourceStatusResolvers.IndexFieldsResolver>,
+  QuerySourceResolver
 >;
 
 export const createSourceStatusResolvers = (libs: {
diff --git a/x-pack/plugins/secops/server/graphql/sources/resolvers.test.ts b/x-pack/plugins/secops/server/graphql/sources/resolvers.test.ts
index 3420d831db2d..01d3f9b19b5f 100644
--- a/x-pack/plugins/secops/server/graphql/sources/resolvers.test.ts
+++ b/x-pack/plugins/secops/server/graphql/sources/resolvers.test.ts
@@ -58,7 +58,7 @@ const context = { req };
 describe('Test Source Resolvers', () => {
   test('Make sure that getConfiguration have been called', async () => {
     const data = await createSourcesResolvers(mockLibs).Query.source(
-      null,
+      {},
       { id: 'default' },
       context,
       {} as GraphQLResolveInfo
diff --git a/x-pack/plugins/secops/server/graphql/sources/resolvers.ts b/x-pack/plugins/secops/server/graphql/sources/resolvers.ts
index 7d62c210dcd2..f3cccfa15b56 100644
--- a/x-pack/plugins/secops/server/graphql/sources/resolvers.ts
+++ b/x-pack/plugins/secops/server/graphql/sources/resolvers.ts
@@ -4,31 +4,29 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { QueryResolvers, SourceResolvers } from '../../../common/graphql/types';
-import { AppResolvedResult, AppResolverWithFields } from '../../lib/framework';
+import { QueryResolvers, SourceResolvers } from '../../graphql/types';
+import {
+  AppResolverOf,
+  AppResolverWithFields,
+  ChildResolverOf,
+  ResultOf,
+} from '../../lib/framework';
 import { SourceStatus } from '../../lib/source_status';
 import { Sources } from '../../lib/sources';
-import { Context } from '../../lib/types';
 
 export type QuerySourceResolver = AppResolverWithFields<
   QueryResolvers.SourceResolver,
-  null,
-  Context,
   'id' | 'configuration'
 >;
 
 export type QueryAllSourcesResolver = AppResolverWithFields<
   QueryResolvers.AllSourcesResolver,
-  null,
-  Context,
   'id' | 'configuration'
 >;
 
-export type SourceStatusResolver = AppResolverWithFields<
-  SourceResolvers.StatusResolver,
-  AppResolvedResult<QuerySourceResolver>,
-  Context,
-  never
+export type SourceStatusResolver = ChildResolverOf<
+  AppResolverOf<SourceResolvers.StatusResolver<ResultOf<QuerySourceResolver>>>,
+  QuerySourceResolver
 >;
 
 export interface SourcesResolversDeps {
diff --git a/x-pack/plugins/secops/server/graphql/sources/source.mock.ts b/x-pack/plugins/secops/server/graphql/sources/source.mock.ts
index cdee12160763..3c0190c94b6a 100644
--- a/x-pack/plugins/secops/server/graphql/sources/source.mock.ts
+++ b/x-pack/plugins/secops/server/graphql/sources/source.mock.ts
@@ -5,7 +5,7 @@
  */
 
 import { Logger } from '../../utils/logger';
-import { Context } from '../index';
+import { SecOpsContext } from '../index';
 
 /* tslint:disable */
 export const mockSourceData = {
@@ -41,7 +41,7 @@ export const mockSourceData = {
 /* tslint:enable */
 
 export const getSourceQueryMock = (logger: Logger) => ({
-  source: (root: unknown, args: unknown, context: Context) => {
+  source: (root: unknown, args: unknown, context: SecOpsContext) => {
     logger.info('Mock source');
     const operationName = context.req.payload.operationName.toLowerCase();
     switch (operationName) {
diff --git a/x-pack/plugins/secops/server/graphql/sources/sources.mock.ts b/x-pack/plugins/secops/server/graphql/sources/sources.mock.ts
index e761b298d49a..8f4f771e7cf8 100644
--- a/x-pack/plugins/secops/server/graphql/sources/sources.mock.ts
+++ b/x-pack/plugins/secops/server/graphql/sources/sources.mock.ts
@@ -5,7 +5,7 @@
  */
 
 import { Logger } from '../../utils/logger';
-import { Context } from '../index';
+import { SecOpsContext } from '../index';
 import { mockSourceData } from './source.mock';
 
 /* tslint:disable */
@@ -16,7 +16,7 @@ export const sourcesDataMock =
 /* tslint:enable */
 
 export const getAllSourcesQueryMock = (logger: Logger) => ({
-  allSources: (root: unknown, args: unknown, context: Context) => {
+  allSources: (root: unknown, args: unknown, context: SecOpsContext) => {
     logger.info('Mock allSources');
     const operationName = context.req.payload.operationName.toLowerCase();
     switch (operationName) {
diff --git a/x-pack/plugins/secops/server/graphql/types.ts b/x-pack/plugins/secops/server/graphql/types.ts
new file mode 100644
index 000000000000..992e99895cb4
--- /dev/null
+++ b/x-pack/plugins/secops/server/graphql/types.ts
@@ -0,0 +1,1080 @@
+/* tslint:disable */
+/*
+     * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+     * or more contributor license agreements. Licensed under the Elastic License;
+     * you may not use this file except in compliance with the Elastic License.
+     */
+
+import { SecOpsContext } from '../lib/types';
+import { GraphQLResolveInfo } from 'graphql';
+
+export type Resolver<Result, Parent = any, Context = any, Args = never> = (
+  parent: Parent,
+  args: Args,
+  context: Context,
+  info: GraphQLResolveInfo
+) => Promise<Result> | Result;
+
+export interface ISubscriptionResolverObject<Result, Parent, Context, Args> {
+  subscribe<R = Result, P = Parent>(
+    parent: P,
+    args: Args,
+    context: Context,
+    info: GraphQLResolveInfo
+  ): AsyncIterator<R | Result>;
+  resolve?<R = Result, P = Parent>(
+    parent: P,
+    args: Args,
+    context: Context,
+    info: GraphQLResolveInfo
+  ): R | Result | Promise<R | Result>;
+}
+
+export type SubscriptionResolver<Result, Parent = any, Context = any, Args = never> =
+  | ((...args: any[]) => ISubscriptionResolverObject<Result, Parent, Context, Args>)
+  | ISubscriptionResolverObject<Result, Parent, Context, Args>;
+
+// ====================================================
+// START: Typescript template
+// ====================================================
+
+// ====================================================
+// Types
+// ====================================================
+
+export interface Query {
+  /** Get a security data source by id */
+  source: Source;
+  /** Get a list of all security data sources */
+  allSources: Source[];
+}
+
+export interface Source {
+  /** The id of the source */
+  id: string;
+  /** The raw configuration of the source */
+  configuration: SourceConfiguration;
+  /** The status of the source */
+  status: SourceStatus;
+  /** Gets Suricata events based on timerange and specified criteria, or all events in the timerange if no criteria is specified */
+  getEvents?: EventsData | null;
+  /** Gets Hosts based on timerange and specified criteria, or all events in the timerange if no criteria is specified */
+  Hosts: HostsData;
+  /** Gets UncommonProcesses based on a timerange, or all UncommonProcesses if no criteria is specified */
+  UncommonProcesses: UncommonProcessesData;
+  /** Just a simple example to get the app name */
+  whoAmI?: SayMyName | null;
+}
+/** A set of configuration options for a security data source */
+export interface SourceConfiguration {
+  /** The alias to read file data from */
+  logAlias: string;
+  /** The alias to read auditbeat data from */
+  auditbeatAlias: string;
+  /** The field mapping to use for this source */
+  fields: SourceFields;
+}
+/** A mapping of semantic fields to their document counterparts */
+export interface SourceFields {
+  /** The field to identify a container by */
+  container: string;
+  /** The fields to identify a host by */
+  host: string;
+  /** The fields that may contain the log event message. The first field found win. */
+  message: string[];
+  /** The field to identify a pod by */
+  pod: string;
+  /** The field to use as a tiebreaker for log events that have identical timestamps */
+  tiebreaker: string;
+  /** The field to use as a timestamp for metrics and logs */
+  timestamp: string;
+}
+/** The status of an infrastructure data source */
+export interface SourceStatus {
+  /** Whether the configured auditbeat alias exists */
+  auditbeatAliasExists: boolean;
+  /** Whether the configured alias or wildcard pattern resolve to any auditbeat indices */
+  auditbeatIndicesExist: boolean;
+  /** The list of indices in the auditbeat alias */
+  auditbeatIndices: string[];
+  /** The list of fields defined in the index mappings */
+  indexFields: IndexField[];
+}
+/** A descriptor of a field in an index */
+export interface IndexField {
+  /** The name of the field */
+  name: string;
+  /** The type of the field's values as recognized by Kibana */
+  type: string;
+  /** Whether the field's values can be efficiently searched for */
+  searchable: boolean;
+  /** Whether the field's values can be aggregated */
+  aggregatable: boolean;
+}
+
+export interface EventsData {
+  kpiEventType: KpiItem[];
+
+  events: EventItem[];
+}
+
+export interface KpiItem {
+  value: string;
+
+  count: number;
+}
+
+export interface EventItem {
+  _id?: string | null;
+
+  destination?: DestinationEcsFields | null;
+
+  event?: EventEcsFields | null;
+
+  geo?: GeoEcsFields | null;
+
+  host?: HostEcsFields | null;
+
+  source?: SourceEcsFields | null;
+
+  suricata?: SuricataEcsFields | null;
+
+  timestamp?: string | null;
+}
+
+export interface DestinationEcsFields {
+  ip?: string | null;
+
+  port?: number | null;
+}
+
+export interface EventEcsFields {
+  category?: string | null;
+
+  id?: number | null;
+
+  module?: string | null;
+
+  severity?: number | null;
+
+  type?: string | null;
+}
+
+export interface GeoEcsFields {
+  country_iso_code?: string | null;
+
+  region_name?: string | null;
+}
+
+export interface HostEcsFields {
+  hostname?: string | null;
+
+  ip?: string | null;
+}
+
+export interface SourceEcsFields {
+  ip?: string | null;
+
+  port?: number | null;
+}
+
+export interface SuricataEcsFields {
+  eve?: SuricataEveData | null;
+}
+
+export interface SuricataEveData {
+  alert?: SuricataAlertData | null;
+
+  flow_id?: number | null;
+
+  proto?: string | null;
+}
+
+export interface SuricataAlertData {
+  signature?: string | null;
+
+  signature_id?: number | null;
+}
+
+export interface HostsData {
+  edges: HostsEdges[];
+
+  totalCount: number;
+
+  pageInfo: PageInfo;
+}
+
+export interface HostsEdges {
+  host: HostItem;
+
+  cursor: CursorType;
+}
+
+export interface HostItem {
+  _id?: string | null;
+
+  name?: string | null;
+
+  firstSeen?: string | null;
+
+  version?: string | null;
+
+  os?: string | null;
+}
+
+export interface CursorType {
+  value: string;
+
+  tiebreaker?: string | null;
+}
+
+export interface PageInfo {
+  endCursor?: CursorType | null;
+
+  hasNextPage?: boolean | null;
+}
+
+export interface UncommonProcessesData {
+  edges: UncommonProcessesEdges[];
+
+  totalCount: number;
+
+  pageInfo: PageInfo;
+}
+
+export interface UncommonProcessesEdges {
+  uncommonProcess: UncommonProcessItem;
+
+  cursor: CursorType;
+}
+
+export interface UncommonProcessItem {
+  _id: string;
+
+  name: string;
+
+  title?: string | null;
+
+  instances: number;
+
+  hosts?: (string | null)[] | null;
+}
+
+export interface SayMyName {
+  /** The id of the source */
+  appName: string;
+}
+
+// ====================================================
+// InputTypes
+// ====================================================
+
+export interface TimerangeInput {
+  /** The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan. */
+  interval: string;
+  /** The end of the timerange */
+  to: number;
+  /** The beginning of the timerange */
+  from: number;
+}
+
+export interface PaginationInput {
+  /** The limit parameter allows you to configure the maximum amount of items to be returned */
+  limit: number;
+  /** The cursor parameter defines the next result you want to fetch */
+  cursor?: string | null;
+  /** The tiebreaker parameter allow to be more precise to fetch the next item */
+  tiebreaker?: string | null;
+}
+
+// ====================================================
+// Arguments
+// ====================================================
+
+export interface SourceQueryArgs {
+  /** The id of the source */
+  id: string;
+}
+export interface GetEventsSourceArgs {
+  timerange: TimerangeInput;
+
+  filterQuery?: string | null;
+}
+export interface HostsSourceArgs {
+  timerange: TimerangeInput;
+
+  pagination: PaginationInput;
+
+  filterQuery?: string | null;
+}
+export interface UncommonProcessesSourceArgs {
+  timerange: TimerangeInput;
+
+  pagination: PaginationInput;
+
+  filterQuery?: string | null;
+}
+export interface IndexFieldsSourceStatusArgs {
+  indexType?: IndexType | null;
+}
+
+// ====================================================
+// Enums
+// ====================================================
+
+export enum IndexType {
+  ANY = 'ANY',
+  LOGS = 'LOGS',
+  AUDITBEAT = 'AUDITBEAT',
+}
+
+// ====================================================
+// END: Typescript template
+// ====================================================
+
+// ====================================================
+// Resolvers
+// ====================================================
+
+export namespace QueryResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = never> {
+    /** Get a security data source by id */
+    source?: SourceResolver<Source, TypeParent, Context>;
+    /** Get a list of all security data sources */
+    allSources?: AllSourcesResolver<Source[], TypeParent, Context>;
+  }
+
+  export type SourceResolver<R = Source, Parent = never, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context,
+    SourceArgs
+  >;
+  export interface SourceArgs {
+    /** The id of the source */
+    id: string;
+  }
+
+  export type AllSourcesResolver<R = Source[], Parent = never, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+}
+
+export namespace SourceResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = Source> {
+    /** The id of the source */
+    id?: IdResolver<string, TypeParent, Context>;
+    /** The raw configuration of the source */
+    configuration?: ConfigurationResolver<SourceConfiguration, TypeParent, Context>;
+    /** The status of the source */
+    status?: StatusResolver<SourceStatus, TypeParent, Context>;
+    /** Gets Suricata events based on timerange and specified criteria, or all events in the timerange if no criteria is specified */
+    getEvents?: GetEventsResolver<EventsData | null, TypeParent, Context>;
+    /** Gets Hosts based on timerange and specified criteria, or all events in the timerange if no criteria is specified */
+    Hosts?: HostsResolver<HostsData, TypeParent, Context>;
+    /** Gets UncommonProcesses based on a timerange, or all UncommonProcesses if no criteria is specified */
+    UncommonProcesses?: UncommonProcessesResolver<UncommonProcessesData, TypeParent, Context>;
+    /** Just a simple example to get the app name */
+    whoAmI?: WhoAmIResolver<SayMyName | null, TypeParent, Context>;
+  }
+
+  export type IdResolver<R = string, Parent = Source, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type ConfigurationResolver<
+    R = SourceConfiguration,
+    Parent = Source,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type StatusResolver<R = SourceStatus, Parent = Source, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type GetEventsResolver<
+    R = EventsData | null,
+    Parent = Source,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context, GetEventsArgs>;
+  export interface GetEventsArgs {
+    timerange: TimerangeInput;
+
+    filterQuery?: string | null;
+  }
+
+  export type HostsResolver<R = HostsData, Parent = Source, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context,
+    HostsArgs
+  >;
+  export interface HostsArgs {
+    timerange: TimerangeInput;
+
+    pagination: PaginationInput;
+
+    filterQuery?: string | null;
+  }
+
+  export type UncommonProcessesResolver<
+    R = UncommonProcessesData,
+    Parent = Source,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context, UncommonProcessesArgs>;
+  export interface UncommonProcessesArgs {
+    timerange: TimerangeInput;
+
+    pagination: PaginationInput;
+
+    filterQuery?: string | null;
+  }
+
+  export type WhoAmIResolver<
+    R = SayMyName | null,
+    Parent = Source,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+/** A set of configuration options for a security data source */
+export namespace SourceConfigurationResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = SourceConfiguration> {
+    /** The alias to read file data from */
+    logAlias?: LogAliasResolver<string, TypeParent, Context>;
+    /** The alias to read auditbeat data from */
+    auditbeatAlias?: AuditbeatAliasResolver<string, TypeParent, Context>;
+    /** The field mapping to use for this source */
+    fields?: FieldsResolver<SourceFields, TypeParent, Context>;
+  }
+
+  export type LogAliasResolver<
+    R = string,
+    Parent = SourceConfiguration,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type AuditbeatAliasResolver<
+    R = string,
+    Parent = SourceConfiguration,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type FieldsResolver<
+    R = SourceFields,
+    Parent = SourceConfiguration,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+/** A mapping of semantic fields to their document counterparts */
+export namespace SourceFieldsResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = SourceFields> {
+    /** The field to identify a container by */
+    container?: ContainerResolver<string, TypeParent, Context>;
+    /** The fields to identify a host by */
+    host?: HostResolver<string, TypeParent, Context>;
+    /** The fields that may contain the log event message. The first field found win. */
+    message?: MessageResolver<string[], TypeParent, Context>;
+    /** The field to identify a pod by */
+    pod?: PodResolver<string, TypeParent, Context>;
+    /** The field to use as a tiebreaker for log events that have identical timestamps */
+    tiebreaker?: TiebreakerResolver<string, TypeParent, Context>;
+    /** The field to use as a timestamp for metrics and logs */
+    timestamp?: TimestampResolver<string, TypeParent, Context>;
+  }
+
+  export type ContainerResolver<
+    R = string,
+    Parent = SourceFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type HostResolver<R = string, Parent = SourceFields, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type MessageResolver<
+    R = string[],
+    Parent = SourceFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type PodResolver<R = string, Parent = SourceFields, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type TiebreakerResolver<
+    R = string,
+    Parent = SourceFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type TimestampResolver<
+    R = string,
+    Parent = SourceFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+/** The status of an infrastructure data source */
+export namespace SourceStatusResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = SourceStatus> {
+    /** Whether the configured auditbeat alias exists */
+    auditbeatAliasExists?: AuditbeatAliasExistsResolver<boolean, TypeParent, Context>;
+    /** Whether the configured alias or wildcard pattern resolve to any auditbeat indices */
+    auditbeatIndicesExist?: AuditbeatIndicesExistResolver<boolean, TypeParent, Context>;
+    /** The list of indices in the auditbeat alias */
+    auditbeatIndices?: AuditbeatIndicesResolver<string[], TypeParent, Context>;
+    /** The list of fields defined in the index mappings */
+    indexFields?: IndexFieldsResolver<IndexField[], TypeParent, Context>;
+  }
+
+  export type AuditbeatAliasExistsResolver<
+    R = boolean,
+    Parent = SourceStatus,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type AuditbeatIndicesExistResolver<
+    R = boolean,
+    Parent = SourceStatus,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type AuditbeatIndicesResolver<
+    R = string[],
+    Parent = SourceStatus,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type IndexFieldsResolver<
+    R = IndexField[],
+    Parent = SourceStatus,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context, IndexFieldsArgs>;
+  export interface IndexFieldsArgs {
+    indexType?: IndexType | null;
+  }
+}
+/** A descriptor of a field in an index */
+export namespace IndexFieldResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = IndexField> {
+    /** The name of the field */
+    name?: NameResolver<string, TypeParent, Context>;
+    /** The type of the field's values as recognized by Kibana */
+    type?: TypeResolver<string, TypeParent, Context>;
+    /** Whether the field's values can be efficiently searched for */
+    searchable?: SearchableResolver<boolean, TypeParent, Context>;
+    /** Whether the field's values can be aggregated */
+    aggregatable?: AggregatableResolver<boolean, TypeParent, Context>;
+  }
+
+  export type NameResolver<R = string, Parent = IndexField, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type TypeResolver<R = string, Parent = IndexField, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type SearchableResolver<
+    R = boolean,
+    Parent = IndexField,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type AggregatableResolver<
+    R = boolean,
+    Parent = IndexField,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace EventsDataResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = EventsData> {
+    kpiEventType?: KpiEventTypeResolver<KpiItem[], TypeParent, Context>;
+
+    events?: EventsResolver<EventItem[], TypeParent, Context>;
+  }
+
+  export type KpiEventTypeResolver<
+    R = KpiItem[],
+    Parent = EventsData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type EventsResolver<
+    R = EventItem[],
+    Parent = EventsData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace KpiItemResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = KpiItem> {
+    value?: ValueResolver<string, TypeParent, Context>;
+
+    count?: CountResolver<number, TypeParent, Context>;
+  }
+
+  export type ValueResolver<R = string, Parent = KpiItem, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type CountResolver<R = number, Parent = KpiItem, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+}
+
+export namespace EventItemResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = EventItem> {
+    _id?: IdResolver<string | null, TypeParent, Context>;
+
+    destination?: DestinationResolver<DestinationEcsFields | null, TypeParent, Context>;
+
+    event?: EventResolver<EventEcsFields | null, TypeParent, Context>;
+
+    geo?: GeoResolver<GeoEcsFields | null, TypeParent, Context>;
+
+    host?: HostResolver<HostEcsFields | null, TypeParent, Context>;
+
+    source?: SourceResolver<SourceEcsFields | null, TypeParent, Context>;
+
+    suricata?: SuricataResolver<SuricataEcsFields | null, TypeParent, Context>;
+
+    timestamp?: TimestampResolver<string | null, TypeParent, Context>;
+  }
+
+  export type IdResolver<R = string | null, Parent = EventItem, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type DestinationResolver<
+    R = DestinationEcsFields | null,
+    Parent = EventItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type EventResolver<
+    R = EventEcsFields | null,
+    Parent = EventItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type GeoResolver<
+    R = GeoEcsFields | null,
+    Parent = EventItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type HostResolver<
+    R = HostEcsFields | null,
+    Parent = EventItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type SourceResolver<
+    R = SourceEcsFields | null,
+    Parent = EventItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type SuricataResolver<
+    R = SuricataEcsFields | null,
+    Parent = EventItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type TimestampResolver<
+    R = string | null,
+    Parent = EventItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace DestinationEcsFieldsResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = DestinationEcsFields> {
+    ip?: IpResolver<string | null, TypeParent, Context>;
+
+    port?: PortResolver<number | null, TypeParent, Context>;
+  }
+
+  export type IpResolver<
+    R = string | null,
+    Parent = DestinationEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type PortResolver<
+    R = number | null,
+    Parent = DestinationEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace EventEcsFieldsResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = EventEcsFields> {
+    category?: CategoryResolver<string | null, TypeParent, Context>;
+
+    id?: IdResolver<number | null, TypeParent, Context>;
+
+    module?: ModuleResolver<string | null, TypeParent, Context>;
+
+    severity?: SeverityResolver<number | null, TypeParent, Context>;
+
+    type?: TypeResolver<string | null, TypeParent, Context>;
+  }
+
+  export type CategoryResolver<
+    R = string | null,
+    Parent = EventEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type IdResolver<
+    R = number | null,
+    Parent = EventEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type ModuleResolver<
+    R = string | null,
+    Parent = EventEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type SeverityResolver<
+    R = number | null,
+    Parent = EventEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type TypeResolver<
+    R = string | null,
+    Parent = EventEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace GeoEcsFieldsResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = GeoEcsFields> {
+    country_iso_code?: CountryIsoCodeResolver<string | null, TypeParent, Context>;
+
+    region_name?: RegionNameResolver<string | null, TypeParent, Context>;
+  }
+
+  export type CountryIsoCodeResolver<
+    R = string | null,
+    Parent = GeoEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type RegionNameResolver<
+    R = string | null,
+    Parent = GeoEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace HostEcsFieldsResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = HostEcsFields> {
+    hostname?: HostnameResolver<string | null, TypeParent, Context>;
+
+    ip?: IpResolver<string | null, TypeParent, Context>;
+  }
+
+  export type HostnameResolver<
+    R = string | null,
+    Parent = HostEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type IpResolver<
+    R = string | null,
+    Parent = HostEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace SourceEcsFieldsResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = SourceEcsFields> {
+    ip?: IpResolver<string | null, TypeParent, Context>;
+
+    port?: PortResolver<number | null, TypeParent, Context>;
+  }
+
+  export type IpResolver<
+    R = string | null,
+    Parent = SourceEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type PortResolver<
+    R = number | null,
+    Parent = SourceEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace SuricataEcsFieldsResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = SuricataEcsFields> {
+    eve?: EveResolver<SuricataEveData | null, TypeParent, Context>;
+  }
+
+  export type EveResolver<
+    R = SuricataEveData | null,
+    Parent = SuricataEcsFields,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace SuricataEveDataResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = SuricataEveData> {
+    alert?: AlertResolver<SuricataAlertData | null, TypeParent, Context>;
+
+    flow_id?: FlowIdResolver<number | null, TypeParent, Context>;
+
+    proto?: ProtoResolver<string | null, TypeParent, Context>;
+  }
+
+  export type AlertResolver<
+    R = SuricataAlertData | null,
+    Parent = SuricataEveData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type FlowIdResolver<
+    R = number | null,
+    Parent = SuricataEveData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type ProtoResolver<
+    R = string | null,
+    Parent = SuricataEveData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace SuricataAlertDataResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = SuricataAlertData> {
+    signature?: SignatureResolver<string | null, TypeParent, Context>;
+
+    signature_id?: SignatureIdResolver<number | null, TypeParent, Context>;
+  }
+
+  export type SignatureResolver<
+    R = string | null,
+    Parent = SuricataAlertData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type SignatureIdResolver<
+    R = number | null,
+    Parent = SuricataAlertData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace HostsDataResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = HostsData> {
+    edges?: EdgesResolver<HostsEdges[], TypeParent, Context>;
+
+    totalCount?: TotalCountResolver<number, TypeParent, Context>;
+
+    pageInfo?: PageInfoResolver<PageInfo, TypeParent, Context>;
+  }
+
+  export type EdgesResolver<
+    R = HostsEdges[],
+    Parent = HostsData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type TotalCountResolver<
+    R = number,
+    Parent = HostsData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type PageInfoResolver<
+    R = PageInfo,
+    Parent = HostsData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace HostsEdgesResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = HostsEdges> {
+    host?: HostResolver<HostItem, TypeParent, Context>;
+
+    cursor?: CursorResolver<CursorType, TypeParent, Context>;
+  }
+
+  export type HostResolver<R = HostItem, Parent = HostsEdges, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type CursorResolver<
+    R = CursorType,
+    Parent = HostsEdges,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace HostItemResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = HostItem> {
+    _id?: IdResolver<string | null, TypeParent, Context>;
+
+    name?: NameResolver<string | null, TypeParent, Context>;
+
+    firstSeen?: FirstSeenResolver<string | null, TypeParent, Context>;
+
+    version?: VersionResolver<string | null, TypeParent, Context>;
+
+    os?: OsResolver<string | null, TypeParent, Context>;
+  }
+
+  export type IdResolver<R = string | null, Parent = HostItem, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type NameResolver<
+    R = string | null,
+    Parent = HostItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type FirstSeenResolver<
+    R = string | null,
+    Parent = HostItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type VersionResolver<
+    R = string | null,
+    Parent = HostItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type OsResolver<R = string | null, Parent = HostItem, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+}
+
+export namespace CursorTypeResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = CursorType> {
+    value?: ValueResolver<string, TypeParent, Context>;
+
+    tiebreaker?: TiebreakerResolver<string | null, TypeParent, Context>;
+  }
+
+  export type ValueResolver<R = string, Parent = CursorType, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+  export type TiebreakerResolver<
+    R = string | null,
+    Parent = CursorType,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace PageInfoResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = PageInfo> {
+    endCursor?: EndCursorResolver<CursorType | null, TypeParent, Context>;
+
+    hasNextPage?: HasNextPageResolver<boolean | null, TypeParent, Context>;
+  }
+
+  export type EndCursorResolver<
+    R = CursorType | null,
+    Parent = PageInfo,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type HasNextPageResolver<
+    R = boolean | null,
+    Parent = PageInfo,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace UncommonProcessesDataResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = UncommonProcessesData> {
+    edges?: EdgesResolver<UncommonProcessesEdges[], TypeParent, Context>;
+
+    totalCount?: TotalCountResolver<number, TypeParent, Context>;
+
+    pageInfo?: PageInfoResolver<PageInfo, TypeParent, Context>;
+  }
+
+  export type EdgesResolver<
+    R = UncommonProcessesEdges[],
+    Parent = UncommonProcessesData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type TotalCountResolver<
+    R = number,
+    Parent = UncommonProcessesData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type PageInfoResolver<
+    R = PageInfo,
+    Parent = UncommonProcessesData,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace UncommonProcessesEdgesResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = UncommonProcessesEdges> {
+    uncommonProcess?: UncommonProcessResolver<UncommonProcessItem, TypeParent, Context>;
+
+    cursor?: CursorResolver<CursorType, TypeParent, Context>;
+  }
+
+  export type UncommonProcessResolver<
+    R = UncommonProcessItem,
+    Parent = UncommonProcessesEdges,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type CursorResolver<
+    R = CursorType,
+    Parent = UncommonProcessesEdges,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace UncommonProcessItemResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = UncommonProcessItem> {
+    _id?: IdResolver<string, TypeParent, Context>;
+
+    name?: NameResolver<string, TypeParent, Context>;
+
+    title?: TitleResolver<string | null, TypeParent, Context>;
+
+    instances?: InstancesResolver<number, TypeParent, Context>;
+
+    hosts?: HostsResolver<(string | null)[] | null, TypeParent, Context>;
+  }
+
+  export type IdResolver<
+    R = string,
+    Parent = UncommonProcessItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type NameResolver<
+    R = string,
+    Parent = UncommonProcessItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type TitleResolver<
+    R = string | null,
+    Parent = UncommonProcessItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type InstancesResolver<
+    R = number,
+    Parent = UncommonProcessItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+  export type HostsResolver<
+    R = (string | null)[] | null,
+    Parent = UncommonProcessItem,
+    Context = SecOpsContext
+  > = Resolver<R, Parent, Context>;
+}
+
+export namespace SayMyNameResolvers {
+  export interface Resolvers<Context = SecOpsContext, TypeParent = SayMyName> {
+    /** The id of the source */
+    appName?: AppNameResolver<string, TypeParent, Context>;
+  }
+
+  export type AppNameResolver<R = string, Parent = SayMyName, Context = SecOpsContext> = Resolver<
+    R,
+    Parent,
+    Context
+  >;
+}
diff --git a/x-pack/plugins/secops/server/graphql/uncommon_processes/resolvers.test.ts b/x-pack/plugins/secops/server/graphql/uncommon_processes/resolvers.test.ts
index 8d6aa19431fc..7dec747df6a6 100644
--- a/x-pack/plugins/secops/server/graphql/uncommon_processes/resolvers.test.ts
+++ b/x-pack/plugins/secops/server/graphql/uncommon_processes/resolvers.test.ts
@@ -6,7 +6,7 @@
 import { GraphQLResolveInfo } from 'graphql';
 import { omit } from 'lodash/fp';
 
-import { Source } from '.../../../common/graphql/types';
+import { Source } from '../../graphql/types';
 import { FrameworkRequest, internalFrameworkRequest } from '../../lib/framework';
 import { SourceStatus } from '../../lib/source_status';
 import { Sources } from '../../lib/sources';
@@ -63,7 +63,7 @@ const context = { req };
 describe('Test Source Resolvers', () => {
   test('Make sure that getUncommonProcesses have been called', async () => {
     const source = await createSourcesResolvers(mockSrcLibs).Query.source(
-      null,
+      {},
       { id: 'default' },
       context,
       {} as GraphQLResolveInfo
diff --git a/x-pack/plugins/secops/server/graphql/uncommon_processes/resolvers.ts b/x-pack/plugins/secops/server/graphql/uncommon_processes/resolvers.ts
index b9584360d954..7b22ac4f6449 100644
--- a/x-pack/plugins/secops/server/graphql/uncommon_processes/resolvers.ts
+++ b/x-pack/plugins/secops/server/graphql/uncommon_processes/resolvers.ts
@@ -5,19 +5,17 @@
  */
 
 import { getOr } from 'lodash/fp';
-import { SourceResolvers } from '../../../common/graphql/types';
-import { AppResolvedResult, AppResolverOf } from '../../lib/framework';
-import { Context } from '../../lib/types';
+import { SourceResolvers } from '../../graphql/types';
+import { AppResolverOf, ChildResolverOf } from '../../lib/framework';
 import { UncommonProcesses } from '../../lib/uncommon_processes';
 import { UncommonProcessesRequestOptions } from '../../lib/uncommon_processes/types';
 import { getFields } from '../../utils/build_query/fields';
 import { parseFilterQuery } from '../../utils/serialized_query';
 import { QuerySourceResolver } from '../sources/resolvers';
 
-type QueryUncommonProcessesResolver = AppResolverOf<
-  SourceResolvers.UncommonProcessesResolver,
-  AppResolvedResult<QuerySourceResolver>,
-  Context
+type QueryUncommonProcessesResolver = ChildResolverOf<
+  AppResolverOf<SourceResolvers.UncommonProcessesResolver>,
+  QuerySourceResolver
 >;
 
 export interface UncommonProcessesResolversDeps {
diff --git a/x-pack/plugins/secops/server/graphql/uncommon_processes/uncommon_processes.mock.ts b/x-pack/plugins/secops/server/graphql/uncommon_processes/uncommon_processes.mock.ts
index cb38bd63c75c..b814542088f2 100644
--- a/x-pack/plugins/secops/server/graphql/uncommon_processes/uncommon_processes.mock.ts
+++ b/x-pack/plugins/secops/server/graphql/uncommon_processes/uncommon_processes.mock.ts
@@ -6,7 +6,7 @@
 
 import { FieldNode } from 'graphql';
 import { Logger } from '../../utils/logger';
-import { Context } from '../index';
+import { SecOpsContext } from '../index';
 
 /* tslint:disable */
 export const mockUncommonProcessesData = {
@@ -49,7 +49,7 @@ export const mockUncommonProcessesData = {
 /* tslint:enable */
 
 export const getUncommonProcessesQueryMock = (logger: Logger) => ({
-  source: (root: unknown, args: unknown, context: Context) => {
+  source: (root: unknown, args: unknown, context: SecOpsContext) => {
     logger.info('Mock source');
     const operationName = context.req.payload.operationName.toLowerCase();
     switch (operationName) {
diff --git a/x-pack/plugins/secops/server/graphql/who_am_i/resolvers.ts b/x-pack/plugins/secops/server/graphql/who_am_i/resolvers.ts
index a1718cd1d212..904daa5dc304 100644
--- a/x-pack/plugins/secops/server/graphql/who_am_i/resolvers.ts
+++ b/x-pack/plugins/secops/server/graphql/who_am_i/resolvers.ts
@@ -4,15 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SourceResolvers } from '../../../common/graphql/types';
-import { AppResolvedResult, AppResolverOf } from '../../lib/framework';
-import { Context } from '../../lib/types';
+import { SourceResolvers } from '../../graphql/types';
+import { AppResolverOf, ChildResolverOf } from '../../lib/framework';
 import { QuerySourceResolver } from '../sources/resolvers';
 
-export type QueryWhoAmIResolver = AppResolverOf<
-  SourceResolvers.WhoAmIResolver,
-  AppResolvedResult<QuerySourceResolver>,
-  Context
+export type QueryWhoAmIResolver = ChildResolverOf<
+  AppResolverOf<SourceResolvers.WhoAmIResolver>,
+  QuerySourceResolver
 >;
 
 export const createWhoAmIResolvers = (): {
diff --git a/x-pack/plugins/secops/server/lib/events/elasticsearch_adapter.ts b/x-pack/plugins/secops/server/lib/events/elasticsearch_adapter.ts
index a332493a136f..351a6c1c2d36 100644
--- a/x-pack/plugins/secops/server/lib/events/elasticsearch_adapter.ts
+++ b/x-pack/plugins/secops/server/lib/events/elasticsearch_adapter.ts
@@ -5,7 +5,7 @@
  */
 
 import { get, has, merge } from 'lodash/fp';
-import { EventItem, EventsData, KpiItem } from '../../../common/graphql/types';
+import { EventItem, EventsData, KpiItem } from '../../graphql/types';
 import { FrameworkAdapter, FrameworkRequest } from '../framework';
 import { TermAggregation } from '../types';
 import { buildQuery, eventFieldsMap } from './query.dsl';
diff --git a/x-pack/plugins/secops/server/lib/events/index.ts b/x-pack/plugins/secops/server/lib/events/index.ts
index dca586f99b08..d6c5ca32b08e 100644
--- a/x-pack/plugins/secops/server/lib/events/index.ts
+++ b/x-pack/plugins/secops/server/lib/events/index.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EventsData } from '../../../common/graphql/types';
+import { EventsData } from '../../graphql/types';
 import { FrameworkRequest } from '../framework';
 export * from './elasticsearch_adapter';
 import { EventsAdapter, EventsRequestOptions } from './types';
diff --git a/x-pack/plugins/secops/server/lib/events/types.ts b/x-pack/plugins/secops/server/lib/events/types.ts
index 542ff5a7ce72..5a7572aa767e 100644
--- a/x-pack/plugins/secops/server/lib/events/types.ts
+++ b/x-pack/plugins/secops/server/lib/events/types.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EventsData, SourceConfiguration, TimerangeInput } from '../../../common/graphql/types';
+import { EventsData, SourceConfiguration, TimerangeInput } from '../../graphql/types';
 import { FrameworkRequest } from '../framework';
 import { ESQuery, SearchHit } from '../types';
 
diff --git a/x-pack/plugins/secops/server/lib/framework/kibana_framework_adapter.ts b/x-pack/plugins/secops/server/lib/framework/kibana_framework_adapter.ts
index aa67be898586..61b18b316377 100644
--- a/x-pack/plugins/secops/server/lib/framework/kibana_framework_adapter.ts
+++ b/x-pack/plugins/secops/server/lib/framework/kibana_framework_adapter.ts
@@ -7,6 +7,8 @@
 import { GraphQLSchema } from 'graphql';
 import { Request, Server } from 'hapi';
 
+import { GenericParams } from 'elasticsearch';
+import { Legacy } from 'kibana';
 import {
   graphiqlHapi,
   graphqlHapi,
@@ -21,15 +23,6 @@ import {
   WrappableRequest,
 } from './types';
 
-declare module 'hapi' {
-  interface PluginProperties {
-    // tslint:disable-next-line:no-any
-    elasticsearch: any;
-    // tslint:disable-next-line:no-any
-    kibana: any;
-  }
-}
-
 export class KibanaBackendFrameworkAdapter implements FrameworkAdapter {
   public version: string;
   private server: Server;
@@ -40,11 +33,17 @@ export class KibanaBackendFrameworkAdapter implements FrameworkAdapter {
   }
 
   // tslint:disable-next-line:no-any
-  public async callWithRequest(req: FrameworkRequest<Request>, ...rest: any[]) {
+  public async callWithRequest(
+    req: FrameworkRequest<Legacy.Request>,
+    endpoint: string,
+    params: GenericParams,
+    // tslint:disable-next-line:no-any
+    ...rest: any[]
+  ) {
     const internalRequest = req[internalFrameworkRequest];
     const { elasticsearch } = internalRequest.server.plugins;
     const { callWithRequest } = elasticsearch.getCluster('data');
-    const fields = await callWithRequest(internalRequest, ...rest);
+    const fields = await callWithRequest(internalRequest, endpoint, params, ...rest);
     return fields;
   }
 
@@ -92,11 +91,11 @@ export class KibanaBackendFrameworkAdapter implements FrameworkAdapter {
     }
     return this.server.indexPatternsServiceFactory({
       // tslint:disable-next-line:no-any
-      callCluster: async (method: string, args: [object], ...rest: any[]) => {
+      callCluster: async (method: string, args: [GenericParams], ...rest: any[]) => {
         const fieldCaps = await this.callWithRequest(
           request,
           method,
-          { ...args, allowNoIndices: true },
+          { ...args, allowNoIndices: true } as GenericParams,
           ...rest
         );
         return fieldCaps;
diff --git a/x-pack/plugins/secops/server/lib/framework/types.ts b/x-pack/plugins/secops/server/lib/framework/types.ts
index 98be0563b4b7..464bcbe883b1 100644
--- a/x-pack/plugins/secops/server/lib/framework/types.ts
+++ b/x-pack/plugins/secops/server/lib/framework/types.ts
@@ -6,7 +6,7 @@
 
 import { GraphQLSchema } from 'graphql';
 
-export * from '../../../common/graphql/typed_resolvers';
+export * from '../../utils/typed_resolvers';
 
 export const internalFrameworkRequest = Symbol('internalFrameworkRequest');
 
diff --git a/x-pack/plugins/secops/server/lib/hosts/elasticsearch_adapter.ts b/x-pack/plugins/secops/server/lib/hosts/elasticsearch_adapter.ts
index ad94b73ebcec..06adc4e0a1c8 100644
--- a/x-pack/plugins/secops/server/lib/hosts/elasticsearch_adapter.ts
+++ b/x-pack/plugins/secops/server/lib/hosts/elasticsearch_adapter.ts
@@ -5,7 +5,7 @@
  */
 
 import { get, getOr, head } from 'lodash/fp';
-import { HostsData, HostsEdges } from '../../../common/graphql/types';
+import { HostsData, HostsEdges } from '../../graphql/types';
 import { mergeFieldsWithHit } from '../../utils/build_query';
 import { FrameworkAdapter, FrameworkRequest } from '../framework';
 import { TermAggregation } from '../types';
diff --git a/x-pack/plugins/secops/server/lib/hosts/index.ts b/x-pack/plugins/secops/server/lib/hosts/index.ts
index 0adeccda4551..587b4d508df4 100644
--- a/x-pack/plugins/secops/server/lib/hosts/index.ts
+++ b/x-pack/plugins/secops/server/lib/hosts/index.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { HostsData } from '../../../common/graphql/types';
+import { HostsData } from '../../graphql/types';
 import { FrameworkRequest } from '../framework';
 export * from './elasticsearch_adapter';
 import { HostsAdapter, HostsRequestOptions } from './types';
diff --git a/x-pack/plugins/secops/server/lib/hosts/types.ts b/x-pack/plugins/secops/server/lib/hosts/types.ts
index 70f8a1eed692..6b50debcb92e 100644
--- a/x-pack/plugins/secops/server/lib/hosts/types.ts
+++ b/x-pack/plugins/secops/server/lib/hosts/types.ts
@@ -9,7 +9,7 @@ import {
   PaginationInput,
   SourceConfiguration,
   TimerangeInput,
-} from '../../../common/graphql/types';
+} from '../../graphql/types';
 import { FrameworkRequest } from '../framework';
 import { ESQuery, SearchHit } from '../types';
 
diff --git a/x-pack/plugins/secops/server/lib/index_fields/elasticsearch_adapter.ts b/x-pack/plugins/secops/server/lib/index_fields/elasticsearch_adapter.ts
index 543826c3916f..9cf01b4e1438 100644
--- a/x-pack/plugins/secops/server/lib/index_fields/elasticsearch_adapter.ts
+++ b/x-pack/plugins/secops/server/lib/index_fields/elasticsearch_adapter.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IndexField } from '../../../common/graphql/types';
+import { IndexField } from '../../graphql/types';
 import { FrameworkAdapter, FrameworkRequest } from '../framework';
 import { FieldsAdapter } from './types';
 
diff --git a/x-pack/plugins/secops/server/lib/index_fields/index.ts b/x-pack/plugins/secops/server/lib/index_fields/index.ts
index b52a58988923..38cc1a30ee1b 100644
--- a/x-pack/plugins/secops/server/lib/index_fields/index.ts
+++ b/x-pack/plugins/secops/server/lib/index_fields/index.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IndexField, IndexType } from '../../../common/graphql/types';
+import { IndexField, IndexType } from '../../graphql/types';
 import { FrameworkRequest } from '../framework';
 import { Sources } from '../sources';
 import { FieldsAdapter } from './types';
diff --git a/x-pack/plugins/secops/server/lib/index_fields/types.ts b/x-pack/plugins/secops/server/lib/index_fields/types.ts
index e0b89027d64c..d8bc4c388055 100644
--- a/x-pack/plugins/secops/server/lib/index_fields/types.ts
+++ b/x-pack/plugins/secops/server/lib/index_fields/types.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IndexField, IndexType } from '../../../common/graphql/types';
+import { IndexField, IndexType } from '../../graphql/types';
 import { FrameworkRequest } from '../framework';
 
 export interface FieldsAdapter {
diff --git a/x-pack/plugins/secops/server/lib/types.ts b/x-pack/plugins/secops/server/lib/types.ts
index 21cdcd9ea763..d8c4a9211e55 100644
--- a/x-pack/plugins/secops/server/lib/types.ts
+++ b/x-pack/plugins/secops/server/lib/types.ts
@@ -37,7 +37,7 @@ export interface Configuration {
   sources: SourceConfigurations;
 }
 
-export interface Context {
+export interface SecOpsContext {
   req: FrameworkRequest;
 }
 
@@ -123,3 +123,8 @@ export interface TermAggregation {
     }>;
   };
 }
+
+export interface TotalHit {
+  value: number;
+  relation: string;
+}
diff --git a/x-pack/plugins/secops/server/lib/uncommon_processes/elastic_adapter.test.ts b/x-pack/plugins/secops/server/lib/uncommon_processes/elastic_adapter.test.ts
index aab334091d73..af828190143f 100644
--- a/x-pack/plugins/secops/server/lib/uncommon_processes/elastic_adapter.test.ts
+++ b/x-pack/plugins/secops/server/lib/uncommon_processes/elastic_adapter.test.ts
@@ -16,7 +16,10 @@ describe('elasticsearch_adapter', () => {
       },
       process: {
         hits: {
-          total: 1,
+          total: {
+            value: 1,
+            relation: 'eq',
+          },
           max_score: 5,
           hits: [],
         },
@@ -29,7 +32,10 @@ describe('elasticsearch_adapter', () => {
       },
       process: {
         hits: {
-          total: 1,
+          total: {
+            value: 1,
+            relation: 'eq',
+          },
           max_score: 5,
           hits: [],
         },
@@ -58,7 +64,10 @@ describe('elasticsearch_adapter', () => {
       _type: 'type-123',
       _id: 'id-123',
       _score: 10,
-      total: 100,
+      total: {
+        value: 100,
+        relation: 'eq',
+      },
       hosts: ['host-1', 'host-2'],
       _source: {
         '@timestamp': 'time',
diff --git a/x-pack/plugins/secops/server/lib/uncommon_processes/elasticsearch_adapter.ts b/x-pack/plugins/secops/server/lib/uncommon_processes/elasticsearch_adapter.ts
index fb74fca4babf..795beefa8754 100644
--- a/x-pack/plugins/secops/server/lib/uncommon_processes/elasticsearch_adapter.ts
+++ b/x-pack/plugins/secops/server/lib/uncommon_processes/elasticsearch_adapter.ts
@@ -5,7 +5,7 @@
  */
 
 import { getOr } from 'lodash/fp';
-import { UncommonProcessesData, UncommonProcessesEdges } from '../../../common/graphql/types';
+import { UncommonProcessesData, UncommonProcessesEdges } from '../../graphql/types';
 import { mergeFieldsWithHit } from '../../utils/build_query';
 import { FrameworkAdapter, FrameworkRequest } from '../framework';
 import { TermAggregation } from '../types';
@@ -39,7 +39,6 @@ export class ElasticsearchUncommonProcessesAdapter implements UncommonProcessesA
       formatUncommonProcessesData(options.fields, hit, processFieldsMap)
     );
     const edges = uncommonProcessesEdges.splice(0, limit);
-
     return {
       edges,
       totalCount,
@@ -77,7 +76,7 @@ export const formatUncommonProcessesData = (
   fields.reduce(
     (flattenedFields, fieldName) => {
       flattenedFields.uncommonProcess._id = hit._id;
-      flattenedFields.uncommonProcess.instances = hit.total;
+      flattenedFields.uncommonProcess.instances = getOr(0, 'total.value', hit);
       flattenedFields.uncommonProcess.hosts = hit.hosts;
       if (hit.cursor) {
         flattenedFields.cursor.value = hit.cursor;
diff --git a/x-pack/plugins/secops/server/lib/uncommon_processes/index.ts b/x-pack/plugins/secops/server/lib/uncommon_processes/index.ts
index dcad00d33cd7..bf3871cd5a26 100644
--- a/x-pack/plugins/secops/server/lib/uncommon_processes/index.ts
+++ b/x-pack/plugins/secops/server/lib/uncommon_processes/index.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { UncommonProcessesData } from '../../../common/graphql/types';
+import { UncommonProcessesData } from '../../graphql/types';
 import { FrameworkRequest } from '../framework';
 export * from './elasticsearch_adapter';
 import { UncommonProcessesAdapter, UncommonProcessesRequestOptions } from './types';
diff --git a/x-pack/plugins/secops/server/lib/uncommon_processes/types.ts b/x-pack/plugins/secops/server/lib/uncommon_processes/types.ts
index 1477915d17cb..ac4ce17235ba 100644
--- a/x-pack/plugins/secops/server/lib/uncommon_processes/types.ts
+++ b/x-pack/plugins/secops/server/lib/uncommon_processes/types.ts
@@ -9,9 +9,9 @@ import {
   SourceConfiguration,
   TimerangeInput,
   UncommonProcessesData,
-} from '../../../common/graphql/types';
+} from '../../graphql/types';
 import { FrameworkRequest } from '../framework';
-import { ESQuery, SearchHit } from '../types';
+import { ESQuery, SearchHit, TotalHit } from '../types';
 
 export interface UncommonProcessesAdapter {
   getUncommonProcesses(
@@ -34,7 +34,7 @@ export interface UncommonProcessHit {
   _type: string;
   _id: string;
   _score: number | null;
-  total: number;
+  total: TotalHit;
   hosts: string[];
   _source: {
     '@timestamp': string;
@@ -57,7 +57,7 @@ export interface UncommonProcessBucket {
   };
   process: {
     hits: {
-      total: number;
+      total: TotalHit;
       max_score: number | null;
       hits: UncommonProcessHit[];
     };
diff --git a/x-pack/plugins/secops/server/utils/typed_resolvers.ts b/x-pack/plugins/secops/server/utils/typed_resolvers.ts
new file mode 100644
index 000000000000..e3fcbd7d2140
--- /dev/null
+++ b/x-pack/plugins/secops/server/utils/typed_resolvers.ts
@@ -0,0 +1,99 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Resolver } from '../graphql/types';
+
+type ResolverResult<R> = R | Promise<R>;
+
+type AppResolverResult<R> =
+  | Promise<R>
+  | Promise<{ [P in keyof R]: () => Promise<R[P]> }>
+  | { [P in keyof R]: () => Promise<R[P]> }
+  | { [P in keyof R]: () => R[P] }
+  | R;
+
+export type ResultOf<Resolver_> = Resolver_ extends Resolver<AppResolverResult<infer Result>>
+  ? Result
+  : never;
+
+export type SubsetResolverWithFields<R, IncludedFields extends string> = R extends Resolver<
+  Array<infer ResultInArray>,
+  infer ParentInArray,
+  infer ContextInArray,
+  infer ArgsInArray
+>
+  ? Resolver<
+      Array<Pick<ResultInArray, Extract<keyof ResultInArray, IncludedFields>>>,
+      ParentInArray,
+      ContextInArray,
+      ArgsInArray
+    >
+  : R extends Resolver<infer Result, infer Parent, infer Context, infer Args>
+  ? Resolver<Pick<Result, Extract<keyof Result, IncludedFields>>, Parent, Context, Args>
+  : never;
+
+export type SubsetResolverWithoutFields<R, ExcludedFields extends string> = R extends Resolver<
+  Array<infer ResultInArray>,
+  infer ParentInArray,
+  infer ContextInArray,
+  infer ArgsInArray
+>
+  ? Resolver<
+      Array<Pick<ResultInArray, Exclude<keyof ResultInArray, ExcludedFields>>>,
+      ParentInArray,
+      ContextInArray,
+      ArgsInArray
+    >
+  : R extends Resolver<infer Result, infer Parent, infer Context, infer Args>
+  ? Resolver<Pick<Result, Exclude<keyof Result, ExcludedFields>>, Parent, Context, Args>
+  : never;
+
+export type ResolverWithParent<Resolver_, Parent> = Resolver_ extends Resolver<
+  infer Result,
+  // tslint:disable-next-line:no-any
+  any,
+  infer Context,
+  infer Args
+>
+  ? Resolver<Result, Parent, Context, Args>
+  : never;
+
+// tslint:disable-next-line:no-any
+export type AppResolver<Result = any, Parent = any, Context = any, Args = any> = Resolver<
+  AppResolverResult<Result>,
+  Parent,
+  Context,
+  Args
+>;
+
+export type AppResolverOf<Resolver_> = Resolver_ extends Resolver<
+  ResolverResult<infer ResultWithNeverParent>,
+  never,
+  infer ContextWithNeverParent,
+  infer ArgsWithNeverParent
+>
+  ? AppResolver<ResultWithNeverParent, {}, ContextWithNeverParent, ArgsWithNeverParent>
+  : Resolver_ extends Resolver<
+      ResolverResult<infer Result>,
+      infer Parent,
+      infer Context,
+      infer Args
+    >
+  ? AppResolver<Result, Parent, Context, Args>
+  : never;
+
+export type AppResolverWithFields<Resolver_, IncludedFields extends string> = AppResolverOf<
+  SubsetResolverWithFields<Resolver_, IncludedFields>
+>;
+
+export type AppResolverWithoutFields<Resolver_, ExcludedFields extends string> = AppResolverOf<
+  SubsetResolverWithoutFields<Resolver_, ExcludedFields>
+>;
+
+export type ChildResolverOf<Resolver_, ParentResolver> = ResolverWithParent<
+  Resolver_,
+  ResultOf<ParentResolver>
+>;
diff --git a/x-pack/test/api_integration/apis/secops/hosts.ts b/x-pack/test/api_integration/apis/secops/hosts.ts
index 473b3dba9216..85edbce6de4e 100644
--- a/x-pack/test/api_integration/apis/secops/hosts.ts
+++ b/x-pack/test/api_integration/apis/secops/hosts.ts
@@ -5,8 +5,8 @@
  */
 
 import expect from 'expect.js';
-import { GetHostsQuery } from '../../../../plugins/secops/common/graphql/types';
 import { hostsQuery } from '../../../../plugins/secops/public/containers/hosts/index.gql_query';
+import { GetHostsQuery } from '../../../../plugins/secops/public/graphql/types';
 
 import { KbnTestProvider } from './types';
 
diff --git a/x-pack/test/api_integration/apis/secops/sources.ts b/x-pack/test/api_integration/apis/secops/sources.ts
index 7c63cec007a1..ab494702cbb3 100644
--- a/x-pack/test/api_integration/apis/secops/sources.ts
+++ b/x-pack/test/api_integration/apis/secops/sources.ts
@@ -5,8 +5,8 @@
  */
 
 import expect from 'expect.js';
-import { SourceQuery } from '../../../../plugins/secops/common/graphql/types';
 import { sourceQuery } from '../../../../plugins/secops/public/containers/source/index.gql_query';
+import { SourceQuery } from '../../../../plugins/secops/public/graphql/types';
 
 import { KbnTestProvider } from './types';