diff --git a/docs/dev-tools/console/console.asciidoc b/docs/dev-tools/console/console.asciidoc
index 48fe936dd2db5..21334c31011f4 100644
--- a/docs/dev-tools/console/console.asciidoc
+++ b/docs/dev-tools/console/console.asciidoc
@@ -129,3 +129,12 @@ image::dev-tools/console/images/console-settings.png["Console Settings", width=6
 
 For a list of available keyboard
 shortcuts, click *Help*.
+
+[float]
+[[console-settings]]
+=== Disable Console
+
+If you don’t want to use *Console*, you can disable it by setting `console.ui.enabled`
+to `false` in your `kibana.yml` configuration file. Changing this setting
+causes the server to regenerate assets on the next startup,
+which might cause a delay before pages start being served.
\ No newline at end of file
diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
index e79bc7a0db026..73efed79324fe 100644
--- a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
+++ b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
@@ -237,6 +237,7 @@ readonly links: {
             elasticAgent: string;
             datastreams: string;
             datastreamsNamingScheme: string;
+            installElasticAgent: string;
             upgradeElasticAgent: string;
             upgradeElasticAgent712lower: string;
             learnMoreBlog: string;
diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md
index d90972d327041..fdf469f443f28 100644
--- a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md
+++ b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md
@@ -17,5 +17,5 @@ export interface DocLinksStart
 |  --- | --- | --- |
 |  [DOC\_LINK\_VERSION](./kibana-plugin-core-public.doclinksstart.doc_link_version.md) | <code>string</code> |  |
 |  [ELASTIC\_WEBSITE\_URL](./kibana-plugin-core-public.doclinksstart.elastic_website_url.md) | <code>string</code> |  |
-|  [links](./kibana-plugin-core-public.doclinksstart.links.md) | <code>{</code><br/><code>        readonly settings: string;</code><br/><code>        readonly elasticStackGetStarted: string;</code><br/><code>        readonly apm: {</code><br/><code>            readonly kibanaSettings: string;</code><br/><code>            readonly supportedServiceMaps: string;</code><br/><code>            readonly customLinks: string;</code><br/><code>            readonly droppedTransactionSpans: string;</code><br/><code>            readonly upgrading: string;</code><br/><code>            readonly metaData: string;</code><br/><code>        };</code><br/><code>        readonly canvas: {</code><br/><code>            readonly guide: string;</code><br/><code>        };</code><br/><code>        readonly dashboard: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly drilldowns: string;</code><br/><code>            readonly drilldownsTriggerPicker: string;</code><br/><code>            readonly urlDrilldownTemplateSyntax: string;</code><br/><code>            readonly urlDrilldownVariables: string;</code><br/><code>        };</code><br/><code>        readonly discover: Record&lt;string, string&gt;;</code><br/><code>        readonly filebeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly installation: string;</code><br/><code>            readonly configuration: string;</code><br/><code>            readonly elasticsearchOutput: string;</code><br/><code>            readonly elasticsearchModule: string;</code><br/><code>            readonly startup: string;</code><br/><code>            readonly exportedFields: string;</code><br/><code>            readonly suricataModule: string;</code><br/><code>            readonly zeekModule: string;</code><br/><code>        };</code><br/><code>        readonly auditbeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly auditdModule: string;</code><br/><code>            readonly systemModule: string;</code><br/><code>        };</code><br/><code>        readonly metricbeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly configure: string;</code><br/><code>            readonly httpEndpoint: string;</code><br/><code>            readonly install: string;</code><br/><code>            readonly start: string;</code><br/><code>        };</code><br/><code>        readonly enterpriseSearch: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly appSearchBase: string;</code><br/><code>            readonly workplaceSearchBase: string;</code><br/><code>        };</code><br/><code>        readonly heartbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly libbeat: {</code><br/><code>            readonly getStarted: string;</code><br/><code>        };</code><br/><code>        readonly logstash: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly functionbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly winlogbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly aggs: {</code><br/><code>            readonly composite: string;</code><br/><code>            readonly composite_missing_bucket: string;</code><br/><code>            readonly date_histogram: string;</code><br/><code>            readonly date_range: string;</code><br/><code>            readonly date_format_pattern: string;</code><br/><code>            readonly filter: string;</code><br/><code>            readonly filters: string;</code><br/><code>            readonly geohash_grid: string;</code><br/><code>            readonly histogram: string;</code><br/><code>            readonly ip_range: string;</code><br/><code>            readonly range: string;</code><br/><code>            readonly significant_terms: string;</code><br/><code>            readonly terms: string;</code><br/><code>            readonly avg: string;</code><br/><code>            readonly avg_bucket: string;</code><br/><code>            readonly max_bucket: string;</code><br/><code>            readonly min_bucket: string;</code><br/><code>            readonly sum_bucket: string;</code><br/><code>            readonly cardinality: string;</code><br/><code>            readonly count: string;</code><br/><code>            readonly cumulative_sum: string;</code><br/><code>            readonly derivative: string;</code><br/><code>            readonly geo_bounds: string;</code><br/><code>            readonly geo_centroid: string;</code><br/><code>            readonly max: string;</code><br/><code>            readonly median: string;</code><br/><code>            readonly min: string;</code><br/><code>            readonly moving_avg: string;</code><br/><code>            readonly percentile_ranks: string;</code><br/><code>            readonly serial_diff: string;</code><br/><code>            readonly std_dev: string;</code><br/><code>            readonly sum: string;</code><br/><code>            readonly top_hits: string;</code><br/><code>        };</code><br/><code>        readonly runtimeFields: {</code><br/><code>            readonly overview: string;</code><br/><code>            readonly mapping: string;</code><br/><code>        };</code><br/><code>        readonly scriptedFields: {</code><br/><code>            readonly scriptFields: string;</code><br/><code>            readonly scriptAggs: string;</code><br/><code>            readonly painless: string;</code><br/><code>            readonly painlessApi: string;</code><br/><code>            readonly painlessLangSpec: string;</code><br/><code>            readonly painlessSyntax: string;</code><br/><code>            readonly painlessWalkthrough: string;</code><br/><code>            readonly luceneExpressions: string;</code><br/><code>        };</code><br/><code>        readonly search: {</code><br/><code>            readonly sessions: string;</code><br/><code>            readonly sessionLimits: string;</code><br/><code>        };</code><br/><code>        readonly indexPatterns: {</code><br/><code>            readonly introduction: string;</code><br/><code>            readonly fieldFormattersNumber: string;</code><br/><code>            readonly fieldFormattersString: string;</code><br/><code>            readonly runtimeFields: string;</code><br/><code>        };</code><br/><code>        readonly addData: string;</code><br/><code>        readonly kibana: string;</code><br/><code>        readonly upgradeAssistant: string;</code><br/><code>        readonly rollupJobs: string;</code><br/><code>        readonly elasticsearch: Record&lt;string, string&gt;;</code><br/><code>        readonly siem: {</code><br/><code>            readonly privileges: string;</code><br/><code>            readonly guide: string;</code><br/><code>            readonly gettingStarted: string;</code><br/><code>            readonly ml: string;</code><br/><code>            readonly ruleChangeLog: string;</code><br/><code>            readonly detectionsReq: string;</code><br/><code>            readonly networkMap: string;</code><br/><code>            readonly troubleshootGaps: string;</code><br/><code>        };</code><br/><code>        readonly securitySolution: {</code><br/><code>            readonly trustedApps: string;</code><br/><code>        };</code><br/><code>        readonly query: {</code><br/><code>            readonly eql: string;</code><br/><code>            readonly kueryQuerySyntax: string;</code><br/><code>            readonly luceneQuerySyntax: string;</code><br/><code>            readonly percolate: string;</code><br/><code>            readonly queryDsl: string;</code><br/><code>            readonly autocompleteChanges: string;</code><br/><code>        };</code><br/><code>        readonly date: {</code><br/><code>            readonly dateMath: string;</code><br/><code>            readonly dateMathIndexNames: string;</code><br/><code>        };</code><br/><code>        readonly management: Record&lt;string, string&gt;;</code><br/><code>        readonly ml: Record&lt;string, string&gt;;</code><br/><code>        readonly transforms: Record&lt;string, string&gt;;</code><br/><code>        readonly visualize: Record&lt;string, string&gt;;</code><br/><code>        readonly apis: Readonly&lt;{</code><br/><code>            bulkIndexAlias: string;</code><br/><code>            byteSizeUnits: string;</code><br/><code>            createAutoFollowPattern: string;</code><br/><code>            createFollower: string;</code><br/><code>            createIndex: string;</code><br/><code>            createSnapshotLifecyclePolicy: string;</code><br/><code>            createRoleMapping: string;</code><br/><code>            createRoleMappingTemplates: string;</code><br/><code>            createRollupJobsRequest: string;</code><br/><code>            createApiKey: string;</code><br/><code>            createPipeline: string;</code><br/><code>            createTransformRequest: string;</code><br/><code>            cronExpressions: string;</code><br/><code>            executeWatchActionModes: string;</code><br/><code>            indexExists: string;</code><br/><code>            openIndex: string;</code><br/><code>            putComponentTemplate: string;</code><br/><code>            painlessExecute: string;</code><br/><code>            painlessExecuteAPIContexts: string;</code><br/><code>            putComponentTemplateMetadata: string;</code><br/><code>            putSnapshotLifecyclePolicy: string;</code><br/><code>            putIndexTemplateV1: string;</code><br/><code>            putWatch: string;</code><br/><code>            simulatePipeline: string;</code><br/><code>            timeUnits: string;</code><br/><code>            updateTransform: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly observability: Readonly&lt;{</code><br/><code>            guide: string;</code><br/><code>            infrastructureThreshold: string;</code><br/><code>            logsThreshold: string;</code><br/><code>            metricsThreshold: string;</code><br/><code>            monitorStatus: string;</code><br/><code>            monitorUptime: string;</code><br/><code>            tlsCertificate: string;</code><br/><code>            uptimeDurationAnomaly: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly alerting: Record&lt;string, string&gt;;</code><br/><code>        readonly maps: Record&lt;string, string&gt;;</code><br/><code>        readonly monitoring: Record&lt;string, string&gt;;</code><br/><code>        readonly security: Readonly&lt;{</code><br/><code>            apiKeyServiceSettings: string;</code><br/><code>            clusterPrivileges: string;</code><br/><code>            elasticsearchSettings: string;</code><br/><code>            elasticsearchEnableSecurity: string;</code><br/><code>            indicesPrivileges: string;</code><br/><code>            kibanaTLS: string;</code><br/><code>            kibanaPrivileges: string;</code><br/><code>            mappingRoles: string;</code><br/><code>            mappingRolesFieldRules: string;</code><br/><code>            runAsPrivilege: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly spaces: Readonly&lt;{</code><br/><code>            kibanaLegacyUrlAliases: string;</code><br/><code>            kibanaDisableLegacyUrlAliasesApi: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly watcher: Record&lt;string, string&gt;;</code><br/><code>        readonly ccs: Record&lt;string, string&gt;;</code><br/><code>        readonly plugins: Record&lt;string, string&gt;;</code><br/><code>        readonly snapshotRestore: Record&lt;string, string&gt;;</code><br/><code>        readonly ingest: Record&lt;string, string&gt;;</code><br/><code>        readonly fleet: Readonly&lt;{</code><br/><code>            guide: string;</code><br/><code>            fleetServer: string;</code><br/><code>            fleetServerAddFleetServer: string;</code><br/><code>            settings: string;</code><br/><code>            settingsFleetServerHostSettings: string;</code><br/><code>            troubleshooting: string;</code><br/><code>            elasticAgent: string;</code><br/><code>            datastreams: string;</code><br/><code>            datastreamsNamingScheme: string;</code><br/><code>            upgradeElasticAgent: string;</code><br/><code>            upgradeElasticAgent712lower: string;</code><br/><code>            learnMoreBlog: string;</code><br/><code>            apiKeysLearnMore: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly ecs: {</code><br/><code>            readonly guide: string;</code><br/><code>        };</code><br/><code>        readonly clients: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly goOverview: string;</code><br/><code>            readonly javaIndex: string;</code><br/><code>            readonly jsIntro: string;</code><br/><code>            readonly netGuide: string;</code><br/><code>            readonly perlGuide: string;</code><br/><code>            readonly phpGuide: string;</code><br/><code>            readonly pythonGuide: string;</code><br/><code>            readonly rubyOverview: string;</code><br/><code>            readonly rustGuide: string;</code><br/><code>        };</code><br/><code>    }</code> |  |
+|  [links](./kibana-plugin-core-public.doclinksstart.links.md) | <code>{</code><br/><code>        readonly settings: string;</code><br/><code>        readonly elasticStackGetStarted: string;</code><br/><code>        readonly apm: {</code><br/><code>            readonly kibanaSettings: string;</code><br/><code>            readonly supportedServiceMaps: string;</code><br/><code>            readonly customLinks: string;</code><br/><code>            readonly droppedTransactionSpans: string;</code><br/><code>            readonly upgrading: string;</code><br/><code>            readonly metaData: string;</code><br/><code>        };</code><br/><code>        readonly canvas: {</code><br/><code>            readonly guide: string;</code><br/><code>        };</code><br/><code>        readonly dashboard: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly drilldowns: string;</code><br/><code>            readonly drilldownsTriggerPicker: string;</code><br/><code>            readonly urlDrilldownTemplateSyntax: string;</code><br/><code>            readonly urlDrilldownVariables: string;</code><br/><code>        };</code><br/><code>        readonly discover: Record&lt;string, string&gt;;</code><br/><code>        readonly filebeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly installation: string;</code><br/><code>            readonly configuration: string;</code><br/><code>            readonly elasticsearchOutput: string;</code><br/><code>            readonly elasticsearchModule: string;</code><br/><code>            readonly startup: string;</code><br/><code>            readonly exportedFields: string;</code><br/><code>            readonly suricataModule: string;</code><br/><code>            readonly zeekModule: string;</code><br/><code>        };</code><br/><code>        readonly auditbeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly auditdModule: string;</code><br/><code>            readonly systemModule: string;</code><br/><code>        };</code><br/><code>        readonly metricbeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly configure: string;</code><br/><code>            readonly httpEndpoint: string;</code><br/><code>            readonly install: string;</code><br/><code>            readonly start: string;</code><br/><code>        };</code><br/><code>        readonly enterpriseSearch: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly appSearchBase: string;</code><br/><code>            readonly workplaceSearchBase: string;</code><br/><code>        };</code><br/><code>        readonly heartbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly libbeat: {</code><br/><code>            readonly getStarted: string;</code><br/><code>        };</code><br/><code>        readonly logstash: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly functionbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly winlogbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly aggs: {</code><br/><code>            readonly composite: string;</code><br/><code>            readonly composite_missing_bucket: string;</code><br/><code>            readonly date_histogram: string;</code><br/><code>            readonly date_range: string;</code><br/><code>            readonly date_format_pattern: string;</code><br/><code>            readonly filter: string;</code><br/><code>            readonly filters: string;</code><br/><code>            readonly geohash_grid: string;</code><br/><code>            readonly histogram: string;</code><br/><code>            readonly ip_range: string;</code><br/><code>            readonly range: string;</code><br/><code>            readonly significant_terms: string;</code><br/><code>            readonly terms: string;</code><br/><code>            readonly avg: string;</code><br/><code>            readonly avg_bucket: string;</code><br/><code>            readonly max_bucket: string;</code><br/><code>            readonly min_bucket: string;</code><br/><code>            readonly sum_bucket: string;</code><br/><code>            readonly cardinality: string;</code><br/><code>            readonly count: string;</code><br/><code>            readonly cumulative_sum: string;</code><br/><code>            readonly derivative: string;</code><br/><code>            readonly geo_bounds: string;</code><br/><code>            readonly geo_centroid: string;</code><br/><code>            readonly max: string;</code><br/><code>            readonly median: string;</code><br/><code>            readonly min: string;</code><br/><code>            readonly moving_avg: string;</code><br/><code>            readonly percentile_ranks: string;</code><br/><code>            readonly serial_diff: string;</code><br/><code>            readonly std_dev: string;</code><br/><code>            readonly sum: string;</code><br/><code>            readonly top_hits: string;</code><br/><code>        };</code><br/><code>        readonly runtimeFields: {</code><br/><code>            readonly overview: string;</code><br/><code>            readonly mapping: string;</code><br/><code>        };</code><br/><code>        readonly scriptedFields: {</code><br/><code>            readonly scriptFields: string;</code><br/><code>            readonly scriptAggs: string;</code><br/><code>            readonly painless: string;</code><br/><code>            readonly painlessApi: string;</code><br/><code>            readonly painlessLangSpec: string;</code><br/><code>            readonly painlessSyntax: string;</code><br/><code>            readonly painlessWalkthrough: string;</code><br/><code>            readonly luceneExpressions: string;</code><br/><code>        };</code><br/><code>        readonly search: {</code><br/><code>            readonly sessions: string;</code><br/><code>            readonly sessionLimits: string;</code><br/><code>        };</code><br/><code>        readonly indexPatterns: {</code><br/><code>            readonly introduction: string;</code><br/><code>            readonly fieldFormattersNumber: string;</code><br/><code>            readonly fieldFormattersString: string;</code><br/><code>            readonly runtimeFields: string;</code><br/><code>        };</code><br/><code>        readonly addData: string;</code><br/><code>        readonly kibana: string;</code><br/><code>        readonly upgradeAssistant: string;</code><br/><code>        readonly rollupJobs: string;</code><br/><code>        readonly elasticsearch: Record&lt;string, string&gt;;</code><br/><code>        readonly siem: {</code><br/><code>            readonly privileges: string;</code><br/><code>            readonly guide: string;</code><br/><code>            readonly gettingStarted: string;</code><br/><code>            readonly ml: string;</code><br/><code>            readonly ruleChangeLog: string;</code><br/><code>            readonly detectionsReq: string;</code><br/><code>            readonly networkMap: string;</code><br/><code>            readonly troubleshootGaps: string;</code><br/><code>        };</code><br/><code>        readonly securitySolution: {</code><br/><code>            readonly trustedApps: string;</code><br/><code>        };</code><br/><code>        readonly query: {</code><br/><code>            readonly eql: string;</code><br/><code>            readonly kueryQuerySyntax: string;</code><br/><code>            readonly luceneQuerySyntax: string;</code><br/><code>            readonly percolate: string;</code><br/><code>            readonly queryDsl: string;</code><br/><code>            readonly autocompleteChanges: string;</code><br/><code>        };</code><br/><code>        readonly date: {</code><br/><code>            readonly dateMath: string;</code><br/><code>            readonly dateMathIndexNames: string;</code><br/><code>        };</code><br/><code>        readonly management: Record&lt;string, string&gt;;</code><br/><code>        readonly ml: Record&lt;string, string&gt;;</code><br/><code>        readonly transforms: Record&lt;string, string&gt;;</code><br/><code>        readonly visualize: Record&lt;string, string&gt;;</code><br/><code>        readonly apis: Readonly&lt;{</code><br/><code>            bulkIndexAlias: string;</code><br/><code>            byteSizeUnits: string;</code><br/><code>            createAutoFollowPattern: string;</code><br/><code>            createFollower: string;</code><br/><code>            createIndex: string;</code><br/><code>            createSnapshotLifecyclePolicy: string;</code><br/><code>            createRoleMapping: string;</code><br/><code>            createRoleMappingTemplates: string;</code><br/><code>            createRollupJobsRequest: string;</code><br/><code>            createApiKey: string;</code><br/><code>            createPipeline: string;</code><br/><code>            createTransformRequest: string;</code><br/><code>            cronExpressions: string;</code><br/><code>            executeWatchActionModes: string;</code><br/><code>            indexExists: string;</code><br/><code>            openIndex: string;</code><br/><code>            putComponentTemplate: string;</code><br/><code>            painlessExecute: string;</code><br/><code>            painlessExecuteAPIContexts: string;</code><br/><code>            putComponentTemplateMetadata: string;</code><br/><code>            putSnapshotLifecyclePolicy: string;</code><br/><code>            putIndexTemplateV1: string;</code><br/><code>            putWatch: string;</code><br/><code>            simulatePipeline: string;</code><br/><code>            timeUnits: string;</code><br/><code>            updateTransform: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly observability: Readonly&lt;{</code><br/><code>            guide: string;</code><br/><code>            infrastructureThreshold: string;</code><br/><code>            logsThreshold: string;</code><br/><code>            metricsThreshold: string;</code><br/><code>            monitorStatus: string;</code><br/><code>            monitorUptime: string;</code><br/><code>            tlsCertificate: string;</code><br/><code>            uptimeDurationAnomaly: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly alerting: Record&lt;string, string&gt;;</code><br/><code>        readonly maps: Record&lt;string, string&gt;;</code><br/><code>        readonly monitoring: Record&lt;string, string&gt;;</code><br/><code>        readonly security: Readonly&lt;{</code><br/><code>            apiKeyServiceSettings: string;</code><br/><code>            clusterPrivileges: string;</code><br/><code>            elasticsearchSettings: string;</code><br/><code>            elasticsearchEnableSecurity: string;</code><br/><code>            indicesPrivileges: string;</code><br/><code>            kibanaTLS: string;</code><br/><code>            kibanaPrivileges: string;</code><br/><code>            mappingRoles: string;</code><br/><code>            mappingRolesFieldRules: string;</code><br/><code>            runAsPrivilege: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly spaces: Readonly&lt;{</code><br/><code>            kibanaLegacyUrlAliases: string;</code><br/><code>            kibanaDisableLegacyUrlAliasesApi: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly watcher: Record&lt;string, string&gt;;</code><br/><code>        readonly ccs: Record&lt;string, string&gt;;</code><br/><code>        readonly plugins: Record&lt;string, string&gt;;</code><br/><code>        readonly snapshotRestore: Record&lt;string, string&gt;;</code><br/><code>        readonly ingest: Record&lt;string, string&gt;;</code><br/><code>        readonly fleet: Readonly&lt;{</code><br/><code>            guide: string;</code><br/><code>            fleetServer: string;</code><br/><code>            fleetServerAddFleetServer: string;</code><br/><code>            settings: string;</code><br/><code>            settingsFleetServerHostSettings: string;</code><br/><code>            troubleshooting: string;</code><br/><code>            elasticAgent: string;</code><br/><code>            datastreams: string;</code><br/><code>            datastreamsNamingScheme: string;</code><br/><code>            installElasticAgent: string;</code><br/><code>            upgradeElasticAgent: string;</code><br/><code>            upgradeElasticAgent712lower: string;</code><br/><code>            learnMoreBlog: string;</code><br/><code>            apiKeysLearnMore: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly ecs: {</code><br/><code>            readonly guide: string;</code><br/><code>        };</code><br/><code>        readonly clients: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly goOverview: string;</code><br/><code>            readonly javaIndex: string;</code><br/><code>            readonly jsIntro: string;</code><br/><code>            readonly netGuide: string;</code><br/><code>            readonly perlGuide: string;</code><br/><code>            readonly phpGuide: string;</code><br/><code>            readonly pythonGuide: string;</code><br/><code>            readonly rubyOverview: string;</code><br/><code>            readonly rustGuide: string;</code><br/><code>        };</code><br/><code>    }</code> |  |
 
diff --git a/docs/management/action-types.asciidoc b/docs/management/action-types.asciidoc
index 93d0ee3d2cab6..b2bf5f2bbe308 100644
--- a/docs/management/action-types.asciidoc
+++ b/docs/management/action-types.asciidoc
@@ -43,6 +43,10 @@ a| <<servicenow-sir-action-type, ServiceNow SecOps>>
 
 | Create a security incident in ServiceNow.
 
+a| <<servicenow-itom-action-type, ServiceNow ITOM>>
+
+| Create an event in ServiceNow.
+
 a| <<slack-action-type, Slack>>
 
 | Send a message to a Slack channel or user.
diff --git a/docs/management/connectors/action-types/servicenow-itom.asciidoc b/docs/management/connectors/action-types/servicenow-itom.asciidoc
new file mode 100644
index 0000000000000..017290dde9b15
--- /dev/null
+++ b/docs/management/connectors/action-types/servicenow-itom.asciidoc
@@ -0,0 +1,90 @@
+[role="xpack"]
+[[servicenow-itom-action-type]]
+=== ServiceNow connector and action
+++++
+<titleabbrev>ServiceNow ITOM</titleabbrev>
+++++
+
+The ServiceNow ITOM connector uses the https://docs.servicenow.com/bundle/rome-it-operations-management/page/product/event-management/task/send-events-via-web-service.html[Event API] to create ServiceNow events.
+
+[float]
+[[servicenow-itom-connector-configuration]]
+==== Connector configuration
+
+ServiceNow ITOM connectors have the following configuration properties.
+
+Name::      The name of the connector. The name is used to identify a  connector in the **Stack Management** UI connector listing, and in the connector list when configuring an action.
+URL::       ServiceNow instance URL.
+Username::  Username for HTTP Basic authentication.
+Password::  Password for HTTP Basic authentication.
+
+The ServiceNow user requires at minimum read, create, and update access to the Event table and read access to the https://docs.servicenow.com/bundle/paris-platform-administration/page/administer/localization/reference/r_ChoicesTable.html[sys_choice]. If you don't provide access to sys_choice, then the choices will not render.
+
+[float]
+[[servicenow-itom-connector-networking-configuration]]
+==== Connector networking configuration
+
+Use the <<action-settings, Action configuration settings>> to customize connector networking configurations, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use `xpack.actions.customHostSettings` to set per-host configurations.
+
+[float]
+[[Preconfigured-servicenow-itom-configuration]]
+==== Preconfigured connector type
+
+[source,text]
+--
+ my-servicenow-itom:
+   name: preconfigured-servicenow-connector-type
+   actionTypeId: .servicenow-itom
+   config:
+     apiUrl: https://example.service-now.com/
+   secrets:
+     username: testuser
+     password: passwordkeystorevalue
+--
+
+Config defines information for the connector type.
+
+`apiUrl`:: An address that corresponds to *URL*.
+
+Secrets defines sensitive information for the connector type.
+
+`username`:: A string that corresponds to *Username*.
+`password`::  A string that corresponds to *Password*. Should be stored in the <<creating-keystore, {kib} keystore>>.
+
+[float]
+[[define-servicenow-itom-ui]]
+==== Define connector in Stack Management
+
+Define ServiceNow ITOM connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/servicenow-itom-connector.png[ServiceNow ITOM connector]
+
+Test ServiceNow ITOM action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/servicenow-itom-params-test.png[ServiceNow ITOM params test]
+
+[float]
+[[servicenow-itom-action-configuration]]
+==== Action configuration
+
+ServiceNow ITOM actions have the following configuration properties.
+
+Source::       The name of the event source type.
+Node::         The Host that the event was triggered for.
+Type::         The type of event.
+Resource::     The name of the resource.
+Metric name::  Name of the metric.
+Source instance (event_class):: Specific instance of the source.
+Message key::  All actions sharing this key will be associated with the same ServiceNow alert. Default value: `<rule ID>:<alert instance ID>`.
+Severity::     The severity of the event.
+Description::  The details about the event.
+
+Refer to https://docs.servicenow.com/bundle/rome-it-operations-management/page/product/event-management/task/send-events-via-web-service.html[ServiceNow documentation] for more information about the properties.
+
+[float]
+[[configuring-servicenow-itom]]
+==== Configure ServiceNow ITOM
+
+ServiceNow offers free https://developer.servicenow.com/dev.do#!/guides/madrid/now-platform/pdi-guide/obtaining-a-pdi[Personal Developer Instances], which you can use to test incidents.
diff --git a/docs/management/connectors/action-types/servicenow-sir.asciidoc b/docs/management/connectors/action-types/servicenow-sir.asciidoc
index 2fa49fe552c2e..40fb07897d206 100644
--- a/docs/management/connectors/action-types/servicenow-sir.asciidoc
+++ b/docs/management/connectors/action-types/servicenow-sir.asciidoc
@@ -36,7 +36,7 @@ Use the <<action-settings, Action configuration settings>> to customize connecto
    name: preconfigured-servicenow-connector-type
    actionTypeId: .servicenow-sir
    config:
-     apiUrl: https://dev94428.service-now.com/
+     apiUrl: https://example.service-now.com/
    secrets:
      username: testuser
      password: passwordkeystorevalue
diff --git a/docs/management/connectors/action-types/servicenow.asciidoc b/docs/management/connectors/action-types/servicenow.asciidoc
index f7c3187f3f024..eae1fce75731d 100644
--- a/docs/management/connectors/action-types/servicenow.asciidoc
+++ b/docs/management/connectors/action-types/servicenow.asciidoc
@@ -36,7 +36,7 @@ Use the <<action-settings, Action configuration settings>> to customize connecto
    name: preconfigured-servicenow-connector-type
    actionTypeId: .servicenow
    config:
-     apiUrl: https://dev94428.service-now.com/
+     apiUrl: https://example.service-now.com/
    secrets:
      username: testuser
      password: passwordkeystorevalue
diff --git a/docs/management/connectors/images/servicenow-itom-connector.png b/docs/management/connectors/images/servicenow-itom-connector.png
new file mode 100644
index 0000000000000..5b73336d21b47
Binary files /dev/null and b/docs/management/connectors/images/servicenow-itom-connector.png differ
diff --git a/docs/management/connectors/images/servicenow-itom-params-test.png b/docs/management/connectors/images/servicenow-itom-params-test.png
new file mode 100644
index 0000000000000..8d7b1e075911a
Binary files /dev/null and b/docs/management/connectors/images/servicenow-itom-params-test.png differ
diff --git a/docs/management/connectors/index.asciidoc b/docs/management/connectors/index.asciidoc
index 536d05705181d..6968475cf3a4e 100644
--- a/docs/management/connectors/index.asciidoc
+++ b/docs/management/connectors/index.asciidoc
@@ -7,6 +7,7 @@ include::action-types/pagerduty.asciidoc[]
 include::action-types/server-log.asciidoc[]
 include::action-types/servicenow.asciidoc[]
 include::action-types/servicenow-sir.asciidoc[]
+include::action-types/servicenow-itom.asciidoc[]
 include::action-types/swimlane.asciidoc[]
 include::action-types/slack.asciidoc[]
 include::action-types/webhook.asciidoc[]
diff --git a/docs/settings/security-settings.asciidoc b/docs/settings/security-settings.asciidoc
index 11072509da1fc..c291b65c3c35b 100644
--- a/docs/settings/security-settings.asciidoc
+++ b/docs/settings/security-settings.asciidoc
@@ -272,7 +272,7 @@ You can configure the following settings in the `kibana.yml` file.
 
 |[[xpack-session-idleTimeout]] `xpack.security.session.idleTimeout` {ess-icon}
   | Ensures that user sessions will expire after a period of inactivity. This and <<xpack-session-lifespan,`xpack.security.session.lifespan`>> are both
-highly recommended. You can also specify this setting for <<xpack-security-provider-session-idleTimeout, every provider separately>>. If this is set to `0`, then sessions will never expire due to inactivity. By default, this value is 1 hour.
+highly recommended. You can also specify this setting for <<xpack-security-provider-session-idleTimeout, every provider separately>>. If this is set to `0`, then sessions will never expire due to inactivity. By default, this value is 8 hours.
 
 2+a|
 [TIP]
diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc
index 4802a4da8182c..af22ad4ad157f 100644
--- a/docs/setup/settings.asciidoc
+++ b/docs/setup/settings.asciidoc
@@ -20,6 +20,11 @@ configuration using `${MY_ENV_VAR}` syntax.
 [cols="2*<"]
 |===
 
+| `console.ui.enabled:`
+Toggling this causes the server to regenerate assets on the next startup,
+which may cause a delay before pages start being served.
+Set to `false` to disable Console. *Default: `true`*
+
 | `csp.rules:`
  | deprecated:[7.14.0,"In 8.0 and later, this setting will no longer be supported."]
 A https://w3c.github.io/webappsec-csp/[Content Security Policy] template
@@ -681,6 +686,10 @@ out through *Advanced Settings*. *Default: `true`*
  | Set this value to true to allow Vega to use any URL to access external data
 sources and images. When false, Vega can only get data from {es}. *Default: `false`*
 
+| `xpack.ccr.ui.enabled`
+Set this value to false to disable the Cross-Cluster Replication UI.
+*Default: `true`*
+
 |[[settings-explore-data-in-context]] `xpack.discoverEnhanced.actions.`
 `exploreDataInContextMenu.enabled`
  | Enables the *Explore underlying data* option that allows you to open *Discover* from a dashboard panel and view the panel data. *Default: `false`*
@@ -689,6 +698,31 @@ sources and images. When false, Vega can only get data from {es}. *Default: `fal
 `exploreDataInChart.enabled`
  | Enables you to view the underlying documents in a data series from a dashboard panel. *Default: `false`*
 
+| `xpack.ilm.ui.enabled`
+Set this value to false to disable the Index Lifecycle Policies UI.
+*Default: `true`*
+
+| `xpack.index_management.ui.enabled`
+Set this value to false to disable the Index Management UI.
+*Default: `true`*
+
+| `xpack.license_management.ui.enabled`
+Set this value to false to disable the License Management UI.
+*Default: `true`*
+
+| `xpack.remote_clusters.ui.enabled`
+Set this value to false to disable the Remote Clusters UI.
+*Default: `true`*
+
+| `xpack.rollup.ui.enabled:`
+Set this value to false to disable the Rollup Jobs UI. *Default: true*
+
+| `xpack.snapshot_restore.ui.enabled:`
+Set this value to false to disable the Snapshot and Restore UI. *Default: true*
+
+| `xpack.upgrade_assistant.ui.enabled:`
+Set this value to false to disable the Upgrade Assistant UI. *Default: true*
+
 | `i18n.locale` {ess-icon}
  | Set this value to change the {kib} interface language.
 Valid locales are: `en`, `zh-CN`, `ja-JP`. *Default: `en`*
diff --git a/docs/user/security/session-management.asciidoc b/docs/user/security/session-management.asciidoc
index b0f27d45bb826..e896c8fe77254 100644
--- a/docs/user/security/session-management.asciidoc
+++ b/docs/user/security/session-management.asciidoc
@@ -12,7 +12,7 @@ To manage user sessions programmatically, {kib} exposes <<session-management-api
 ==== Session idle timeout
 
 You can use `xpack.security.session.idleTimeout` to expire sessions after a period of inactivity. This and `xpack.security.session.lifespan` are both highly recommended.
-By default, sessions expire after 1 hour of inactivity. To define another value for a sliding session expiration, set the  property in the `kibana.yml` configuration file. The idle timeout is formatted as a duration of `<count>[ms|s|m|h|d|w|M|Y]` (e.g. '20m', '24h', '7d', '1w'). For example, set the idle timeout to expire sessions after 30 minutes of inactivity:
+By default, sessions expire after 8 hours of inactivity. To define another value for a sliding session expiration, set the  property in the `kibana.yml` configuration file. The idle timeout is formatted as a duration of `<count>[ms|s|m|h|d|w|M|Y]` (e.g. '20m', '24h', '7d', '1w'). For example, set the idle timeout to expire sessions after 30 minutes of inactivity:
 
 --
 [source,yaml]
diff --git a/package.json b/package.json
index 47ed5e110b000..b3b9b96e75566 100644
--- a/package.json
+++ b/package.json
@@ -102,7 +102,7 @@
     "@elastic/datemath": "link:bazel-bin/packages/elastic-datemath",
     "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@^8.0.0-canary.21",
     "@elastic/ems-client": "7.16.0",
-    "@elastic/eui": "39.0.0",
+    "@elastic/eui": "39.1.1",
     "@elastic/filesaver": "1.1.2",
     "@elastic/maki": "6.3.0",
     "@elastic/node-crypto": "1.2.1",
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index a07e12eae8d71..91ad185447986 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -477,9 +477,10 @@ export class DocLinksService {
           settings: `${FLEET_DOCS}fleet-settings.html#fleet-server-hosts-setting`,
           settingsFleetServerHostSettings: `${FLEET_DOCS}fleet-settings.html#fleet-server-hosts-setting`,
           troubleshooting: `${FLEET_DOCS}fleet-troubleshooting.html`,
-          elasticAgent: `${FLEET_DOCS}elastic-agent-installation-configuration.html`,
+          elasticAgent: `${FLEET_DOCS}elastic-agent-installation.html`,
           datastreams: `${FLEET_DOCS}data-streams.html`,
           datastreamsNamingScheme: `${FLEET_DOCS}data-streams.html#data-streams-naming-scheme`,
+          installElasticAgent: `${FLEET_DOCS}install-fleet-managed-elastic-agent.html`,
           upgradeElasticAgent: `${FLEET_DOCS}upgrade-elastic-agent.html`,
           upgradeElasticAgent712lower: `${FLEET_DOCS}upgrade-elastic-agent.html#upgrade-7.12-lower`,
           learnMoreBlog: `${ELASTIC_WEBSITE_URL}blog/elastic-agent-and-fleet-make-it-easier-to-integrate-your-systems-with-elastic`,
@@ -740,6 +741,7 @@ export interface DocLinksStart {
       elasticAgent: string;
       datastreams: string;
       datastreamsNamingScheme: string;
+      installElasticAgent: string;
       upgradeElasticAgent: string;
       upgradeElasticAgent712lower: string;
       learnMoreBlog: string;
diff --git a/src/core/public/i18n/__snapshots__/i18n_service.test.tsx.snap b/src/core/public/i18n/__snapshots__/i18n_service.test.tsx.snap
index d714f2159d1a2..197714df7f207 100644
--- a/src/core/public/i18n/__snapshots__/i18n_service.test.tsx.snap
+++ b/src/core/public/i18n/__snapshots__/i18n_service.test.tsx.snap
@@ -175,6 +175,7 @@ exports[`#start() returns \`Context\` component 1`] = `
           "euiRefreshInterval.legend": "Refresh every",
           "euiRefreshInterval.start": "Start",
           "euiRefreshInterval.stop": "Stop",
+          "euiRelativeTab.dateInputError": "Must be a valid range",
           "euiRelativeTab.fullDescription": [Function],
           "euiRelativeTab.numberInputError": "Must be >= 0",
           "euiRelativeTab.numberInputLabel": "Time span amount",
diff --git a/src/core/public/i18n/i18n_eui_mapping.tsx b/src/core/public/i18n/i18n_eui_mapping.tsx
index 7585ada886c05..f28add25056ee 100644
--- a/src/core/public/i18n/i18n_eui_mapping.tsx
+++ b/src/core/public/i18n/i18n_eui_mapping.tsx
@@ -64,7 +64,7 @@ export const getEuiContextMapping = (): EuiTokensObject => {
       }),
     'euiBasicTable.tablePagination': ({ tableCaption }: EuiValues) =>
       i18n.translate('core.euiBasicTable.tablePagination', {
-        defaultMessage: 'Pagination for preceding table: {tableCaption}',
+        defaultMessage: 'Pagination for table: {tableCaption}',
         values: { tableCaption },
         description: 'Screen reader text to describe the pagination controls',
       }),
@@ -861,6 +861,9 @@ export const getEuiContextMapping = (): EuiTokensObject => {
     'euiRelativeTab.numberInputLabel': i18n.translate('core.euiRelativeTab.numberInputLabel', {
       defaultMessage: 'Time span amount',
     }),
+    'euiRelativeTab.dateInputError': i18n.translate('core.euiRelativeTab.dateInputError', {
+      defaultMessage: 'Must be a valid range',
+    }),
     'euiResizableButton.horizontalResizerAriaLabel': i18n.translate(
       'core.euiResizableButton.horizontalResizerAriaLabel',
       {
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index 4c7f8aab5b767..508299686b0d9 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -706,6 +706,7 @@ export interface DocLinksStart {
             elasticAgent: string;
             datastreams: string;
             datastreamsNamingScheme: string;
+            installElasticAgent: string;
             upgradeElasticAgent: string;
             upgradeElasticAgent712lower: string;
             learnMoreBlog: string;
diff --git a/src/core/server/saved_objects/object_types/registration.ts b/src/core/server/saved_objects/object_types/registration.ts
index 6ef4f79ef77c9..ce10896747178 100644
--- a/src/core/server/saved_objects/object_types/registration.ts
+++ b/src/core/server/saved_objects/object_types/registration.ts
@@ -17,6 +17,7 @@ const legacyUrlAliasType: SavedObjectsType = {
     properties: {
       sourceId: { type: 'keyword' },
       targetType: { type: 'keyword' },
+      targetNamespace: { type: 'keyword' },
       resolveCounter: { type: 'long' },
       disabled: { type: 'boolean' },
       // other properties exist, but we aren't querying or aggregating on those, so we don't need to specify them (because we use `dynamic: false` above)
diff --git a/src/core/server/saved_objects/service/lib/repository.test.js b/src/core/server/saved_objects/service/lib/repository.test.js
index 82a0dd71700f6..84359147fccbc 100644
--- a/src/core/server/saved_objects/service/lib/repository.test.js
+++ b/src/core/server/saved_objects/service/lib/repository.test.js
@@ -26,6 +26,7 @@ import { encodeHitVersion } from '../../version';
 import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 import { DocumentMigrator } from '../../migrations/core/document_migrator';
 import { mockKibanaMigrator } from '../../migrations/kibana/kibana_migrator.mock';
+import { LEGACY_URL_ALIAS_TYPE } from '../../object_types';
 import { elasticsearchClientMock } from '../../../elasticsearch/client/mocks';
 import * as esKuery from '@kbn/es-query';
 import { errors as EsErrors } from '@elastic/elasticsearch';
@@ -2714,7 +2715,11 @@ describe('SavedObjectsRepository', () => {
         const allTypes = registry.getAllTypes().map((type) => type.name);
         expect(getSearchDslNS.getSearchDsl).toHaveBeenCalledWith(mappings, registry, {
           namespaces: [namespace],
-          type: allTypes.filter((type) => !registry.isNamespaceAgnostic(type)),
+          type: [
+            ...allTypes.filter((type) => !registry.isNamespaceAgnostic(type)),
+            LEGACY_URL_ALIAS_TYPE,
+          ],
+          kueryNode: expect.anything(),
         });
       });
     });
diff --git a/src/core/server/saved_objects/service/lib/repository.ts b/src/core/server/saved_objects/service/lib/repository.ts
index e522d770b3f58..c081c59911405 100644
--- a/src/core/server/saved_objects/service/lib/repository.ts
+++ b/src/core/server/saved_objects/service/lib/repository.ts
@@ -8,6 +8,7 @@
 
 import { omit, isObject } from 'lodash';
 import type { estypes } from '@elastic/elasticsearch';
+import * as esKuery from '@kbn/es-query';
 import type { ElasticsearchClient } from '../../../elasticsearch/';
 import { isSupportedEsServer, isNotFoundFromUnsupportedServer } from '../../../elasticsearch';
 import type { Logger } from '../../../logging';
@@ -55,6 +56,7 @@ import {
   SavedObjectsBulkResolveObject,
   SavedObjectsBulkResolveResponse,
 } from '../saved_objects_client';
+import { LEGACY_URL_ALIAS_TYPE } from '../../object_types';
 import {
   SavedObject,
   SavedObjectsBaseOptions,
@@ -780,7 +782,16 @@ export class SavedObjectsRepository {
     }
 
     const allTypes = Object.keys(getRootPropertiesObjects(this._mappings));
-    const typesToUpdate = allTypes.filter((type) => !this._registry.isNamespaceAgnostic(type));
+    const typesToUpdate = [
+      ...allTypes.filter((type) => !this._registry.isNamespaceAgnostic(type)),
+      LEGACY_URL_ALIAS_TYPE,
+    ];
+
+    // Construct kueryNode to filter legacy URL aliases (these space-agnostic objects do not use root-level "namespace/s" fields)
+    const { buildNode } = esKuery.nodeTypes.function;
+    const match1 = buildNode('is', `${LEGACY_URL_ALIAS_TYPE}.targetNamespace`, namespace);
+    const match2 = buildNode('not', buildNode('is', 'type', LEGACY_URL_ALIAS_TYPE));
+    const kueryNode = buildNode('or', [match1, match2]);
 
     const { body, statusCode, headers } = await this.client.updateByQuery(
       {
@@ -803,8 +814,9 @@ export class SavedObjectsRepository {
           },
           conflicts: 'proceed',
           ...getSearchDsl(this._mappings, this._registry, {
-            namespaces: namespace ? [namespace] : undefined,
+            namespaces: [namespace],
             type: typesToUpdate,
+            kueryNode,
           }),
         },
       },
diff --git a/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_1/test_file_1.jsx b/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_1/test_file_1.jsx
index a52047f00feb0..8dc47a53da421 100644
--- a/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_1/test_file_1.jsx
+++ b/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_1/test_file_1.jsx
@@ -1,11 +1,8 @@
 /* eslint-disable */
 
-// Angular service
-i18n('plugin_1.id_1', { defaultMessage: 'Message 1' });
-
 // @kbn/i18n
-i18n.translate('plugin_1.id_2', {
-  defaultMessage: 'Message 2',
+i18n.translate('plugin_1.id_1', {
+  defaultMessage: 'Message 1',
   description: 'Message description',
 });
 
@@ -15,10 +12,10 @@ class Component extends PureComponent {
     return (
       <div>
         <FormattedMessage
-          id="plugin_1.id_3"
-          defaultMessage="Message 3"
+          id="plugin_1.id_2"
+          defaultMessage="Message 2"
         />
-        {intl.formatMessage({ id: 'plugin_1.id_4', defaultMessage: 'Message 4' })}
+        {intl.formatMessage({ id: 'plugin_1.id_3', defaultMessage: 'Message 3' })}
       </div>
     );
   }
diff --git a/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_1/test_file_4.html b/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_1/test_file_4.html
deleted file mode 100644
index f9c8a8383d647..0000000000000
--- a/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_1/test_file_4.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<kbn-top-nav name="dashboard" config="topNavMenu">
-  <div data-transclude-slots>
-    <div
-      i18n-id="plugin_1.id_7"
-      i18n-default-message="Message 7"
-    ></div>
-  </div>
-</kbn-top-nav>
diff --git a/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2/test_file.html b/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2/test_file.html
deleted file mode 100644
index c12843602b13b..0000000000000
--- a/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2/test_file.html
+++ /dev/null
@@ -1 +0,0 @@
-<p>{{ ::'plugin_2.message-id' | i18n: { defaultMessage: 'Message text' } }}</p>
diff --git a/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2/test_file.jsx b/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2/test_file.jsx
new file mode 100644
index 0000000000000..8f41a58bf82d1
--- /dev/null
+++ b/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2/test_file.jsx
@@ -0,0 +1,8 @@
+/* eslint-disable */
+
+i18n.translate('plugin_2.duplicate_id', { defaultMessage: 'Message 1' });
+
+i18n.translate('plugin_2.duplicate_id', {
+  defaultMessage: 'Message 2',
+  description: 'Message description',
+});
diff --git a/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_3/test_file.jsx b/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2_additional_path/test_file.jsx
similarity index 100%
rename from src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_3/test_file.jsx
rename to src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2_additional_path/test_file.jsx
diff --git a/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_3_additional_path/test_file.jsx b/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_3_additional_path/test_file.jsx
deleted file mode 100644
index 7fa370dec5ebb..0000000000000
--- a/src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_3_additional_path/test_file.jsx
+++ /dev/null
@@ -1,8 +0,0 @@
-/* eslint-disable */
-
-i18n('plugin_3.duplicate_id', { defaultMessage: 'Message 1' });
-
-i18n.translate('plugin_3.duplicate_id', {
-  defaultMessage: 'Message 2',
-  description: 'Message description',
-});
diff --git a/src/dev/i18n/__snapshots__/extract_default_translations.test.js.snap b/src/dev/i18n/__snapshots__/extract_default_translations.test.js.snap
index b19b366a8db7b..c9215b9aed98b 100644
--- a/src/dev/i18n/__snapshots__/extract_default_translations.test.js.snap
+++ b/src/dev/i18n/__snapshots__/extract_default_translations.test.js.snap
@@ -5,14 +5,14 @@ Array [
   Array [
     "plugin_1.id_1",
     Object {
-      "description": undefined,
+      "description": "Message description",
       "message": "Message 1",
     },
   ],
   Array [
     "plugin_1.id_2",
     Object {
-      "description": "Message description",
+      "description": undefined,
       "message": "Message 2",
     },
   ],
@@ -23,27 +23,13 @@ Array [
       "message": "Message 3",
     },
   ],
-  Array [
-    "plugin_1.id_4",
-    Object {
-      "description": undefined,
-      "message": "Message 4",
-    },
-  ],
-  Array [
-    "plugin_1.id_7",
-    Object {
-      "description": undefined,
-      "message": "Message 7",
-    },
-  ],
 ]
 `;
 
 exports[`dev/i18n/extract_default_translations throws on id collision 1`] = `
 Array [
-  " I18N ERROR  Error in src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_3/test_file.jsx
-Error: There is more than one default message for the same id \\"plugin_3.duplicate_id\\":
+  " I18N ERROR  Error in src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2/test_file.jsx
+Error: There is more than one default message for the same id \\"plugin_2.duplicate_id\\":
 \\"Message 1\\" and \\"Message 2\\"",
 ]
 `;
diff --git a/src/dev/i18n/extract_default_translations.js b/src/dev/i18n/extract_default_translations.js
index 97554704edc7f..a453b0bbae2fb 100644
--- a/src/dev/i18n/extract_default_translations.js
+++ b/src/dev/i18n/extract_default_translations.js
@@ -8,7 +8,7 @@
 
 import path from 'path';
 
-import { extractHtmlMessages, extractCodeMessages } from './extractors';
+import { extractCodeMessages } from './extractors';
 import { globAsync, readFileAsync, normalizePath } from './utils';
 
 import { createFailError, isFailError } from '@kbn/dev-utils';
@@ -59,7 +59,7 @@ export async function matchEntriesWithExctractors(inputPath, options = {}) {
     '**/*.d.ts',
   ].concat(additionalIgnore);
 
-  const entries = await globAsync('*.{js,jsx,ts,tsx,html}', {
+  const entries = await globAsync('*.{js,jsx,ts,tsx}', {
     cwd: inputPath,
     matchBase: true,
     ignore,
@@ -67,25 +67,14 @@ export async function matchEntriesWithExctractors(inputPath, options = {}) {
     absolute,
   });
 
-  const { htmlEntries, codeEntries } = entries.reduce(
-    (paths, entry) => {
-      const resolvedPath = path.resolve(inputPath, entry);
+  const codeEntries = entries.reduce((paths, entry) => {
+    const resolvedPath = path.resolve(inputPath, entry);
+    paths.push(resolvedPath);
 
-      if (resolvedPath.endsWith('.html')) {
-        paths.htmlEntries.push(resolvedPath);
-      } else {
-        paths.codeEntries.push(resolvedPath);
-      }
-
-      return paths;
-    },
-    { htmlEntries: [], codeEntries: [] }
-  );
+    return paths;
+  }, []);
 
-  return [
-    [htmlEntries, extractHtmlMessages],
-    [codeEntries, extractCodeMessages],
-  ];
+  return [[codeEntries, extractCodeMessages]];
 }
 
 export async function extractMessagesFromPathToMap(inputPath, targetMap, config, reporter) {
diff --git a/src/dev/i18n/extract_default_translations.test.js b/src/dev/i18n/extract_default_translations.test.js
index 4b0da570ca551..e5b33eba7a4db 100644
--- a/src/dev/i18n/extract_default_translations.test.js
+++ b/src/dev/i18n/extract_default_translations.test.js
@@ -18,17 +18,15 @@ const fixturesPath = path.resolve(__dirname, '__fixtures__', 'extract_default_tr
 const pluginsPaths = [
   path.join(fixturesPath, 'test_plugin_1'),
   path.join(fixturesPath, 'test_plugin_2'),
-  path.join(fixturesPath, 'test_plugin_3'),
-  path.join(fixturesPath, 'test_plugin_3_additional_path'),
+  path.join(fixturesPath, 'test_plugin_2_additional_path'),
 ];
 
 const config = {
   paths: {
     plugin_1: ['src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_1'],
-    plugin_2: ['src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2'],
-    plugin_3: [
-      'src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_3',
-      'src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_3_additional_path',
+    plugin_2: [
+      'src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2',
+      'src/dev/i18n/__fixtures__/extract_default_translations/test_plugin_2_additional_path',
     ],
   },
   exclude: [],
@@ -44,7 +42,7 @@ describe('dev/i18n/extract_default_translations', () => {
   });
 
   test('throws on id collision', async () => {
-    const [, , pluginPath] = pluginsPaths;
+    const [, pluginPath] = pluginsPaths;
     const reporter = new ErrorReporter();
 
     await expect(
@@ -57,20 +55,20 @@ describe('dev/i18n/extract_default_translations', () => {
     const id = 'plugin_2.message-id';
     const filePath = path.resolve(
       __dirname,
-      '__fixtures__/extract_default_translations/test_plugin_2/test_file.html'
+      '__fixtures__/extract_default_translations/test_plugin_2/test_file.jsx'
     );
     expect(() => validateMessageNamespace(id, filePath, config.paths)).not.toThrow();
   });
 
   test('validates message namespace with multiple paths', () => {
-    const id = 'plugin_3.message-id';
+    const id = 'plugin_2.message-id';
     const filePath1 = path.resolve(
       __dirname,
-      '__fixtures__/extract_default_translations/test_plugin_3/test_file.html'
+      '__fixtures__/extract_default_translations/test_plugin_2/test_file.jsx'
     );
     const filePath2 = path.resolve(
       __dirname,
-      '__fixtures__/extract_default_translations/test_plugin_3_additional_path/test_file.html'
+      '__fixtures__/extract_default_translations/test_plugin_2_additional_path/test_file.jsx'
     );
     expect(() => validateMessageNamespace(id, filePath1, config.paths)).not.toThrow();
     expect(() => validateMessageNamespace(id, filePath2, config.paths)).not.toThrow();
@@ -81,7 +79,7 @@ describe('dev/i18n/extract_default_translations', () => {
     const id = 'wrong_plugin_namespace.message-id';
     const filePath = path.resolve(
       __dirname,
-      '__fixtures__/extract_default_translations/test_plugin_2/test_file.html'
+      '__fixtures__/extract_default_translations/test_plugin_2/test_file.jsx'
     );
 
     expect(() => validateMessageNamespace(id, filePath, config.paths, { report })).not.toThrow();
diff --git a/src/dev/i18n/extractors/__snapshots__/html.test.js.snap b/src/dev/i18n/extractors/__snapshots__/html.test.js.snap
deleted file mode 100644
index f911674400d45..0000000000000
--- a/src/dev/i18n/extractors/__snapshots__/html.test.js.snap
+++ /dev/null
@@ -1,77 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`dev/i18n/extractors/html extracts default messages from HTML 1`] = `
-Array [
-  Array [
-    "kbn.dashboard.id-1",
-    Object {
-      "description": "Message description 1",
-      "message": "Message text 1 {value}",
-    },
-  ],
-  Array [
-    "kbn.dashboard.id-2",
-    Object {
-      "description": undefined,
-      "message": "Message text 2",
-    },
-  ],
-  Array [
-    "kbn.dashboard.id-3",
-    Object {
-      "description": "Message description 3",
-      "message": "Message text 3",
-    },
-  ],
-]
-`;
-
-exports[`dev/i18n/extractors/html extracts default messages from HTML with one-time binding 1`] = `
-Array [
-  Array [
-    "kbn.id",
-    Object {
-      "description": undefined,
-      "message": "Message text with {value}",
-    },
-  ],
-]
-`;
-
-exports[`dev/i18n/extractors/html extracts message from i18n filter in interpolating directive 1`] = `
-Array [
-  Array [
-    "namespace.messageId",
-    Object {
-      "description": undefined,
-      "message": "Message",
-    },
-  ],
-]
-`;
-
-exports[`dev/i18n/extractors/html throws on empty i18n-id 1`] = `
-Array [
-  Array [
-    [Error: Empty "i18n-id" value in angular directive is not allowed.],
-  ],
-]
-`;
-
-exports[`dev/i18n/extractors/html throws on i18n filter usage in complex angular expression 1`] = `
-Array [
-  Array [
-    [Error: Couldn't parse angular i18n expression:
-Missing semicolon. (1:5):
- mode as ('metricVis.colorModes.' + mode],
-  ],
-]
-`;
-
-exports[`dev/i18n/extractors/html throws on missing i18n-default-message attribute 1`] = `
-Array [
-  Array [
-    [Error: Empty defaultMessage in angular directive is not allowed ("message-id").],
-  ],
-]
-`;
diff --git a/src/dev/i18n/extractors/html.js b/src/dev/i18n/extractors/html.js
deleted file mode 100644
index 922f67ac2fb09..0000000000000
--- a/src/dev/i18n/extractors/html.js
+++ /dev/null
@@ -1,252 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import cheerio from 'cheerio';
-import { parse } from '@babel/parser';
-import { isObjectExpression, isStringLiteral } from '@babel/types';
-
-import {
-  isPropertyWithKey,
-  formatHTMLString,
-  formatJSString,
-  traverseNodes,
-  checkValuesProperty,
-  createParserErrorMessage,
-  extractMessageValueFromNode,
-  extractValuesKeysFromNode,
-  extractDescriptionValueFromNode,
-} from '../utils';
-import { DEFAULT_MESSAGE_KEY, DESCRIPTION_KEY, VALUES_KEY } from '../constants';
-import { createFailError, isFailError } from '@kbn/dev-utils';
-
-/**
- * Find all substrings of "{{ any text }}" pattern allowing '{' and '}' chars in single quote strings
- *
- * Example: `{{ ::'message.id' | i18n: { defaultMessage: 'Message with {{curlyBraces}}' } }}`
- */
-const ANGULAR_EXPRESSION_REGEX = /{{([^{}]|({([^']|('([^']|(\\'))*'))*?}))*}}+/g;
-
-const LINEBREAK_REGEX = /\n/g;
-const I18N_FILTER_MARKER = '| i18n: ';
-
-function parseExpression(expression) {
-  let ast;
-
-  try {
-    ast = parse(`+${expression}`.replace(LINEBREAK_REGEX, ' '));
-  } catch (error) {
-    if (error instanceof SyntaxError) {
-      const errorWithContext = createParserErrorMessage(` ${expression}`, error);
-      throw createFailError(`Couldn't parse angular i18n expression:\n${errorWithContext}`);
-    }
-  }
-
-  return ast;
-}
-
-/**
- * Extract default message from an angular filter expression argument
- * @param {string} expression JavaScript code containing a filter object
- * @param {string} messageId id of the message
- * @returns {{ message?: string, description?: string, valuesKeys: string[]] }}
- */
-function parseFilterObjectExpression(expression, messageId) {
-  const ast = parseExpression(expression);
-  const objectExpressionNode = [...traverseNodes(ast.program.body)].find((node) =>
-    isObjectExpression(node)
-  );
-
-  if (!objectExpressionNode) {
-    return {};
-  }
-
-  const [messageProperty, descriptionProperty, valuesProperty] = [
-    DEFAULT_MESSAGE_KEY,
-    DESCRIPTION_KEY,
-    VALUES_KEY,
-  ].map((key) =>
-    objectExpressionNode.properties.find((property) => isPropertyWithKey(property, key))
-  );
-
-  const message = messageProperty
-    ? formatJSString(extractMessageValueFromNode(messageProperty.value, messageId))
-    : undefined;
-
-  const description = descriptionProperty
-    ? formatJSString(extractDescriptionValueFromNode(descriptionProperty.value, messageId))
-    : undefined;
-
-  const valuesKeys = valuesProperty
-    ? extractValuesKeysFromNode(valuesProperty.value, messageId)
-    : [];
-
-  return { message, description, valuesKeys };
-}
-
-function parseIdExpression(expression) {
-  const ast = parseExpression(expression);
-  const stringNode = [...traverseNodes(ast.program.body)].find((node) => isStringLiteral(node));
-
-  if (!stringNode) {
-    throw createFailError(`Message id should be a string literal, but got: \n${expression}`);
-  }
-
-  return stringNode ? formatJSString(stringNode.value) : null;
-}
-
-function trimCurlyBraces(string) {
-  if (string.startsWith('{{') && string.endsWith('}}')) {
-    return string.slice(2, -2).trim();
-  }
-
-  return string;
-}
-
-/**
- * Removes one-time binding operator `::` from the start of a string.
- *
- * Example: `::'id' | i18n: { defaultMessage: 'Message' }`
- * @param {string} string string to trim
- */
-function trimOneTimeBindingOperator(string) {
-  if (string.startsWith('::')) {
-    return string.slice(2);
-  }
-
-  return string;
-}
-
-function* extractExpressions(htmlContent) {
-  const elements = cheerio.load(htmlContent)('*').toArray();
-
-  for (const element of elements) {
-    for (const node of element.children) {
-      if (node.type === 'text') {
-        yield* (node.data.match(ANGULAR_EXPRESSION_REGEX) || [])
-          .filter((expression) => expression.includes(I18N_FILTER_MARKER))
-          .map(trimCurlyBraces);
-      }
-    }
-
-    for (const attribute of Object.values(element.attribs)) {
-      if (attribute.includes(I18N_FILTER_MARKER)) {
-        yield trimCurlyBraces(attribute);
-      }
-    }
-  }
-}
-
-function* getFilterMessages(htmlContent, reporter) {
-  for (const expression of extractExpressions(htmlContent)) {
-    const filterStart = expression.indexOf(I18N_FILTER_MARKER);
-
-    const idExpression = trimOneTimeBindingOperator(expression.slice(0, filterStart).trim());
-    const filterObjectExpression = expression.slice(filterStart + I18N_FILTER_MARKER.length).trim();
-
-    try {
-      if (!filterObjectExpression || !idExpression) {
-        throw createFailError(`Cannot parse i18n filter expression: ${expression}`);
-      }
-
-      const messageId = parseIdExpression(idExpression);
-
-      if (!messageId) {
-        throw createFailError('Empty "id" value in angular filter expression is not allowed.');
-      }
-
-      const { message, description, valuesKeys } = parseFilterObjectExpression(
-        filterObjectExpression,
-        messageId
-      );
-
-      if (!message) {
-        throw createFailError(
-          `Empty defaultMessage in angular filter expression is not allowed ("${messageId}").`
-        );
-      }
-
-      checkValuesProperty(valuesKeys, message, messageId);
-
-      yield [messageId, { message, description }];
-    } catch (error) {
-      if (!isFailError(error)) {
-        throw error;
-      }
-
-      reporter.report(error);
-    }
-  }
-}
-
-function* getDirectiveMessages(htmlContent, reporter) {
-  const $ = cheerio.load(htmlContent);
-
-  const elements = $('[i18n-id]')
-    .map((idx, el) => {
-      const $el = $(el);
-
-      return {
-        id: $el.attr('i18n-id'),
-        defaultMessage: $el.attr('i18n-default-message'),
-        description: $el.attr('i18n-description'),
-        values: $el.attr('i18n-values'),
-      };
-    })
-    .toArray();
-
-  for (const element of elements) {
-    const messageId = formatHTMLString(element.id);
-    if (!messageId) {
-      reporter.report(
-        createFailError('Empty "i18n-id" value in angular directive is not allowed.')
-      );
-      continue;
-    }
-
-    const message = formatHTMLString(element.defaultMessage);
-    if (!message) {
-      reporter.report(
-        createFailError(
-          `Empty defaultMessage in angular directive is not allowed ("${messageId}").`
-        )
-      );
-      continue;
-    }
-
-    try {
-      if (element.values) {
-        const ast = parseExpression(element.values);
-        const valuesObjectNode = [...traverseNodes(ast.program.body)].find((node) =>
-          isObjectExpression(node)
-        );
-        const valuesKeys = extractValuesKeysFromNode(valuesObjectNode);
-
-        checkValuesProperty(valuesKeys, message, messageId);
-      } else {
-        checkValuesProperty([], message, messageId);
-      }
-
-      yield [
-        messageId,
-        { message, description: formatHTMLString(element.description) || undefined },
-      ];
-    } catch (error) {
-      if (!isFailError(error)) {
-        throw error;
-      }
-
-      reporter.report(error);
-    }
-  }
-}
-
-export function* extractHtmlMessages(buffer, reporter) {
-  const content = buffer.toString();
-  yield* getDirectiveMessages(content, reporter);
-  yield* getFilterMessages(content, reporter);
-}
diff --git a/src/dev/i18n/extractors/html.test.js b/src/dev/i18n/extractors/html.test.js
deleted file mode 100644
index 5f0c7ac39e8f6..0000000000000
--- a/src/dev/i18n/extractors/html.test.js
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { extractHtmlMessages } from './html';
-
-const htmlSourceBuffer = Buffer.from(`
-<div name="dashboard">
-  <div>
-    <p
-      i18n-id="kbn.dashboard.id-1"
-      i18n-default-message="Message text 1 {value}"
-      i18n-description="Message description 1"
-      i18n-values="{
-        value: 'Multiline
-                string',
-      }"
-    ></p>
-  </div>
-  <div>
-    {{ 'kbn.dashboard.id-2' | i18n: { defaultMessage: 'Message text 2' } }}
-  </div>
-  <div>
-    {{ 'kbn.dashboard.id-3' | i18n: { defaultMessage: 'Message text 3', description: 'Message description 3' } }}
-  </div>
-</div>
-`);
-
-const report = jest.fn();
-
-describe('dev/i18n/extractors/html', () => {
-  beforeEach(() => {
-    report.mockClear();
-  });
-
-  test('extracts default messages from HTML', () => {
-    const actual = Array.from(extractHtmlMessages(htmlSourceBuffer));
-    expect(actual.sort()).toMatchSnapshot();
-  });
-
-  test('extracts default messages from HTML with one-time binding', () => {
-    const actual = Array.from(
-      extractHtmlMessages(`
-<div>
-  {{::'kbn.id' | i18n: { defaultMessage: 'Message text with {value}', values: { value: 'value' } }}}
-</div>
-`)
-    );
-    expect(actual.sort()).toMatchSnapshot();
-  });
-
-  test('throws on empty i18n-id', () => {
-    const source = Buffer.from(`\
-<p
-  i18n-id=""
-  i18n-default-message="Message text"
-  i18n-description="Message description"
-></p>
-`);
-
-    expect(() => extractHtmlMessages(source, { report }).next()).not.toThrow();
-    expect(report.mock.calls).toMatchSnapshot();
-  });
-
-  test('throws on missing i18n-default-message attribute', () => {
-    const source = Buffer.from(`\
-<p
-  i18n-id="message-id"
-></p>
-`);
-
-    expect(() => extractHtmlMessages(source, { report }).next()).not.toThrow();
-    expect(report.mock.calls).toMatchSnapshot();
-  });
-
-  test('throws on i18n filter usage in complex angular expression', () => {
-    const source = Buffer.from(`\
-<div
-  ng-options="mode as ('metricVis.colorModes.' + mode | i18n: { defaultMessage: mode }) for mode in collections.metricColorMode"
-></div>
-`);
-
-    expect(() => extractHtmlMessages(source, { report }).next()).not.toThrow();
-    expect(report.mock.calls).toMatchSnapshot();
-  });
-
-  test('extracts message from i18n filter in interpolating directive', () => {
-    const source = Buffer.from(`
-<icon-tip
-  content="::'namespace.messageId' | i18n: {
-    defaultMessage: 'Message'
-  }"
-  position="'right'"
-></icon-tip>
-`);
-
-    expect(Array.from(extractHtmlMessages(source))).toMatchSnapshot();
-  });
-});
diff --git a/src/dev/i18n/extractors/index.js b/src/dev/i18n/extractors/index.js
index dc269586f5abe..601a080c80b1b 100644
--- a/src/dev/i18n/extractors/index.js
+++ b/src/dev/i18n/extractors/index.js
@@ -7,4 +7,3 @@
  */
 
 export { extractCodeMessages } from './code';
-export { extractHtmlMessages } from './html';
diff --git a/src/dev/license_checker/config.ts b/src/dev/license_checker/config.ts
index a4ae39848735e..efa54e74fdf2f 100644
--- a/src/dev/license_checker/config.ts
+++ b/src/dev/license_checker/config.ts
@@ -75,6 +75,6 @@ export const LICENSE_OVERRIDES = {
   'jsts@1.6.2': ['Eclipse Distribution License - v 1.0'], // cf. https://github.com/bjornharrtell/jsts
   '@mapbox/jsonlint-lines-primitives@2.0.2': ['MIT'], // license in readme https://github.com/tmcw/jsonlint
   '@elastic/ems-client@7.16.0': ['Elastic License 2.0'],
-  '@elastic/eui@39.0.0': ['SSPL-1.0 OR Elastic License 2.0'],
+  '@elastic/eui@39.1.1': ['SSPL-1.0 OR Elastic License 2.0'],
   'language-subtag-registry@0.3.21': ['CC-BY-4.0'], // retired ODC‑By license https://github.com/mattcg/language-subtag-registry
 };
diff --git a/src/plugins/console/public/index.ts b/src/plugins/console/public/index.ts
index 8c4a107108565..9a9c5896cd26d 100644
--- a/src/plugins/console/public/index.ts
+++ b/src/plugins/console/public/index.ts
@@ -7,13 +7,14 @@
  */
 
 import './index.scss';
+import { PluginInitializerContext } from 'src/core/public';
 
 import { ConsoleUIPlugin } from './plugin';
 
-export type { ConsoleUILocatorParams } from './plugin';
+export type { ConsoleUILocatorParams, ConsolePluginSetup } from './types';
 
 export { ConsoleUIPlugin as Plugin };
 
-export function plugin() {
-  return new ConsoleUIPlugin();
+export function plugin(ctx: PluginInitializerContext) {
+  return new ConsoleUIPlugin(ctx);
 }
diff --git a/src/plugins/console/public/plugin.ts b/src/plugins/console/public/plugin.ts
index e3791df6a2db6..d61769c23dfe0 100644
--- a/src/plugins/console/public/plugin.ts
+++ b/src/plugins/console/public/plugin.ts
@@ -7,77 +7,87 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { SerializableRecord } from '@kbn/utility-types';
-import { Plugin, CoreSetup } from 'src/core/public';
+import { Plugin, CoreSetup, PluginInitializerContext } from 'src/core/public';
 
 import { FeatureCatalogueCategory } from '../../home/public';
-import { AppSetupUIPluginDependencies } from './types';
-
-export interface ConsoleUILocatorParams extends SerializableRecord {
-  loadFrom?: string;
-}
+import {
+  AppSetupUIPluginDependencies,
+  ClientConfigType,
+  ConsolePluginSetup,
+  ConsoleUILocatorParams,
+} from './types';
 
 export class ConsoleUIPlugin implements Plugin<void, void, AppSetupUIPluginDependencies> {
+  constructor(private ctx: PluginInitializerContext) {}
+
   public setup(
     { notifications, getStartServices, http }: CoreSetup,
     { devTools, home, share, usageCollection }: AppSetupUIPluginDependencies
-  ) {
-    if (home) {
-      home.featureCatalogue.register({
+  ): ConsolePluginSetup {
+    const {
+      ui: { enabled: isConsoleUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
+
+    if (isConsoleUiEnabled) {
+      if (home) {
+        home.featureCatalogue.register({
+          id: 'console',
+          title: i18n.translate('console.devToolsTitle', {
+            defaultMessage: 'Interact with the Elasticsearch API',
+          }),
+          description: i18n.translate('console.devToolsDescription', {
+            defaultMessage: 'Skip cURL and use a JSON interface to work with your data in Console.',
+          }),
+          icon: 'consoleApp',
+          path: '/app/dev_tools#/console',
+          showOnHomePage: false,
+          category: FeatureCatalogueCategory.ADMIN,
+        });
+      }
+
+      devTools.register({
         id: 'console',
-        title: i18n.translate('console.devToolsTitle', {
-          defaultMessage: 'Interact with the Elasticsearch API',
-        }),
-        description: i18n.translate('console.devToolsDescription', {
-          defaultMessage: 'Skip cURL and use a JSON interface to work with your data in Console.',
+        order: 1,
+        title: i18n.translate('console.consoleDisplayName', {
+          defaultMessage: 'Console',
         }),
-        icon: 'consoleApp',
-        path: '/app/dev_tools#/console',
-        showOnHomePage: false,
-        category: FeatureCatalogueCategory.ADMIN,
-      });
-    }
+        enableRouting: false,
+        mount: async ({ element }) => {
+          const [core] = await getStartServices();
 
-    devTools.register({
-      id: 'console',
-      order: 1,
-      title: i18n.translate('console.consoleDisplayName', {
-        defaultMessage: 'Console',
-      }),
-      enableRouting: false,
-      mount: async ({ element }) => {
-        const [core] = await getStartServices();
+          const {
+            i18n: { Context: I18nContext },
+            docLinks: { DOC_LINK_VERSION },
+          } = core;
 
-        const {
-          i18n: { Context: I18nContext },
-          docLinks: { DOC_LINK_VERSION },
-        } = core;
+          const { renderApp } = await import('./application');
 
-        const { renderApp } = await import('./application');
+          return renderApp({
+            http,
+            docLinkVersion: DOC_LINK_VERSION,
+            I18nContext,
+            notifications,
+            usageCollection,
+            element,
+          });
+        },
+      });
 
-        return renderApp({
-          http,
-          docLinkVersion: DOC_LINK_VERSION,
-          I18nContext,
-          notifications,
-          usageCollection,
-          element,
-        });
-      },
-    });
+      const locator = share.url.locators.create<ConsoleUILocatorParams>({
+        id: 'CONSOLE_APP_LOCATOR',
+        getLocation: async ({ loadFrom }) => {
+          return {
+            app: 'dev_tools',
+            path: `#/console${loadFrom ? `?load_from=${loadFrom}` : ''}`,
+            state: { loadFrom },
+          };
+        },
+      });
 
-    const locator = share.url.locators.create<ConsoleUILocatorParams>({
-      id: 'CONSOLE_APP_LOCATOR',
-      getLocation: async ({ loadFrom }) => {
-        return {
-          app: 'dev_tools',
-          path: `#/console${loadFrom ? `?load_from=${loadFrom}` : ''}`,
-          state: { loadFrom },
-        };
-      },
-    });
+      return { locator };
+    }
 
-    return { locator };
+    return {};
   }
 
   public start() {}
diff --git a/src/plugins/console/public/types/config.ts b/src/plugins/console/public/types/config.ts
new file mode 100644
index 0000000000000..da41eef6f5484
--- /dev/null
+++ b/src/plugins/console/public/types/config.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export interface ClientConfigType {
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/src/plugins/console/public/types/index.ts b/src/plugins/console/public/types/index.ts
index b98adbf5610cd..d8b6aaf7b12c4 100644
--- a/src/plugins/console/public/types/index.ts
+++ b/src/plugins/console/public/types/index.ts
@@ -11,3 +11,5 @@ export * from './core_editor';
 export * from './token';
 export * from './tokens_provider';
 export * from './common';
+export { ClientConfigType } from './config';
+export { ConsoleUILocatorParams } from './locator';
diff --git a/src/plugins/console/public/types/locator.ts b/src/plugins/console/public/types/locator.ts
new file mode 100644
index 0000000000000..f3a42338aaadc
--- /dev/null
+++ b/src/plugins/console/public/types/locator.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { SerializableRecord } from '@kbn/utility-types';
+
+export interface ConsoleUILocatorParams extends SerializableRecord {
+  loadFrom?: string;
+}
diff --git a/src/plugins/console/public/types/plugin_dependencies.ts b/src/plugins/console/public/types/plugin_dependencies.ts
index 444776f47ea13..afc49f9a5a986 100644
--- a/src/plugins/console/public/types/plugin_dependencies.ts
+++ b/src/plugins/console/public/types/plugin_dependencies.ts
@@ -9,7 +9,9 @@
 import { HomePublicPluginSetup } from '../../../home/public';
 import { DevToolsSetup } from '../../../dev_tools/public';
 import { UsageCollectionSetup } from '../../../usage_collection/public';
-import { SharePluginSetup } from '../../../share/public';
+import { SharePluginSetup, LocatorPublic } from '../../../share/public';
+
+import { ConsoleUILocatorParams } from './locator';
 
 export interface AppSetupUIPluginDependencies {
   home?: HomePublicPluginSetup;
@@ -17,3 +19,7 @@ export interface AppSetupUIPluginDependencies {
   share: SharePluginSetup;
   usageCollection?: UsageCollectionSetup;
 }
+
+export interface ConsolePluginSetup {
+  locator?: LocatorPublic<ConsoleUILocatorParams>;
+}
diff --git a/src/plugins/console/server/config.ts b/src/plugins/console/server/config.ts
index 6d667fed081e8..024777aa8d252 100644
--- a/src/plugins/console/server/config.ts
+++ b/src/plugins/console/server/config.ts
@@ -7,6 +7,8 @@
  */
 
 import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginConfigDescriptor } from 'kibana/server';
 
@@ -14,62 +16,171 @@ import { MAJOR_VERSION } from '../common/constants';
 
 const kibanaVersion = new SemVer(MAJOR_VERSION);
 
-const baseSettings = {
-  enabled: schema.boolean({ defaultValue: true }),
-  ssl: schema.object({ verify: schema.boolean({ defaultValue: false }) }, {}),
-};
-
-// Settings only available in 7.x
-const deprecatedSettings = {
-  proxyFilter: schema.arrayOf(schema.string(), { defaultValue: ['.*'] }),
-  proxyConfig: schema.arrayOf(
-    schema.object({
-      match: schema.object({
-        protocol: schema.string({ defaultValue: '*' }),
-        host: schema.string({ defaultValue: '*' }),
-        port: schema.string({ defaultValue: '*' }),
-        path: schema.string({ defaultValue: '*' }),
-      }),
-
-      timeout: schema.number(),
-      ssl: schema.object(
-        {
-          verify: schema.boolean(),
-          ca: schema.arrayOf(schema.string()),
-          cert: schema.string(),
-          key: schema.string(),
-        },
-        { defaultValue: undefined }
-      ),
-    }),
-    { defaultValue: [] }
-  ),
-};
-
-const configSchema = schema.object(
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
   {
-    ...baseSettings,
+    ssl: schema.object({ verify: schema.boolean({ defaultValue: false }) }, {}),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
   },
   { defaultValue: undefined }
 );
 
-const configSchema7x = schema.object(
+const configLatest: PluginConfigDescriptor<ConsoleConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type ConsoleConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
   {
-    ...baseSettings,
-    ...deprecatedSettings,
+    enabled: schema.boolean({ defaultValue: true }),
+    proxyFilter: schema.arrayOf(schema.string(), { defaultValue: ['.*'] }),
+    proxyConfig: schema.arrayOf(
+      schema.object({
+        match: schema.object({
+          protocol: schema.string({ defaultValue: '*' }),
+          host: schema.string({ defaultValue: '*' }),
+          port: schema.string({ defaultValue: '*' }),
+          path: schema.string({ defaultValue: '*' }),
+        }),
+
+        timeout: schema.number(),
+        ssl: schema.object(
+          {
+            verify: schema.boolean(),
+            ca: schema.arrayOf(schema.string()),
+            cert: schema.string(),
+            key: schema.string(),
+          },
+          { defaultValue: undefined }
+        ),
+      }),
+      { defaultValue: [] }
+    ),
+    ssl: schema.object({ verify: schema.boolean({ defaultValue: false }) }, {}),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
   },
   { defaultValue: undefined }
 );
 
-export type ConfigType = TypeOf<typeof configSchema>;
-export type ConfigType7x = TypeOf<typeof configSchema7x>;
+export type ConsoleConfig7x = TypeOf<typeof schema7x>;
 
-export const config: PluginConfigDescriptor<ConfigType | ConfigType7x> = {
-  schema: kibanaVersion.major < 8 ? configSchema7x : configSchema,
+const config7x: PluginConfigDescriptor<ConsoleConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
   deprecations: ({ deprecate, unused }) => [
-    deprecate('enabled', '8.0.0'),
-    deprecate('proxyFilter', '8.0.0'),
-    deprecate('proxyConfig', '8.0.0'),
     unused('ssl'),
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'console.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'console.enabled',
+        level: 'critical',
+        title: i18n.translate('console.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "console.enabled" is deprecated',
+        }),
+        message: i18n.translate('console.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Console UI, use the "console.ui.enabled" setting instead of "console.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('console.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('console.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage: 'Change the "console.enabled" setting to "console.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'console.proxyConfig') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'console.proxyConfig',
+        level: 'critical',
+        title: i18n.translate('console.deprecations.proxyConfigTitle', {
+          defaultMessage: 'Setting "console.proxyConfig" is deprecated',
+        }),
+        message: i18n.translate('console.deprecations.proxyConfigMessage', {
+          defaultMessage:
+            'Configuring "console.proxyConfig" is deprecated and will be removed in 8.0.0. To secure your connection between Kibana and Elasticsearch use the standard "server.ssl.*" settings instead.',
+        }),
+        documentationUrl: 'https://ela.st/encrypt-kibana-browser',
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('console.deprecations.proxyConfig.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('console.deprecations.proxyConfig.manualStepTwoMessage', {
+              defaultMessage: 'Remove the "console.proxyConfig" setting.',
+            }),
+            i18n.translate('console.deprecations.proxyConfig.manualStepThreeMessage', {
+              defaultMessage:
+                'Configure the secure connection between Kibana and Elasticsearch using the "server.ssl.*" settings.',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'console.proxyFilter') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'console.proxyFilter',
+        level: 'critical',
+        title: i18n.translate('console.deprecations.proxyFilterTitle', {
+          defaultMessage: 'Setting "console.proxyFilter" is deprecated',
+        }),
+        message: i18n.translate('console.deprecations.proxyFilterMessage', {
+          defaultMessage:
+            'Configuring "console.proxyFilter" is deprecated and will be removed in 8.0.0. To secure your connection between Kibana and Elasticsearch use the standard "server.ssl.*" settings instead.',
+        }),
+        documentationUrl: 'https://ela.st/encrypt-kibana-browser',
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('console.deprecations.proxyFilter.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('console.deprecations.proxyFilter.manualStepTwoMessage', {
+              defaultMessage: 'Remove the "console.proxyFilter" setting.',
+            }),
+            i18n.translate('console.deprecations.proxyFilter.manualStepThreeMessage', {
+              defaultMessage:
+                'Configure the secure connection between Kibana and Elasticsearch using the "server.ssl.*" settings.',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
   ],
 };
+
+export const config: PluginConfigDescriptor<ConsoleConfig | ConsoleConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/src/plugins/console/server/index.ts b/src/plugins/console/server/index.ts
index 6ae518f5dc796..b270b89a3d45a 100644
--- a/src/plugins/console/server/index.ts
+++ b/src/plugins/console/server/index.ts
@@ -11,6 +11,7 @@ import { PluginInitializerContext } from 'kibana/server';
 import { ConsoleServerPlugin } from './plugin';
 
 export { ConsoleSetup, ConsoleStart } from './types';
+
 export { config } from './config';
 
 export const plugin = (ctx: PluginInitializerContext) => new ConsoleServerPlugin(ctx);
diff --git a/src/plugins/console/server/plugin.ts b/src/plugins/console/server/plugin.ts
index 613337b286fbf..5543c40d03cb0 100644
--- a/src/plugins/console/server/plugin.ts
+++ b/src/plugins/console/server/plugin.ts
@@ -11,7 +11,7 @@ import { SemVer } from 'semver';
 
 import { ProxyConfigCollection } from './lib';
 import { SpecDefinitionsService, EsLegacyConfigService } from './services';
-import { ConfigType, ConfigType7x } from './config';
+import { ConsoleConfig, ConsoleConfig7x } from './config';
 
 import { registerRoutes } from './routes';
 
@@ -24,11 +24,11 @@ export class ConsoleServerPlugin implements Plugin<ConsoleSetup, ConsoleStart> {
 
   esLegacyConfigService = new EsLegacyConfigService();
 
-  constructor(private readonly ctx: PluginInitializerContext<ConfigType | ConfigType7x>) {
+  constructor(private readonly ctx: PluginInitializerContext<ConsoleConfig | ConsoleConfig7x>) {
     this.log = this.ctx.logger.get();
   }
 
-  setup({ http, capabilities, getStartServices, elasticsearch }: CoreSetup) {
+  setup({ http, capabilities, elasticsearch }: CoreSetup) {
     capabilities.registerProvider(() => ({
       dev_tools: {
         show: true,
@@ -43,8 +43,8 @@ export class ConsoleServerPlugin implements Plugin<ConsoleSetup, ConsoleStart> {
     let proxyConfigCollection: ProxyConfigCollection | undefined;
     if (kibanaVersion.major < 8) {
       // "pathFilters" and "proxyConfig" are only used in 7.x
-      pathFilters = (config as ConfigType7x).proxyFilter.map((str: string) => new RegExp(str));
-      proxyConfigCollection = new ProxyConfigCollection((config as ConfigType7x).proxyConfig);
+      pathFilters = (config as ConsoleConfig7x).proxyFilter.map((str: string) => new RegExp(str));
+      proxyConfigCollection = new ProxyConfigCollection((config as ConsoleConfig7x).proxyConfig);
     }
 
     this.esLegacyConfigService.setup(elasticsearch.legacy.config$);
diff --git a/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts b/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts
index 8772f14a6ec4c..4afb42aa841bb 100644
--- a/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts
+++ b/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts
@@ -114,14 +114,14 @@ export function createSavedDashboardClass(
         },
 
         // if this is null/undefined then the SavedObject will be assigned the defaults
-        id: typeof arg === 'string' ? arg : arg.id,
+        id: typeof arg === 'object' ? arg.id : arg,
 
         // default values that will get assigned if the doc is new
         defaults,
       });
 
-      const id: string = typeof arg === 'string' ? arg : arg.id;
-      const useResolve = typeof arg === 'string' ? false : arg.useResolve;
+      const id: string = typeof arg === 'object' ? arg.id : arg;
+      const useResolve = typeof arg === 'object' ? arg.useResolve : false;
 
       this.getFullPath = () => `/app/dashboards#${createDashboardEditUrl(this.aliasId || this.id)}`;
 
diff --git a/src/plugins/data/common/search/aggs/metrics/single_percentile.test.ts b/src/plugins/data/common/search/aggs/metrics/single_percentile.test.ts
index c2ba6ee1a403a..967e1b1f624aa 100644
--- a/src/plugins/data/common/search/aggs/metrics/single_percentile.test.ts
+++ b/src/plugins/data/common/search/aggs/metrics/single_percentile.test.ts
@@ -73,6 +73,11 @@ describe('AggTypeMetricSinglePercentileProvider class', () => {
     ).toEqual(123);
   });
 
+  it('should not throw error for empty buckets', () => {
+    const agg = aggConfigs.getResponseAggs()[0];
+    expect(agg.getValue({})).toEqual(NaN);
+  });
+
   it('produces the expected expression ast', () => {
     const agg = aggConfigs.getResponseAggs()[0];
     expect(agg.toExpressionAst()).toMatchInlineSnapshot(`
diff --git a/src/plugins/data/common/search/aggs/metrics/single_percentile.ts b/src/plugins/data/common/search/aggs/metrics/single_percentile.ts
index 4bdafcae327cd..954576e2bbe1f 100644
--- a/src/plugins/data/common/search/aggs/metrics/single_percentile.ts
+++ b/src/plugins/data/common/search/aggs/metrics/single_percentile.ts
@@ -57,7 +57,9 @@ export const getSinglePercentileMetricAgg = () => {
       if (Number.isInteger(agg.params.percentile)) {
         valueKey += '.0';
       }
-      return bucket[agg.id].values[valueKey];
+      const { values } = bucket[agg.id] ?? {};
+
+      return values ? values[valueKey] : NaN;
     },
   });
 };
diff --git a/src/plugins/data/common/search/tabify/tabify_docs.test.ts b/src/plugins/data/common/search/tabify/tabify_docs.test.ts
index a2910a1be4a9a..1964247b09585 100644
--- a/src/plugins/data/common/search/tabify/tabify_docs.test.ts
+++ b/src/plugins/data/common/search/tabify/tabify_docs.test.ts
@@ -41,6 +41,11 @@ function create(id: string) {
   });
 }
 
+const meta = {
+  _index: 'index-name',
+  _id: '1',
+};
+
 describe('tabify_docs', () => {
   describe('flattenHit', () => {
     let indexPattern: DataView;
@@ -70,6 +75,50 @@ describe('tabify_docs', () => {
       expect(Object.keys(response)).toEqual(expectedOrder);
       expect(Object.entries(response).map(([key]) => key)).toEqual(expectedOrder);
     });
+
+    it('does merge values from ignored_field_values and fields correctly', () => {
+      const flatten = flattenHit(
+        {
+          ...meta,
+          fields: { 'extension.keyword': ['foo'], extension: ['foo', 'ignored'] },
+          ignored_field_values: {
+            'extension.keyword': ['ignored'],
+            fully_ignored: ['some', 'value'],
+          },
+        },
+        indexPattern,
+        { includeIgnoredValues: true }
+      );
+      expect(flatten).toHaveProperty(['extension.keyword'], ['foo', 'ignored']);
+      expect(flatten).toHaveProperty('extension', ['foo', 'ignored']);
+      expect(flatten).toHaveProperty('fully_ignored', ['some', 'value']);
+    });
+
+    it('does not merge values from ignored_field_values into _source', () => {
+      const flatten = flattenHit(
+        {
+          ...meta,
+          _source: { 'extension.keyword': ['foo', 'ignored'] },
+          ignored_field_values: { 'extension.keyword': ['ignored'] },
+        },
+        indexPattern,
+        { includeIgnoredValues: true, source: true }
+      );
+      expect(flatten).toHaveProperty(['extension.keyword'], ['foo', 'ignored']);
+    });
+
+    it('does merge ignored_field_values when no _source was present, even when parameter was on', () => {
+      const flatten = flattenHit(
+        {
+          ...meta,
+          fields: { 'extension.keyword': ['foo'] },
+          ignored_field_values: { 'extension.keyword': ['ignored'] },
+        },
+        indexPattern,
+        { includeIgnoredValues: true, source: true }
+      );
+      expect(flatten).toHaveProperty(['extension.keyword'], ['foo', 'ignored']);
+    });
   });
 
   describe('tabifyDocs', () => {
diff --git a/src/plugins/data/common/search/tabify/tabify_docs.ts b/src/plugins/data/common/search/tabify/tabify_docs.ts
index 4259488771761..353a0c10ba12a 100644
--- a/src/plugins/data/common/search/tabify/tabify_docs.ts
+++ b/src/plugins/data/common/search/tabify/tabify_docs.ts
@@ -55,8 +55,18 @@ export interface TabifyDocsOptions {
    * merged into the flattened document.
    */
   source?: boolean;
+  /**
+   * If set to `true` values that have been ignored in ES (ignored_field_values)
+   * will be merged into the flattened document. This will only have an effect if
+   * the `hit` has been retrieved using the `fields` option.
+   */
+  includeIgnoredValues?: boolean;
 }
 
+// This is an overwrite of the SearchHit type to add the ignored_field_values.
+// Can be removed once the estypes.SearchHit knows about ignored_field_values
+type Hit<T = unknown> = estypes.SearchHit<T> & { ignored_field_values?: Record<string, unknown[]> };
+
 /**
  * Flattens an individual hit (from an ES response) into an object. This will
  * create flattened field names, like `user.name`.
@@ -65,11 +75,7 @@ export interface TabifyDocsOptions {
  * @param indexPattern The index pattern for the requested index if available.
  * @param params Parameters how to flatten the hit
  */
-export function flattenHit(
-  hit: estypes.SearchHit,
-  indexPattern?: IndexPattern,
-  params?: TabifyDocsOptions
-) {
+export function flattenHit(hit: Hit, indexPattern?: IndexPattern, params?: TabifyDocsOptions) {
   const flat = {} as Record<string, any>;
 
   function flatten(obj: Record<string, any>, keyPrefix: string = '') {
@@ -109,6 +115,28 @@ export function flattenHit(
   flatten(hit.fields || {});
   if (params?.source !== false && hit._source) {
     flatten(hit._source as Record<string, any>);
+  } else if (params?.includeIgnoredValues && hit.ignored_field_values) {
+    // If enabled merge the ignored_field_values into the flattened hit. This will
+    // merge values that are not actually indexed by ES (i.e. ignored), e.g. because
+    // they were above the `ignore_above` limit or malformed for specific types.
+    // This API will only contain the values that were actually ignored, i.e. for the same
+    // field there might exist another value in the `fields` response, why this logic
+    // merged them both together. We do not merge this (even if enabled) in case source has been
+    // merged, since we would otherwise duplicate values, since ignore_field_values and _source
+    // contain the same values.
+    Object.entries(hit.ignored_field_values).forEach(([fieldName, fieldValue]) => {
+      if (flat[fieldName]) {
+        // If there was already a value from the fields API, make sure we're merging both together
+        if (Array.isArray(flat[fieldName])) {
+          flat[fieldName] = [...flat[fieldName], ...fieldValue];
+        } else {
+          flat[fieldName] = [flat[fieldName], ...fieldValue];
+        }
+      } else {
+        // If no previous value was assigned we can simply use the value from `ignored_field_values` as it is
+        flat[fieldName] = fieldValue;
+      }
+    });
   }
 
   // Merge all valid meta fields into the flattened object
diff --git a/src/plugins/data/public/utils/table_inspector_view/components/__snapshots__/data_view.test.tsx.snap b/src/plugins/data/public/utils/table_inspector_view/components/__snapshots__/data_view.test.tsx.snap
index eae2032748396..7773f2209bf96 100644
--- a/src/plugins/data/public/utils/table_inspector_view/components/__snapshots__/data_view.test.tsx.snap
+++ b/src/plugins/data/public/utils/table_inspector_view/components/__snapshots__/data_view.test.tsx.snap
@@ -1220,93 +1220,75 @@ exports[`Inspector Data View component should render single table without select
                 </table>
               </EuiTable>
             </div>
-            <PaginationBar
-              aria-controls="__table_generated-id"
-              onPageChange={[Function]}
-              onPageSizeChange={[Function]}
-              pagination={
+            <EuiI18n
+              default="Pagination for table: {tableCaption}"
+              token="euiBasicTable.tablePagination"
+              values={
                 Object {
-                  "hidePerPageOptions": undefined,
-                  "pageIndex": 0,
-                  "pageSize": 20,
-                  "pageSizeOptions": Array [
-                    10,
-                    20,
-                    50,
-                  ],
-                  "totalItemCount": 1,
+                  "tableCaption": undefined,
                 }
               }
             >
-              <div>
-                <EuiSpacer
-                  size="m"
-                >
-                  <div
-                    className="euiSpacer euiSpacer--m"
-                  />
-                </EuiSpacer>
-                <EuiTablePagination
-                  activePage={0}
-                  aria-controls="__table_generated-id"
-                  itemsPerPage={20}
-                  itemsPerPageOptions={
-                    Array [
+              <PaginationBar
+                aria-controls="__table_generated-id"
+                aria-label="Pagination for table: "
+                onPageChange={[Function]}
+                onPageSizeChange={[Function]}
+                pagination={
+                  Object {
+                    "hidePerPageOptions": undefined,
+                    "pageIndex": 0,
+                    "pageSize": 20,
+                    "pageSizeOptions": Array [
                       10,
                       20,
                       50,
-                    ]
+                    ],
+                    "totalItemCount": 1,
                   }
-                  onChangeItemsPerPage={[Function]}
-                  onChangePage={[Function]}
-                  pageCount={1}
-                >
-                  <EuiFlexGroup
-                    alignItems="center"
-                    justifyContent="spaceBetween"
-                    responsive={false}
+                }
+              >
+                <div>
+                  <EuiSpacer
+                    size="m"
                   >
                     <div
-                      className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentSpaceBetween euiFlexGroup--directionRow"
+                      className="euiSpacer euiSpacer--m"
+                    />
+                  </EuiSpacer>
+                  <EuiTablePagination
+                    activePage={0}
+                    aria-controls="__table_generated-id"
+                    aria-label="Pagination for table: "
+                    itemsPerPage={20}
+                    itemsPerPageOptions={
+                      Array [
+                        10,
+                        20,
+                        50,
+                      ]
+                    }
+                    onChangeItemsPerPage={[Function]}
+                    onChangePage={[Function]}
+                    pageCount={1}
+                  >
+                    <EuiFlexGroup
+                      alignItems="center"
+                      justifyContent="spaceBetween"
+                      responsive={false}
                     >
-                      <EuiFlexItem
-                        grow={false}
+                      <div
+                        className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentSpaceBetween euiFlexGroup--directionRow"
                       >
-                        <div
-                          className="euiFlexItem euiFlexItem--flexGrowZero"
+                        <EuiFlexItem
+                          grow={false}
                         >
-                          <EuiPopover
-                            anchorPosition="upRight"
-                            button={
-                              <EuiButtonEmpty
-                                color="text"
-                                data-test-subj="tablePaginationPopoverButton"
-                                iconSide="right"
-                                iconType="arrowDown"
-                                onClick={[Function]}
-                                size="xs"
-                              >
-                                <EuiI18n
-                                  default="Rows per page"
-                                  token="euiTablePagination.rowsPerPage"
-                                />
-                                : 
-                                20
-                              </EuiButtonEmpty>
-                            }
-                            closePopover={[Function]}
-                            display="inlineBlock"
-                            hasArrow={true}
-                            isOpen={false}
-                            ownFocus={true}
-                            panelPaddingSize="none"
+                          <div
+                            className="euiFlexItem euiFlexItem--flexGrowZero"
                           >
-                            <div
-                              className="euiPopover euiPopover--anchorUpRight"
-                            >
-                              <div
-                                className="euiPopover__anchor"
-                              >
+                            <EuiPopover
+                              anchorPosition="upRight"
+                              button={
                                 <EuiButtonEmpty
                                   color="text"
                                   data-test-subj="tablePaginationPopoverButton"
@@ -1315,272 +1297,305 @@ exports[`Inspector Data View component should render single table without select
                                   onClick={[Function]}
                                   size="xs"
                                 >
-                                  <button
-                                    className="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--xSmall"
+                                  <EuiI18n
+                                    default="Rows per page"
+                                    token="euiTablePagination.rowsPerPage"
+                                  />
+                                  : 
+                                  20
+                                </EuiButtonEmpty>
+                              }
+                              closePopover={[Function]}
+                              display="inlineBlock"
+                              hasArrow={true}
+                              isOpen={false}
+                              ownFocus={true}
+                              panelPaddingSize="none"
+                            >
+                              <div
+                                className="euiPopover euiPopover--anchorUpRight"
+                              >
+                                <div
+                                  className="euiPopover__anchor"
+                                >
+                                  <EuiButtonEmpty
+                                    color="text"
                                     data-test-subj="tablePaginationPopoverButton"
-                                    disabled={false}
+                                    iconSide="right"
+                                    iconType="arrowDown"
                                     onClick={[Function]}
-                                    type="button"
+                                    size="xs"
                                   >
-                                    <EuiButtonContent
-                                      className="euiButtonEmpty__content"
-                                      iconSide="right"
-                                      iconSize="s"
-                                      iconType="arrowDown"
-                                      textProps={
-                                        Object {
-                                          "className": "euiButtonEmpty__text",
-                                        }
-                                      }
+                                    <button
+                                      className="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--xSmall"
+                                      data-test-subj="tablePaginationPopoverButton"
+                                      disabled={false}
+                                      onClick={[Function]}
+                                      type="button"
                                     >
-                                      <span
-                                        className="euiButtonContent euiButtonContent--iconRight euiButtonEmpty__content"
+                                      <EuiButtonContent
+                                        className="euiButtonEmpty__content"
+                                        iconSide="right"
+                                        iconSize="s"
+                                        iconType="arrowDown"
+                                        textProps={
+                                          Object {
+                                            "className": "euiButtonEmpty__text",
+                                          }
+                                        }
                                       >
-                                        <EuiIcon
-                                          className="euiButtonContent__icon"
-                                          color="inherit"
-                                          size="s"
-                                          type="arrowDown"
+                                        <span
+                                          className="euiButtonContent euiButtonContent--iconRight euiButtonEmpty__content"
                                         >
-                                          <span
+                                          <EuiIcon
                                             className="euiButtonContent__icon"
                                             color="inherit"
-                                            data-euiicon-type="arrowDown"
                                             size="s"
-                                          />
-                                        </EuiIcon>
-                                        <span
-                                          className="euiButtonEmpty__text"
-                                        >
-                                          <EuiI18n
-                                            default="Rows per page"
-                                            token="euiTablePagination.rowsPerPage"
+                                            type="arrowDown"
                                           >
-                                            Rows per page
-                                          </EuiI18n>
-                                          : 
-                                          20
+                                            <span
+                                              className="euiButtonContent__icon"
+                                              color="inherit"
+                                              data-euiicon-type="arrowDown"
+                                              size="s"
+                                            />
+                                          </EuiIcon>
+                                          <span
+                                            className="euiButtonEmpty__text"
+                                          >
+                                            <EuiI18n
+                                              default="Rows per page"
+                                              token="euiTablePagination.rowsPerPage"
+                                            >
+                                              Rows per page
+                                            </EuiI18n>
+                                            : 
+                                            20
+                                          </span>
                                         </span>
-                                      </span>
-                                    </EuiButtonContent>
-                                  </button>
-                                </EuiButtonEmpty>
+                                      </EuiButtonContent>
+                                    </button>
+                                  </EuiButtonEmpty>
+                                </div>
                               </div>
-                            </div>
-                          </EuiPopover>
-                        </div>
-                      </EuiFlexItem>
-                      <EuiFlexItem
-                        grow={false}
-                      >
-                        <div
-                          className="euiFlexItem euiFlexItem--flexGrowZero"
+                            </EuiPopover>
+                          </div>
+                        </EuiFlexItem>
+                        <EuiFlexItem
+                          grow={false}
                         >
-                          <EuiPagination
-                            activePage={0}
-                            aria-controls="__table_generated-id"
-                            onPageClick={[Function]}
-                            pageCount={1}
+                          <div
+                            className="euiFlexItem euiFlexItem--flexGrowZero"
                           >
-                            <nav
-                              className="euiPagination"
+                            <EuiPagination
+                              activePage={0}
+                              aria-controls="__table_generated-id"
+                              aria-label="Pagination for table: "
+                              onPageClick={[Function]}
+                              pageCount={1}
                             >
-                              <EuiI18n
-                                default="Previous page, {page}"
-                                token="euiPagination.previousPage"
-                                values={
-                                  Object {
-                                    "page": 0,
-                                  }
-                                }
+                              <nav
+                                aria-label="Pagination for table: "
+                                className="euiPagination"
                               >
                                 <EuiI18n
-                                  default="Previous page"
-                                  token="euiPagination.disabledPreviousPage"
+                                  default="Previous page, {page}"
+                                  token="euiPagination.previousPage"
+                                  values={
+                                    Object {
+                                      "page": 0,
+                                    }
+                                  }
                                 >
-                                  <EuiButtonIcon
-                                    aria-label="Previous page"
-                                    color="text"
-                                    data-test-subj="pagination-button-previous"
-                                    disabled={true}
-                                    iconType="arrowLeft"
-                                    onClick={[Function]}
+                                  <EuiI18n
+                                    default="Previous page"
+                                    token="euiPagination.disabledPreviousPage"
                                   >
-                                    <button
+                                    <EuiButtonIcon
                                       aria-label="Previous page"
-                                      className="euiButtonIcon euiButtonIcon-isDisabled euiButtonIcon--text euiButtonIcon--empty euiButtonIcon--xSmall"
+                                      color="text"
                                       data-test-subj="pagination-button-previous"
                                       disabled={true}
+                                      iconType="arrowLeft"
                                       onClick={[Function]}
-                                      type="button"
                                     >
-                                      <EuiIcon
-                                        aria-hidden="true"
-                                        className="euiButtonIcon__icon"
-                                        color="inherit"
-                                        size="m"
-                                        type="arrowLeft"
+                                      <button
+                                        aria-label="Previous page"
+                                        className="euiButtonIcon euiButtonIcon-isDisabled euiButtonIcon--text euiButtonIcon--empty euiButtonIcon--xSmall"
+                                        data-test-subj="pagination-button-previous"
+                                        disabled={true}
+                                        onClick={[Function]}
+                                        type="button"
                                       >
-                                        <span
+                                        <EuiIcon
                                           aria-hidden="true"
                                           className="euiButtonIcon__icon"
                                           color="inherit"
-                                          data-euiicon-type="arrowLeft"
                                           size="m"
-                                        />
-                                      </EuiIcon>
-                                    </button>
-                                  </EuiButtonIcon>
+                                          type="arrowLeft"
+                                        >
+                                          <span
+                                            aria-hidden="true"
+                                            className="euiButtonIcon__icon"
+                                            color="inherit"
+                                            data-euiicon-type="arrowLeft"
+                                            size="m"
+                                          />
+                                        </EuiIcon>
+                                      </button>
+                                    </EuiButtonIcon>
+                                  </EuiI18n>
                                 </EuiI18n>
-                              </EuiI18n>
-                              <ul
-                                className="euiPagination__list"
-                              >
-                                <PaginationButtonWrapper
-                                  activePage={0}
-                                  ariaControls="__table_generated-id"
-                                  key="0"
-                                  pageCount={1}
-                                  pageIndex={0}
-                                  safeClick={[Function]}
+                                <ul
+                                  aria-label="Pagination for table: "
+                                  className="euiPagination__list"
                                 >
-                                  <li
-                                    className="euiPagination__item"
+                                  <PaginationButtonWrapper
+                                    activePage={0}
+                                    ariaControls="__table_generated-id"
+                                    key="0"
+                                    pageCount={1}
+                                    pageIndex={0}
+                                    safeClick={[Function]}
                                   >
-                                    <EuiPaginationButton
-                                      aria-controls="__table_generated-id"
-                                      hideOnMobile={true}
-                                      isActive={true}
-                                      onClick={[Function]}
-                                      pageIndex={0}
-                                      totalPages={1}
+                                    <li
+                                      className="euiPagination__item"
                                     >
-                                      <EuiI18n
-                                        default="Page {page} of {totalPages}"
-                                        token="euiPaginationButton.longPageString"
-                                        values={
-                                          Object {
-                                            "page": 1,
-                                            "totalPages": 1,
-                                          }
-                                        }
+                                      <EuiPaginationButton
+                                        aria-controls="__table_generated-id"
+                                        hideOnMobile={true}
+                                        isActive={true}
+                                        onClick={[Function]}
+                                        pageIndex={0}
+                                        totalPages={1}
                                       >
                                         <EuiI18n
-                                          default="Page {page}"
-                                          token="euiPaginationButton.shortPageString"
+                                          default="Page {page} of {totalPages}"
+                                          token="euiPaginationButton.longPageString"
                                           values={
                                             Object {
                                               "page": 1,
+                                              "totalPages": 1,
                                             }
                                           }
                                         >
-                                          <EuiButtonEmpty
-                                            aria-controls="__table_generated-id"
-                                            aria-current={true}
-                                            aria-label="Page 1 of 1"
-                                            className="euiPaginationButton euiPaginationButton-isActive euiPaginationButton--hideOnMobile"
-                                            color="text"
-                                            data-test-subj="pagination-button-0"
-                                            href="#__table_generated-id"
-                                            isDisabled={true}
-                                            onClick={[Function]}
-                                            size="s"
+                                          <EuiI18n
+                                            default="Page {page}"
+                                            token="euiPaginationButton.shortPageString"
+                                            values={
+                                              Object {
+                                                "page": 1,
+                                              }
+                                            }
                                           >
-                                            <button
+                                            <EuiButtonEmpty
                                               aria-controls="__table_generated-id"
                                               aria-current={true}
                                               aria-label="Page 1 of 1"
-                                              className="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiButtonEmpty-isDisabled euiPaginationButton euiPaginationButton-isActive euiPaginationButton--hideOnMobile"
+                                              className="euiPaginationButton euiPaginationButton-isActive euiPaginationButton--hideOnMobile"
+                                              color="text"
                                               data-test-subj="pagination-button-0"
-                                              disabled={true}
+                                              href="#__table_generated-id"
+                                              isDisabled={true}
                                               onClick={[Function]}
-                                              type="button"
+                                              size="s"
                                             >
-                                              <EuiButtonContent
-                                                className="euiButtonEmpty__content"
-                                                iconSide="left"
-                                                iconSize="m"
-                                                textProps={
-                                                  Object {
-                                                    "className": "euiButtonEmpty__text",
-                                                  }
-                                                }
+                                              <button
+                                                aria-controls="__table_generated-id"
+                                                aria-current={true}
+                                                aria-label="Page 1 of 1"
+                                                className="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiButtonEmpty-isDisabled euiPaginationButton euiPaginationButton-isActive euiPaginationButton--hideOnMobile"
+                                                data-test-subj="pagination-button-0"
+                                                disabled={true}
+                                                onClick={[Function]}
+                                                type="button"
                                               >
-                                                <span
-                                                  className="euiButtonContent euiButtonEmpty__content"
+                                                <EuiButtonContent
+                                                  className="euiButtonEmpty__content"
+                                                  iconSide="left"
+                                                  iconSize="m"
+                                                  textProps={
+                                                    Object {
+                                                      "className": "euiButtonEmpty__text",
+                                                    }
+                                                  }
                                                 >
                                                   <span
-                                                    className="euiButtonEmpty__text"
+                                                    className="euiButtonContent euiButtonEmpty__content"
                                                   >
-                                                    1
+                                                    <span
+                                                      className="euiButtonEmpty__text"
+                                                    >
+                                                      1
+                                                    </span>
                                                   </span>
-                                                </span>
-                                              </EuiButtonContent>
-                                            </button>
-                                          </EuiButtonEmpty>
+                                                </EuiButtonContent>
+                                              </button>
+                                            </EuiButtonEmpty>
+                                          </EuiI18n>
                                         </EuiI18n>
-                                      </EuiI18n>
-                                    </EuiPaginationButton>
-                                  </li>
-                                </PaginationButtonWrapper>
-                              </ul>
-                              <EuiI18n
-                                default="Next page, {page}"
-                                token="euiPagination.nextPage"
-                                values={
-                                  Object {
-                                    "page": 2,
-                                  }
-                                }
-                              >
+                                      </EuiPaginationButton>
+                                    </li>
+                                  </PaginationButtonWrapper>
+                                </ul>
                                 <EuiI18n
-                                  default="Next page"
-                                  token="euiPagination.disabledNextPage"
+                                  default="Next page, {page}"
+                                  token="euiPagination.nextPage"
+                                  values={
+                                    Object {
+                                      "page": 2,
+                                    }
+                                  }
                                 >
-                                  <EuiButtonIcon
-                                    aria-label="Next page"
-                                    color="text"
-                                    data-test-subj="pagination-button-next"
-                                    disabled={true}
-                                    iconType="arrowRight"
-                                    onClick={[Function]}
+                                  <EuiI18n
+                                    default="Next page"
+                                    token="euiPagination.disabledNextPage"
                                   >
-                                    <button
+                                    <EuiButtonIcon
                                       aria-label="Next page"
-                                      className="euiButtonIcon euiButtonIcon-isDisabled euiButtonIcon--text euiButtonIcon--empty euiButtonIcon--xSmall"
+                                      color="text"
                                       data-test-subj="pagination-button-next"
                                       disabled={true}
+                                      iconType="arrowRight"
                                       onClick={[Function]}
-                                      type="button"
                                     >
-                                      <EuiIcon
-                                        aria-hidden="true"
-                                        className="euiButtonIcon__icon"
-                                        color="inherit"
-                                        size="m"
-                                        type="arrowRight"
+                                      <button
+                                        aria-label="Next page"
+                                        className="euiButtonIcon euiButtonIcon-isDisabled euiButtonIcon--text euiButtonIcon--empty euiButtonIcon--xSmall"
+                                        data-test-subj="pagination-button-next"
+                                        disabled={true}
+                                        onClick={[Function]}
+                                        type="button"
                                       >
-                                        <span
+                                        <EuiIcon
                                           aria-hidden="true"
                                           className="euiButtonIcon__icon"
                                           color="inherit"
-                                          data-euiicon-type="arrowRight"
                                           size="m"
-                                        />
-                                      </EuiIcon>
-                                    </button>
-                                  </EuiButtonIcon>
+                                          type="arrowRight"
+                                        >
+                                          <span
+                                            aria-hidden="true"
+                                            className="euiButtonIcon__icon"
+                                            color="inherit"
+                                            data-euiicon-type="arrowRight"
+                                            size="m"
+                                          />
+                                        </EuiIcon>
+                                      </button>
+                                    </EuiButtonIcon>
+                                  </EuiI18n>
                                 </EuiI18n>
-                              </EuiI18n>
-                            </nav>
-                          </EuiPagination>
-                        </div>
-                      </EuiFlexItem>
-                    </div>
-                  </EuiFlexGroup>
-                </EuiTablePagination>
-              </div>
-            </PaginationBar>
+                              </nav>
+                            </EuiPagination>
+                          </div>
+                        </EuiFlexItem>
+                      </div>
+                    </EuiFlexGroup>
+                  </EuiTablePagination>
+                </div>
+              </PaginationBar>
+            </EuiI18n>
           </div>
         </EuiBasicTable>
       </EuiInMemoryTable>
@@ -2791,93 +2806,75 @@ exports[`Inspector Data View component should support multiple datatables 1`] =
                 </table>
               </EuiTable>
             </div>
-            <PaginationBar
-              aria-controls="__table_generated-id"
-              onPageChange={[Function]}
-              onPageSizeChange={[Function]}
-              pagination={
+            <EuiI18n
+              default="Pagination for table: {tableCaption}"
+              token="euiBasicTable.tablePagination"
+              values={
                 Object {
-                  "hidePerPageOptions": undefined,
-                  "pageIndex": 0,
-                  "pageSize": 20,
-                  "pageSizeOptions": Array [
-                    10,
-                    20,
-                    50,
-                  ],
-                  "totalItemCount": 1,
+                  "tableCaption": undefined,
                 }
               }
             >
-              <div>
-                <EuiSpacer
-                  size="m"
-                >
-                  <div
-                    className="euiSpacer euiSpacer--m"
-                  />
-                </EuiSpacer>
-                <EuiTablePagination
-                  activePage={0}
-                  aria-controls="__table_generated-id"
-                  itemsPerPage={20}
-                  itemsPerPageOptions={
-                    Array [
+              <PaginationBar
+                aria-controls="__table_generated-id"
+                aria-label="Pagination for table: "
+                onPageChange={[Function]}
+                onPageSizeChange={[Function]}
+                pagination={
+                  Object {
+                    "hidePerPageOptions": undefined,
+                    "pageIndex": 0,
+                    "pageSize": 20,
+                    "pageSizeOptions": Array [
                       10,
                       20,
                       50,
-                    ]
+                    ],
+                    "totalItemCount": 1,
                   }
-                  onChangeItemsPerPage={[Function]}
-                  onChangePage={[Function]}
-                  pageCount={1}
-                >
-                  <EuiFlexGroup
-                    alignItems="center"
-                    justifyContent="spaceBetween"
-                    responsive={false}
+                }
+              >
+                <div>
+                  <EuiSpacer
+                    size="m"
                   >
                     <div
-                      className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentSpaceBetween euiFlexGroup--directionRow"
+                      className="euiSpacer euiSpacer--m"
+                    />
+                  </EuiSpacer>
+                  <EuiTablePagination
+                    activePage={0}
+                    aria-controls="__table_generated-id"
+                    aria-label="Pagination for table: "
+                    itemsPerPage={20}
+                    itemsPerPageOptions={
+                      Array [
+                        10,
+                        20,
+                        50,
+                      ]
+                    }
+                    onChangeItemsPerPage={[Function]}
+                    onChangePage={[Function]}
+                    pageCount={1}
+                  >
+                    <EuiFlexGroup
+                      alignItems="center"
+                      justifyContent="spaceBetween"
+                      responsive={false}
                     >
-                      <EuiFlexItem
-                        grow={false}
+                      <div
+                        className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentSpaceBetween euiFlexGroup--directionRow"
                       >
-                        <div
-                          className="euiFlexItem euiFlexItem--flexGrowZero"
+                        <EuiFlexItem
+                          grow={false}
                         >
-                          <EuiPopover
-                            anchorPosition="upRight"
-                            button={
-                              <EuiButtonEmpty
-                                color="text"
-                                data-test-subj="tablePaginationPopoverButton"
-                                iconSide="right"
-                                iconType="arrowDown"
-                                onClick={[Function]}
-                                size="xs"
-                              >
-                                <EuiI18n
-                                  default="Rows per page"
-                                  token="euiTablePagination.rowsPerPage"
-                                />
-                                : 
-                                20
-                              </EuiButtonEmpty>
-                            }
-                            closePopover={[Function]}
-                            display="inlineBlock"
-                            hasArrow={true}
-                            isOpen={false}
-                            ownFocus={true}
-                            panelPaddingSize="none"
+                          <div
+                            className="euiFlexItem euiFlexItem--flexGrowZero"
                           >
-                            <div
-                              className="euiPopover euiPopover--anchorUpRight"
-                            >
-                              <div
-                                className="euiPopover__anchor"
-                              >
+                            <EuiPopover
+                              anchorPosition="upRight"
+                              button={
                                 <EuiButtonEmpty
                                   color="text"
                                   data-test-subj="tablePaginationPopoverButton"
@@ -2886,272 +2883,305 @@ exports[`Inspector Data View component should support multiple datatables 1`] =
                                   onClick={[Function]}
                                   size="xs"
                                 >
-                                  <button
-                                    className="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--xSmall"
+                                  <EuiI18n
+                                    default="Rows per page"
+                                    token="euiTablePagination.rowsPerPage"
+                                  />
+                                  : 
+                                  20
+                                </EuiButtonEmpty>
+                              }
+                              closePopover={[Function]}
+                              display="inlineBlock"
+                              hasArrow={true}
+                              isOpen={false}
+                              ownFocus={true}
+                              panelPaddingSize="none"
+                            >
+                              <div
+                                className="euiPopover euiPopover--anchorUpRight"
+                              >
+                                <div
+                                  className="euiPopover__anchor"
+                                >
+                                  <EuiButtonEmpty
+                                    color="text"
                                     data-test-subj="tablePaginationPopoverButton"
-                                    disabled={false}
+                                    iconSide="right"
+                                    iconType="arrowDown"
                                     onClick={[Function]}
-                                    type="button"
+                                    size="xs"
                                   >
-                                    <EuiButtonContent
-                                      className="euiButtonEmpty__content"
-                                      iconSide="right"
-                                      iconSize="s"
-                                      iconType="arrowDown"
-                                      textProps={
-                                        Object {
-                                          "className": "euiButtonEmpty__text",
-                                        }
-                                      }
+                                    <button
+                                      className="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--xSmall"
+                                      data-test-subj="tablePaginationPopoverButton"
+                                      disabled={false}
+                                      onClick={[Function]}
+                                      type="button"
                                     >
-                                      <span
-                                        className="euiButtonContent euiButtonContent--iconRight euiButtonEmpty__content"
+                                      <EuiButtonContent
+                                        className="euiButtonEmpty__content"
+                                        iconSide="right"
+                                        iconSize="s"
+                                        iconType="arrowDown"
+                                        textProps={
+                                          Object {
+                                            "className": "euiButtonEmpty__text",
+                                          }
+                                        }
                                       >
-                                        <EuiIcon
-                                          className="euiButtonContent__icon"
-                                          color="inherit"
-                                          size="s"
-                                          type="arrowDown"
+                                        <span
+                                          className="euiButtonContent euiButtonContent--iconRight euiButtonEmpty__content"
                                         >
-                                          <span
+                                          <EuiIcon
                                             className="euiButtonContent__icon"
                                             color="inherit"
-                                            data-euiicon-type="arrowDown"
                                             size="s"
-                                          />
-                                        </EuiIcon>
-                                        <span
-                                          className="euiButtonEmpty__text"
-                                        >
-                                          <EuiI18n
-                                            default="Rows per page"
-                                            token="euiTablePagination.rowsPerPage"
+                                            type="arrowDown"
                                           >
-                                            Rows per page
-                                          </EuiI18n>
-                                          : 
-                                          20
+                                            <span
+                                              className="euiButtonContent__icon"
+                                              color="inherit"
+                                              data-euiicon-type="arrowDown"
+                                              size="s"
+                                            />
+                                          </EuiIcon>
+                                          <span
+                                            className="euiButtonEmpty__text"
+                                          >
+                                            <EuiI18n
+                                              default="Rows per page"
+                                              token="euiTablePagination.rowsPerPage"
+                                            >
+                                              Rows per page
+                                            </EuiI18n>
+                                            : 
+                                            20
+                                          </span>
                                         </span>
-                                      </span>
-                                    </EuiButtonContent>
-                                  </button>
-                                </EuiButtonEmpty>
+                                      </EuiButtonContent>
+                                    </button>
+                                  </EuiButtonEmpty>
+                                </div>
                               </div>
-                            </div>
-                          </EuiPopover>
-                        </div>
-                      </EuiFlexItem>
-                      <EuiFlexItem
-                        grow={false}
-                      >
-                        <div
-                          className="euiFlexItem euiFlexItem--flexGrowZero"
+                            </EuiPopover>
+                          </div>
+                        </EuiFlexItem>
+                        <EuiFlexItem
+                          grow={false}
                         >
-                          <EuiPagination
-                            activePage={0}
-                            aria-controls="__table_generated-id"
-                            onPageClick={[Function]}
-                            pageCount={1}
+                          <div
+                            className="euiFlexItem euiFlexItem--flexGrowZero"
                           >
-                            <nav
-                              className="euiPagination"
+                            <EuiPagination
+                              activePage={0}
+                              aria-controls="__table_generated-id"
+                              aria-label="Pagination for table: "
+                              onPageClick={[Function]}
+                              pageCount={1}
                             >
-                              <EuiI18n
-                                default="Previous page, {page}"
-                                token="euiPagination.previousPage"
-                                values={
-                                  Object {
-                                    "page": 0,
-                                  }
-                                }
+                              <nav
+                                aria-label="Pagination for table: "
+                                className="euiPagination"
                               >
                                 <EuiI18n
-                                  default="Previous page"
-                                  token="euiPagination.disabledPreviousPage"
+                                  default="Previous page, {page}"
+                                  token="euiPagination.previousPage"
+                                  values={
+                                    Object {
+                                      "page": 0,
+                                    }
+                                  }
                                 >
-                                  <EuiButtonIcon
-                                    aria-label="Previous page"
-                                    color="text"
-                                    data-test-subj="pagination-button-previous"
-                                    disabled={true}
-                                    iconType="arrowLeft"
-                                    onClick={[Function]}
+                                  <EuiI18n
+                                    default="Previous page"
+                                    token="euiPagination.disabledPreviousPage"
                                   >
-                                    <button
+                                    <EuiButtonIcon
                                       aria-label="Previous page"
-                                      className="euiButtonIcon euiButtonIcon-isDisabled euiButtonIcon--text euiButtonIcon--empty euiButtonIcon--xSmall"
+                                      color="text"
                                       data-test-subj="pagination-button-previous"
                                       disabled={true}
+                                      iconType="arrowLeft"
                                       onClick={[Function]}
-                                      type="button"
                                     >
-                                      <EuiIcon
-                                        aria-hidden="true"
-                                        className="euiButtonIcon__icon"
-                                        color="inherit"
-                                        size="m"
-                                        type="arrowLeft"
+                                      <button
+                                        aria-label="Previous page"
+                                        className="euiButtonIcon euiButtonIcon-isDisabled euiButtonIcon--text euiButtonIcon--empty euiButtonIcon--xSmall"
+                                        data-test-subj="pagination-button-previous"
+                                        disabled={true}
+                                        onClick={[Function]}
+                                        type="button"
                                       >
-                                        <span
+                                        <EuiIcon
                                           aria-hidden="true"
                                           className="euiButtonIcon__icon"
                                           color="inherit"
-                                          data-euiicon-type="arrowLeft"
                                           size="m"
-                                        />
-                                      </EuiIcon>
-                                    </button>
-                                  </EuiButtonIcon>
+                                          type="arrowLeft"
+                                        >
+                                          <span
+                                            aria-hidden="true"
+                                            className="euiButtonIcon__icon"
+                                            color="inherit"
+                                            data-euiicon-type="arrowLeft"
+                                            size="m"
+                                          />
+                                        </EuiIcon>
+                                      </button>
+                                    </EuiButtonIcon>
+                                  </EuiI18n>
                                 </EuiI18n>
-                              </EuiI18n>
-                              <ul
-                                className="euiPagination__list"
-                              >
-                                <PaginationButtonWrapper
-                                  activePage={0}
-                                  ariaControls="__table_generated-id"
-                                  key="0"
-                                  pageCount={1}
-                                  pageIndex={0}
-                                  safeClick={[Function]}
+                                <ul
+                                  aria-label="Pagination for table: "
+                                  className="euiPagination__list"
                                 >
-                                  <li
-                                    className="euiPagination__item"
+                                  <PaginationButtonWrapper
+                                    activePage={0}
+                                    ariaControls="__table_generated-id"
+                                    key="0"
+                                    pageCount={1}
+                                    pageIndex={0}
+                                    safeClick={[Function]}
                                   >
-                                    <EuiPaginationButton
-                                      aria-controls="__table_generated-id"
-                                      hideOnMobile={true}
-                                      isActive={true}
-                                      onClick={[Function]}
-                                      pageIndex={0}
-                                      totalPages={1}
+                                    <li
+                                      className="euiPagination__item"
                                     >
-                                      <EuiI18n
-                                        default="Page {page} of {totalPages}"
-                                        token="euiPaginationButton.longPageString"
-                                        values={
-                                          Object {
-                                            "page": 1,
-                                            "totalPages": 1,
-                                          }
-                                        }
+                                      <EuiPaginationButton
+                                        aria-controls="__table_generated-id"
+                                        hideOnMobile={true}
+                                        isActive={true}
+                                        onClick={[Function]}
+                                        pageIndex={0}
+                                        totalPages={1}
                                       >
                                         <EuiI18n
-                                          default="Page {page}"
-                                          token="euiPaginationButton.shortPageString"
+                                          default="Page {page} of {totalPages}"
+                                          token="euiPaginationButton.longPageString"
                                           values={
                                             Object {
                                               "page": 1,
+                                              "totalPages": 1,
                                             }
                                           }
                                         >
-                                          <EuiButtonEmpty
-                                            aria-controls="__table_generated-id"
-                                            aria-current={true}
-                                            aria-label="Page 1 of 1"
-                                            className="euiPaginationButton euiPaginationButton-isActive euiPaginationButton--hideOnMobile"
-                                            color="text"
-                                            data-test-subj="pagination-button-0"
-                                            href="#__table_generated-id"
-                                            isDisabled={true}
-                                            onClick={[Function]}
-                                            size="s"
+                                          <EuiI18n
+                                            default="Page {page}"
+                                            token="euiPaginationButton.shortPageString"
+                                            values={
+                                              Object {
+                                                "page": 1,
+                                              }
+                                            }
                                           >
-                                            <button
+                                            <EuiButtonEmpty
                                               aria-controls="__table_generated-id"
                                               aria-current={true}
                                               aria-label="Page 1 of 1"
-                                              className="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiButtonEmpty-isDisabled euiPaginationButton euiPaginationButton-isActive euiPaginationButton--hideOnMobile"
+                                              className="euiPaginationButton euiPaginationButton-isActive euiPaginationButton--hideOnMobile"
+                                              color="text"
                                               data-test-subj="pagination-button-0"
-                                              disabled={true}
+                                              href="#__table_generated-id"
+                                              isDisabled={true}
                                               onClick={[Function]}
-                                              type="button"
+                                              size="s"
                                             >
-                                              <EuiButtonContent
-                                                className="euiButtonEmpty__content"
-                                                iconSide="left"
-                                                iconSize="m"
-                                                textProps={
-                                                  Object {
-                                                    "className": "euiButtonEmpty__text",
-                                                  }
-                                                }
+                                              <button
+                                                aria-controls="__table_generated-id"
+                                                aria-current={true}
+                                                aria-label="Page 1 of 1"
+                                                className="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiButtonEmpty-isDisabled euiPaginationButton euiPaginationButton-isActive euiPaginationButton--hideOnMobile"
+                                                data-test-subj="pagination-button-0"
+                                                disabled={true}
+                                                onClick={[Function]}
+                                                type="button"
                                               >
-                                                <span
-                                                  className="euiButtonContent euiButtonEmpty__content"
+                                                <EuiButtonContent
+                                                  className="euiButtonEmpty__content"
+                                                  iconSide="left"
+                                                  iconSize="m"
+                                                  textProps={
+                                                    Object {
+                                                      "className": "euiButtonEmpty__text",
+                                                    }
+                                                  }
                                                 >
                                                   <span
-                                                    className="euiButtonEmpty__text"
+                                                    className="euiButtonContent euiButtonEmpty__content"
                                                   >
-                                                    1
+                                                    <span
+                                                      className="euiButtonEmpty__text"
+                                                    >
+                                                      1
+                                                    </span>
                                                   </span>
-                                                </span>
-                                              </EuiButtonContent>
-                                            </button>
-                                          </EuiButtonEmpty>
+                                                </EuiButtonContent>
+                                              </button>
+                                            </EuiButtonEmpty>
+                                          </EuiI18n>
                                         </EuiI18n>
-                                      </EuiI18n>
-                                    </EuiPaginationButton>
-                                  </li>
-                                </PaginationButtonWrapper>
-                              </ul>
-                              <EuiI18n
-                                default="Next page, {page}"
-                                token="euiPagination.nextPage"
-                                values={
-                                  Object {
-                                    "page": 2,
-                                  }
-                                }
-                              >
+                                      </EuiPaginationButton>
+                                    </li>
+                                  </PaginationButtonWrapper>
+                                </ul>
                                 <EuiI18n
-                                  default="Next page"
-                                  token="euiPagination.disabledNextPage"
+                                  default="Next page, {page}"
+                                  token="euiPagination.nextPage"
+                                  values={
+                                    Object {
+                                      "page": 2,
+                                    }
+                                  }
                                 >
-                                  <EuiButtonIcon
-                                    aria-label="Next page"
-                                    color="text"
-                                    data-test-subj="pagination-button-next"
-                                    disabled={true}
-                                    iconType="arrowRight"
-                                    onClick={[Function]}
+                                  <EuiI18n
+                                    default="Next page"
+                                    token="euiPagination.disabledNextPage"
                                   >
-                                    <button
+                                    <EuiButtonIcon
                                       aria-label="Next page"
-                                      className="euiButtonIcon euiButtonIcon-isDisabled euiButtonIcon--text euiButtonIcon--empty euiButtonIcon--xSmall"
+                                      color="text"
                                       data-test-subj="pagination-button-next"
                                       disabled={true}
+                                      iconType="arrowRight"
                                       onClick={[Function]}
-                                      type="button"
                                     >
-                                      <EuiIcon
-                                        aria-hidden="true"
-                                        className="euiButtonIcon__icon"
-                                        color="inherit"
-                                        size="m"
-                                        type="arrowRight"
+                                      <button
+                                        aria-label="Next page"
+                                        className="euiButtonIcon euiButtonIcon-isDisabled euiButtonIcon--text euiButtonIcon--empty euiButtonIcon--xSmall"
+                                        data-test-subj="pagination-button-next"
+                                        disabled={true}
+                                        onClick={[Function]}
+                                        type="button"
                                       >
-                                        <span
+                                        <EuiIcon
                                           aria-hidden="true"
                                           className="euiButtonIcon__icon"
                                           color="inherit"
-                                          data-euiicon-type="arrowRight"
                                           size="m"
-                                        />
-                                      </EuiIcon>
-                                    </button>
-                                  </EuiButtonIcon>
+                                          type="arrowRight"
+                                        >
+                                          <span
+                                            aria-hidden="true"
+                                            className="euiButtonIcon__icon"
+                                            color="inherit"
+                                            data-euiicon-type="arrowRight"
+                                            size="m"
+                                          />
+                                        </EuiIcon>
+                                      </button>
+                                    </EuiButtonIcon>
+                                  </EuiI18n>
                                 </EuiI18n>
-                              </EuiI18n>
-                            </nav>
-                          </EuiPagination>
-                        </div>
-                      </EuiFlexItem>
-                    </div>
-                  </EuiFlexGroup>
-                </EuiTablePagination>
-              </div>
-            </PaginationBar>
+                              </nav>
+                            </EuiPagination>
+                          </div>
+                        </EuiFlexItem>
+                      </div>
+                    </EuiFlexGroup>
+                  </EuiTablePagination>
+                </div>
+              </PaginationBar>
+            </EuiI18n>
           </div>
         </EuiBasicTable>
       </EuiInMemoryTable>
diff --git a/src/plugins/data_views/common/data_views/data_view.ts b/src/plugins/data_views/common/data_views/data_view.ts
index 57db127208dc3..b7823677b70f9 100644
--- a/src/plugins/data_views/common/data_views/data_view.ts
+++ b/src/plugins/data_views/common/data_views/data_view.ts
@@ -17,7 +17,6 @@ import { DuplicateField } from '../../../kibana_utils/common';
 
 import { IIndexPattern, IFieldType } from '../../common';
 import { DataViewField, IIndexPatternFieldList, fieldList } from '../fields';
-import { formatHitProvider } from './format_hit';
 import { flattenHitWrapper } from './flatten_hit';
 import {
   FieldFormatsStartCommon,
@@ -45,8 +44,6 @@ interface SavedObjectBody {
   type?: string;
 }
 
-type FormatFieldFn = (hit: Record<string, any>, fieldName: string) => any;
-
 export class DataView implements IIndexPattern {
   public id?: string;
   public title: string = '';
@@ -67,11 +64,6 @@ export class DataView implements IIndexPattern {
    * Type is used to identify rollup index patterns
    */
   public type: string | undefined;
-  public formatHit: {
-    (hit: Record<string, any>, type?: string): any;
-    formatField: FormatFieldFn;
-  };
-  public formatField: FormatFieldFn;
   /**
    * @deprecated Use `flattenHit` utility method exported from data plugin instead.
    */
@@ -103,11 +95,6 @@ export class DataView implements IIndexPattern {
     this.fields = fieldList([], this.shortDotsEnable);
 
     this.flattenHit = flattenHitWrapper(this, metaFields);
-    this.formatHit = formatHitProvider(
-      this,
-      fieldFormats.getDefaultInstance(KBN_FIELD_TYPES.STRING)
-    );
-    this.formatField = this.formatHit.formatField;
 
     // set values
     this.id = spec.id;
diff --git a/src/plugins/data_views/common/data_views/format_hit.ts b/src/plugins/data_views/common/data_views/format_hit.ts
deleted file mode 100644
index c8e6e8e337155..0000000000000
--- a/src/plugins/data_views/common/data_views/format_hit.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import _ from 'lodash';
-import { DataView } from './data_view';
-import { FieldFormatsContentType } from '../../../field_formats/common';
-
-const formattedCache = new WeakMap();
-const partialFormattedCache = new WeakMap();
-
-// Takes a hit, merges it with any stored/scripted fields, and with the metaFields
-// returns a formatted version
-export function formatHitProvider(dataView: DataView, defaultFormat: any) {
-  function convert(
-    hit: Record<string, any>,
-    val: any,
-    fieldName: string,
-    type: FieldFormatsContentType = 'html'
-  ) {
-    const field = dataView.fields.getByName(fieldName);
-    const format = field ? dataView.getFormatterForField(field) : defaultFormat;
-
-    return format.convert(val, type, { field, hit, indexPattern: dataView });
-  }
-
-  function formatHit(hit: Record<string, any>, type: string = 'html') {
-    const cached = formattedCache.get(hit);
-    if (cached) {
-      return cached;
-    }
-
-    // use and update the partial cache, but don't rewrite it.
-    // _source is stored in partialFormattedCache but not formattedCache
-    const partials = partialFormattedCache.get(hit) || {};
-    partialFormattedCache.set(hit, partials);
-
-    const cache: Record<string, any> = {};
-    formattedCache.set(hit, cache);
-
-    _.forOwn(dataView.flattenHit(hit), function (val: any, fieldName?: string) {
-      // sync the formatted and partial cache
-      if (!fieldName) {
-        return;
-      }
-      const formatted =
-        partials[fieldName] == null ? convert(hit, val, fieldName) : partials[fieldName];
-      cache[fieldName] = partials[fieldName] = formatted;
-    });
-
-    return cache;
-  }
-
-  formatHit.formatField = function (hit: Record<string, any>, fieldName: string) {
-    let partials = partialFormattedCache.get(hit);
-    if (partials && partials[fieldName] != null) {
-      return partials[fieldName];
-    }
-
-    if (!partials) {
-      partials = {};
-      partialFormattedCache.set(hit, partials);
-    }
-
-    const val = fieldName === '_source' ? hit._source : dataView.flattenHit(hit)[fieldName];
-    return convert(hit, val, fieldName);
-  };
-
-  return formatHit;
-}
diff --git a/src/plugins/data_views/common/data_views/index.ts b/src/plugins/data_views/common/data_views/index.ts
index 7c94dff961c9c..d925d42fbea0d 100644
--- a/src/plugins/data_views/common/data_views/index.ts
+++ b/src/plugins/data_views/common/data_views/index.ts
@@ -8,6 +8,5 @@
 
 export * from './_pattern_cache';
 export * from './flatten_hit';
-export * from './format_hit';
 export * from './data_view';
 export * from './data_views';
diff --git a/src/plugins/data_views/public/index.ts b/src/plugins/data_views/public/index.ts
index 5c810ec1fd4c8..3a6b5ccb237f2 100644
--- a/src/plugins/data_views/public/index.ts
+++ b/src/plugins/data_views/public/index.ts
@@ -13,7 +13,7 @@ export {
   ILLEGAL_CHARACTERS,
   validateDataView,
 } from '../common/lib';
-export { formatHitProvider, onRedirectNoIndexPattern } from './data_views';
+export { onRedirectNoIndexPattern } from './data_views';
 
 export { IndexPatternField, IIndexPatternFieldList, TypeMeta } from '../common';
 
diff --git a/src/plugins/discover/kibana.json b/src/plugins/discover/kibana.json
index 3d5fdefd276d3..791ce54a0cb1b 100644
--- a/src/plugins/discover/kibana.json
+++ b/src/plugins/discover/kibana.json
@@ -8,6 +8,7 @@
     "data",
     "embeddable",
     "inspector",
+    "fieldFormats",
     "kibanaLegacy",
     "urlForwarding",
     "navigation",
@@ -16,7 +17,7 @@
     "indexPatternFieldEditor"
   ],
   "optionalPlugins": ["home", "share", "usageCollection", "spaces"],
-  "requiredBundles": ["kibanaUtils", "home", "kibanaReact", "fieldFormats", "dataViews"],
+  "requiredBundles": ["kibanaUtils", "home", "kibanaReact", "dataViews"],
   "extraPublicDirs": ["common"],
   "owner": {
     "name": "Data Discovery",
diff --git a/src/plugins/discover/public/__mocks__/index_pattern.ts b/src/plugins/discover/public/__mocks__/index_pattern.ts
index 2acb512617a6b..d33445baa0a2b 100644
--- a/src/plugins/discover/public/__mocks__/index_pattern.ts
+++ b/src/plugins/discover/public/__mocks__/index_pattern.ts
@@ -6,8 +6,7 @@
  * Side Public License, v 1.
  */
 
-import type { estypes } from '@elastic/elasticsearch';
-import { flattenHit, IIndexPatternFieldList } from '../../../data/common';
+import { IIndexPatternFieldList } from '../../../data/common';
 import { IndexPattern } from '../../../data/common';
 
 const fields = [
@@ -28,6 +27,7 @@ const fields = [
   {
     name: 'message',
     type: 'string',
+    displayName: 'message',
     scripted: false,
     filterable: false,
     aggregatable: false,
@@ -35,6 +35,7 @@ const fields = [
   {
     name: 'extension',
     type: 'string',
+    displayName: 'extension',
     scripted: false,
     filterable: true,
     aggregatable: true,
@@ -42,6 +43,7 @@ const fields = [
   {
     name: 'bytes',
     type: 'number',
+    displayName: 'bytesDisplayName',
     scripted: false,
     filterable: true,
     aggregatable: true,
@@ -49,12 +51,14 @@ const fields = [
   {
     name: 'scripted',
     type: 'number',
+    displayName: 'scripted',
     scripted: true,
     filterable: false,
   },
   {
     name: 'object.value',
     type: 'number',
+    displayName: 'object.value',
     scripted: false,
     filterable: true,
     aggregatable: true,
@@ -73,23 +77,15 @@ const indexPattern = {
   id: 'the-index-pattern-id',
   title: 'the-index-pattern-title',
   metaFields: ['_index', '_score'],
-  formatField: jest.fn(),
-  flattenHit: undefined,
-  formatHit: jest.fn((hit) => (hit.fields ? hit.fields : hit._source)),
   fields,
   getComputedFields: () => ({ docvalueFields: [], scriptFields: {}, storedFields: ['*'] }),
   getSourceFiltering: () => ({}),
   getFieldByName: jest.fn(() => ({})),
   timeFieldName: '',
   docvalueFields: [],
-  getFormatterForField: () => ({ convert: () => 'formatted' }),
+  getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
 } as unknown as IndexPattern;
 
 indexPattern.isTimeBased = () => !!indexPattern.timeFieldName;
-indexPattern.formatField = (hit: Record<string, unknown>, fieldName: string) => {
-  return fieldName === '_source'
-    ? hit._source
-    : flattenHit(hit as unknown as estypes.SearchHit, indexPattern)[fieldName];
-};
 
 export const indexPatternMock = indexPattern;
diff --git a/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts b/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts
index 6cf8e8b3485ff..906ebdebdd06a 100644
--- a/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts
+++ b/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts
@@ -6,9 +6,8 @@
  * Side Public License, v 1.
  */
 
-import { flattenHit, IIndexPatternFieldList } from '../../../data/common';
+import { IIndexPatternFieldList } from '../../../data/common';
 import { IndexPattern } from '../../../data/common';
-import type { estypes } from '@elastic/elasticsearch';
 
 const fields = [
   {
@@ -64,23 +63,16 @@ const indexPattern = {
   id: 'index-pattern-with-timefield-id',
   title: 'index-pattern-with-timefield',
   metaFields: ['_index', '_score'],
-  flattenHit: undefined,
-  formatHit: jest.fn((hit) => hit._source),
   fields,
   getComputedFields: () => ({}),
   getSourceFiltering: () => ({}),
   getFieldByName: (name: string) => fields.getByName(name),
   timeFieldName: 'timestamp',
-  getFormatterForField: () => ({ convert: () => 'formatted' }),
+  getFormatterForField: () => ({ convert: (value: unknown) => value }),
   isTimeNanosBased: () => false,
   popularizeField: () => {},
 } as unknown as IndexPattern;
 
 indexPattern.isTimeBased = () => !!indexPattern.timeFieldName;
-indexPattern.formatField = (hit: Record<string, unknown>, fieldName: string) => {
-  return fieldName === '_source'
-    ? hit._source
-    : flattenHit(hit as unknown as estypes.SearchHit, indexPattern)[fieldName];
-};
 
 export const indexPatternWithTimefieldMock = indexPattern;
diff --git a/src/plugins/discover/public/__mocks__/index_patterns.ts b/src/plugins/discover/public/__mocks__/index_patterns.ts
index 88447eacc884d..b90338e895623 100644
--- a/src/plugins/discover/public/__mocks__/index_patterns.ts
+++ b/src/plugins/discover/public/__mocks__/index_patterns.ts
@@ -10,12 +10,14 @@ import { IndexPatternsService } from '../../../data/common';
 import { indexPatternMock } from './index_pattern';
 
 export const indexPatternsMock = {
-  getCache: () => {
+  getCache: async () => {
     return [indexPatternMock];
   },
-  get: (id: string) => {
+  get: async (id: string) => {
     if (id === 'the-index-pattern-id') {
-      return indexPatternMock;
+      return Promise.resolve(indexPatternMock);
+    } else if (id === 'invalid-index-pattern-id') {
+      return Promise.reject('Invald');
     }
   },
   updateSavedObject: jest.fn(),
diff --git a/src/plugins/discover/public/__mocks__/services.ts b/src/plugins/discover/public/__mocks__/services.ts
index 8cc5ccf5aa121..6a90ed42417e6 100644
--- a/src/plugins/discover/public/__mocks__/services.ts
+++ b/src/plugins/discover/public/__mocks__/services.ts
@@ -13,6 +13,7 @@ import {
   CONTEXT_STEP_SETTING,
   DEFAULT_COLUMNS_SETTING,
   DOC_HIDE_TIME_COLUMN_SETTING,
+  MAX_DOC_FIELDS_DISPLAYED,
   SAMPLE_SIZE_SETTING,
   SORT_DEFAULT_ORDER_SETTING,
 } from '../../common';
@@ -43,9 +44,13 @@ export const discoverServiceMock = {
       save: true,
     },
   },
+  fieldFormats: {
+    getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+    getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+  },
   filterManager: dataPlugin.query.filterManager,
   uiSettings: {
-    get: (key: string) => {
+    get: jest.fn((key: string) => {
       if (key === 'fields:popularLimit') {
         return 5;
       } else if (key === DEFAULT_COLUMNS_SETTING) {
@@ -62,8 +67,10 @@ export const discoverServiceMock = {
         return false;
       } else if (key === SAMPLE_SIZE_SETTING) {
         return 250;
+      } else if (key === MAX_DOC_FIELDS_DISPLAYED) {
+        return 50;
       }
-    },
+    }),
     isDefault: (key: string) => {
       return true;
     },
diff --git a/src/plugins/discover/public/application/apps/context/context_app.test.tsx b/src/plugins/discover/public/application/apps/context/context_app.test.tsx
index 0e50f8f714a2c..d1c557f2839bc 100644
--- a/src/plugins/discover/public/application/apps/context/context_app.test.tsx
+++ b/src/plugins/discover/public/application/apps/context/context_app.test.tsx
@@ -62,6 +62,10 @@ describe('ContextApp test', () => {
       navigation: mockNavigationPlugin,
       core: { notifications: { toasts: [] } },
       history: () => {},
+      fieldFormats: {
+        getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+        getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+      },
       filterManager: mockFilterManager,
       uiSettings: uiSettingsMock,
     } as unknown as DiscoverServices);
diff --git a/src/plugins/discover/public/application/apps/context/context_app_route.tsx b/src/plugins/discover/public/application/apps/context/context_app_route.tsx
index d124fd6cfa395..6c4722418be14 100644
--- a/src/plugins/discover/public/application/apps/context/context_app_route.tsx
+++ b/src/plugins/discover/public/application/apps/context/context_app_route.tsx
@@ -8,6 +8,8 @@
 import React, { useEffect } from 'react';
 import { useParams } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
+import { EuiEmptyPrompt } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { DiscoverServices } from '../../../build_services';
 import { ContextApp } from './context_app';
 import { getRootBreadcrumbs } from '../../helpers/breadcrumbs';
@@ -43,7 +45,29 @@ export function ContextAppRoute(props: ContextAppProps) {
     ]);
   }, [chrome]);
 
-  const indexPattern = useIndexPattern(services.indexPatterns, indexPatternId);
+  const { indexPattern, error } = useIndexPattern(services.indexPatterns, indexPatternId);
+
+  if (error) {
+    return (
+      <EuiEmptyPrompt
+        iconType="alert"
+        iconColor="danger"
+        title={
+          <FormattedMessage
+            id="discover.singleDocRoute.errorTitle"
+            defaultMessage="An error occured"
+          />
+        }
+        body={
+          <FormattedMessage
+            id="discover.singleDocRoute.errorMessage"
+            defaultMessage="No matching index pattern for id {indexPatternId}"
+            values={{ indexPatternId }}
+          />
+        }
+      />
+    );
+  }
 
   if (!indexPattern) {
     return <LoadingIndicator />;
diff --git a/src/plugins/discover/public/application/apps/doc/components/doc.test.tsx b/src/plugins/discover/public/application/apps/doc/components/doc.test.tsx
index 31ff39ea6b577..68c012ddd92e9 100644
--- a/src/plugins/discover/public/application/apps/doc/components/doc.test.tsx
+++ b/src/plugins/discover/public/application/apps/doc/components/doc.test.tsx
@@ -14,6 +14,7 @@ import { ReactWrapper } from 'enzyme';
 import { findTestSubject } from '@elastic/eui/lib/test';
 import { Doc, DocProps } from './doc';
 import { SEARCH_FIELDS_FROM_SOURCE as mockSearchFieldsFromSource } from '../../../../../common';
+import { indexPatternMock } from '../../../../__mocks__/index_pattern';
 
 const mockSearchApi = jest.fn();
 
@@ -74,21 +75,11 @@ const waitForPromises = async () =>
  * this works but logs ugly error messages until we're using React 16.9
  * should be adapted when we upgrade
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-async function mountDoc(update = false, indexPatternGetter: any = null) {
-  const indexPattern = {
-    getComputedFields: () => [],
-  };
-  const indexPatternService = {
-    get: indexPatternGetter ? indexPatternGetter : jest.fn(() => Promise.resolve(indexPattern)),
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  } as any;
-
+async function mountDoc(update = false) {
   const props = {
     id: '1',
     index: 'index1',
-    indexPatternId: 'xyz',
-    indexPatternService,
+    indexPattern: indexPatternMock,
   } as DocProps;
   let comp!: ReactWrapper;
   await act(async () => {
@@ -108,12 +99,6 @@ describe('Test of <Doc /> of Discover', () => {
     expect(findTestSubject(comp, 'doc-msg-loading').length).toBe(1);
   });
 
-  test('renders IndexPattern notFound msg', async () => {
-    const indexPatternGetter = jest.fn(() => Promise.reject({ savedObjectId: '007' }));
-    const comp = await mountDoc(true, indexPatternGetter);
-    expect(findTestSubject(comp, 'doc-msg-notFoundIndexPattern').length).toBe(1);
-  });
-
   test('renders notFound msg', async () => {
     mockSearchApi.mockImplementation(() => throwError({ status: 404 }));
     const comp = await mountDoc(true);
diff --git a/src/plugins/discover/public/application/apps/doc/components/doc.tsx b/src/plugins/discover/public/application/apps/doc/components/doc.tsx
index f33ffe561e490..c6cfad3953e95 100644
--- a/src/plugins/discover/public/application/apps/doc/components/doc.tsx
+++ b/src/plugins/discover/public/application/apps/doc/components/doc.tsx
@@ -9,7 +9,7 @@
 import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiCallOut, EuiLink, EuiLoadingSpinner, EuiPageContent, EuiPage } from '@elastic/eui';
-import { IndexPatternsContract } from 'src/plugins/data/public';
+import { IndexPattern } from 'src/plugins/data/public';
 import { getServices } from '../../../../kibana_services';
 import { DocViewer } from '../../../components/doc_viewer/doc_viewer';
 import { ElasticRequestState } from '../types';
@@ -25,14 +25,9 @@ export interface DocProps {
    */
   index: string;
   /**
-   * IndexPattern ID used to get IndexPattern entity
-   * that's used for adding additional fields (stored_fields, script_fields, docvalue_fields)
+   * IndexPattern entity
    */
-  indexPatternId: string;
-  /**
-   * IndexPatternService to get a given index pattern by ID
-   */
-  indexPatternService: IndexPatternsContract;
+  indexPattern: IndexPattern;
   /**
    * If set, will always request source, regardless of the global `fieldsFromSource` setting
    */
@@ -40,7 +35,8 @@ export interface DocProps {
 }
 
 export function Doc(props: DocProps) {
-  const [reqState, hit, indexPattern] = useEsDocSearch(props);
+  const { indexPattern } = props;
+  const [reqState, hit] = useEsDocSearch(props);
   const indexExistsLink = getServices().docLinks.links.apis.indexExists;
   return (
     <EuiPage>
@@ -54,7 +50,7 @@ export function Doc(props: DocProps) {
               <FormattedMessage
                 id="discover.doc.failedToLocateIndexPattern"
                 defaultMessage="No index pattern matches ID {indexPatternId}."
-                values={{ indexPatternId: props.indexPatternId }}
+                values={{ indexPatternId: indexPattern.id }}
               />
             }
           />
diff --git a/src/plugins/discover/public/application/apps/doc/single_doc_route.tsx b/src/plugins/discover/public/application/apps/doc/single_doc_route.tsx
index 8398f6255e0f9..aef928d523515 100644
--- a/src/plugins/discover/public/application/apps/doc/single_doc_route.tsx
+++ b/src/plugins/discover/public/application/apps/doc/single_doc_route.tsx
@@ -7,6 +7,8 @@
  */
 import React, { useEffect } from 'react';
 import { useLocation, useParams } from 'react-router-dom';
+import { EuiEmptyPrompt } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { DiscoverServices } from '../../../build_services';
 import { getRootBreadcrumbs } from '../../helpers/breadcrumbs';
 import { Doc } from './components/doc';
@@ -31,7 +33,7 @@ function useQuery() {
 
 export function SingleDocRoute(props: SingleDocRouteProps) {
   const { services } = props;
-  const { chrome, timefilter, indexPatterns } = services;
+  const { chrome, timefilter } = services;
 
   const { indexPatternId, index } = useParams<DocUrlParams>();
 
@@ -52,7 +54,29 @@ export function SingleDocRoute(props: SingleDocRouteProps) {
     timefilter.disableTimeRangeSelector();
   });
 
-  const indexPattern = useIndexPattern(services.indexPatterns, indexPatternId);
+  const { indexPattern, error } = useIndexPattern(services.indexPatterns, indexPatternId);
+
+  if (error) {
+    return (
+      <EuiEmptyPrompt
+        iconType="alert"
+        iconColor="danger"
+        title={
+          <FormattedMessage
+            id="discover.singleDocRoute.errorTitle"
+            defaultMessage="An error occured"
+          />
+        }
+        body={
+          <FormattedMessage
+            id="discover.singleDocRoute.errorMessage"
+            defaultMessage="No matching index pattern for id {indexPatternId}"
+            values={{ indexPatternId }}
+          />
+        }
+      />
+    );
+  }
 
   if (!indexPattern) {
     return <LoadingIndicator />;
@@ -60,12 +84,7 @@ export function SingleDocRoute(props: SingleDocRouteProps) {
 
   return (
     <div className="app-container">
-      <Doc
-        id={docId}
-        index={index}
-        indexPatternId={indexPatternId}
-        indexPatternService={indexPatterns}
-      />
+      <Doc id={docId} index={index} indexPattern={indexPattern} />
     </div>
   );
 }
diff --git a/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx b/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
index d91735460af08..0bf4a36555d16 100644
--- a/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
@@ -10,6 +10,7 @@ import React, { Fragment, useCallback, useMemo, useState } from 'react';
 import classNames from 'classnames';
 import { i18n } from '@kbn/i18n';
 import { EuiButtonEmpty, EuiIcon } from '@elastic/eui';
+import { formatFieldValue } from '../../../../../helpers/format_value';
 import { flattenHit } from '../../../../../../../../data/common';
 import { DocViewer } from '../../../../../components/doc_viewer/doc_viewer';
 import { FilterManager, IndexPattern } from '../../../../../../../../data/public';
@@ -58,7 +59,10 @@ export const TableRow = ({
   });
   const anchorDocTableRowSubj = row.isAnchor ? ' docTableAnchorRow' : '';
 
-  const flattenedRow = useMemo(() => flattenHit(row, indexPattern), [indexPattern, row]);
+  const flattenedRow = useMemo(
+    () => flattenHit(row, indexPattern, { includeIgnoredValues: true }),
+    [indexPattern, row]
+  );
   const mapping = useMemo(() => indexPattern.fields.getByName, [indexPattern]);
 
   // toggle display of the rows details, a full list of the fields from each row
@@ -68,13 +72,24 @@ export const TableRow = ({
    * Fill an element with the value of a field
    */
   const displayField = (fieldName: string) => {
-    const formattedField = indexPattern.formatField(row, fieldName);
-
-    // field formatters take care of escaping
-    // eslint-disable-next-line react/no-danger
-    const fieldElement = <span dangerouslySetInnerHTML={{ __html: formattedField }} />;
+    // If we're formatting the _source column, don't use the regular field formatter,
+    // but our Discover mechanism to format a hit in a better human-readable way.
+    if (fieldName === '_source') {
+      return formatRow(row, indexPattern, fieldsToShow);
+    }
+
+    const formattedField = formatFieldValue(
+      flattenedRow[fieldName],
+      row,
+      indexPattern,
+      mapping(fieldName)
+    );
 
-    return <div className="truncate-by-height">{fieldElement}</div>;
+    return (
+      // formatFieldValue always returns sanitized HTML
+      // eslint-disable-next-line react/no-danger
+      <div className="truncate-by-height" dangerouslySetInnerHTML={{ __html: formattedField }} />
+    );
   };
   const inlineFilter = useCallback(
     (column: string, type: '+' | '-') => {
@@ -141,10 +156,9 @@ export const TableRow = ({
     );
   } else {
     columns.forEach(function (column: string) {
-      // when useNewFieldsApi is true, addressing to the fields property is safe
-      if (useNewFieldsApi && !mapping(column) && !row.fields![column]) {
+      if (useNewFieldsApi && !mapping(column) && row.fields && !row.fields[column]) {
         const innerColumns = Object.fromEntries(
-          Object.entries(row.fields!).filter(([key]) => {
+          Object.entries(row.fields).filter(([key]) => {
             return key.indexOf(`${column}.`) === 0;
           })
         );
@@ -161,7 +175,13 @@ export const TableRow = ({
           />
         );
       } else {
-        const isFilterable = Boolean(mapping(column)?.filterable && filter);
+        // Check whether the field is defined as filterable in the mapping and does
+        // NOT have ignored values in it to determine whether we want to allow filtering.
+        // We should improve this and show a helpful tooltip why the filter buttons are not
+        // there/disabled when there are ignored values.
+        const isFilterable = Boolean(
+          mapping(column)?.filterable && filter && !row._ignored?.includes(column)
+        );
         rowCells.push(
           <TableCell
             key={column}
diff --git a/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.test.ts b/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.test.ts
index 9cd2959f5d72a..2e777a18ce906 100644
--- a/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.test.ts
+++ b/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.test.ts
@@ -17,6 +17,7 @@ import { stubbedSavedObjectIndexPattern } from '../../../../../../../../data/com
 describe('Row formatter', () => {
   const hit = {
     _id: 'a',
+    _index: 'foo',
     _type: 'doc',
     _score: 1,
     _source: {
@@ -39,7 +40,7 @@ describe('Row formatter', () => {
       spec: { id, type, version, timeFieldName, fields: JSON.parse(fields), title },
       fieldFormats: fieldFormatsMock,
       shortDotsEnable: false,
-      metaFields: [],
+      metaFields: ['_id', '_type', '_score'],
     });
   };
 
@@ -47,26 +48,15 @@ describe('Row formatter', () => {
 
   const fieldsToShow = indexPattern.fields.getAll().map((fld) => fld.name);
 
-  // Realistic response with alphabetical insertion order
-  const formatHitReturnValue = {
-    also: 'with \\&quot;quotes\\&quot; or &#39;single qoutes&#39;',
-    foo: 'bar',
-    number: '42',
-    hello: '&lt;h1&gt;World&lt;/h1&gt;',
-    _id: 'a',
-    _type: 'doc',
-    _score: 1,
-  };
-
-  const formatHitMock = jest.fn().mockReturnValue(formatHitReturnValue);
-
   beforeEach(() => {
-    // @ts-expect-error
-    indexPattern.formatHit = formatHitMock;
     setServices({
       uiSettings: {
         get: () => 100,
       },
+      fieldFormats: {
+        getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+        getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+      },
     } as unknown as DiscoverServices);
   });
 
@@ -77,32 +67,32 @@ describe('Row formatter', () => {
           Array [
             Array [
               "also",
-              "with \\\\&quot;quotes\\\\&quot; or &#39;single qoutes&#39;",
+              "with \\"quotes\\" or 'single quotes'",
             ],
             Array [
               "foo",
               "bar",
             ],
             Array [
-              "number",
-              "42",
+              "hello",
+              "<h1>World</h1>",
             ],
             Array [
-              "hello",
-              "&lt;h1&gt;World&lt;/h1&gt;",
+              "number",
+              42,
             ],
             Array [
               "_id",
               "a",
             ],
-            Array [
-              "_type",
-              "doc",
-            ],
             Array [
               "_score",
               1,
             ],
+            Array [
+              "_type",
+              "doc",
+            ],
           ]
         }
       />
@@ -114,6 +104,10 @@ describe('Row formatter', () => {
       uiSettings: {
         get: () => 1,
       },
+      fieldFormats: {
+        getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+        getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+      },
     } as unknown as DiscoverServices);
     expect(formatRow(hit, indexPattern, [])).toMatchInlineSnapshot(`
       <TemplateComponent
@@ -121,7 +115,31 @@ describe('Row formatter', () => {
           Array [
             Array [
               "also",
-              "with \\\\&quot;quotes\\\\&quot; or &#39;single qoutes&#39;",
+              "with \\"quotes\\" or 'single quotes'",
+            ],
+            Array [
+              "foo",
+              "bar",
+            ],
+            Array [
+              "hello",
+              "<h1>World</h1>",
+            ],
+            Array [
+              "number",
+              42,
+            ],
+            Array [
+              "_id",
+              "a",
+            ],
+            Array [
+              "_score",
+              1,
+            ],
+            Array [
+              "_type",
+              "doc",
             ],
           ]
         }
@@ -130,18 +148,18 @@ describe('Row formatter', () => {
   });
 
   it('formats document with highlighted fields first', () => {
-    expect(formatRow({ ...hit, highlight: { number: '42' } }, indexPattern, fieldsToShow))
+    expect(formatRow({ ...hit, highlight: { number: ['42'] } }, indexPattern, fieldsToShow))
       .toMatchInlineSnapshot(`
       <TemplateComponent
         defPairs={
           Array [
             Array [
               "number",
-              "42",
+              42,
             ],
             Array [
               "also",
-              "with \\\\&quot;quotes\\\\&quot; or &#39;single qoutes&#39;",
+              "with \\"quotes\\" or 'single quotes'",
             ],
             Array [
               "foo",
@@ -149,20 +167,20 @@ describe('Row formatter', () => {
             ],
             Array [
               "hello",
-              "&lt;h1&gt;World&lt;/h1&gt;",
+              "<h1>World</h1>",
             ],
             Array [
               "_id",
               "a",
             ],
-            Array [
-              "_type",
-              "doc",
-            ],
             Array [
               "_score",
               1,
             ],
+            Array [
+              "_type",
+              "doc",
+            ],
           ]
         }
       />
diff --git a/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx b/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx
index 14cf1839107e7..2702a232f21ef 100644
--- a/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx
@@ -6,15 +6,17 @@
  * Side Public License, v 1.
  */
 
+import { estypes } from '@elastic/elasticsearch';
 import React, { Fragment } from 'react';
 import type { IndexPattern } from 'src/plugins/data/common';
 import { MAX_DOC_FIELDS_DISPLAYED } from '../../../../../../../common';
 import { getServices } from '../../../../../../kibana_services';
+import { formatHit } from '../../../../../helpers/format_hit';
 
 import './row_formatter.scss';
 
 interface Props {
-  defPairs: Array<[string, unknown]>;
+  defPairs: Array<[string, string]>;
 }
 const TemplateComponent = ({ defPairs }: Props) => {
   return (
@@ -24,8 +26,8 @@ const TemplateComponent = ({ defPairs }: Props) => {
           <dt>{pair[0]}:</dt>
           <dd
             className="rowFormatter__value"
-            // We  can dangerously set HTML here because this content is guaranteed to have been run through a valid field formatter first.
-            dangerouslySetInnerHTML={{ __html: `${pair[1]}` }} // eslint-disable-line react/no-danger
+            // eslint-disable-next-line react/no-danger
+            dangerouslySetInnerHTML={{ __html: pair[1] }}
           />{' '}
         </Fragment>
       ))}
@@ -34,30 +36,12 @@ const TemplateComponent = ({ defPairs }: Props) => {
 };
 
 export const formatRow = (
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  hit: Record<string, any>,
+  hit: estypes.SearchHit,
   indexPattern: IndexPattern,
   fieldsToShow: string[]
 ) => {
-  const highlights = hit?.highlight ?? {};
-  // Keys are sorted in the hits object
-  const formatted = indexPattern.formatHit(hit);
-  const fields = indexPattern.fields;
-  const highlightPairs: Array<[string, unknown]> = [];
-  const sourcePairs: Array<[string, unknown]> = [];
-  Object.entries(formatted).forEach(([key, val]) => {
-    const displayKey = fields.getByName ? fields.getByName(key)?.displayName : undefined;
-    const pairs = highlights[key] ? highlightPairs : sourcePairs;
-    if (displayKey) {
-      if (fieldsToShow.includes(displayKey)) {
-        pairs.push([displayKey, val]);
-      }
-    } else {
-      pairs.push([key, val]);
-    }
-  });
-  const maxEntries = getServices().uiSettings.get(MAX_DOC_FIELDS_DISPLAYED);
-  return <TemplateComponent defPairs={[...highlightPairs, ...sourcePairs].slice(0, maxEntries)} />;
+  const pairs = formatHit(hit, indexPattern, fieldsToShow);
+  return <TemplateComponent defPairs={pairs} />;
 };
 
 export const formatTopLevelObject = (
@@ -68,8 +52,8 @@ export const formatTopLevelObject = (
   indexPattern: IndexPattern
 ) => {
   const highlights = row.highlight ?? {};
-  const highlightPairs: Array<[string, unknown]> = [];
-  const sourcePairs: Array<[string, unknown]> = [];
+  const highlightPairs: Array<[string, string]> = [];
+  const sourcePairs: Array<[string, string]> = [];
   const sorted = Object.entries(fields).sort(([keyA], [keyB]) => keyA.localeCompare(keyB));
   sorted.forEach(([key, values]) => {
     const field = indexPattern.getFieldByName(key);
diff --git a/src/plugins/discover/public/application/apps/main/components/layout/discover_documents.test.tsx b/src/plugins/discover/public/application/apps/main/components/layout/discover_documents.test.tsx
index e5212e877e8ba..60540268dcd7f 100644
--- a/src/plugins/discover/public/application/apps/main/components/layout/discover_documents.test.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/layout/discover_documents.test.tsx
@@ -20,6 +20,11 @@ import { DiscoverDocuments } from './discover_documents';
 import { ElasticSearchHit } from '../../../../doc_views/doc_views_types';
 import { indexPatternMock } from '../../../../../__mocks__/index_pattern';
 
+jest.mock('../../../../../kibana_services', () => ({
+  ...jest.requireActual('../../../../../kibana_services'),
+  getServices: () => jest.requireActual('../../../../../__mocks__/services').discoverServiceMock,
+}));
+
 setHeaderActionMenuMounter(jest.fn());
 
 function getProps(fetchStatus: FetchStatus, hits: ElasticSearchHit[]) {
diff --git a/src/plugins/discover/public/application/apps/main/components/layout/discover_layout.test.tsx b/src/plugins/discover/public/application/apps/main/components/layout/discover_layout.test.tsx
index 6ebed3185e2f1..7e3252dce1ef5 100644
--- a/src/plugins/discover/public/application/apps/main/components/layout/discover_layout.test.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/layout/discover_layout.test.tsx
@@ -33,6 +33,19 @@ import { RequestAdapter } from '../../../../../../../inspector';
 import { Chart } from '../chart/point_series';
 import { DiscoverSidebar } from '../sidebar/discover_sidebar';
 
+jest.mock('../../../../../kibana_services', () => ({
+  ...jest.requireActual('../../../../../kibana_services'),
+  getServices: () => ({
+    fieldFormats: {
+      getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+      getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+    },
+    uiSettings: {
+      get: jest.fn((key: string) => key === 'discover:maxDocFieldsDisplayed' && 50),
+    },
+  }),
+}));
+
 setHeaderActionMenuMounter(jest.fn());
 
 function getProps(indexPattern: IndexPattern, wasSidebarClosed?: boolean): DiscoverLayoutProps {
diff --git a/src/plugins/discover/public/application/apps/main/components/sidebar/__snapshots__/discover_index_pattern_management.test.tsx.snap b/src/plugins/discover/public/application/apps/main/components/sidebar/__snapshots__/discover_index_pattern_management.test.tsx.snap
index ebb06e0b2ecd3..02e2879476a5e 100644
--- a/src/plugins/discover/public/application/apps/main/components/sidebar/__snapshots__/discover_index_pattern_management.test.tsx.snap
+++ b/src/plugins/discover/public/application/apps/main/components/sidebar/__snapshots__/discover_index_pattern_management.test.tsx.snap
@@ -115,42 +115,7 @@ exports[`Discover IndexPattern Management renders correctly 1`] = `
         "deserialize": [MockFunction],
         "getByFieldType": [MockFunction],
         "getDefaultConfig": [MockFunction],
-        "getDefaultInstance": [MockFunction] {
-          "calls": Array [
-            Array [
-              "string",
-            ],
-            Array [
-              "string",
-            ],
-            Array [
-              "string",
-            ],
-          ],
-          "results": Array [
-            Object {
-              "type": "return",
-              "value": Object {
-                "convert": [MockFunction],
-                "getConverterFor": [MockFunction],
-              },
-            },
-            Object {
-              "type": "return",
-              "value": Object {
-                "convert": [MockFunction],
-                "getConverterFor": [MockFunction],
-              },
-            },
-            Object {
-              "type": "return",
-              "value": Object {
-                "convert": [MockFunction],
-                "getConverterFor": [MockFunction],
-              },
-            },
-          ],
-        },
+        "getDefaultInstance": [MockFunction],
         "getDefaultInstanceCacheResolver": [MockFunction],
         "getDefaultInstancePlain": [MockFunction],
         "getDefaultType": [MockFunction],
@@ -651,8 +616,6 @@ exports[`Discover IndexPattern Management renders correctly 1`] = `
         },
       ],
       "flattenHit": [Function],
-      "formatField": [Function],
-      "formatHit": [Function],
       "getFieldAttrs": [Function],
       "getOriginalSavedObjectBody": [Function],
       "id": "logstash-*",
diff --git a/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js b/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js
index be7e9c616273d..c709f3311105d 100644
--- a/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js
+++ b/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js
@@ -13,7 +13,7 @@ import { flattenHit } from '../../../../../../../../data/common';
 function getFieldValues(hits, field, indexPattern) {
   const name = field.name;
   return map(hits, function (hit) {
-    return flattenHit(hit, indexPattern)[name];
+    return flattenHit(hit, indexPattern, { includeIgnoredValues: true })[name];
   });
 }
 
diff --git a/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts b/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts
index 211c4e5c8b069..2198d2f66b6b4 100644
--- a/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts
+++ b/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts
@@ -22,7 +22,7 @@ export function calcFieldCounts(
     return {};
   }
   for (const hit of rows) {
-    const fields = Object.keys(flattenHit(hit, indexPattern));
+    const fields = Object.keys(flattenHit(hit, indexPattern, { includeIgnoredValues: true }));
     for (const fieldName of fields) {
       counts[fieldName] = (counts[fieldName] || 0) + 1;
     }
diff --git a/src/plugins/discover/public/application/components/discover_grid/discover_grid.test.tsx b/src/plugins/discover/public/application/components/discover_grid/discover_grid.test.tsx
index b2be40c008200..22284480afc05 100644
--- a/src/plugins/discover/public/application/components/discover_grid/discover_grid.test.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/discover_grid.test.tsx
@@ -19,6 +19,11 @@ import { DiscoverServices } from '../../../build_services';
 import { ElasticSearchHit } from '../../doc_views/doc_views_types';
 import { getDocId } from './discover_grid_document_selection';
 
+jest.mock('../../../kibana_services', () => ({
+  ...jest.requireActual('../../../kibana_services'),
+  getServices: () => jest.requireActual('../../../__mocks__/services').discoverServiceMock,
+}));
+
 function getProps() {
   const servicesMock = {
     uiSettings: uiSettingsMock,
diff --git a/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx b/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx
index 11323080274a9..ca403c813010b 100644
--- a/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx
@@ -271,7 +271,11 @@ export const DiscoverGrid = ({
       getRenderCellValueFn(
         indexPattern,
         displayedRows,
-        displayedRows ? displayedRows.map((hit) => flattenHit(hit, indexPattern)) : [],
+        displayedRows
+          ? displayedRows.map((hit) =>
+              flattenHit(hit, indexPattern, { includeIgnoredValues: true })
+            )
+          : [],
         useNewFieldsApi,
         fieldsToShow,
         services.uiSettings.get(MAX_DOC_FIELDS_DISPLAYED)
diff --git a/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx b/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx
index 6556876217953..3fb96ba9e9daa 100644
--- a/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx
@@ -25,6 +25,9 @@ jest.mock('../../../kibana_services', () => ({
     uiSettings: {
       get: jest.fn(),
     },
+    fieldFormats: {
+      getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => (value ? value : '-') })),
+    },
   }),
 }));
 
@@ -102,7 +105,7 @@ describe('Discover grid cell rendering', function () {
       rowsSource,
       rowsSource.map(flatten),
       false,
-      [],
+      ['extension', 'bytes'],
       100
     );
     const component = shallow(
@@ -133,7 +136,7 @@ describe('Discover grid cell rendering', function () {
           }
         />
         <EuiDescriptionListTitle>
-          bytes
+          bytesDisplayName
         </EuiDescriptionListTitle>
         <EuiDescriptionListDescription
           className="dscDiscoverGrid__descriptionListDescription"
@@ -143,6 +146,28 @@ describe('Discover grid cell rendering', function () {
             }
           }
         />
+        <EuiDescriptionListTitle>
+          _index
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": "test",
+            }
+          }
+        />
+        <EuiDescriptionListTitle>
+          _score
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": 1,
+            }
+          }
+        />
       </EuiDescriptionList>
     `);
   });
@@ -196,7 +221,7 @@ describe('Discover grid cell rendering', function () {
       rowsFields,
       rowsFields.map(flatten),
       true,
-      [],
+      ['extension', 'bytes'],
       100
     );
     const component = shallow(
@@ -229,7 +254,7 @@ describe('Discover grid cell rendering', function () {
           }
         />
         <EuiDescriptionListTitle>
-          bytes
+          bytesDisplayName
         </EuiDescriptionListTitle>
         <EuiDescriptionListDescription
           className="dscDiscoverGrid__descriptionListDescription"
@@ -241,6 +266,28 @@ describe('Discover grid cell rendering', function () {
             }
           }
         />
+        <EuiDescriptionListTitle>
+          _index
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": "test",
+            }
+          }
+        />
+        <EuiDescriptionListTitle>
+          _score
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": 1,
+            }
+          }
+        />
       </EuiDescriptionList>
     `);
   });
@@ -251,7 +298,7 @@ describe('Discover grid cell rendering', function () {
       rowsFields,
       rowsFields.map(flatten),
       true,
-      [],
+      ['extension', 'bytes'],
       // this is the number of rendered items
       1
     );
@@ -284,6 +331,41 @@ describe('Discover grid cell rendering', function () {
             }
           }
         />
+        <EuiDescriptionListTitle>
+          bytesDisplayName
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": Array [
+                100,
+              ],
+            }
+          }
+        />
+        <EuiDescriptionListTitle>
+          _index
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": "test",
+            }
+          }
+        />
+        <EuiDescriptionListTitle>
+          _score
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": 1,
+            }
+          }
+        />
       </EuiDescriptionList>
     `);
   });
@@ -342,7 +424,7 @@ describe('Discover grid cell rendering', function () {
       rowsFieldsWithTopLevelObject,
       rowsFieldsWithTopLevelObject.map(flatten),
       true,
-      [],
+      ['object.value', 'extension', 'bytes'],
       100
     );
     const component = shallow(
@@ -368,7 +450,7 @@ describe('Discover grid cell rendering', function () {
           className="dscDiscoverGrid__descriptionListDescription"
           dangerouslySetInnerHTML={
             Object {
-              "__html": "formatted",
+              "__html": "100",
             }
           }
         />
@@ -383,7 +465,7 @@ describe('Discover grid cell rendering', function () {
       rowsFieldsWithTopLevelObject,
       rowsFieldsWithTopLevelObject.map(flatten),
       true,
-      [],
+      ['extension', 'bytes', 'object.value'],
       100
     );
     const component = shallow(
diff --git a/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx b/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx
index a052971580666..4066c13f6391e 100644
--- a/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx
@@ -22,6 +22,8 @@ import { DiscoverGridContext } from './discover_grid_context';
 import { JsonCodeEditor } from '../json_code_editor/json_code_editor';
 import { defaultMonacoEditorWidth } from './constants';
 import { EsHitRecord } from '../../types';
+import { formatFieldValue } from '../../helpers/format_value';
+import { formatHit } from '../../helpers/format_hit';
 
 export const getRenderCellValueFn =
   (
@@ -145,39 +147,19 @@ export const getRenderCellValueFn =
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         return <JsonCodeEditor json={row as any} width={defaultMonacoEditorWidth} />;
       }
-      const formatted = indexPattern.formatHit(row);
-
-      // Put the most important fields first
-      const highlights: Record<string, unknown> = (row.highlight as Record<string, unknown>) ?? {};
-      const highlightPairs: Array<[string, string]> = [];
-      const sourcePairs: Array<[string, string]> = [];
-      Object.entries(formatted).forEach(([key, val]) => {
-        const pairs = highlights[key] ? highlightPairs : sourcePairs;
-        const displayKey = indexPattern.fields.getByName
-          ? indexPattern.fields.getByName(key)?.displayName
-          : undefined;
-        if (displayKey) {
-          if (fieldsToShow.includes(displayKey)) {
-            pairs.push([displayKey, val as string]);
-          }
-        } else {
-          pairs.push([key, val as string]);
-        }
-      });
+      const pairs = formatHit(row, indexPattern, fieldsToShow);
 
       return (
         <EuiDescriptionList type="inline" compressed className="dscDiscoverGrid__descriptionList">
-          {[...highlightPairs, ...sourcePairs]
-            .slice(0, maxDocFieldsDisplayed)
-            .map(([key, value]) => (
-              <Fragment key={key}>
-                <EuiDescriptionListTitle>{key}</EuiDescriptionListTitle>
-                <EuiDescriptionListDescription
-                  dangerouslySetInnerHTML={{ __html: value }}
-                  className="dscDiscoverGrid__descriptionListDescription"
-                />
-              </Fragment>
-            ))}
+          {pairs.map(([key, value]) => (
+            <Fragment key={key}>
+              <EuiDescriptionListTitle>{key}</EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                className="dscDiscoverGrid__descriptionListDescription"
+                dangerouslySetInnerHTML={{ __html: value }}
+              />
+            </Fragment>
+          ))}
         </EuiDescriptionList>
       );
     }
@@ -191,12 +173,13 @@ export const getRenderCellValueFn =
       return <span>{JSON.stringify(rowFlattened[columnId])}</span>;
     }
 
-    const valueFormatted = indexPattern.formatField(row, columnId);
-    if (typeof valueFormatted === 'undefined') {
-      return <span>-</span>;
-    }
     return (
-      // eslint-disable-next-line react/no-danger
-      <span dangerouslySetInnerHTML={{ __html: indexPattern.formatField(row, columnId) }} />
+      <span
+        // formatFieldValue guarantees sanitized values
+        // eslint-disable-next-line react/no-danger
+        dangerouslySetInnerHTML={{
+          __html: formatFieldValue(rowFlattened[columnId], row, indexPattern, field),
+        }}
+      />
     );
   };
diff --git a/src/plugins/discover/public/application/components/doc_viewer/doc_viewer_tab.test.tsx b/src/plugins/discover/public/application/components/doc_viewer/doc_viewer_tab.test.tsx
index a2434170acdd7..188deba755445 100644
--- a/src/plugins/discover/public/application/components/doc_viewer/doc_viewer_tab.test.tsx
+++ b/src/plugins/discover/public/application/components/doc_viewer/doc_viewer_tab.test.tsx
@@ -10,6 +10,7 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { DocViewerTab } from './doc_viewer_tab';
 import { ElasticSearchHit } from '../../doc_views/doc_views_types';
+import { indexPatternMock } from '../../../__mocks__/index_pattern';
 
 describe('DocViewerTab', () => {
   test('changing columns triggers an update', () => {
@@ -21,6 +22,7 @@ describe('DocViewerTab', () => {
       renderProps: {
         hit: {} as ElasticSearchHit,
         columns: ['test'],
+        indexPattern: indexPatternMock,
       },
     };
 
@@ -31,6 +33,7 @@ describe('DocViewerTab', () => {
       renderProps: {
         hit: {} as ElasticSearchHit,
         columns: ['test2'],
+        indexPattern: indexPatternMock,
       },
     };
 
diff --git a/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap b/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap
index 82d9183f3d394..761263ee861b9 100644
--- a/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap
+++ b/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap
@@ -5,7 +5,11 @@ exports[`Source Viewer component renders error state 1`] = `
   hasLineNumbers={true}
   id="1"
   index="index1"
-  indexPatternId="xyz"
+  indexPattern={
+    Object {
+      "getComputedFields": [Function],
+    }
+  }
   intl={
     Object {
       "defaultFormats": Object {},
@@ -264,7 +268,11 @@ exports[`Source Viewer component renders json code editor 1`] = `
   hasLineNumbers={true}
   id="1"
   index="index1"
-  indexPatternId="xyz"
+  indexPattern={
+    Object {
+      "getComputedFields": [Function],
+    }
+  }
   intl={
     Object {
       "defaultFormats": Object {},
@@ -619,7 +627,11 @@ exports[`Source Viewer component renders loading state 1`] = `
   hasLineNumbers={true}
   id="1"
   index="index1"
-  indexPatternId="xyz"
+  indexPattern={
+    Object {
+      "getComputedFields": [Function],
+    }
+  }
   intl={
     Object {
       "defaultFormats": Object {},
diff --git a/src/plugins/discover/public/application/components/source_viewer/source_viewer.test.tsx b/src/plugins/discover/public/application/components/source_viewer/source_viewer.test.tsx
index 7895c1025dda9..a98c2de6197d8 100644
--- a/src/plugins/discover/public/application/components/source_viewer/source_viewer.test.tsx
+++ b/src/plugins/discover/public/application/components/source_viewer/source_viewer.test.tsx
@@ -43,13 +43,13 @@ const mockIndexPatternService = {
 }));
 describe('Source Viewer component', () => {
   test('renders loading state', () => {
-    jest.spyOn(hooks, 'useEsDocSearch').mockImplementation(() => [0, null, null, () => {}]);
+    jest.spyOn(hooks, 'useEsDocSearch').mockImplementation(() => [0, null, () => {}]);
 
     const comp = mountWithIntl(
       <SourceViewer
         id={'1'}
         index={'index1'}
-        indexPatternId={'xyz'}
+        indexPattern={mockIndexPattern}
         width={123}
         hasLineNumbers={true}
       />
@@ -60,13 +60,13 @@ describe('Source Viewer component', () => {
   });
 
   test('renders error state', () => {
-    jest.spyOn(hooks, 'useEsDocSearch').mockImplementation(() => [3, null, null, () => {}]);
+    jest.spyOn(hooks, 'useEsDocSearch').mockImplementation(() => [3, null, () => {}]);
 
     const comp = mountWithIntl(
       <SourceViewer
         id={'1'}
         index={'index1'}
-        indexPatternId={'xyz'}
+        indexPattern={mockIndexPattern}
         width={123}
         hasLineNumbers={true}
       />
@@ -97,9 +97,7 @@ describe('Source Viewer component', () => {
         _underscore: 123,
       },
     } as never;
-    jest
-      .spyOn(hooks, 'useEsDocSearch')
-      .mockImplementation(() => [2, mockHit, mockIndexPattern, () => {}]);
+    jest.spyOn(hooks, 'useEsDocSearch').mockImplementation(() => [2, mockHit, () => {}]);
     jest.spyOn(useUiSettingHook, 'useUiSetting').mockImplementation(() => {
       return false;
     });
@@ -107,7 +105,7 @@ describe('Source Viewer component', () => {
       <SourceViewer
         id={'1'}
         index={'index1'}
-        indexPatternId={'xyz'}
+        indexPattern={mockIndexPattern}
         width={123}
         hasLineNumbers={true}
       />
diff --git a/src/plugins/discover/public/application/components/source_viewer/source_viewer.tsx b/src/plugins/discover/public/application/components/source_viewer/source_viewer.tsx
index 9e37ae8f8bf93..31d4d866df21e 100644
--- a/src/plugins/discover/public/application/components/source_viewer/source_viewer.tsx
+++ b/src/plugins/discover/public/application/components/source_viewer/source_viewer.tsx
@@ -17,11 +17,12 @@ import { getServices } from '../../../kibana_services';
 import { SEARCH_FIELDS_FROM_SOURCE } from '../../../../common';
 import { ElasticRequestState } from '../../apps/doc/types';
 import { useEsDocSearch } from '../../services/use_es_doc_search';
+import { IndexPattern } from '../../../../../data_views/common';
 
 interface SourceViewerProps {
   id: string;
   index: string;
-  indexPatternId: string;
+  indexPattern: IndexPattern;
   hasLineNumbers: boolean;
   width?: number;
 }
@@ -29,19 +30,17 @@ interface SourceViewerProps {
 export const SourceViewer = ({
   id,
   index,
-  indexPatternId,
+  indexPattern,
   width,
   hasLineNumbers,
 }: SourceViewerProps) => {
   const [editor, setEditor] = useState<monaco.editor.IStandaloneCodeEditor>();
   const [jsonValue, setJsonValue] = useState<string>('');
-  const indexPatternService = getServices().data.indexPatterns;
   const useNewFieldsApi = !getServices().uiSettings.get(SEARCH_FIELDS_FROM_SOURCE);
-  const [reqState, hit, , requestData] = useEsDocSearch({
+  const [reqState, hit, requestData] = useEsDocSearch({
     id,
     index,
-    indexPatternId,
-    indexPatternService,
+    indexPattern,
     requestSource: useNewFieldsApi,
   });
 
@@ -106,11 +105,7 @@ export const SourceViewer = ({
     <EuiEmptyPrompt iconType="alert" title={errorMessageTitle} body={errorMessage} />
   );
 
-  if (
-    reqState === ElasticRequestState.Error ||
-    reqState === ElasticRequestState.NotFound ||
-    reqState === ElasticRequestState.NotFoundIndexPattern
-  ) {
+  if (reqState === ElasticRequestState.Error || reqState === ElasticRequestState.NotFound) {
     return errorState;
   }
 
diff --git a/src/plugins/discover/public/application/components/table/table.test.tsx b/src/plugins/discover/public/application/components/table/table.test.tsx
index ce914edcec703..e61333cce1166 100644
--- a/src/plugins/discover/public/application/components/table/table.test.tsx
+++ b/src/plugins/discover/public/application/components/table/table.test.tsx
@@ -27,6 +27,10 @@ import { getServices } from '../../../kibana_services';
       }
     },
   },
+  fieldFormats: {
+    getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+    getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+  },
 }));
 
 const indexPattern = {
@@ -65,8 +69,7 @@ const indexPattern = {
     ],
   },
   metaFields: ['_index', '_score'],
-  flattenHit: jest.fn(),
-  formatHit: jest.fn((hit) => hit._source),
+  getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
 } as unknown as IndexPattern;
 
 indexPattern.fields.getByName = (name: string) => {
@@ -359,32 +362,7 @@ describe('DocViewTable at Discover Doc with Fields API', () => {
       ],
     },
     metaFields: ['_index', '_type', '_score', '_id'],
-    flattenHit: jest.fn((hit) => {
-      const result = {} as Record<string, unknown>;
-      Object.keys(hit).forEach((key) => {
-        if (key !== 'fields') {
-          result[key] = hit[key];
-        } else {
-          Object.keys(hit.fields).forEach((field) => {
-            result[field] = hit.fields[field];
-          });
-        }
-      });
-      return result;
-    }),
-    formatHit: jest.fn((hit) => {
-      const result = {} as Record<string, unknown>;
-      Object.keys(hit).forEach((key) => {
-        if (key !== 'fields') {
-          result[key] = hit[key];
-        } else {
-          Object.keys(hit.fields).forEach((field) => {
-            result[field] = hit.fields[field];
-          });
-        }
-      });
-      return result;
-    }),
+    getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
   } as unknown as IndexPattern;
 
   indexPatterneCommerce.fields.getByName = (name: string) => {
diff --git a/src/plugins/discover/public/application/components/table/table.tsx b/src/plugins/discover/public/application/components/table/table.tsx
index 7f597d846f88f..78a6d9ddd3237 100644
--- a/src/plugins/discover/public/application/components/table/table.tsx
+++ b/src/plugins/discover/public/application/components/table/table.tsx
@@ -20,12 +20,14 @@ import {
 } from '../../doc_views/doc_views_types';
 import { ACTIONS_COLUMN, MAIN_COLUMNS } from './table_columns';
 import { getFieldsToShow } from '../../helpers/get_fields_to_show';
+import { getIgnoredReason, IgnoredReason } from '../../helpers/get_ignored_reason';
+import { formatFieldValue } from '../../helpers/format_value';
 
 export interface DocViewerTableProps {
   columns?: string[];
   filter?: DocViewFilterFn;
   hit: ElasticSearchHit;
-  indexPattern?: IndexPattern;
+  indexPattern: IndexPattern;
   onAddColumn?: (columnName: string) => void;
   onRemoveColumn?: (columnName: string) => void;
 }
@@ -46,6 +48,7 @@ export interface FieldRecord {
   };
   value: {
     formattedValue: string;
+    ignored?: IgnoredReason;
   };
 }
 
@@ -64,8 +67,6 @@ export const DocViewerTable = ({
     [indexPattern?.fields]
   );
 
-  const formattedHit = useMemo(() => indexPattern?.formatHit(hit, 'html'), [hit, indexPattern]);
-
   const tableColumns = useMemo(() => {
     return filter ? [ACTIONS_COLUMN, ...MAIN_COLUMNS] : MAIN_COLUMNS;
   }, [filter]);
@@ -96,7 +97,7 @@ export const DocViewerTable = ({
     return null;
   }
 
-  const flattened = flattenHit(hit, indexPattern, { source: true });
+  const flattened = flattenHit(hit, indexPattern, { source: true, includeIgnoredValues: true });
   const fieldsToShow = getFieldsToShow(Object.keys(flattened), indexPattern, showMultiFields);
 
   const items: FieldRecord[] = Object.keys(flattened)
@@ -115,6 +116,8 @@ export const DocViewerTable = ({
       const displayName = fieldMapping?.displayName ?? field;
       const fieldType = isNestedFieldParent(field, indexPattern) ? 'nested' : fieldMapping?.type;
 
+      const ignored = getIgnoredReason(fieldMapping ?? field, hit._ignored);
+
       return {
         action: {
           onToggleColumn,
@@ -130,7 +133,8 @@ export const DocViewerTable = ({
           scripted: Boolean(fieldMapping?.scripted),
         },
         value: {
-          formattedValue: formattedHit[field],
+          formattedValue: formatFieldValue(flattened[field], hit, indexPattern, fieldMapping),
+          ignored,
         },
       };
     });
diff --git a/src/plugins/discover/public/application/components/table/table_cell_actions.tsx b/src/plugins/discover/public/application/components/table/table_cell_actions.tsx
index 7f2f87e7c296c..e43a17448de2e 100644
--- a/src/plugins/discover/public/application/components/table/table_cell_actions.tsx
+++ b/src/plugins/discover/public/application/components/table/table_cell_actions.tsx
@@ -21,6 +21,7 @@ interface TableActionsProps {
   fieldMapping?: IndexPatternField;
   onFilter: DocViewFilterFn;
   onToggleColumn: (field: string) => void;
+  ignoredValue: boolean;
 }
 
 export const TableActions = ({
@@ -30,15 +31,16 @@ export const TableActions = ({
   flattenedField,
   onToggleColumn,
   onFilter,
+  ignoredValue,
 }: TableActionsProps) => {
   return (
     <div className="kbnDocViewer__buttons">
       <DocViewTableRowBtnFilterAdd
-        disabled={!fieldMapping || !fieldMapping.filterable}
+        disabled={!fieldMapping || !fieldMapping.filterable || ignoredValue}
         onClick={() => onFilter(fieldMapping, flattenedField, '+')}
       />
       <DocViewTableRowBtnFilterRemove
-        disabled={!fieldMapping || !fieldMapping.filterable}
+        disabled={!fieldMapping || !fieldMapping.filterable || ignoredValue}
         onClick={() => onFilter(fieldMapping, flattenedField, '-')}
       />
       <DocViewTableRowBtnToggleColumn
diff --git a/src/plugins/discover/public/application/components/table/table_cell_value.tsx b/src/plugins/discover/public/application/components/table/table_cell_value.tsx
index 22c84b23949e1..e006de1cd7aeb 100644
--- a/src/plugins/discover/public/application/components/table/table_cell_value.tsx
+++ b/src/plugins/discover/public/application/components/table/table_cell_value.tsx
@@ -6,19 +6,98 @@
  * Side Public License, v 1.
  */
 
+import { css } from '@emotion/react';
+import { EuiFlexGroup, EuiFlexItem, EuiIcon, EuiTextColor, EuiToolTip } from '@elastic/eui';
 import classNames from 'classnames';
 import React, { Fragment, useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { IgnoredReason } from '../../helpers/get_ignored_reason';
 import { FieldRecord } from './table';
 import { DocViewTableRowBtnCollapse } from './table_row_btn_collapse';
 
 const COLLAPSE_LINE_LENGTH = 350;
 
-type TableFieldValueProps = FieldRecord['value'] & Pick<FieldRecord['field'], 'field'>;
+interface IgnoreWarningProps {
+  reason: IgnoredReason;
+  rawValue: unknown;
+}
 
-export const TableFieldValue = ({ formattedValue, field }: TableFieldValueProps) => {
+const IgnoreWarning: React.FC<IgnoreWarningProps> = React.memo(({ rawValue, reason }) => {
+  const multiValue = Array.isArray(rawValue) && rawValue.length > 1;
+
+  const getToolTipContent = (): string => {
+    switch (reason) {
+      case IgnoredReason.IGNORE_ABOVE:
+        return multiValue
+          ? i18n.translate('discover.docView.table.ignored.multiAboveTooltip', {
+              defaultMessage: `One or more values in this field are too long and can't be searched or filtered.`,
+            })
+          : i18n.translate('discover.docView.table.ignored.singleAboveTooltip', {
+              defaultMessage: `The value in this field is too long and can't be searched or filtered.`,
+            });
+      case IgnoredReason.MALFORMED:
+        return multiValue
+          ? i18n.translate('discover.docView.table.ignored.multiMalformedTooltip', {
+              defaultMessage: `This field has one or more malformed values that can't be searched or filtered.`,
+            })
+          : i18n.translate('discover.docView.table.ignored.singleMalformedTooltip', {
+              defaultMessage: `The value in this field is malformed and can't be searched or filtered.`,
+            });
+      case IgnoredReason.UNKNOWN:
+        return multiValue
+          ? i18n.translate('discover.docView.table.ignored.multiUnknownTooltip', {
+              defaultMessage: `One or more values in this field were ignored by Elasticsearch and can't be searched or filtered.`,
+            })
+          : i18n.translate('discover.docView.table.ignored.singleUnknownTooltip', {
+              defaultMessage: `The value in this field was ignored by Elasticsearch and can't be searched or filtered.`,
+            });
+    }
+  };
+
+  return (
+    <EuiToolTip content={getToolTipContent()}>
+      <EuiFlexGroup
+        gutterSize="xs"
+        responsive={false}
+        alignItems="center"
+        css={css`
+          cursor: help;
+        `}
+      >
+        <EuiFlexItem grow={false}>
+          <EuiIcon type="alert" color="warning" />
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiTextColor color="warning">
+            {multiValue
+              ? i18n.translate('discover.docViews.table.ignored.multiValueLabel', {
+                  defaultMessage: 'Contains ignored values',
+                })
+              : i18n.translate('discover.docViews.table.ignored.singleValueLabel', {
+                  defaultMessage: 'Ignored value',
+                })}
+          </EuiTextColor>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiToolTip>
+  );
+});
+
+type TableFieldValueProps = Pick<FieldRecord['field'], 'field'> & {
+  formattedValue: FieldRecord['value']['formattedValue'];
+  rawValue: unknown;
+  ignoreReason?: IgnoredReason;
+};
+
+export const TableFieldValue = ({
+  formattedValue,
+  field,
+  rawValue,
+  ignoreReason,
+}: TableFieldValueProps) => {
   const [fieldOpen, setFieldOpen] = useState(false);
 
-  const value = String(formattedValue);
+  const value = String(rawValue);
   const isCollapsible = value.length > COLLAPSE_LINE_LENGTH;
   const isCollapsed = isCollapsible && !fieldOpen;
 
@@ -32,18 +111,26 @@ export const TableFieldValue = ({ formattedValue, field }: TableFieldValueProps)
 
   return (
     <Fragment>
-      {isCollapsible && (
-        <DocViewTableRowBtnCollapse onClick={onToggleCollapse} isCollapsed={isCollapsed} />
+      {(isCollapsible || ignoreReason) && (
+        <EuiFlexGroup gutterSize="s">
+          {isCollapsible && (
+            <EuiFlexItem grow={false}>
+              <DocViewTableRowBtnCollapse onClick={onToggleCollapse} isCollapsed={isCollapsed} />
+            </EuiFlexItem>
+          )}
+          {ignoreReason && (
+            <EuiFlexItem grow={false}>
+              <IgnoreWarning reason={ignoreReason} rawValue={rawValue} />
+            </EuiFlexItem>
+          )}
+        </EuiFlexGroup>
       )}
       <div
         className={valueClassName}
         data-test-subj={`tableDocViewRow-${field}-value`}
-        /*
-         * Justification for dangerouslySetInnerHTML:
-         * We just use values encoded by our field formatters
-         */
+        // Value returned from formatFieldValue is always sanitized
         // eslint-disable-next-line react/no-danger
-        dangerouslySetInnerHTML={{ __html: value }}
+        dangerouslySetInnerHTML={{ __html: formattedValue }}
       />
     </Fragment>
   );
diff --git a/src/plugins/discover/public/application/components/table/table_columns.tsx b/src/plugins/discover/public/application/components/table/table_columns.tsx
index 5bd92fe9166e9..5944f9bede646 100644
--- a/src/plugins/discover/public/application/components/table/table_columns.tsx
+++ b/src/plugins/discover/public/application/components/table/table_columns.tsx
@@ -31,7 +31,7 @@ export const ACTIONS_COLUMN: EuiBasicTableColumn<FieldRecord> = {
   ),
   render: (
     { flattenedField, isActive, onFilter, onToggleColumn }: FieldRecord['action'],
-    { field: { field, fieldMapping } }: FieldRecord
+    { field: { field, fieldMapping }, value: { ignored } }: FieldRecord
   ) => {
     return (
       <TableActions
@@ -41,6 +41,7 @@ export const ACTIONS_COLUMN: EuiBasicTableColumn<FieldRecord> = {
         flattenedField={flattenedField}
         onFilter={onFilter!}
         onToggleColumn={onToggleColumn}
+        ignoredValue={!!ignored}
       />
     );
   },
@@ -82,8 +83,18 @@ export const MAIN_COLUMNS: Array<EuiBasicTableColumn<FieldRecord>> = [
         </strong>
       </EuiText>
     ),
-    render: ({ formattedValue }: FieldRecord['value'], { field: { field } }: FieldRecord) => {
-      return <TableFieldValue field={field} formattedValue={formattedValue} />;
+    render: (
+      { formattedValue, ignored }: FieldRecord['value'],
+      { field: { field }, action: { flattenedField } }: FieldRecord
+    ) => {
+      return (
+        <TableFieldValue
+          field={field}
+          formattedValue={formattedValue}
+          rawValue={flattenedField}
+          ignoreReason={ignored}
+        />
+      );
     },
   },
 ];
diff --git a/src/plugins/discover/public/application/components/table/table_row_btn_filter_add.tsx b/src/plugins/discover/public/application/components/table/table_row_btn_filter_add.tsx
index 5fe1b4dc33342..de56d733442d6 100644
--- a/src/plugins/discover/public/application/components/table/table_row_btn_filter_add.tsx
+++ b/src/plugins/discover/public/application/components/table/table_row_btn_filter_add.tsx
@@ -20,7 +20,7 @@ export function DocViewTableRowBtnFilterAdd({ onClick, disabled = false }: Props
   const tooltipContent = disabled ? (
     <FormattedMessage
       id="discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip"
-      defaultMessage="Unindexed fields can not be searched"
+      defaultMessage="Unindexed fields or ignored values cannot be searched"
     />
   ) : (
     <FormattedMessage
diff --git a/src/plugins/discover/public/application/components/table/table_row_btn_filter_remove.tsx b/src/plugins/discover/public/application/components/table/table_row_btn_filter_remove.tsx
index 6dc1af968bba9..4a14c269901d4 100644
--- a/src/plugins/discover/public/application/components/table/table_row_btn_filter_remove.tsx
+++ b/src/plugins/discover/public/application/components/table/table_row_btn_filter_remove.tsx
@@ -20,7 +20,7 @@ export function DocViewTableRowBtnFilterRemove({ onClick, disabled = false }: Pr
   const tooltipContent = disabled ? (
     <FormattedMessage
       id="discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip"
-      defaultMessage="Unindexed fields can not be searched"
+      defaultMessage="Unindexed fields or ignored values cannot be searched"
     />
   ) : (
     <FormattedMessage
diff --git a/src/plugins/discover/public/application/doc_views/doc_views_types.ts b/src/plugins/discover/public/application/doc_views/doc_views_types.ts
index 48bebec22b9b5..d3e482c0f2e1d 100644
--- a/src/plugins/discover/public/application/doc_views/doc_views_types.ts
+++ b/src/plugins/discover/public/application/doc_views/doc_views_types.ts
@@ -32,7 +32,7 @@ export interface DocViewRenderProps {
   columns?: string[];
   filter?: DocViewFilterFn;
   hit: ElasticSearchHit;
-  indexPattern?: IndexPattern;
+  indexPattern: IndexPattern;
   onAddColumn?: (columnName: string) => void;
   onRemoveColumn?: (columnName: string) => void;
 }
diff --git a/src/plugins/discover/public/application/helpers/format_hit.test.ts b/src/plugins/discover/public/application/helpers/format_hit.test.ts
new file mode 100644
index 0000000000000..2cb46f28dd397
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/format_hit.test.ts
@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { estypes } from '@elastic/elasticsearch';
+import { indexPatternMock as dataViewMock } from '../../__mocks__/index_pattern';
+import { formatHit } from './format_hit';
+import { discoverServiceMock } from '../../__mocks__/services';
+import { MAX_DOC_FIELDS_DISPLAYED } from '../../../common';
+
+jest.mock('../../kibana_services', () => ({
+  getServices: () => jest.requireActual('../../__mocks__/services').discoverServiceMock,
+}));
+
+describe('formatHit', () => {
+  let hit: estypes.SearchHit;
+  beforeEach(() => {
+    hit = {
+      _id: '1',
+      _index: 'logs',
+      fields: {
+        message: ['foobar'],
+        extension: ['png'],
+        'object.value': [42, 13],
+        bytes: [123],
+      },
+    };
+    (dataViewMock.getFormatterForField as jest.Mock).mockReturnValue({
+      convert: (value: unknown) => `formatted:${value}`,
+    });
+  });
+
+  afterEach(() => {
+    (discoverServiceMock.uiSettings.get as jest.Mock).mockReset();
+  });
+
+  it('formats a document as expected', () => {
+    const formatted = formatHit(hit, dataViewMock, ['message', 'extension', 'object.value']);
+    expect(formatted).toEqual([
+      ['extension', 'formatted:png'],
+      ['message', 'formatted:foobar'],
+      ['object.value', 'formatted:42,13'],
+      ['_index', 'formatted:logs'],
+      ['_score', undefined],
+    ]);
+  });
+
+  it('orders highlighted fields first', () => {
+    const formatted = formatHit({ ...hit, highlight: { message: ['%%'] } }, dataViewMock, [
+      'message',
+      'extension',
+      'object.value',
+    ]);
+    expect(formatted.map(([fieldName]) => fieldName)).toEqual([
+      'message',
+      'extension',
+      'object.value',
+      '_index',
+      '_score',
+    ]);
+  });
+
+  it('only limits count of pairs based on advanced setting', () => {
+    (discoverServiceMock.uiSettings.get as jest.Mock).mockImplementation(
+      (key) => key === MAX_DOC_FIELDS_DISPLAYED && 2
+    );
+    const formatted = formatHit(hit, dataViewMock, ['message', 'extension', 'object.value']);
+    expect(formatted).toEqual([
+      ['extension', 'formatted:png'],
+      ['message', 'formatted:foobar'],
+    ]);
+  });
+
+  it('should not include fields not mentioned in fieldsToShow', () => {
+    const formatted = formatHit(hit, dataViewMock, ['message', 'object.value']);
+    expect(formatted).toEqual([
+      ['message', 'formatted:foobar'],
+      ['object.value', 'formatted:42,13'],
+      ['_index', 'formatted:logs'],
+      ['_score', undefined],
+    ]);
+  });
+
+  it('should filter fields based on their real name not displayName', () => {
+    const formatted = formatHit(hit, dataViewMock, ['bytes']);
+    expect(formatted).toEqual([
+      ['bytesDisplayName', 'formatted:123'],
+      ['_index', 'formatted:logs'],
+      ['_score', undefined],
+    ]);
+  });
+});
diff --git a/src/plugins/discover/public/application/helpers/format_hit.ts b/src/plugins/discover/public/application/helpers/format_hit.ts
new file mode 100644
index 0000000000000..3890973a3f3e4
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/format_hit.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { estypes } from '@elastic/elasticsearch';
+import { DataView, flattenHit } from '../../../../data/common';
+import { MAX_DOC_FIELDS_DISPLAYED } from '../../../common';
+import { getServices } from '../../kibana_services';
+import { formatFieldValue } from './format_value';
+
+const formattedHitCache = new WeakMap<estypes.SearchHit, FormattedHit>();
+
+type FormattedHit = Array<[fieldName: string, formattedValue: string]>;
+
+/**
+ * Returns a formatted document in form of key/value pairs of the fields name and a formatted value.
+ * The value returned in each pair is an HTML string which is safe to be applied to the DOM, since
+ * it's formatted using field formatters.
+ * @param hit The hit to format
+ * @param dataView The corresponding data view
+ * @param fieldsToShow A list of fields that should be included in the document summary.
+ */
+export function formatHit(
+  hit: estypes.SearchHit,
+  dataView: DataView,
+  fieldsToShow: string[]
+): FormattedHit {
+  const cached = formattedHitCache.get(hit);
+  if (cached) {
+    return cached;
+  }
+
+  const highlights = hit.highlight ?? {};
+  // Flatten the object using the flattenHit implementation we use across Discover for flattening documents.
+  const flattened = flattenHit(hit, dataView, { includeIgnoredValues: true, source: true });
+
+  const highlightPairs: Array<[fieldName: string, formattedValue: string]> = [];
+  const sourcePairs: Array<[fieldName: string, formattedValue: string]> = [];
+
+  // Add each flattened field into the corresponding array for highlighted or other fields,
+  // depending on whether the original hit had a highlight for it. That way we can later
+  // put highlighted fields first in the document summary.
+  Object.entries(flattened).forEach(([key, val]) => {
+    // Retrieve the (display) name of the fields, if it's a mapped field on the data view
+    const displayKey = dataView.fields.getByName(key)?.displayName;
+    const pairs = highlights[key] ? highlightPairs : sourcePairs;
+    // Format the raw value using the regular field formatters for that field
+    const formattedValue = formatFieldValue(val, hit, dataView, dataView.fields.getByName(key));
+    // If the field was a mapped field, we validate it against the fieldsToShow list, if not
+    // we always include it into the result.
+    if (displayKey) {
+      if (fieldsToShow.includes(key)) {
+        pairs.push([displayKey, formattedValue]);
+      }
+    } else {
+      pairs.push([key, formattedValue]);
+    }
+  });
+  const maxEntries = getServices().uiSettings.get<number>(MAX_DOC_FIELDS_DISPLAYED);
+  const formatted = [...highlightPairs, ...sourcePairs].slice(0, maxEntries);
+  formattedHitCache.set(hit, formatted);
+  return formatted;
+}
diff --git a/src/plugins/discover/public/application/helpers/format_value.test.ts b/src/plugins/discover/public/application/helpers/format_value.test.ts
new file mode 100644
index 0000000000000..76d95c08e4a19
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/format_value.test.ts
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { FieldFormat } from '../../../../field_formats/common';
+import { indexPatternMock } from '../../__mocks__/index_pattern';
+import { formatFieldValue } from './format_value';
+
+import { getServices } from '../../kibana_services';
+
+jest.mock('../../kibana_services', () => {
+  const services = {
+    fieldFormats: {
+      getDefaultInstance: jest.fn<FieldFormat, [string]>(
+        () => ({ convert: (value: unknown) => value } as FieldFormat)
+      ),
+    },
+  };
+  return { getServices: () => services };
+});
+
+const hit = {
+  _id: '1',
+  _index: 'index',
+  fields: {
+    message: 'foo',
+  },
+};
+
+describe('formatFieldValue', () => {
+  afterEach(() => {
+    (indexPatternMock.getFormatterForField as jest.Mock).mockReset();
+    (getServices().fieldFormats.getDefaultInstance as jest.Mock).mockReset();
+  });
+
+  it('should call correct fieldFormatter for field', () => {
+    const formatterForFieldMock = indexPatternMock.getFormatterForField as jest.Mock;
+    const convertMock = jest.fn((value: unknown) => `formatted:${value}`);
+    formatterForFieldMock.mockReturnValue({ convert: convertMock });
+    const field = indexPatternMock.fields.getByName('message');
+    expect(formatFieldValue('foo', hit, indexPatternMock, field)).toBe('formatted:foo');
+    expect(indexPatternMock.getFormatterForField).toHaveBeenCalledWith(field);
+    expect(convertMock).toHaveBeenCalledWith('foo', 'html', { field, hit });
+  });
+
+  it('should call default string formatter if no field specified', () => {
+    const convertMock = jest.fn((value: unknown) => `formatted:${value}`);
+    (getServices().fieldFormats.getDefaultInstance as jest.Mock).mockReturnValue({
+      convert: convertMock,
+    });
+    expect(formatFieldValue('foo', hit, indexPatternMock)).toBe('formatted:foo');
+    expect(getServices().fieldFormats.getDefaultInstance).toHaveBeenCalledWith('string');
+    expect(convertMock).toHaveBeenCalledWith('foo', 'html', { field: undefined, hit });
+  });
+
+  it('should call default string formatter if no indexPattern is specified', () => {
+    const convertMock = jest.fn((value: unknown) => `formatted:${value}`);
+    (getServices().fieldFormats.getDefaultInstance as jest.Mock).mockReturnValue({
+      convert: convertMock,
+    });
+    expect(formatFieldValue('foo', hit)).toBe('formatted:foo');
+    expect(getServices().fieldFormats.getDefaultInstance).toHaveBeenCalledWith('string');
+    expect(convertMock).toHaveBeenCalledWith('foo', 'html', { field: undefined, hit });
+  });
+});
diff --git a/src/plugins/discover/public/application/helpers/format_value.ts b/src/plugins/discover/public/application/helpers/format_value.ts
new file mode 100644
index 0000000000000..cc33276790372
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/format_value.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { estypes } from '@elastic/elasticsearch';
+import { DataView, DataViewField, KBN_FIELD_TYPES } from '../../../../data/common';
+import { getServices } from '../../kibana_services';
+
+/**
+ * Formats the value of a specific field using the appropriate field formatter if available
+ * or the default string field formatter otherwise.
+ *
+ * @param value The value to format
+ * @param hit The actual search hit (required to get highlight information from)
+ * @param dataView The data view if available
+ * @param field The field that value was from if available
+ * @returns An sanitized HTML string, that is safe to be applied via dangerouslySetInnerHTML
+ */
+export function formatFieldValue(
+  value: unknown,
+  hit: estypes.SearchHit,
+  dataView?: DataView,
+  field?: DataViewField
+): string {
+  if (!dataView || !field) {
+    // If either no field is available or no data view, we'll use the default
+    // string formatter to format that field.
+    return getServices()
+      .fieldFormats.getDefaultInstance(KBN_FIELD_TYPES.STRING)
+      .convert(value, 'html', { hit, field });
+  }
+
+  // If we have a data view and field we use that fields field formatter
+  return dataView.getFormatterForField(field).convert(value, 'html', { hit, field });
+}
diff --git a/src/plugins/discover/public/application/helpers/get_ignored_reason.test.ts b/src/plugins/discover/public/application/helpers/get_ignored_reason.test.ts
new file mode 100644
index 0000000000000..13632ca5ed901
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/get_ignored_reason.test.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { getIgnoredReason, IgnoredReason } from './get_ignored_reason';
+import { DataViewField, KBN_FIELD_TYPES } from '../../../../data/common';
+
+function field(params: Partial<DataViewField>): DataViewField {
+  return {
+    name: 'text',
+    type: 'keyword',
+    ...params,
+  } as unknown as DataViewField;
+}
+
+describe('getIgnoredReason', () => {
+  it('will correctly return undefined when no value was ignored', () => {
+    expect(getIgnoredReason(field({ name: 'foo' }), undefined)).toBeUndefined();
+    expect(getIgnoredReason(field({ name: 'foo' }), ['bar', 'baz'])).toBeUndefined();
+  });
+
+  it('will return UNKNOWN if the field passed in was only a name, and thus no type information is present', () => {
+    expect(getIgnoredReason('foo', ['foo'])).toBe(IgnoredReason.UNKNOWN);
+  });
+
+  it('will return IGNORE_ABOVE for string types', () => {
+    expect(getIgnoredReason(field({ name: 'foo', type: KBN_FIELD_TYPES.STRING }), ['foo'])).toBe(
+      IgnoredReason.IGNORE_ABOVE
+    );
+  });
+
+  // Each type that can have malformed values
+  [
+    KBN_FIELD_TYPES.DATE,
+    KBN_FIELD_TYPES.IP,
+    KBN_FIELD_TYPES.GEO_POINT,
+    KBN_FIELD_TYPES.GEO_SHAPE,
+    KBN_FIELD_TYPES.NUMBER,
+  ].forEach((type) => {
+    it(`will return MALFORMED for ${type} fields`, () => {
+      expect(getIgnoredReason(field({ name: 'foo', type }), ['foo'])).toBe(IgnoredReason.MALFORMED);
+    });
+  });
+
+  it('will return unknown reasons if it does not know what the reason was', () => {
+    expect(getIgnoredReason(field({ name: 'foo', type: 'range' }), ['foo'])).toBe(
+      IgnoredReason.UNKNOWN
+    );
+  });
+});
diff --git a/src/plugins/discover/public/application/helpers/get_ignored_reason.ts b/src/plugins/discover/public/application/helpers/get_ignored_reason.ts
new file mode 100644
index 0000000000000..4d2fb85bdb2c4
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/get_ignored_reason.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { estypes } from '@elastic/elasticsearch';
+import { DataViewField, KBN_FIELD_TYPES } from '../../../../data/common';
+
+export enum IgnoredReason {
+  IGNORE_ABOVE = 'ignore_above',
+  MALFORMED = 'malformed',
+  UNKNOWN = 'unknown',
+}
+
+/**
+ * Returns the reason why a specific field was ignored in the response.
+ * Will return undefined if the field had no ignored values in it.
+ * This implementation will make some assumptions based on specific types
+ * of ignored values can only happen with specific field types in Elasticsearch.
+ *
+ * @param field Either the data view field or the string name of it.
+ * @param ignoredFields The hit._ignored value of the hit to validate.
+ */
+export function getIgnoredReason(
+  field: DataViewField | string,
+  ignoredFields: estypes.SearchHit['_ignored']
+): IgnoredReason | undefined {
+  const fieldName = typeof field === 'string' ? field : field.name;
+  if (!ignoredFields?.includes(fieldName)) {
+    return undefined;
+  }
+
+  if (typeof field === 'string') {
+    return IgnoredReason.UNKNOWN;
+  }
+
+  switch (field.type) {
+    case KBN_FIELD_TYPES.STRING:
+      return IgnoredReason.IGNORE_ABOVE;
+    case KBN_FIELD_TYPES.NUMBER:
+    case KBN_FIELD_TYPES.DATE:
+    case KBN_FIELD_TYPES.GEO_POINT:
+    case KBN_FIELD_TYPES.GEO_SHAPE:
+    case KBN_FIELD_TYPES.IP:
+      return IgnoredReason.MALFORMED;
+    default:
+      return IgnoredReason.UNKNOWN;
+  }
+}
diff --git a/src/plugins/discover/public/application/helpers/use_index_pattern.test.tsx b/src/plugins/discover/public/application/helpers/use_index_pattern.test.tsx
index 85282afb6fc37..dfc54d8630742 100644
--- a/src/plugins/discover/public/application/helpers/use_index_pattern.test.tsx
+++ b/src/plugins/discover/public/application/helpers/use_index_pattern.test.tsx
@@ -8,12 +8,24 @@
 import { useIndexPattern } from './use_index_pattern';
 import { indexPatternMock } from '../../__mocks__/index_pattern';
 import { indexPatternsMock } from '../../__mocks__/index_patterns';
-import { renderHook, act } from '@testing-library/react-hooks';
+import { renderHook } from '@testing-library/react-hooks';
 
 describe('Use Index Pattern', () => {
   test('returning a valid index pattern', async () => {
-    const { result } = renderHook(() => useIndexPattern(indexPatternsMock, 'the-index-pattern-id'));
-    await act(() => Promise.resolve());
-    expect(result.current).toBe(indexPatternMock);
+    const { result, waitForNextUpdate } = renderHook(() =>
+      useIndexPattern(indexPatternsMock, 'the-index-pattern-id')
+    );
+    await waitForNextUpdate();
+    expect(result.current.indexPattern).toBe(indexPatternMock);
+    expect(result.current.error).toBe(undefined);
+  });
+
+  test('returning an error', async () => {
+    const { result, waitForNextUpdate } = renderHook(() =>
+      useIndexPattern(indexPatternsMock, 'invalid-index-pattern-id')
+    );
+    await waitForNextUpdate();
+    expect(result.current.indexPattern).toBe(undefined);
+    expect(result.current.error).toBeTruthy();
   });
 });
diff --git a/src/plugins/discover/public/application/helpers/use_index_pattern.tsx b/src/plugins/discover/public/application/helpers/use_index_pattern.tsx
index f53d131920c5c..374f83cbbfe72 100644
--- a/src/plugins/discover/public/application/helpers/use_index_pattern.tsx
+++ b/src/plugins/discover/public/application/helpers/use_index_pattern.tsx
@@ -10,13 +10,18 @@ import { IndexPattern, IndexPatternsContract } from '../../../../data/common';
 
 export const useIndexPattern = (indexPatterns: IndexPatternsContract, indexPatternId: string) => {
   const [indexPattern, setIndexPattern] = useState<IndexPattern | undefined>(undefined);
+  const [error, setError] = useState();
 
   useEffect(() => {
     async function loadIndexPattern() {
-      const ip = await indexPatterns.get(indexPatternId);
-      setIndexPattern(ip);
+      try {
+        const item = await indexPatterns.get(indexPatternId);
+        setIndexPattern(item);
+      } catch (e) {
+        setError(e);
+      }
     }
     loadIndexPattern();
-  });
-  return indexPattern;
+  }, [indexPatternId, indexPatterns]);
+  return { indexPattern, error };
 };
diff --git a/src/plugins/discover/public/application/services/use_es_doc_search.test.tsx b/src/plugins/discover/public/application/services/use_es_doc_search.test.tsx
index af7d189e62882..ca57b470b471a 100644
--- a/src/plugins/discover/public/application/services/use_es_doc_search.test.tsx
+++ b/src/plugins/discover/public/application/services/use_es_doc_search.test.tsx
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { renderHook, act } from '@testing-library/react-hooks';
+import { renderHook } from '@testing-library/react-hooks';
 import { buildSearchBody, useEsDocSearch } from './use_es_doc_search';
 import { Observable } from 'rxjs';
 import { IndexPattern } from 'src/plugins/data/common';
@@ -175,26 +175,14 @@ describe('Test of <Doc /> helper / hook', () => {
     const indexPattern = {
       getComputedFields: () => [],
     };
-    const getMock = jest.fn(() => Promise.resolve(indexPattern));
-    const indexPatternService = {
-      get: getMock,
-    } as unknown as IndexPattern;
     const props = {
       id: '1',
       index: 'index1',
-      indexPatternId: 'xyz',
-      indexPatternService,
-    } as unknown as DocProps;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    let hook: any;
-    await act(async () => {
-      hook = renderHook((p: DocProps) => useEsDocSearch(p), { initialProps: props });
-    });
-    expect(hook.result.current.slice(0, 3)).toEqual([
-      ElasticRequestState.Loading,
-      null,
       indexPattern,
-    ]);
-    expect(getMock).toHaveBeenCalled();
+    } as unknown as DocProps;
+
+    const { result } = renderHook((p: DocProps) => useEsDocSearch(p), { initialProps: props });
+
+    expect(result.current.slice(0, 2)).toEqual([ElasticRequestState.Loading, null]);
   });
 });
diff --git a/src/plugins/discover/public/application/services/use_es_doc_search.ts b/src/plugins/discover/public/application/services/use_es_doc_search.ts
index a2f0cd6f8442b..16a24ff27292b 100644
--- a/src/plugins/discover/public/application/services/use_es_doc_search.ts
+++ b/src/plugins/discover/public/application/services/use_es_doc_search.ts
@@ -64,11 +64,9 @@ export function buildSearchBody(
 export function useEsDocSearch({
   id,
   index,
-  indexPatternId,
-  indexPatternService,
+  indexPattern,
   requestSource,
-}: DocProps): [ElasticRequestState, ElasticSearchHit | null, IndexPattern | null, () => void] {
-  const [indexPattern, setIndexPattern] = useState<IndexPattern | null>(null);
+}: DocProps): [ElasticRequestState, ElasticSearchHit | null | null, () => void] {
   const [status, setStatus] = useState(ElasticRequestState.Loading);
   const [hit, setHit] = useState<ElasticSearchHit | null>(null);
   const { data, uiSettings } = useMemo(() => getServices(), []);
@@ -76,14 +74,11 @@ export function useEsDocSearch({
 
   const requestData = useCallback(async () => {
     try {
-      const indexPatternEntity = await indexPatternService.get(indexPatternId);
-      setIndexPattern(indexPatternEntity);
-
       const { rawResponse } = await data.search
         .search({
           params: {
             index,
-            body: buildSearchBody(id, indexPatternEntity, useNewFieldsApi, requestSource)?.body,
+            body: buildSearchBody(id, indexPattern, useNewFieldsApi, requestSource)?.body,
           },
         })
         .toPromise();
@@ -105,11 +100,11 @@ export function useEsDocSearch({
         setStatus(ElasticRequestState.Error);
       }
     }
-  }, [id, index, indexPatternId, indexPatternService, data.search, useNewFieldsApi, requestSource]);
+  }, [id, index, indexPattern, data.search, useNewFieldsApi, requestSource]);
 
   useEffect(() => {
     requestData();
   }, [requestData]);
 
-  return [status, hit, indexPattern, requestData];
+  return [status, hit, requestData];
 }
diff --git a/src/plugins/discover/public/build_services.ts b/src/plugins/discover/public/build_services.ts
index ab2484abee892..ac16b6b3cc2ba 100644
--- a/src/plugins/discover/public/build_services.ts
+++ b/src/plugins/discover/public/build_services.ts
@@ -36,6 +36,7 @@ import { KibanaLegacyStart } from '../../kibana_legacy/public';
 import { UrlForwardingStart } from '../../url_forwarding/public';
 import { NavigationPublicPluginStart } from '../../navigation/public';
 import { IndexPatternFieldEditorStart } from '../../index_pattern_field_editor/public';
+import { FieldFormatsStart } from '../../field_formats/public';
 
 import type { SpacesApi } from '../../../../x-pack/plugins/spaces/public';
 
@@ -49,6 +50,7 @@ export interface DiscoverServices {
   history: () => History;
   theme: ChartsPluginStart['theme'];
   filterManager: FilterManager;
+  fieldFormats: FieldFormatsStart;
   indexPatterns: IndexPatternsContract;
   inspector: InspectorPublicPluginStart;
   metadata: { branch: string };
@@ -82,6 +84,7 @@ export function buildServices(
     data: plugins.data,
     docLinks: core.docLinks,
     theme: plugins.charts.theme,
+    fieldFormats: plugins.fieldFormats,
     filterManager: plugins.data.query.filterManager,
     history: getHistory,
     indexPatterns: plugins.data.indexPatterns,
diff --git a/src/plugins/discover/public/plugin.tsx b/src/plugins/discover/public/plugin.tsx
index d86e5f363630c..e170e61f7ebc5 100644
--- a/src/plugins/discover/public/plugin.tsx
+++ b/src/plugins/discover/public/plugin.tsx
@@ -61,6 +61,7 @@ import { IndexPatternFieldEditorStart } from '../../../plugins/index_pattern_fie
 import { DeferredSpinner } from './shared';
 import { ViewSavedSearchAction } from './application/embeddable/view_saved_search_action';
 import type { SpacesPluginStart } from '../../../../x-pack/plugins/spaces/public';
+import { FieldFormatsStart } from '../../field_formats/public';
 
 declare module '../../share/public' {
   export interface UrlGeneratorStateMapping {
@@ -180,6 +181,7 @@ export interface DiscoverStartPlugins {
   navigation: NavigationStart;
   charts: ChartsPluginStart;
   data: DataPublicPluginStart;
+  fieldFormats: FieldFormatsStart;
   share?: SharePluginStart;
   kibanaLegacy: KibanaLegacyStart;
   urlForwarding: UrlForwardingStart;
@@ -267,7 +269,7 @@ export class DiscoverPlugin
           <SourceViewer
             index={hit._index}
             id={hit._id}
-            indexPatternId={indexPattern?.id || ''}
+            indexPattern={indexPattern}
             hasLineNumbers
           />
         </React.Suspense>
diff --git a/src/plugins/field_formats/common/converters/source.test.ts b/src/plugins/field_formats/common/converters/source.test.ts
index 298c93dac8c4e..6f9e96a136d0b 100644
--- a/src/plugins/field_formats/common/converters/source.test.ts
+++ b/src/plugins/field_formats/common/converters/source.test.ts
@@ -19,7 +19,7 @@ describe('Source Format', () => {
     convertHtml = source.getConverterFor(HTML_CONTEXT_TYPE) as HtmlContextTypeConvert;
   });
 
-  test('should use the text content type if a field is not passed', () => {
+  test('should render stringified object', () => {
     const hit = {
       foo: 'bar',
       number: 42,
@@ -27,23 +27,8 @@ describe('Source Format', () => {
       also: 'with "quotes" or \'single quotes\'',
     };
 
-    expect(convertHtml(hit)).toBe(
-      '{&quot;foo&quot;:&quot;bar&quot;,&quot;number&quot;:42,&quot;hello&quot;:&quot;&lt;h1&gt;World&lt;/h1&gt;&quot;,&quot;also&quot;:&quot;with \\&quot;quotes\\&quot; or &#39;single quotes&#39;&quot;}'
-    );
-  });
-
-  test('should render a description list if a field is passed', () => {
-    const hit = {
-      foo: 'bar',
-      number: 42,
-      hello: '<h1>World</h1>',
-      also: 'with "quotes" or \'single quotes\'',
-    };
-
-    expect(
-      convertHtml(hit, { field: 'field', indexPattern: { formatHit: (h: string) => h }, hit })
-    ).toMatchInlineSnapshot(
-      `"<dl class=\\"source truncate-by-height\\"><dt>foo:</dt><dd>bar</dd> <dt>number:</dt><dd>42</dd> <dt>hello:</dt><dd><h1>World</h1></dd> <dt>also:</dt><dd>with \\"quotes\\" or 'single quotes'</dd> </dl>"`
+    expect(convertHtml(hit, { field: 'field', hit })).toMatchInlineSnapshot(
+      `"{&quot;foo&quot;:&quot;bar&quot;,&quot;number&quot;:42,&quot;hello&quot;:&quot;&lt;h1&gt;World&lt;/h1&gt;&quot;,&quot;also&quot;:&quot;with \\\\&quot;quotes\\\\&quot; or &#39;single quotes&#39;&quot;}"`
     );
   });
 });
diff --git a/src/plugins/field_formats/common/converters/source.tsx b/src/plugins/field_formats/common/converters/source.tsx
index 1caffb5bfb9a8..f92027ec07451 100644
--- a/src/plugins/field_formats/common/converters/source.tsx
+++ b/src/plugins/field_formats/common/converters/source.tsx
@@ -7,33 +7,8 @@
  */
 
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
-import React, { Fragment } from 'react';
-import ReactDOM from 'react-dom/server';
-import { escape, keys } from 'lodash';
-import { shortenDottedString } from '../utils';
 import { FieldFormat } from '../field_format';
-import { TextContextTypeConvert, HtmlContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
-import { FORMATS_UI_SETTINGS } from '../constants/ui_settings';
-
-interface Props {
-  defPairs: Array<[string, string]>;
-}
-const TemplateComponent = ({ defPairs }: Props) => {
-  return (
-    <dl className={'source truncate-by-height'}>
-      {defPairs.map((pair, idx) => (
-        <Fragment key={idx}>
-          <dt
-            dangerouslySetInnerHTML={{ __html: `${escape(pair[0])}:` }} // eslint-disable-line react/no-danger
-          />
-          <dd
-            dangerouslySetInnerHTML={{ __html: `${pair[1]}` }} // eslint-disable-line react/no-danger
-          />{' '}
-        </Fragment>
-      ))}
-    </dl>
-  );
-};
+import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 
 /** @public */
 export class SourceFormat extends FieldFormat {
@@ -42,32 +17,4 @@ export class SourceFormat extends FieldFormat {
   static fieldType = KBN_FIELD_TYPES._SOURCE;
 
   textConvert: TextContextTypeConvert = (value: string) => JSON.stringify(value);
-
-  htmlConvert: HtmlContextTypeConvert = (value: string, options = {}) => {
-    const { field, hit, indexPattern } = options;
-
-    if (!field) {
-      const converter = this.getConverterFor('text') as Function;
-
-      return escape(converter(value));
-    }
-
-    const highlights: Record<string, string[]> = (hit && hit.highlight) || {};
-    // TODO: remove index pattern dependency
-    const formatted = hit ? indexPattern!.formatHit(hit) : {};
-    const highlightPairs: Array<[string, string]> = [];
-    const sourcePairs: Array<[string, string]> = [];
-    const isShortDots = this.getConfig!(FORMATS_UI_SETTINGS.SHORT_DOTS_ENABLE);
-
-    keys(formatted).forEach((key) => {
-      const pairs = highlights[key] ? highlightPairs : sourcePairs;
-      const newField = isShortDots ? shortenDottedString(key) : key;
-      const val = formatted![key];
-      pairs.push([newField as string, val]);
-    }, []);
-
-    return ReactDOM.renderToStaticMarkup(
-      <TemplateComponent defPairs={highlightPairs.concat(sourcePairs)} />
-    );
-  };
 }
diff --git a/src/plugins/field_formats/common/types.ts b/src/plugins/field_formats/common/types.ts
index 00f9f5d707e89..6f0efebe389a1 100644
--- a/src/plugins/field_formats/common/types.ts
+++ b/src/plugins/field_formats/common/types.ts
@@ -17,10 +17,6 @@ export type FieldFormatsContentType = 'html' | 'text';
  */
 export interface HtmlContextTypeOptions {
   field?: { name: string };
-  // TODO: get rid of indexPattern dep completely
-  indexPattern?: {
-    formatHit: (hit: { highlight: Record<string, string[]> }) => Record<string, string>;
-  };
   hit?: { highlight: Record<string, string[]> };
 }
 
diff --git a/src/plugins/home/public/application/components/__snapshots__/home.test.tsx.snap b/src/plugins/home/public/application/components/__snapshots__/home.test.tsx.snap
index b6679dd7ba493..f38bdb9ac53f0 100644
--- a/src/plugins/home/public/application/components/__snapshots__/home.test.tsx.snap
+++ b/src/plugins/home/public/application/components/__snapshots__/home.test.tsx.snap
@@ -21,10 +21,28 @@ exports[`home change home route should render a link to change the default route
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={Array []}
   />
   <mockConstructor
@@ -57,10 +75,28 @@ exports[`home directories should not render directory entry when showOnHomePage
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={Array []}
   />
   <mockConstructor
@@ -93,10 +129,28 @@ exports[`home directories should render ADMIN directory entry in "Manage your da
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={
       Array [
         Object {
@@ -176,10 +230,28 @@ exports[`home directories should render solutions in the "solution section" 1`]
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={Array []}
   />
   <mockConstructor
@@ -212,10 +284,28 @@ exports[`home isNewKibanaInstance should safely handle exceptions 1`] = `
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={Array []}
   />
   <mockConstructor
@@ -248,10 +338,28 @@ exports[`home isNewKibanaInstance should set isNewKibanaInstance to false when t
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={Array []}
   />
   <mockConstructor
@@ -480,314 +588,28 @@ exports[`home should render home component 1`] = `
   />
   <AddData
     addBasePath={[Function]}
-    isDarkMode={false}
-  />
-  <ManageData
-    addBasePath={[Function]}
-    features={Array []}
-  />
-  <mockConstructor
-    addBasePath={[Function]}
-    onChangeDefaultRoute={[Function]}
-    onSetDefaultRoute={[Function]}
-    path="/app/home"
-  />
-</mockConstructor>
-`;
-
-exports[`home welcome should show the normal home page if loading fails 1`] = `
-<mockConstructor
-  data-test-subj="homeApp"
-  pageHeader={
-    Object {
-      "bottomBorder": false,
-      "pageTitle": <FormattedMessage
-        defaultMessage="Welcome home"
-        id="home.header.title"
-        values={Object {}}
-      />,
-    }
-  }
-  template="empty"
->
-  <SolutionsSection
-    addBasePath={[Function]}
-    solutions={Array []}
-  />
-  <AddData
-    addBasePath={[Function]}
-    isDarkMode={false}
-  />
-  <ManageData
-    addBasePath={[Function]}
-    features={Array []}
-  />
-  <mockConstructor
-    addBasePath={[Function]}
-    onChangeDefaultRoute={[Function]}
-    onSetDefaultRoute={[Function]}
-    path="/app/home"
-  />
-</mockConstructor>
-`;
-
-exports[`home welcome should show the normal home page if welcome screen is disabled locally 1`] = `
-<mockConstructor
-  data-test-subj="homeApp"
-  pageHeader={
-    Object {
-      "bottomBorder": false,
-      "pageTitle": <FormattedMessage
-        defaultMessage="Welcome home"
-        id="home.header.title"
-        values={Object {}}
-      />,
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
     }
-  }
-  template="empty"
->
-  <SolutionsSection
-    addBasePath={[Function]}
-    solutions={Array []}
-  />
-  <AddData
-    addBasePath={[Function]}
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
-    features={Array []}
-  />
-  <mockConstructor
-    addBasePath={[Function]}
-    onChangeDefaultRoute={[Function]}
-    onSetDefaultRoute={[Function]}
-    path="/app/home"
-  />
-</mockConstructor>
-`;
-
-exports[`home welcome should show the welcome screen if enabled, and there are no index patterns defined 1`] = `
-<Welcome
-  onSkip={[Function]}
-  telemetry={
-    Object {
-      "telemetryConstants": Object {
-        "getPrivacyStatementUrl": [MockFunction],
-      },
-      "telemetryNotifications": TelemetryNotifications {
-        "http": Object {
-          "addLoadingCountSource": [MockFunction],
-          "anonymousPaths": Object {
-            "isAnonymous": [MockFunction],
-            "register": [MockFunction],
-          },
-          "basePath": BasePath {
-            "basePath": "",
-            "get": [Function],
-            "prepend": [Function],
-            "publicBaseUrl": undefined,
-            "remove": [Function],
-            "serverBasePath": "",
-          },
-          "delete": [MockFunction],
-          "externalUrl": Object {
-            "validateUrl": [MockFunction],
-          },
-          "fetch": [MockFunction],
-          "get": [MockFunction],
-          "getLoadingCount$": [MockFunction],
-          "head": [MockFunction],
-          "intercept": [MockFunction],
-          "options": [MockFunction],
-          "patch": [MockFunction],
-          "post": [MockFunction],
-          "put": [MockFunction],
-        },
-        "onSetOptInClick": [Function],
-        "optInBannerId": undefined,
-        "optedInNoticeBannerId": undefined,
-        "overlays": Object {
-          "banners": Object {
-            "add": [MockFunction],
-            "get$": [MockFunction],
-            "getComponent": [MockFunction],
-            "remove": [MockFunction],
-            "replace": [MockFunction],
-          },
-          "openConfirm": [MockFunction],
-          "openFlyout": [MockFunction],
-          "openModal": [MockFunction],
-        },
-        "renderOptInBanner": [Function],
-        "renderOptedInNoticeBanner": [Function],
-        "setOptedInNoticeSeen": [Function],
-        "shouldShowOptInBanner": [Function],
-        "shouldShowOptedInNoticeBanner": [Function],
-        "telemetryService": TelemetryService {
-          "canSendTelemetry": [Function],
-          "currentKibanaVersion": "mockKibanaVersion",
-          "defaultConfig": Object {
-            "allowChangingOptInStatus": true,
-            "banner": true,
-            "enabled": true,
-            "optIn": true,
-            "sendUsageFrom": "browser",
-            "sendUsageTo": "staging",
-            "telemetryNotifyUserAboutOptInDefault": true,
-            "userCanChangeSettings": true,
-          },
-          "fetchExample": [Function],
-          "fetchTelemetry": [Function],
-          "getCanChangeOptInStatus": [Function],
-          "getIsOptedIn": [Function],
-          "getOptInStatusUrl": [Function],
-          "getTelemetryUrl": [Function],
-          "http": Object {
-            "addLoadingCountSource": [MockFunction],
-            "anonymousPaths": Object {
-              "isAnonymous": [MockFunction],
-              "register": [MockFunction],
-            },
-            "basePath": BasePath {
-              "basePath": "",
-              "get": [Function],
-              "prepend": [Function],
-              "publicBaseUrl": undefined,
-              "remove": [Function],
-              "serverBasePath": "",
-            },
-            "delete": [MockFunction],
-            "externalUrl": Object {
-              "validateUrl": [MockFunction],
-            },
-            "fetch": [MockFunction],
-            "get": [MockFunction],
-            "getLoadingCount$": [MockFunction],
-            "head": [MockFunction],
-            "intercept": [MockFunction],
-            "options": [MockFunction],
-            "patch": [MockFunction],
-            "post": [MockFunction],
-            "put": [MockFunction],
-          },
-          "isScreenshotMode": false,
-          "notifications": Object {
-            "toasts": Object {
-              "add": [MockFunction],
-              "addDanger": [MockFunction],
-              "addError": [MockFunction],
-              "addInfo": [MockFunction],
-              "addSuccess": [MockFunction],
-              "addWarning": [MockFunction],
-              "get$": [MockFunction],
-              "remove": [MockFunction],
-            },
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
           },
-          "reportOptInStatus": [MockFunction],
-          "reportOptInStatusChange": true,
-          "setOptIn": [Function],
-          "setUserHasSeenNotice": [Function],
-          "updatedConfig": undefined,
         },
-      },
-      "telemetryService": TelemetryService {
-        "canSendTelemetry": [Function],
-        "currentKibanaVersion": "mockKibanaVersion",
-        "defaultConfig": Object {
-          "allowChangingOptInStatus": true,
-          "banner": true,
-          "enabled": true,
-          "optIn": true,
-          "sendUsageFrom": "browser",
-          "sendUsageTo": "staging",
-          "telemetryNotifyUserAboutOptInDefault": true,
-          "userCanChangeSettings": true,
-        },
-        "fetchExample": [Function],
-        "fetchTelemetry": [Function],
-        "getCanChangeOptInStatus": [Function],
-        "getIsOptedIn": [Function],
-        "getOptInStatusUrl": [Function],
-        "getTelemetryUrl": [Function],
-        "http": Object {
-          "addLoadingCountSource": [MockFunction],
-          "anonymousPaths": Object {
-            "isAnonymous": [MockFunction],
-            "register": [MockFunction],
-          },
-          "basePath": BasePath {
-            "basePath": "",
-            "get": [Function],
-            "prepend": [Function],
-            "publicBaseUrl": undefined,
-            "remove": [Function],
-            "serverBasePath": "",
-          },
-          "delete": [MockFunction],
-          "externalUrl": Object {
-            "validateUrl": [MockFunction],
-          },
-          "fetch": [MockFunction],
-          "get": [MockFunction],
-          "getLoadingCount$": [MockFunction],
-          "head": [MockFunction],
-          "intercept": [MockFunction],
-          "options": [MockFunction],
-          "patch": [MockFunction],
-          "post": [MockFunction],
-          "put": [MockFunction],
-        },
-        "isScreenshotMode": false,
-        "notifications": Object {
-          "toasts": Object {
-            "add": [MockFunction],
-            "addDanger": [MockFunction],
-            "addError": [MockFunction],
-            "addInfo": [MockFunction],
-            "addSuccess": [MockFunction],
-            "addWarning": [MockFunction],
-            "get$": [MockFunction],
-            "remove": [MockFunction],
-          },
-        },
-        "reportOptInStatus": [MockFunction],
-        "reportOptInStatusChange": true,
-        "setOptIn": [Function],
-        "setUserHasSeenNotice": [Function],
-        "updatedConfig": undefined,
-      },
+      }
     }
-  }
-  urlBasePath="goober"
-/>
-`;
-
-exports[`home welcome stores skip welcome setting if skipped 1`] = `
-<mockConstructor
-  data-test-subj="homeApp"
-  pageHeader={
-    Object {
-      "bottomBorder": false,
-      "pageTitle": <FormattedMessage
-        defaultMessage="Welcome home"
-        id="home.header.title"
-        values={Object {}}
-      />,
-    }
-  }
-  template="empty"
->
-  <SolutionsSection
-    addBasePath={[Function]}
-    solutions={Array []}
-  />
-  <AddData
-    addBasePath={[Function]}
-    isDarkMode={false}
-  />
-  <ManageData
-    addBasePath={[Function]}
     features={Array []}
   />
   <mockConstructor
diff --git a/src/plugins/home/public/application/components/home.test.tsx b/src/plugins/home/public/application/components/home.test.tsx
index 83000ff0860b4..a3b4df157ace4 100644
--- a/src/plugins/home/public/application/components/home.test.tsx
+++ b/src/plugins/home/public/application/components/home.test.tsx
@@ -13,7 +13,9 @@ import { Home } from './home';
 
 import { FeatureCatalogueCategory } from '../../services';
 import { telemetryPluginMock } from '../../../../telemetry/public/mocks';
+import { Welcome } from './welcome';
 
+let mockHasIntegrationsPermission = true;
 jest.mock('../kibana_services', () => ({
   getServices: () => ({
     getBasePath: () => 'path',
@@ -22,6 +24,13 @@ jest.mock('../kibana_services', () => ({
     chrome: {
       setBreadcrumbs: () => {},
     },
+    application: {
+      capabilities: {
+        navLinks: {
+          integrations: mockHasIntegrationsPermission,
+        },
+      },
+    },
   }),
 }));
 
@@ -35,6 +44,7 @@ describe('home', () => {
   let defaultProps: HomeProps;
 
   beforeEach(() => {
+    mockHasIntegrationsPermission = true;
     defaultProps = {
       directories: [],
       solutions: [],
@@ -182,7 +192,7 @@ describe('home', () => {
 
       expect(defaultProps.localStorage.getItem).toHaveBeenCalledTimes(1);
 
-      expect(component).toMatchSnapshot();
+      expect(component.find(Welcome).exists()).toBe(true);
     });
 
     test('stores skip welcome setting if skipped', async () => {
@@ -196,7 +206,7 @@ describe('home', () => {
 
       expect(defaultProps.localStorage.setItem).toHaveBeenCalledWith('home:welcome:show', 'false');
 
-      expect(component).toMatchSnapshot();
+      expect(component.find(Welcome).exists()).toBe(false);
     });
 
     test('should show the normal home page if loading fails', async () => {
@@ -205,7 +215,7 @@ describe('home', () => {
       const hasUserIndexPattern = jest.fn(() => Promise.reject('Doh!'));
       const component = await renderHome({ hasUserIndexPattern });
 
-      expect(component).toMatchSnapshot();
+      expect(component.find(Welcome).exists()).toBe(false);
     });
 
     test('should show the normal home page if welcome screen is disabled locally', async () => {
@@ -213,7 +223,15 @@ describe('home', () => {
 
       const component = await renderHome();
 
-      expect(component).toMatchSnapshot();
+      expect(component.find(Welcome).exists()).toBe(false);
+    });
+
+    test("should show the normal home page if user doesn't have access to integrations", async () => {
+      mockHasIntegrationsPermission = false;
+
+      const component = await renderHome();
+
+      expect(component.find(Welcome).exists()).toBe(false);
     });
   });
 
diff --git a/src/plugins/home/public/application/components/home.tsx b/src/plugins/home/public/application/components/home.tsx
index d398311d30255..2a08754889c28 100644
--- a/src/plugins/home/public/application/components/home.tsx
+++ b/src/plugins/home/public/application/components/home.tsx
@@ -45,10 +45,10 @@ export class Home extends Component<HomeProps, State> {
   constructor(props: HomeProps) {
     super(props);
 
-    const isWelcomeEnabled = !(
-      getServices().homeConfig.disableWelcomeScreen ||
-      props.localStorage.getItem(KEY_ENABLE_WELCOME) === 'false'
-    );
+    const isWelcomeEnabled =
+      !getServices().homeConfig.disableWelcomeScreen &&
+      getServices().application.capabilities.navLinks.integrations &&
+      props.localStorage.getItem(KEY_ENABLE_WELCOME) !== 'false';
 
     const body = document.querySelector('body')!;
     body.classList.add('isHomPage');
diff --git a/src/plugins/home/public/application/components/home_app.js b/src/plugins/home/public/application/components/home_app.js
index b0ba4d46646d0..1dbcaa6f50fa1 100644
--- a/src/plugins/home/public/application/components/home_app.js
+++ b/src/plugins/home/public/application/components/home_app.js
@@ -17,8 +17,11 @@ import { getTutorial } from '../load_tutorials';
 import { replaceTemplateStrings } from './tutorial/replace_template_strings';
 import { getServices } from '../kibana_services';
 
+const REDIRECT_TO_INTEGRATIONS_TAB_IDS = ['all', 'logging', 'metrics', 'security'];
+
 export function HomeApp({ directories, solutions }) {
   const {
+    application,
     savedObjectsClient,
     getBasePath,
     addBasePath,
@@ -30,10 +33,17 @@ export function HomeApp({ directories, solutions }) {
   const isCloudEnabled = environment.cloud;
 
   const renderTutorialDirectory = (props) => {
+    // Redirect to integrations app unless a specific tab that is still supported was specified.
+    const tabId = props.match.params.tab;
+    if (!tabId || REDIRECT_TO_INTEGRATIONS_TAB_IDS.includes(tabId)) {
+      application.navigateToApp('integrations', { replace: true });
+      return null;
+    }
+
     return (
       <TutorialDirectory
         addBasePath={addBasePath}
-        openTab={props.match.params.tab}
+        openTab={tabId}
         isCloudEnabled={isCloudEnabled}
       />
     );
diff --git a/src/plugins/home/public/application/components/manage_data/manage_data.tsx b/src/plugins/home/public/application/components/manage_data/manage_data.tsx
index b374bdd2e1612..0f465dfcf965f 100644
--- a/src/plugins/home/public/application/components/manage_data/manage_data.tsx
+++ b/src/plugins/home/public/application/components/manage_data/manage_data.tsx
@@ -61,7 +61,8 @@ export const ManageData: FC<Props> = ({ addBasePath, application, features }) =>
             {isDevToolsEnabled || isManagementEnabled ? (
               <EuiFlexItem className="homDataManage__actions" grow={false}>
                 <EuiFlexGroup alignItems="center" responsive={false} wrap>
-                  {isDevToolsEnabled ? (
+                  {/* Check if both the Dev Tools UI and the Console UI are enabled. */}
+                  {isDevToolsEnabled && consoleHref !== undefined ? (
                     <EuiFlexItem grow={false}>
                       <RedirectAppLinks application={application}>
                         <EuiButtonEmpty
diff --git a/src/plugins/home/public/application/components/tutorial/tutorial.js b/src/plugins/home/public/application/components/tutorial/tutorial.js
index 508a236bf45d4..4af5e362baca9 100644
--- a/src/plugins/home/public/application/components/tutorial/tutorial.js
+++ b/src/plugins/home/public/application/components/tutorial/tutorial.js
@@ -26,9 +26,8 @@ const INSTRUCTIONS_TYPE = {
   ON_PREM_ELASTIC_CLOUD: 'onPremElasticCloud',
 };
 
-const homeTitle = i18n.translate('home.breadcrumbs.homeTitle', { defaultMessage: 'Home' });
-const addDataTitle = i18n.translate('home.breadcrumbs.addDataTitle', {
-  defaultMessage: 'Add data',
+const integrationsTitle = i18n.translate('home.breadcrumbs.integrationsAppTitle', {
+  defaultMessage: 'Integrations',
 });
 
 class TutorialUi extends React.Component {
@@ -80,12 +79,8 @@ class TutorialUi extends React.Component {
 
     getServices().chrome.setBreadcrumbs([
       {
-        text: homeTitle,
-        href: '#/',
-      },
-      {
-        text: addDataTitle,
-        href: '#/tutorial_directory',
+        text: integrationsTitle,
+        href: this.props.addBasePath('/app/integrations/browse'),
       },
       {
         text: tutorial ? tutorial.name : this.props.tutorialId,
diff --git a/src/plugins/home/public/application/components/tutorial_directory.js b/src/plugins/home/public/application/components/tutorial_directory.js
index 83e629a7c891e..ac0d1524145a1 100644
--- a/src/plugins/home/public/application/components/tutorial_directory.js
+++ b/src/plugins/home/public/application/components/tutorial_directory.js
@@ -18,12 +18,10 @@ import { getServices } from '../kibana_services';
 import { KibanaPageTemplate } from '../../../../kibana_react/public';
 import { getTutorials } from '../load_tutorials';
 
-const ALL_TAB_ID = 'all';
 const SAMPLE_DATA_TAB_ID = 'sampleData';
 
-const homeTitle = i18n.translate('home.breadcrumbs.homeTitle', { defaultMessage: 'Home' });
-const addDataTitle = i18n.translate('home.breadcrumbs.addDataTitle', {
-  defaultMessage: 'Add data',
+const integrationsTitle = i18n.translate('home.breadcrumbs.integrationsAppTitle', {
+  defaultMessage: 'Integrations',
 });
 
 class TutorialDirectoryUi extends React.Component {
@@ -48,7 +46,7 @@ class TutorialDirectoryUi extends React.Component {
       })),
     ];
 
-    let openTab = ALL_TAB_ID;
+    let openTab = SAMPLE_DATA_TAB_ID;
     if (
       props.openTab &&
       this.tabs.some((tab) => {
@@ -72,10 +70,9 @@ class TutorialDirectoryUi extends React.Component {
 
     getServices().chrome.setBreadcrumbs([
       {
-        text: homeTitle,
-        href: '#/',
+        text: integrationsTitle,
+        href: this.props.addBasePath(`/app/integrations/browse`),
       },
-      { text: addDataTitle },
     ]);
 
     const tutorialConfigs = await getTutorials();
@@ -155,6 +152,15 @@ class TutorialDirectoryUi extends React.Component {
   renderTabContent = () => {
     const tab = this.tabs.find(({ id }) => id === this.state.selectedTabId);
     if (tab?.content) {
+      getServices().chrome.setBreadcrumbs([
+        {
+          text: integrationsTitle,
+          href: this.props.addBasePath(`/app/integrations/browse`),
+        },
+        {
+          text: tab.name,
+        },
+      ]);
       return tab.content;
     }
 
@@ -163,7 +169,7 @@ class TutorialDirectoryUi extends React.Component {
         {this.state.tutorialCards
           .filter((tutorial) => {
             return (
-              this.state.selectedTabId === ALL_TAB_ID ||
+              this.state.selectedTabId === SAMPLE_DATA_TAB_ID ||
               this.state.selectedTabId === tutorial.category
             );
           })
diff --git a/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx b/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx
index 36f2f8534399f..e46910c170103 100644
--- a/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx
+++ b/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx
@@ -39,15 +39,17 @@ export const RequestCodeViewer = ({ indexPattern, json }: RequestCodeViewerProps
   const { services } = useKibana<InspectorPluginStartDeps>();
 
   const navigateToUrl = services.application?.navigateToUrl;
-  const canShowDevTools = services.application?.capabilities?.dev_tools.show;
   const devToolsDataUri = compressToEncodedURIComponent(`GET ${indexPattern}/_search\n${json}`);
-  const devToolsHref = services.share.url.locators
+  const consoleHref = services.share.url.locators
     .get('CONSOLE_APP_LOCATOR')
     ?.useUrl({ loadFrom: `data:text/plain,${devToolsDataUri}` });
+  // Check if both the Dev Tools UI and the Console UI are enabled.
+  const canShowDevTools =
+    services.application?.capabilities?.dev_tools.show && consoleHref !== undefined;
   const shouldShowDevToolsLink = !!(indexPattern && canShowDevTools);
   const handleDevToolsLinkClick = useCallback(
-    () => devToolsHref && navigateToUrl && navigateToUrl(devToolsHref),
-    [devToolsHref, navigateToUrl]
+    () => consoleHref && navigateToUrl && navigateToUrl(consoleHref),
+    [consoleHref, navigateToUrl]
   );
 
   return (
@@ -79,7 +81,7 @@ export const RequestCodeViewer = ({ indexPattern, json }: RequestCodeViewerProps
               size="xs"
               flush="right"
               iconType="wrench"
-              href={devToolsHref}
+              href={consoleHref}
               onClick={handleDevToolsLinkClick}
               data-test-subj="inspectorRequestOpenInConsoleButton"
             >
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
index f66d05140b2e9..8e1d0cb92e006 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
@@ -1,117 +1,177 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`ElasticAgentCard props button 1`] = `
-<EuiCard
-  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Button
-    </EuiButton>
+<RedirectAppLinks
+  application={
+    Object {
+      "capabilities": Object {
+        "navLinks": Object {
+          "integrations": true,
+        },
+      },
+    }
   }
-  href="/app/integrations/browse"
-  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
-  paddingSize="l"
-  title={
-    <EuiScreenReaderOnly>
-      <span>
-        Add Elastic Agent
-      </span>
-    </EuiScreenReaderOnly>
-  }
-/>
+>
+  <EuiCard
+    description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+    footer={
+      <EuiButton
+        fill={true}
+      >
+        Button
+      </EuiButton>
+    }
+    href="/app/integrations/browse"
+    image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+    paddingSize="l"
+    title={
+      <EuiScreenReaderOnly>
+        <span>
+          Add Elastic Agent
+        </span>
+      </EuiScreenReaderOnly>
+    }
+  />
+</RedirectAppLinks>
 `;
 
 exports[`ElasticAgentCard props category 1`] = `
-<EuiCard
-  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Add Elastic Agent
-    </EuiButton>
+<RedirectAppLinks
+  application={
+    Object {
+      "capabilities": Object {
+        "navLinks": Object {
+          "integrations": true,
+        },
+      },
+    }
   }
-  href="/app/integrations/browse/custom"
-  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
-  paddingSize="l"
-  title={
-    <EuiScreenReaderOnly>
-      <span>
+>
+  <EuiCard
+    description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+    footer={
+      <EuiButton
+        fill={true}
+      >
         Add Elastic Agent
-      </span>
-    </EuiScreenReaderOnly>
-  }
-/>
+      </EuiButton>
+    }
+    href="/app/integrations/browse/custom"
+    image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+    paddingSize="l"
+    title={
+      <EuiScreenReaderOnly>
+        <span>
+          Add Elastic Agent
+        </span>
+      </EuiScreenReaderOnly>
+    }
+  />
+</RedirectAppLinks>
 `;
 
 exports[`ElasticAgentCard props href 1`] = `
-<EuiCard
-  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Button
-    </EuiButton>
+<RedirectAppLinks
+  application={
+    Object {
+      "capabilities": Object {
+        "navLinks": Object {
+          "integrations": true,
+        },
+      },
+    }
   }
-  href="#"
-  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
-  paddingSize="l"
-  title={
-    <EuiScreenReaderOnly>
-      <span>
-        Add Elastic Agent
-      </span>
-    </EuiScreenReaderOnly>
-  }
-/>
+>
+  <EuiCard
+    description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+    footer={
+      <EuiButton
+        fill={true}
+      >
+        Button
+      </EuiButton>
+    }
+    href="#"
+    image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+    paddingSize="l"
+    title={
+      <EuiScreenReaderOnly>
+        <span>
+          Add Elastic Agent
+        </span>
+      </EuiScreenReaderOnly>
+    }
+  />
+</RedirectAppLinks>
 `;
 
 exports[`ElasticAgentCard props recommended 1`] = `
-<EuiCard
-  betaBadgeLabel="Recommended"
-  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Add Elastic Agent
-    </EuiButton>
+<RedirectAppLinks
+  application={
+    Object {
+      "capabilities": Object {
+        "navLinks": Object {
+          "integrations": true,
+        },
+      },
+    }
   }
-  href="/app/integrations/browse"
-  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
-  paddingSize="l"
-  title={
-    <EuiScreenReaderOnly>
-      <span>
+>
+  <EuiCard
+    betaBadgeLabel="Recommended"
+    description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+    footer={
+      <EuiButton
+        fill={true}
+      >
         Add Elastic Agent
-      </span>
-    </EuiScreenReaderOnly>
-  }
-/>
+      </EuiButton>
+    }
+    href="/app/integrations/browse"
+    image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+    paddingSize="l"
+    title={
+      <EuiScreenReaderOnly>
+        <span>
+          Add Elastic Agent
+        </span>
+      </EuiScreenReaderOnly>
+    }
+  />
+</RedirectAppLinks>
 `;
 
 exports[`ElasticAgentCard renders 1`] = `
-<EuiCard
-  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Add Elastic Agent
-    </EuiButton>
+<RedirectAppLinks
+  application={
+    Object {
+      "capabilities": Object {
+        "navLinks": Object {
+          "integrations": true,
+        },
+      },
+    }
   }
-  href="/app/integrations/browse"
-  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
-  paddingSize="l"
-  title={
-    <EuiScreenReaderOnly>
-      <span>
+>
+  <EuiCard
+    description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+    footer={
+      <EuiButton
+        fill={true}
+      >
         Add Elastic Agent
-      </span>
-    </EuiScreenReaderOnly>
-  }
-/>
+      </EuiButton>
+    }
+    href="/app/integrations/browse"
+    image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+    paddingSize="l"
+    title={
+      <EuiScreenReaderOnly>
+        <span>
+          Add Elastic Agent
+        </span>
+      </EuiScreenReaderOnly>
+    }
+  />
+</RedirectAppLinks>
 `;
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
index 5a91e568471d1..b9d412fe4df89 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
@@ -12,6 +12,7 @@ import { CoreStart } from 'kibana/public';
 import { EuiButton, EuiCard, EuiTextColor, EuiScreenReaderOnly } from '@elastic/eui';
 import { useKibana } from '../../../context';
 import { NoDataPageActions, NO_DATA_RECOMMENDED } from '../no_data_page';
+import { RedirectAppLinks } from '../../../app_links';
 
 export type ElasticAgentCardProps = NoDataPageActions & {
   solution: string;
@@ -76,23 +77,25 @@ export const ElasticAgentCard: FunctionComponent<ElasticAgentCardProps> = ({
     );
 
   return (
-    <EuiCard
-      paddingSize="l"
-      image={image}
-      href={href ?? addBasePath(`/app/integrations/browse${hasCategory}`)}
-      // Bad hack to fix the need for an a11y title even though the button exists
-      title={
-        <EuiScreenReaderOnly>
-          <span>{defaultCTAtitle}</span>
-        </EuiScreenReaderOnly>
-      }
-      description={i18n.translate('kibana-react.noDataPage.elasticAgentCard.description', {
-        defaultMessage: `Use Elastic Agent for a simple, unified way to collect data from your machines.`,
-      })}
-      betaBadgeLabel={recommended ? NO_DATA_RECOMMENDED : undefined}
-      footer={footer}
-      layout={layout as 'vertical' | undefined}
-      {...cardRest}
-    />
+    <RedirectAppLinks application={application}>
+      <EuiCard
+        paddingSize="l"
+        image={image}
+        href={href ?? addBasePath(`/app/integrations/browse${hasCategory}`)}
+        // Bad hack to fix the need for an a11y title even though the button exists
+        title={
+          <EuiScreenReaderOnly>
+            <span>{defaultCTAtitle}</span>
+          </EuiScreenReaderOnly>
+        }
+        description={i18n.translate('kibana-react.noDataPage.elasticAgentCard.description', {
+          defaultMessage: `Use Elastic Agent for a simple, unified way to collect data from your machines.`,
+        })}
+        betaBadgeLabel={recommended ? NO_DATA_RECOMMENDED : undefined}
+        footer={footer}
+        layout={layout as 'vertical' | undefined}
+        {...cardRest}
+      />
+    </RedirectAppLinks>
   );
 };
diff --git a/src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx b/src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx
new file mode 100644
index 0000000000000..ebb806387d9cf
--- /dev/null
+++ b/src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiButton,
+  EuiModal,
+  EuiModalBody,
+  EuiModalFooter,
+  EuiModalHeader,
+  EuiModalHeaderTitle,
+  EuiTextColor,
+} from '@elastic/eui';
+
+interface ExternalUrlErrorModalProps {
+  url: string;
+  handleClose: () => void;
+}
+
+export const ExternalUrlErrorModal = ({ url, handleClose }: ExternalUrlErrorModalProps) => (
+  <EuiModal onClose={handleClose}>
+    <EuiModalHeader>
+      <EuiModalHeaderTitle>
+        <FormattedMessage
+          id="visTypeTimeseries.externalUrlErrorModal.headerTitle"
+          defaultMessage="Access to this external URL is not yet enabled"
+        />
+      </EuiModalHeaderTitle>
+    </EuiModalHeader>
+    <EuiModalBody>
+      <FormattedMessage
+        id="visTypeTimeseries.externalUrlErrorModal.bodyMessage"
+        defaultMessage="Configure {externalUrlPolicy} in your {kibanaConfigFileName} to allow access to {url}."
+        values={{
+          url: (
+            <EuiTextColor color="warning" component="span">
+              {url}
+            </EuiTextColor>
+          ),
+          externalUrlPolicy: 'externalUrl.policy',
+          kibanaConfigFileName: 'kibana.yml',
+        }}
+      />
+    </EuiModalBody>
+    <EuiModalFooter>
+      <EuiButton onClick={handleClose} fill>
+        <FormattedMessage
+          id="visTypeTimeseries.externalUrlErrorModal.closeButtonLabel"
+          defaultMessage="Close"
+        />
+      </EuiButton>
+    </EuiModalFooter>
+  </EuiModal>
+);
diff --git a/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js b/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js
index 7b1db4b362647..b3a48a997b301 100644
--- a/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js
+++ b/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js
@@ -17,6 +17,7 @@ import { createFieldFormatter } from '../../lib/create_field_formatter';
 import { isSortable } from './is_sortable';
 import { EuiToolTip, EuiIcon } from '@elastic/eui';
 import { replaceVars } from '../../lib/replace_vars';
+import { ExternalUrlErrorModal } from '../../lib/external_url_error_modal';
 import { FIELD_FORMAT_IDS } from '../../../../../../../../plugins/field_formats/common';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { getFieldFormats, getCoreStart } from '../../../../services';
@@ -53,12 +54,26 @@ class TableVis extends Component {
     const DateFormat = fieldFormatsService.getType(FIELD_FORMAT_IDS.DATE);
 
     this.dateFormatter = new DateFormat({}, this.props.getConfig);
+
+    this.state = {
+      accessDeniedDrilldownUrl: null,
+    };
   }
 
   get visibleSeries() {
     return get(this.props, 'model.series', []).filter((series) => !series.hidden);
   }
 
+  createDrilldownUrlClickHandler = (url) => (event) => {
+    const validatedUrl = getCoreStart().http.externalUrl.validateUrl(url);
+    if (validatedUrl) {
+      this.setState({ accessDeniedDrilldownUrl: null });
+    } else {
+      event.preventDefault();
+      this.setState({ accessDeniedDrilldownUrl: url });
+    }
+  };
+
   renderRow = (row) => {
     const { model, fieldFormatMap, getConfig } = this.props;
 
@@ -74,7 +89,16 @@ class TableVis extends Component {
 
     if (model.drilldown_url) {
       const url = replaceVars(model.drilldown_url, {}, { key: row.key });
-      rowDisplay = <a href={sanitizeUrl(url)}>{rowDisplay}</a>;
+      const handleDrilldownUrlClick = this.createDrilldownUrlClickHandler(url);
+      rowDisplay = (
+        <a
+          href={sanitizeUrl(url)}
+          onClick={handleDrilldownUrlClick}
+          onContextMenu={handleDrilldownUrlClick}
+        >
+          {rowDisplay}
+        </a>
+      );
     }
 
     const columns = row.series
@@ -213,8 +237,11 @@ class TableVis extends Component {
     );
   }
 
+  closeExternalUrlErrorModal = () => this.setState({ accessDeniedDrilldownUrl: null });
+
   render() {
     const { visData, model } = this.props;
+    const { accessDeniedDrilldownUrl } = this.state;
     const header = this.renderHeader();
     let rows;
 
@@ -239,16 +266,24 @@ class TableVis extends Component {
       );
     }
     return (
-      <RedirectAppLinks
-        application={getCoreStart().application}
-        className="tvbVis"
-        data-test-subj="tableView"
-      >
-        <table className="table">
-          <thead>{header}</thead>
-          <tbody>{rows}</tbody>
-        </table>
-      </RedirectAppLinks>
+      <>
+        <RedirectAppLinks
+          application={getCoreStart().application}
+          className="tvbVis"
+          data-test-subj="tableView"
+        >
+          <table className="table">
+            <thead>{header}</thead>
+            <tbody>{rows}</tbody>
+          </table>
+        </RedirectAppLinks>
+        {accessDeniedDrilldownUrl && (
+          <ExternalUrlErrorModal
+            url={accessDeniedDrilldownUrl}
+            handleClose={this.closeExternalUrlErrorModal}
+          />
+        )}
+      </>
     );
   }
 }
diff --git a/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js b/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js
index 8176f6ece2805..5eb850a753384 100644
--- a/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js
+++ b/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js
@@ -15,10 +15,11 @@ import { getLastValue } from '../../../../../common/last_value_utils';
 import { isBackgroundInverted } from '../../../lib/set_is_reversed';
 import { replaceVars } from '../../lib/replace_vars';
 import PropTypes from 'prop-types';
-import React from 'react';
+import React, { useState, useCallback } from 'react';
 import { sortBy, first, get } from 'lodash';
 import { DATA_FORMATTERS } from '../../../../../common/enums';
 import { getOperator, shouldOperate } from '../../../../../common/operators_utils';
+import { ExternalUrlErrorModal } from '../../lib/external_url_error_modal';
 
 function sortByDirection(data, direction, fn) {
   if (direction === 'desc') {
@@ -41,6 +42,8 @@ function sortSeries(visData, model) {
 }
 
 function TopNVisualization(props) {
+  const [accessDeniedDrilldownUrl, setAccessDeniedDrilldownUrl] = useState(null);
+  const coreStart = getCoreStart();
   const { backgroundColor, model, visData, fieldFormatMap, getConfig } = props;
 
   const series = sortSeries(visData, model).map((item) => {
@@ -83,13 +86,27 @@ function TopNVisualization(props) {
   if (model.drilldown_url) {
     params.onClick = (item) => {
       const url = replaceVars(model.drilldown_url, {}, { key: item.label });
-      getCoreStart().application.navigateToUrl(url);
+      const validatedUrl = coreStart.http.externalUrl.validateUrl(url);
+      if (validatedUrl) {
+        setAccessDeniedDrilldownUrl(null);
+        coreStart.application.navigateToUrl(url);
+      } else {
+        setAccessDeniedDrilldownUrl(url);
+      }
     };
   }
 
+  const closeExternalUrlErrorModal = useCallback(() => setAccessDeniedDrilldownUrl(null), []);
+
   return (
     <div className="tvbVis" style={style}>
       <TopN {...params} />
+      {accessDeniedDrilldownUrl && (
+        <ExternalUrlErrorModal
+          url={accessDeniedDrilldownUrl}
+          handleClose={closeExternalUrlErrorModal}
+        />
+      )}
     </div>
   );
 }
diff --git a/test/functional/apps/home/_add_data.js b/test/functional/apps/home/_add_data.ts
similarity index 59%
rename from test/functional/apps/home/_add_data.js
rename to test/functional/apps/home/_add_data.ts
index c69e0a02c26e4..3fd69c1a488f4 100644
--- a/test/functional/apps/home/_add_data.js
+++ b/test/functional/apps/home/_add_data.ts
@@ -6,20 +6,15 @@
  * Side Public License, v 1.
  */
 
-import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../ftr_provider_context';
 
-export default function ({ getService, getPageObjects }) {
-  const retry = getService('retry');
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common', 'header', 'home', 'dashboard']);
 
   describe('add data tutorials', function describeIndexTests() {
-    it('directory should display registered tutorials', async () => {
+    it('directory should redirect to integrations app', async () => {
       await PageObjects.common.navigateToUrl('home', 'tutorial_directory', { useActualUrl: true });
-      await PageObjects.header.waitUntilLoadingHasFinished();
-      await retry.try(async () => {
-        const tutorialExists = await PageObjects.home.doesSynopsisExist('netflowlogs');
-        expect(tutorialExists).to.be(true);
-      });
+      await PageObjects.common.waitUntilUrlIncludes('/app/integrations');
     });
   });
 }
diff --git a/test/functional/apps/home/_sample_data.ts b/test/functional/apps/home/_sample_data.ts
index 3cf387133bc9c..e0a96940337e2 100644
--- a/test/functional/apps/home/_sample_data.ts
+++ b/test/functional/apps/home/_sample_data.ts
@@ -31,6 +31,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     after(async () => {
       await security.testUser.restoreDefaults();
+      await PageObjects.common.unsetTime();
     });
 
     it('should display registered flights sample data sets', async () => {
@@ -74,6 +75,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     describe('dashboard', () => {
       beforeEach(async () => {
+        await time();
         await PageObjects.common.navigateToUrl('home', '/tutorial_directory/sampleData', {
           useActualUrl: true,
         });
@@ -84,10 +86,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('flights');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(17);
       });
@@ -112,10 +110,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('logs');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(13);
       });
@@ -124,10 +118,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('ecommerce');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(15);
       });
@@ -160,5 +150,12 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         expect(isInstalled).to.be(false);
       });
     });
+
+    async function time() {
+      const today = moment().format('MMM D, YYYY');
+      const from = `${today} @ 00:00:00.000`;
+      const to = `${today} @ 23:59:59.999`;
+      await PageObjects.common.setTime({ from, to });
+    }
   });
 }
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index 64fb184f40e48..a40465b00dbeb 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -30,6 +30,7 @@ export class CommonPageObject extends FtrService {
   private readonly globalNav = this.ctx.getService('globalNav');
   private readonly testSubjects = this.ctx.getService('testSubjects');
   private readonly loginPage = this.ctx.getPageObject('login');
+  private readonly kibanaServer = this.ctx.getService('kibanaServer');
 
   private readonly defaultTryTimeout = this.config.get('timeouts.try');
   private readonly defaultFindTimeout = this.config.get('timeouts.find');
@@ -500,4 +501,12 @@ export class CommonPageObject extends FtrService {
       await this.testSubjects.exists(validator);
     }
   }
+
+  async setTime(time: { from: string; to: string }) {
+    await this.kibanaServer.uiSettings.replace({ 'timepicker:timeDefaults': JSON.stringify(time) });
+  }
+
+  async unsetTime() {
+    await this.kibanaServer.uiSettings.unset('timepicker:timeDefaults');
+  }
 }
diff --git a/x-pack/.i18nrc.json b/x-pack/.i18nrc.json
index 372812d4d0dc1..b51363f1b7006 100644
--- a/x-pack/.i18nrc.json
+++ b/x-pack/.i18nrc.json
@@ -64,7 +64,7 @@
     "xpack.observability": "plugins/observability",
     "xpack.banners": "plugins/banners"
   },
-  "exclude": ["examples", "plugins/monitoring/public/angular/angular_i18n"],
+  "exclude": ["examples"],
   "translations": [
     "plugins/translations/translations/zh-CN.json",
     "plugins/translations/translations/ja-JP.json"
diff --git a/x-pack/plugins/actions/README.md b/x-pack/plugins/actions/README.md
index 0d66c9d30f8b9..f838832b6ea66 100644
--- a/x-pack/plugins/actions/README.md
+++ b/x-pack/plugins/actions/README.md
@@ -45,9 +45,12 @@ Table of Contents
       - [`subActionParams (getFields)`](#subactionparams-getfields-1)
       - [`subActionParams (getIncident)`](#subactionparams-getincident-1)
       - [`subActionParams (getChoices)`](#subactionparams-getchoices-1)
-  - [| fields   | An array of fields. Example: `[priority, category]`. | string[] |](#-fields----an-array-of-fields-example-priority-category--string-)
-  - [Jira](#jira)
+  - [ServiceNow ITOM](#servicenow-itom)
     - [`params`](#params-2)
+      - [`subActionParams (addEvent)`](#subactionparams-addevent)
+      - [`subActionParams (getChoices)`](#subactionparams-getchoices-2)
+  - [Jira](#jira)
+    - [`params`](#params-3)
       - [`subActionParams (pushToService)`](#subactionparams-pushtoservice-2)
       - [`subActionParams (getIncident)`](#subactionparams-getincident-2)
       - [`subActionParams (issueTypes)`](#subactionparams-issuetypes)
@@ -56,13 +59,13 @@ Table of Contents
       - [`subActionParams (issue)`](#subactionparams-issue)
       - [`subActionParams (getFields)`](#subactionparams-getfields-2)
   - [IBM Resilient](#ibm-resilient)
-    - [`params`](#params-3)
+    - [`params`](#params-4)
       - [`subActionParams (pushToService)`](#subactionparams-pushtoservice-3)
       - [`subActionParams (getFields)`](#subactionparams-getfields-3)
       - [`subActionParams (incidentTypes)`](#subactionparams-incidenttypes)
       - [`subActionParams (severity)`](#subactionparams-severity)
   - [Swimlane](#swimlane)
-    - [`params`](#params-4)
+    - [`params`](#params-5)
   - [| severity    | The severity of the incident.    | string _(optional)_ |](#-severity-----the-severity-of-the-incident-----string-optional-)
 - [Command Line Utility](#command-line-utility)
 - [Developing New Action Types](#developing-new-action-types)
@@ -355,6 +358,43 @@ No parameters for the `getFields` subaction. Provide an empty object `{}`.
 | Property | Description                                          | Type     |
 | -------- | ---------------------------------------------------- | -------- |
 | fields   | An array of fields. Example: `[priority, category]`. | string[] |
+
+---
+## ServiceNow ITOM
+
+The [ServiceNow ITOM user documentation `params`](https://www.elastic.co/guide/en/kibana/master/servicenow-itom-action-type.html) lists configuration properties for the `addEvent` subaction. In addition, several other subaction types are available.
+### `params`
+
+| Property        | Description                                                       | Type   |
+| --------------- | ----------------------------------------------------------------- | ------ |
+| subAction       | The subaction to perform. It can be `addEvent`, and `getChoices`. | string |
+| subActionParams | The parameters of the subaction.                                  | object |
+
+#### `subActionParams (addEvent)`
+
+
+| Property        | Description                                                                                                                      | Type                |
+| --------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------- |
+| source          | The name of the event source type.                                                                                               | string _(optional)_ |
+| event_class     | Specific instance of the source.                                                                                                 | string _(optional)_ |
+| resource        | The name of the resource.                                                                                                        | string _(optional)_ |
+| node            | The Host that the event was triggered for.                                                                                       | string _(optional)_ |
+| metric_name     | Name of the metric.                                                                                                              | string _(optional)_ |
+| type            | The type of event.                                                                                                               | string _(optional)_ |
+| severity        | The category in ServiceNow.                                                                                                      | string _(optional)_ |
+| description     | The subcategory in ServiceNow.                                                                                                   | string _(optional)_ |
+| additional_info | Any additional information about the event.                                                                                      | string _(optional)_ |
+| message_key     | This value is used for de-duplication of events. All actions sharing this key will be associated with the same ServiceNow alert. | string _(optional)_ |
+| time_of_event   | The time of the event.                                                                                                           | string _(optional)_ |
+
+Refer to [ServiceNow documentation](https://docs.servicenow.com/bundle/rome-it-operations-management/page/product/event-management/task/send-events-via-web-service.html) for more information about the properties.
+
+#### `subActionParams (getChoices)`
+
+| Property | Description                                | Type     |
+| -------- | ------------------------------------------ | -------- |
+| fields   | An array of fields. Example: `[severity]`. | string[] |
+
 ---
 ## Jira
 
@@ -418,6 +458,7 @@ No parameters for the `issueTypes` subaction. Provide an empty object `{}`.
 No parameters for the `getFields` subaction. Provide an empty object `{}`.
 
 ---
+
 ## IBM Resilient
 
 The [IBM Resilient user documentation `params`](https://www.elastic.co/guide/en/kibana/master/resilient-action-type.html) lists configuration properties for the `pushToService` subaction. In addition, several other subaction types are available.
@@ -545,4 +586,4 @@ Instead of `schema.maybe()`, use `schema.nullable()`, which is the same as `sche
 
 ## user interface
 
-To make this action usable in the Kibana UI, you will need to provide all the UI editing aspects of the action. The existing action type user interfaces are defined in [`x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types`](../triggers_actions_ui/public/application/components/builtin_action_types). For more information, see the [UI documentation](../triggers_actions_ui/README.md#create-and-register-new-action-type-ui).
+To make this action usable in the Kibana UI, you will need to provide all the UI editing aspects of the action. The existing action type user interfaces are defined in [`x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types`](../triggers_actions_ui/public/application/components/builtin_action_types). For more information, see the [UI documentation](../triggers_actions_ui/README.md#create-and-register-new-action-type-ui).
\ No newline at end of file
diff --git a/x-pack/plugins/actions/server/builtin_action_types/index.ts b/x-pack/plugins/actions/server/builtin_action_types/index.ts
index 07859cba4c371..3351a36b38344 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/index.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/index.ts
@@ -16,10 +16,15 @@ import { getActionType as getSwimlaneActionType } from './swimlane';
 import { getActionType as getServerLogActionType } from './server_log';
 import { getActionType as getSlackActionType } from './slack';
 import { getActionType as getWebhookActionType } from './webhook';
-import { getServiceNowITSMActionType, getServiceNowSIRActionType } from './servicenow';
+import {
+  getServiceNowITSMActionType,
+  getServiceNowSIRActionType,
+  getServiceNowITOMActionType,
+} from './servicenow';
 import { getActionType as getJiraActionType } from './jira';
 import { getActionType as getResilientActionType } from './resilient';
 import { getActionType as getTeamsActionType } from './teams';
+import { ENABLE_ITOM } from '../constants/connectors';
 export { ActionParamsType as EmailActionParams, ActionTypeId as EmailActionTypeId } from './email';
 export {
   ActionParamsType as IndexActionParams,
@@ -42,6 +47,7 @@ export {
   ActionParamsType as ServiceNowActionParams,
   ServiceNowITSMActionTypeId,
   ServiceNowSIRActionTypeId,
+  ServiceNowITOMActionTypeId,
 } from './servicenow';
 export { ActionParamsType as JiraActionParams, ActionTypeId as JiraActionTypeId } from './jira';
 export {
@@ -75,4 +81,9 @@ export function registerBuiltInActionTypes({
   actionTypeRegistry.register(getJiraActionType({ logger, configurationUtilities }));
   actionTypeRegistry.register(getResilientActionType({ logger, configurationUtilities }));
   actionTypeRegistry.register(getTeamsActionType({ logger, configurationUtilities }));
+
+  // TODO: Remove when ITOM is ready
+  if (ENABLE_ITOM) {
+    actionTypeRegistry.register(getServiceNowITOMActionType({ logger, configurationUtilities }));
+  }
 }
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts
index e1f66263729e2..7969f2e53d3d9 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts
@@ -361,6 +361,7 @@ describe('api', () => {
       const res = await api.getFields({
         externalService,
         params: {},
+        logger: mockedLogger,
       });
       expect(res).toEqual(serviceNowCommonFields);
     });
@@ -371,6 +372,7 @@ describe('api', () => {
       const res = await api.getChoices({
         externalService,
         params: { fields: ['priority'] },
+        logger: mockedLogger,
       });
       expect(res).toEqual(serviceNowChoices);
     });
@@ -383,6 +385,7 @@ describe('api', () => {
         params: {
           externalId: 'incident-1',
         },
+        logger: mockedLogger,
       });
       expect(res).toEqual({
         description: 'description from servicenow',
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api_itom.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api_itom.test.ts
new file mode 100644
index 0000000000000..c918c4a52670a
--- /dev/null
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api_itom.test.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Logger } from '../../../../../../src/core/server';
+import { externalServiceITOMMock, itomEventParams } from './mocks';
+import { ExternalServiceITOM } from './types';
+import { apiITOM, prepareParams } from './api_itom';
+let mockedLogger: jest.Mocked<Logger>;
+
+describe('api_itom', () => {
+  let externalService: jest.Mocked<ExternalServiceITOM>;
+  const eventParamsWithFormattedDate = {
+    ...itomEventParams,
+    time_of_event: '2021-10-13, 10:51:44',
+  };
+
+  beforeEach(() => {
+    externalService = externalServiceITOMMock.create();
+    jest.clearAllMocks();
+  });
+
+  describe('prepareParams', () => {
+    test('it prepares the params correctly', async () => {
+      expect(prepareParams(itomEventParams)).toEqual(eventParamsWithFormattedDate);
+    });
+
+    test('it removes null values', async () => {
+      const { time_of_event: timeOfEvent, ...rest } = itomEventParams;
+      expect(prepareParams({ ...rest, time_of_event: null })).toEqual(rest);
+    });
+
+    test('it set the time to null if it is not a proper date', async () => {
+      const { time_of_event: timeOfEvent, ...rest } = itomEventParams;
+      expect(prepareParams({ ...rest, time_of_event: 'not a proper date' })).toEqual(rest);
+    });
+  });
+
+  describe('addEvent', () => {
+    test('it adds an event correctly', async () => {
+      await apiITOM.addEvent({
+        externalService,
+        params: itomEventParams,
+        logger: mockedLogger,
+      });
+
+      expect(externalService.addEvent).toHaveBeenCalledWith(eventParamsWithFormattedDate);
+    });
+  });
+});
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api_itom.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api_itom.ts
new file mode 100644
index 0000000000000..668e17a042718
--- /dev/null
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api_itom.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { api } from './api';
+import {
+  ExecutorSubActionAddEventParams,
+  AddEventApiHandlerArgs,
+  ExternalServiceApiITOM,
+} from './types';
+
+const isValidDate = (d: Date) => !isNaN(d.valueOf());
+
+const formatTimeOfEvent = (timeOfEvent: string | null): string | undefined => {
+  if (timeOfEvent != null) {
+    const date = new Date(timeOfEvent);
+
+    return isValidDate(date)
+      ? // The format is: yyyy-MM-dd HH:mm:ss GMT
+        date.toLocaleDateString('en-CA', {
+          year: 'numeric',
+          month: '2-digit',
+          day: '2-digit',
+          hour: '2-digit',
+          hour12: false,
+          minute: '2-digit',
+          second: '2-digit',
+          timeZone: 'GMT',
+        })
+      : undefined;
+  }
+};
+
+const removeNullValues = (
+  params: ExecutorSubActionAddEventParams
+): ExecutorSubActionAddEventParams =>
+  (Object.keys(params) as Array<keyof ExecutorSubActionAddEventParams>).reduce(
+    (acc, key) => ({
+      ...acc,
+      ...(params[key] != null ? { [key]: params[key] } : {}),
+    }),
+    {} as ExecutorSubActionAddEventParams
+  );
+
+export const prepareParams = (
+  params: ExecutorSubActionAddEventParams
+): ExecutorSubActionAddEventParams => {
+  const timeOfEvent = formatTimeOfEvent(params.time_of_event);
+  return removeNullValues({
+    ...params,
+    time_of_event: timeOfEvent ?? null,
+  });
+};
+
+const addEventServiceHandler = async ({
+  externalService,
+  params,
+}: AddEventApiHandlerArgs): Promise<void> => {
+  const itomExternalService = externalService;
+  const preparedParams = prepareParams(params);
+  await itomExternalService.addEvent(preparedParams);
+};
+
+export const apiITOM: ExternalServiceApiITOM = {
+  getChoices: api.getChoices,
+  addEvent: addEventServiceHandler,
+};
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/config.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/config.test.ts
index babd360cbcb82..41f723bc9e2aa 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/config.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/config.test.ts
@@ -37,4 +37,15 @@ describe('config', () => {
       commentFieldKey: 'work_notes',
     });
   });
+
+  test('ITOM: the config are correct', async () => {
+    const snConfig = snExternalServiceConfig['.servicenow-itom'];
+    expect(snConfig).toEqual({
+      importSetTable: 'x_elas2_inc_int_elastic_incident',
+      appScope: 'x_elas2_inc_int',
+      table: 'em_event',
+      useImportAPI: true,
+      commentFieldKey: 'work_notes',
+    });
+  });
 });
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/config.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/config.ts
index 37e4c6994b403..52d2eb7662f53 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/config.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/config.ts
@@ -6,6 +6,7 @@
  */
 
 import {
+  ENABLE_ITOM,
   ENABLE_NEW_SN_ITSM_CONNECTOR,
   ENABLE_NEW_SN_SIR_CONNECTOR,
 } from '../../constants/connectors';
@@ -16,6 +17,7 @@ export const serviceNowSIRTable = 'sn_si_incident';
 
 export const ServiceNowITSMActionTypeId = '.servicenow';
 export const ServiceNowSIRActionTypeId = '.servicenow-sir';
+export const ServiceNowITOMActionTypeId = '.servicenow-itom';
 
 export const snExternalServiceConfig: SNProductsConfig = {
   '.servicenow': {
@@ -32,6 +34,14 @@ export const snExternalServiceConfig: SNProductsConfig = {
     useImportAPI: ENABLE_NEW_SN_SIR_CONNECTOR,
     commentFieldKey: 'work_notes',
   },
+  '.servicenow-itom': {
+    importSetTable: 'x_elas2_inc_int_elastic_incident',
+    appScope: 'x_elas2_inc_int',
+    table: 'em_event',
+    useImportAPI: ENABLE_ITOM,
+    commentFieldKey: 'work_notes',
+  },
 };
 
 export const FIELD_PREFIX = 'u_';
+export const DEFAULT_ALERTS_GROUPING_KEY = '{{rule.id}}:{{alert.id}}';
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/index.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/index.test.ts
index b342844033994..6ba8b80dfc09c 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/index.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/index.test.ts
@@ -8,7 +8,7 @@
 import { actionsMock } from '../../mocks';
 import { createActionTypeRegistry } from '../index.test';
 import {
-  ServiceNowPublicConfigurationType,
+  ServiceNowPublicConfigurationBaseType,
   ServiceNowSecretConfigurationType,
   ExecutorParams,
   PushToServiceResponse,
@@ -56,7 +56,7 @@ describe('ServiceNow', () => {
     beforeAll(() => {
       const { actionTypeRegistry } = createActionTypeRegistry();
       actionType = actionTypeRegistry.get<
-        ServiceNowPublicConfigurationType,
+        ServiceNowPublicConfigurationBaseType,
         ServiceNowSecretConfigurationType,
         ExecutorParams,
         PushToServiceResponse | {}
@@ -91,7 +91,7 @@ describe('ServiceNow', () => {
     beforeAll(() => {
       const { actionTypeRegistry } = createActionTypeRegistry();
       actionType = actionTypeRegistry.get<
-        ServiceNowPublicConfigurationType,
+        ServiceNowPublicConfigurationBaseType,
         ServiceNowSecretConfigurationType,
         ExecutorParams,
         PushToServiceResponse | {}
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/index.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/index.ts
index 29907381d45da..1e07cf858f332 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/index.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/index.ts
@@ -11,9 +11,11 @@ import { schema, TypeOf } from '@kbn/config-schema';
 import { validate } from './validators';
 import {
   ExternalIncidentServiceConfiguration,
+  ExternalIncidentServiceConfigurationBase,
   ExternalIncidentServiceSecretConfiguration,
   ExecutorParamsSchemaITSM,
   ExecutorParamsSchemaSIR,
+  ExecutorParamsSchemaITOM,
 } from './schema';
 import { ActionsConfigurationUtilities } from '../../actions_config';
 import { ActionType, ActionTypeExecutorOptions, ActionTypeExecutorResult } from '../../types';
@@ -32,8 +34,14 @@ import {
   ExecutorSubActionGetChoicesParams,
   ServiceFactory,
   ExternalServiceAPI,
+  ExecutorParamsITOM,
+  ExecutorSubActionAddEventParams,
+  ExternalServiceApiITOM,
+  ExternalServiceITOM,
+  ServiceNowPublicConfigurationBaseType,
 } from './types';
 import {
+  ServiceNowITOMActionTypeId,
   ServiceNowITSMActionTypeId,
   serviceNowITSMTable,
   ServiceNowSIRActionTypeId,
@@ -42,12 +50,16 @@ import {
 } from './config';
 import { createExternalServiceSIR } from './service_sir';
 import { apiSIR } from './api_sir';
+import { throwIfSubActionIsNotSupported } from './utils';
+import { createExternalServiceITOM } from './service_itom';
+import { apiITOM } from './api_itom';
 
 export {
   ServiceNowITSMActionTypeId,
   serviceNowITSMTable,
   ServiceNowSIRActionTypeId,
   serviceNowSIRTable,
+  ServiceNowITOMActionTypeId,
 };
 
 export type ActionParamsType =
@@ -59,21 +71,20 @@ interface GetActionTypeParams {
   configurationUtilities: ActionsConfigurationUtilities;
 }
 
-export type ServiceNowActionType = ActionType<
-  ServiceNowPublicConfigurationType,
-  ServiceNowSecretConfigurationType,
-  ExecutorParams,
-  PushToServiceResponse | {}
->;
+export type ServiceNowActionType<
+  C extends Record<string, unknown> = ServiceNowPublicConfigurationBaseType,
+  T extends Record<string, unknown> = ExecutorParams
+> = ActionType<C, ServiceNowSecretConfigurationType, T, PushToServiceResponse | {}>;
 
-export type ServiceNowActionTypeExecutorOptions = ActionTypeExecutorOptions<
-  ServiceNowPublicConfigurationType,
-  ServiceNowSecretConfigurationType,
-  ExecutorParams
->;
+export type ServiceNowActionTypeExecutorOptions<
+  C extends Record<string, unknown> = ServiceNowPublicConfigurationBaseType,
+  T extends Record<string, unknown> = ExecutorParams
+> = ActionTypeExecutorOptions<C, ServiceNowSecretConfigurationType, T>;
 
 // action type definition
-export function getServiceNowITSMActionType(params: GetActionTypeParams): ServiceNowActionType {
+export function getServiceNowITSMActionType(
+  params: GetActionTypeParams
+): ServiceNowActionType<ServiceNowPublicConfigurationType, ExecutorParams> {
   const { logger, configurationUtilities } = params;
   return {
     id: ServiceNowITSMActionTypeId,
@@ -98,7 +109,9 @@ export function getServiceNowITSMActionType(params: GetActionTypeParams): Servic
   };
 }
 
-export function getServiceNowSIRActionType(params: GetActionTypeParams): ServiceNowActionType {
+export function getServiceNowSIRActionType(
+  params: GetActionTypeParams
+): ServiceNowActionType<ServiceNowPublicConfigurationType, ExecutorParams> {
   const { logger, configurationUtilities } = params;
   return {
     id: ServiceNowSIRActionTypeId,
@@ -123,6 +136,33 @@ export function getServiceNowSIRActionType(params: GetActionTypeParams): Service
   };
 }
 
+export function getServiceNowITOMActionType(
+  params: GetActionTypeParams
+): ServiceNowActionType<ServiceNowPublicConfigurationBaseType, ExecutorParamsITOM> {
+  const { logger, configurationUtilities } = params;
+  return {
+    id: ServiceNowITOMActionTypeId,
+    minimumLicenseRequired: 'platinum',
+    name: i18n.SERVICENOW_ITOM,
+    validate: {
+      config: schema.object(ExternalIncidentServiceConfigurationBase, {
+        validate: curry(validate.config)(configurationUtilities),
+      }),
+      secrets: schema.object(ExternalIncidentServiceSecretConfiguration, {
+        validate: curry(validate.secrets)(configurationUtilities),
+      }),
+      params: ExecutorParamsSchemaITOM,
+    },
+    executor: curry(executorITOM)({
+      logger,
+      configurationUtilities,
+      actionTypeId: ServiceNowITOMActionTypeId,
+      createService: createExternalServiceITOM,
+      api: apiITOM,
+    }),
+  };
+}
+
 // action executor
 const supportedSubActions: string[] = ['getFields', 'pushToService', 'getChoices', 'getIncident'];
 async function executor(
@@ -139,7 +179,10 @@ async function executor(
     createService: ServiceFactory;
     api: ExternalServiceAPI;
   },
-  execOptions: ServiceNowActionTypeExecutorOptions
+  execOptions: ServiceNowActionTypeExecutorOptions<
+    ServiceNowPublicConfigurationType,
+    ExecutorParams
+  >
 ): Promise<ActionTypeExecutorResult<ServiceNowExecutorResultData | {}>> {
   const { actionId, config, params, secrets } = execOptions;
   const { subAction, subActionParams } = params;
@@ -156,17 +199,8 @@ async function executor(
     externalServiceConfig
   );
 
-  if (!api[subAction]) {
-    const errorMessage = `[Action][ExternalService] Unsupported subAction type ${subAction}.`;
-    logger.error(errorMessage);
-    throw new Error(errorMessage);
-  }
-
-  if (!supportedSubActions.includes(subAction)) {
-    const errorMessage = `[Action][ExternalService] subAction ${subAction} not implemented.`;
-    logger.error(errorMessage);
-    throw new Error(errorMessage);
-  }
+  const apiAsRecord = api as unknown as Record<string, unknown>;
+  throwIfSubActionIsNotSupported({ api: apiAsRecord, subAction, supportedSubActions, logger });
 
   if (subAction === 'pushToService') {
     const pushToServiceParams = subActionParams as ExecutorSubActionPushParams;
@@ -187,6 +221,7 @@ async function executor(
     data = await api.getFields({
       externalService,
       params: getFieldsParams,
+      logger,
     });
   }
 
@@ -195,6 +230,73 @@ async function executor(
     data = await api.getChoices({
       externalService,
       params: getChoicesParams,
+      logger,
+    });
+  }
+
+  return { status: 'ok', data: data ?? {}, actionId };
+}
+
+const supportedSubActionsITOM = ['addEvent', 'getChoices'];
+
+async function executorITOM(
+  {
+    logger,
+    configurationUtilities,
+    actionTypeId,
+    createService,
+    api,
+  }: {
+    logger: Logger;
+    configurationUtilities: ActionsConfigurationUtilities;
+    actionTypeId: string;
+    createService: ServiceFactory<ExternalServiceITOM>;
+    api: ExternalServiceApiITOM;
+  },
+  execOptions: ServiceNowActionTypeExecutorOptions<
+    ServiceNowPublicConfigurationBaseType,
+    ExecutorParamsITOM
+  >
+): Promise<ActionTypeExecutorResult<ServiceNowExecutorResultData | {}>> {
+  const { actionId, config, params, secrets } = execOptions;
+  const { subAction, subActionParams } = params;
+  const externalServiceConfig = snExternalServiceConfig[actionTypeId];
+  let data: ServiceNowExecutorResultData | null = null;
+
+  const externalService = createService(
+    {
+      config,
+      secrets,
+    },
+    logger,
+    configurationUtilities,
+    externalServiceConfig
+  ) as ExternalServiceITOM;
+
+  const apiAsRecord = api as unknown as Record<string, unknown>;
+
+  throwIfSubActionIsNotSupported({
+    api: apiAsRecord,
+    subAction,
+    supportedSubActions: supportedSubActionsITOM,
+    logger,
+  });
+
+  if (subAction === 'addEvent') {
+    const eventParams = subActionParams as ExecutorSubActionAddEventParams;
+    await api.addEvent({
+      externalService,
+      params: eventParams,
+      logger,
+    });
+  }
+
+  if (subAction === 'getChoices') {
+    const getChoicesParams = subActionParams as ExecutorSubActionGetChoicesParams;
+    data = await api.getChoices({
+      externalService,
+      params: getChoicesParams,
+      logger,
     });
   }
 
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/mocks.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/mocks.ts
index 3629fb33915ae..1043fe62af1e1 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/mocks.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/mocks.ts
@@ -12,6 +12,8 @@ import {
   ExternalServiceSIR,
   Observable,
   ObservableTypes,
+  ExternalServiceITOM,
+  ExecutorSubActionAddEventParams,
 } from './types';
 
 export const serviceNowCommonFields = [
@@ -151,6 +153,16 @@ const createSIRMock = (): jest.Mocked<ExternalServiceSIR> => {
   return service;
 };
 
+const createITOMMock = (): jest.Mocked<ExternalServiceITOM> => {
+  const serviceMock = createMock();
+  const service = {
+    getChoices: serviceMock.getChoices,
+    addEvent: jest.fn().mockImplementation(() => Promise.resolve()),
+  };
+
+  return service;
+};
+
 export const externalServiceMock = {
   create: createMock,
 };
@@ -159,6 +171,10 @@ export const externalServiceSIRMock = {
   create: createSIRMock,
 };
 
+export const externalServiceITOMMock = {
+  create: createITOMMock,
+};
+
 export const executorParams: ExecutorSubActionPushParams = {
   incident: {
     externalId: 'incident-3',
@@ -227,3 +243,17 @@ export const observables: Observable[] = [
 ];
 
 export const apiParams = executorParams;
+
+export const itomEventParams: ExecutorSubActionAddEventParams = {
+  source: 'A source',
+  event_class: 'An event class',
+  resource: 'C:',
+  node: 'node.example.com',
+  metric_name: 'Percentage Logical Disk Free Space',
+  type: 'Disk space',
+  severity: '4',
+  description: 'desc',
+  additional_info: '{"alert": "test"}',
+  message_key: 'a key',
+  time_of_event: '2021-10-13T10:51:44.981Z',
+};
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts
index dab68bb9d3e9d..5f57555a8f9e1 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts
@@ -6,12 +6,21 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import { DEFAULT_ALERTS_GROUPING_KEY } from './config';
 
-export const ExternalIncidentServiceConfiguration = {
+export const ExternalIncidentServiceConfigurationBase = {
   apiUrl: schema.string(),
+};
+
+export const ExternalIncidentServiceConfiguration = {
+  ...ExternalIncidentServiceConfigurationBase,
   isLegacy: schema.boolean({ defaultValue: false }),
 };
 
+export const ExternalIncidentServiceConfigurationBaseSchema = schema.object(
+  ExternalIncidentServiceConfigurationBase
+);
+
 export const ExternalIncidentServiceConfigurationSchema = schema.object(
   ExternalIncidentServiceConfiguration
 );
@@ -80,6 +89,21 @@ export const ExecutorSubActionPushParamsSchemaSIR = schema.object({
   comments: CommentsSchema,
 });
 
+// Schema for ServiceNow ITOM
+export const ExecutorSubActionAddEventParamsSchema = schema.object({
+  source: schema.nullable(schema.string()),
+  event_class: schema.nullable(schema.string()),
+  resource: schema.nullable(schema.string()),
+  node: schema.nullable(schema.string()),
+  metric_name: schema.nullable(schema.string()),
+  type: schema.nullable(schema.string()),
+  severity: schema.nullable(schema.string()),
+  description: schema.nullable(schema.string()),
+  additional_info: schema.nullable(schema.string()),
+  message_key: schema.nullable(schema.string({ defaultValue: DEFAULT_ALERTS_GROUPING_KEY })),
+  time_of_event: schema.nullable(schema.string()),
+});
+
 export const ExecutorSubActionGetIncidentParamsSchema = schema.object({
   externalId: schema.string(),
 });
@@ -138,3 +162,15 @@ export const ExecutorParamsSchemaSIR = schema.oneOf([
     subActionParams: ExecutorSubActionGetChoicesParamsSchema,
   }),
 ]);
+
+// Executor parameters for ITOM
+export const ExecutorParamsSchemaITOM = schema.oneOf([
+  schema.object({
+    subAction: schema.literal('addEvent'),
+    subActionParams: ExecutorSubActionAddEventParamsSchema,
+  }),
+  schema.object({
+    subAction: schema.literal('getChoices'),
+    subActionParams: ExecutorSubActionGetChoicesParamsSchema,
+  }),
+]);
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/service_itom.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/service_itom.test.ts
new file mode 100644
index 0000000000000..5223add79d301
--- /dev/null
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/service_itom.test.ts
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import axios from 'axios';
+
+import { createExternalServiceITOM } from './service_itom';
+import * as utils from '../lib/axios_utils';
+import { ExternalServiceITOM } from './types';
+import { Logger } from '../../../../../../src/core/server';
+import { loggingSystemMock } from '../../../../../../src/core/server/mocks';
+import { actionsConfigMock } from '../../actions_config.mock';
+import { snExternalServiceConfig } from './config';
+import { itomEventParams, serviceNowChoices } from './mocks';
+
+const logger = loggingSystemMock.create().get() as jest.Mocked<Logger>;
+
+jest.mock('axios');
+jest.mock('../lib/axios_utils', () => {
+  const originalUtils = jest.requireActual('../lib/axios_utils');
+  return {
+    ...originalUtils,
+    request: jest.fn(),
+  };
+});
+
+axios.create = jest.fn(() => axios);
+const requestMock = utils.request as jest.Mock;
+const configurationUtilities = actionsConfigMock.create();
+
+describe('ServiceNow SIR service', () => {
+  let service: ExternalServiceITOM;
+
+  beforeEach(() => {
+    service = createExternalServiceITOM(
+      {
+        config: { apiUrl: 'https://example.com/' },
+        secrets: { username: 'admin', password: 'admin' },
+      },
+      logger,
+      configurationUtilities,
+      snExternalServiceConfig['.servicenow-itom']
+    ) as ExternalServiceITOM;
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('addEvent', () => {
+    test('it adds an event', async () => {
+      requestMock.mockImplementationOnce(() => ({
+        data: {
+          result: {
+            'Default Bulk Endpoint': '1 events were inserted',
+          },
+        },
+      }));
+
+      await service.addEvent(itomEventParams);
+      expect(requestMock).toHaveBeenCalledWith({
+        axios,
+        logger,
+        configurationUtilities,
+        url: 'https://example.com/api/global/em/jsonv2',
+        method: 'post',
+        data: { records: [itomEventParams] },
+      });
+    });
+  });
+
+  describe('getChoices', () => {
+    test('it should call request with correct arguments', async () => {
+      requestMock.mockImplementation(() => ({
+        data: { result: serviceNowChoices },
+      }));
+      await service.getChoices(['severity']);
+
+      expect(requestMock).toHaveBeenCalledWith({
+        axios,
+        logger,
+        configurationUtilities,
+        url: 'https://example.com/api/now/table/sys_choice?sysparm_query=name=task^ORname=em_event^element=severity&sysparm_fields=label,value,dependent_value,element',
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/service_itom.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/service_itom.ts
new file mode 100644
index 0000000000000..aa135e07dbc64
--- /dev/null
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/service_itom.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import axios from 'axios';
+
+import {
+  ExternalServiceCredentials,
+  SNProductsConfigValue,
+  ServiceFactory,
+  ExternalServiceITOM,
+  ExecutorSubActionAddEventParams,
+} from './types';
+
+import { Logger } from '../../../../../../src/core/server';
+import { ServiceNowSecretConfigurationType } from './types';
+import { request } from '../lib/axios_utils';
+import { ActionsConfigurationUtilities } from '../../actions_config';
+import { createExternalService } from './service';
+import { createServiceError } from './utils';
+
+const getAddEventURL = (url: string) => `${url}/api/global/em/jsonv2`;
+
+export const createExternalServiceITOM: ServiceFactory<ExternalServiceITOM> = (
+  credentials: ExternalServiceCredentials,
+  logger: Logger,
+  configurationUtilities: ActionsConfigurationUtilities,
+  serviceConfig: SNProductsConfigValue
+): ExternalServiceITOM => {
+  const snService = createExternalService(
+    credentials,
+    logger,
+    configurationUtilities,
+    serviceConfig
+  );
+
+  const { username, password } = credentials.secrets as ServiceNowSecretConfigurationType;
+  const axiosInstance = axios.create({
+    auth: { username, password },
+  });
+
+  const addEvent = async (params: ExecutorSubActionAddEventParams) => {
+    try {
+      const res = await request({
+        axios: axiosInstance,
+        url: getAddEventURL(snService.getUrl()),
+        logger,
+        method: 'post',
+        data: { records: [params] },
+        configurationUtilities,
+      });
+
+      snService.checkInstance(res);
+    } catch (error) {
+      throw createServiceError(error, `Unable to add event`);
+    }
+  };
+
+  return {
+    addEvent,
+    getChoices: snService.getChoices,
+  };
+};
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/service_sir.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/service_sir.ts
index fc8d8cc555bc8..03433f11f9465 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/service_sir.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/service_sir.ts
@@ -29,7 +29,7 @@ const getAddObservableToIncidentURL = (url: string, incidentID: string) =>
 const getBulkAddObservableToIncidentURL = (url: string, incidentID: string) =>
   `${url}/api/x_elas2_sir_int/elastic_api/incident/${incidentID}/observables/bulk`;
 
-export const createExternalServiceSIR: ServiceFactory = (
+export const createExternalServiceSIR: ServiceFactory<ExternalServiceSIR> = (
   credentials: ExternalServiceCredentials,
   logger: Logger,
   configurationUtilities: ActionsConfigurationUtilities,
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/translations.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/translations.ts
index b46e118a7235f..8b2bb9423d012 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/translations.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/translations.ts
@@ -19,6 +19,10 @@ export const SERVICENOW_SIR = i18n.translate('xpack.actions.builtin.serviceNowSI
   defaultMessage: 'ServiceNow SecOps',
 });
 
+export const SERVICENOW_ITOM = i18n.translate('xpack.actions.builtin.serviceNowITOMTitle', {
+  defaultMessage: 'ServiceNow ITOM',
+});
+
 export const ALLOWED_HOSTS_ERROR = (message: string) =>
   i18n.translate('xpack.actions.builtin.configuration.apiAllowedHostsError', {
     defaultMessage: 'error configuring connector action: {message}',
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/types.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/types.ts
index ecca1e55e0fec..31af3781c6b04 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/types.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/types.ts
@@ -20,13 +20,21 @@ import {
   ExecutorParamsSchemaSIR,
   ExecutorSubActionPushParamsSchemaSIR,
   ExecutorSubActionGetChoicesParamsSchema,
+  ExecutorParamsSchemaITOM,
+  ExecutorSubActionAddEventParamsSchema,
+  ExternalIncidentServiceConfigurationBaseSchema,
 } from './schema';
 import { ActionsConfigurationUtilities } from '../../actions_config';
 import { Logger } from '../../../../../../src/core/server';
 
+export type ServiceNowPublicConfigurationBaseType = TypeOf<
+  typeof ExternalIncidentServiceConfigurationBaseSchema
+>;
+
 export type ServiceNowPublicConfigurationType = TypeOf<
   typeof ExternalIncidentServiceConfigurationSchema
 >;
+
 export type ServiceNowSecretConfigurationType = TypeOf<
   typeof ExternalIncidentServiceSecretConfigurationSchema
 >;
@@ -108,8 +116,9 @@ export type PushToServiceApiParams = ExecutorSubActionPushParams;
 export type PushToServiceApiParamsITSM = ExecutorSubActionPushParamsITSM;
 export type PushToServiceApiParamsSIR = ExecutorSubActionPushParamsSIR;
 
-export interface ExternalServiceApiHandlerArgs {
-  externalService: ExternalService;
+export interface ExternalServiceApiHandlerArgs<T = ExternalService> {
+  externalService: T;
+  logger: Logger;
 }
 
 export type ExecutorSubActionGetIncidentParams = TypeOf<
@@ -134,7 +143,6 @@ export interface PushToServiceApiHandlerArgs extends ExternalServiceApiHandlerAr
   params: PushToServiceApiParams;
   config: Record<string, unknown>;
   secrets: Record<string, unknown>;
-  logger: Logger;
   commentFieldKey: string;
 }
 
@@ -162,13 +170,13 @@ export interface ExternalServiceChoices {
 export type GetCommonFieldsResponse = ExternalServiceFields[];
 export type GetChoicesResponse = ExternalServiceChoices[];
 
-export interface GetCommonFieldsHandlerArgs {
-  externalService: ExternalService;
+export interface GetCommonFieldsHandlerArgs extends ExternalServiceApiHandlerArgs {
   params: ExecutorSubActionCommonFieldsParams;
 }
 
 export interface GetChoicesHandlerArgs {
-  externalService: ExternalService;
+  externalService: Partial<ExternalService> & { getChoices: ExternalService['getChoices'] };
+  logger: Logger;
   params: ExecutorSubActionGetChoicesParams;
 }
 
@@ -276,9 +284,36 @@ export interface ExternalServiceSIR extends ExternalService {
   ) => Promise<ObservableResponse[]>;
 }
 
-export type ServiceFactory = (
+export type ServiceFactory<T = ExternalService> = (
   credentials: ExternalServiceCredentials,
   logger: Logger,
   configurationUtilities: ActionsConfigurationUtilities,
   serviceConfig: SNProductsConfigValue
-) => ExternalServiceSIR | ExternalService;
+) => T;
+
+/**
+ * ITOM
+ */
+
+export type ExecutorSubActionAddEventParams = TypeOf<typeof ExecutorSubActionAddEventParamsSchema>;
+
+export interface ExternalServiceITOM {
+  getChoices: ExternalService['getChoices'];
+  addEvent: (params: ExecutorSubActionAddEventParams) => Promise<void>;
+}
+
+export interface AddEventApiHandlerArgs extends ExternalServiceApiHandlerArgs<ExternalServiceITOM> {
+  params: ExecutorSubActionAddEventParams;
+}
+
+export interface GetCommonFieldsHandlerArgsITOM
+  extends ExternalServiceApiHandlerArgs<ExternalServiceITOM> {
+  params: ExecutorSubActionGetChoicesParams;
+}
+
+export interface ExternalServiceApiITOM {
+  getChoices: ExternalServiceAPI['getChoices'];
+  addEvent: (args: AddEventApiHandlerArgs) => Promise<void>;
+}
+
+export type ExecutorParamsITOM = TypeOf<typeof ExecutorParamsSchemaITOM>;
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/utils.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/utils.test.ts
index 87f27da6d213f..3eaf5305d5d26 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/utils.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/utils.test.ts
@@ -6,7 +6,17 @@
  */
 
 import { AxiosError } from 'axios';
-import { prepareIncident, createServiceError, getPushedDate } from './utils';
+
+import { Logger } from '../../../../../../src/core/server';
+import { loggingSystemMock } from '../../../../../../src/core/server/mocks';
+import {
+  prepareIncident,
+  createServiceError,
+  getPushedDate,
+  throwIfSubActionIsNotSupported,
+} from './utils';
+
+const logger = loggingSystemMock.create().get() as jest.Mocked<Logger>;
 
 /**
  * The purpose of this test is to
@@ -15,7 +25,6 @@ import { prepareIncident, createServiceError, getPushedDate } from './utils';
  * such as the scope or the import set table
  * of our ServiceNow application
  */
-
 describe('utils', () => {
   describe('prepareIncident', () => {
     test('it prepares the incident correctly when useOldApi=false', async () => {
@@ -81,4 +90,45 @@ describe('utils', () => {
       expect(getPushedDate()).toBe('2021-10-04T11:15:06.000Z');
     });
   });
+
+  describe('throwIfSubActionIsNotSupported', () => {
+    const api = { pushToService: 'whatever' };
+
+    test('it throws correctly if the subAction is not supported', async () => {
+      expect.assertions(1);
+
+      expect(() =>
+        throwIfSubActionIsNotSupported({
+          api,
+          subAction: 'addEvent',
+          supportedSubActions: ['getChoices'],
+          logger,
+        })
+      ).toThrow('[Action][ExternalService] Unsupported subAction type addEvent');
+    });
+
+    test('it throws correctly if the subAction is not implemented', async () => {
+      expect.assertions(1);
+
+      expect(() =>
+        throwIfSubActionIsNotSupported({
+          api,
+          subAction: 'pushToService',
+          supportedSubActions: ['getChoices'],
+          logger,
+        })
+      ).toThrow('[Action][ExternalService] subAction pushToService not implemented.');
+    });
+
+    test('it does not throw if the sub action is supported and implemented', async () => {
+      expect(() =>
+        throwIfSubActionIsNotSupported({
+          api,
+          subAction: 'pushToService',
+          supportedSubActions: ['pushToService'],
+          logger,
+        })
+      ).not.toThrow();
+    });
+  });
 });
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/utils.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/utils.ts
index 5b7ca99ffc709..3bd4864b71e7a 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/utils.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/utils.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Logger } from '../../../../../../src/core/server';
 import { Incident, PartialIncident, ResponseError, ServiceNowError } from './types';
 import { FIELD_PREFIX } from './config';
 import { addTimeZoneToDate, getErrorMessage } from '../lib/axios_utils';
@@ -44,3 +45,27 @@ export const getPushedDate = (timestamp?: string) => {
 
   return new Date().toISOString();
 };
+
+export const throwIfSubActionIsNotSupported = ({
+  api,
+  subAction,
+  supportedSubActions,
+  logger,
+}: {
+  api: Record<string, unknown>;
+  subAction: string;
+  supportedSubActions: string[];
+  logger: Logger;
+}) => {
+  if (!api[subAction]) {
+    const errorMessage = `[Action][ExternalService] Unsupported subAction type ${subAction}.`;
+    logger.error(errorMessage);
+    throw new Error(errorMessage);
+  }
+
+  if (!supportedSubActions.includes(subAction)) {
+    const errorMessage = `[Action][ExternalService] subAction ${subAction} not implemented.`;
+    logger.error(errorMessage);
+    throw new Error(errorMessage);
+  }
+};
diff --git a/x-pack/plugins/actions/server/constants/connectors.ts b/x-pack/plugins/actions/server/constants/connectors.ts
index f20d499716cf0..94324e4d82bc2 100644
--- a/x-pack/plugins/actions/server/constants/connectors.ts
+++ b/x-pack/plugins/actions/server/constants/connectors.ts
@@ -10,3 +10,6 @@ export const ENABLE_NEW_SN_ITSM_CONNECTOR = true;
 
 // TODO: Remove when Elastic for Security Operations is published.
 export const ENABLE_NEW_SN_SIR_CONNECTOR = true;
+
+// TODO: Remove when ready
+export const ENABLE_ITOM = true;
diff --git a/x-pack/plugins/apm/public/components/app/error_group_overview/List/__snapshots__/List.test.tsx.snap b/x-pack/plugins/apm/public/components/app/error_group_overview/List/__snapshots__/List.test.tsx.snap
index c8c7bf82dff04..ee68630daa469 100644
--- a/x-pack/plugins/apm/public/components/app/error_group_overview/List/__snapshots__/List.test.tsx.snap
+++ b/x-pack/plugins/apm/public/components/app/error_group_overview/List/__snapshots__/List.test.tsx.snap
@@ -151,7 +151,6 @@ exports[`ErrorGroupOverview -> List should render empty state 1`] = `
             className="euiTableHeaderCell"
             data-test-subj="tableHeaderCell_handled_3"
             role="columnheader"
-            scope="col"
             style={
               Object {
                 "width": undefined,
@@ -447,7 +446,6 @@ exports[`ErrorGroupOverview -> List should render with data 1`] = `
             className="euiTableHeaderCell"
             data-test-subj="tableHeaderCell_handled_3"
             role="columnheader"
-            scope="col"
             style={
               Object {
                 "width": undefined,
@@ -1265,6 +1263,7 @@ exports[`ErrorGroupOverview -> List should render with data 1`] = `
         className="euiFlexItem euiFlexItem--flexGrowZero"
       >
         <nav
+          aria-label="Pagination for table: "
           className="euiPagination"
         >
           <button
@@ -1284,6 +1283,7 @@ exports[`ErrorGroupOverview -> List should render with data 1`] = `
             />
           </button>
           <ul
+            aria-label="Pagination for table: "
             className="euiPagination__list"
           >
             <li
diff --git a/x-pack/plugins/canvas/public/components/home/my_workpads/__snapshots__/workpad_table.stories.storyshot b/x-pack/plugins/canvas/public/components/home/my_workpads/__snapshots__/workpad_table.stories.storyshot
index f955a6e2322a9..81a92ca7139ba 100644
--- a/x-pack/plugins/canvas/public/components/home/my_workpads/__snapshots__/workpad_table.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/home/my_workpads/__snapshots__/workpad_table.stories.storyshot
@@ -341,7 +341,7 @@ exports[`Storyshots Home/Components/Workpad Table Workpad Table 1`] = `
                       className="euiCheckbox__input"
                       data-test-subj="checkboxSelectRow-workpad-2"
                       disabled={false}
-                      id="_selection_column_workpad-2-checkbox"
+                      id="__table_generated-id_selection_column_workpad-2-checkbox"
                       onChange={[Function]}
                       title="Select this row"
                       type="checkbox"
@@ -515,7 +515,7 @@ exports[`Storyshots Home/Components/Workpad Table Workpad Table 1`] = `
                       className="euiCheckbox__input"
                       data-test-subj="checkboxSelectRow-workpad-1"
                       disabled={false}
-                      id="_selection_column_workpad-1-checkbox"
+                      id="__table_generated-id_selection_column_workpad-1-checkbox"
                       onChange={[Function]}
                       title="Select this row"
                       type="checkbox"
@@ -689,7 +689,7 @@ exports[`Storyshots Home/Components/Workpad Table Workpad Table 1`] = `
                       className="euiCheckbox__input"
                       data-test-subj="checkboxSelectRow-workpad-0"
                       disabled={false}
-                      id="_selection_column_workpad-0-checkbox"
+                      id="__table_generated-id_selection_column_workpad-0-checkbox"
                       onChange={[Function]}
                       title="Select this row"
                       type="checkbox"
@@ -896,6 +896,7 @@ exports[`Storyshots Home/Components/Workpad Table Workpad Table 1`] = `
             className="euiFlexItem euiFlexItem--flexGrowZero"
           >
             <nav
+              aria-label="Pagination for table: "
               className="euiPagination"
             >
               <button
@@ -915,6 +916,7 @@ exports[`Storyshots Home/Components/Workpad Table Workpad Table 1`] = `
                 />
               </button>
               <ul
+                aria-label="Pagination for table: "
                 className="euiPagination__list"
               >
                 <li
diff --git a/x-pack/plugins/cross_cluster_replication/common/constants/index.ts b/x-pack/plugins/cross_cluster_replication/common/constants/index.ts
index f1b327aed6389..a800afcf77ae4 100644
--- a/x-pack/plugins/cross_cluster_replication/common/constants/index.ts
+++ b/x-pack/plugins/cross_cluster_replication/common/constants/index.ts
@@ -19,6 +19,8 @@ export const PLUGIN = {
   minimumLicenseType: platinumLicense,
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const APPS = {
   CCR_APP: 'ccr',
   REMOTE_CLUSTER_APP: 'remote_cluster',
diff --git a/x-pack/plugins/cross_cluster_replication/server/config.ts b/x-pack/plugins/cross_cluster_replication/server/config.ts
index 50cca903f8a2b..732137e308a0d 100644
--- a/x-pack/plugins/cross_cluster_replication/server/config.ts
+++ b/x-pack/plugins/cross_cluster_replication/server/config.ts
@@ -4,14 +4,96 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<CrossClusterReplicationConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+export type CrossClusterReplicationConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type CrossClusterReplicationConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<CrossClusterReplicationConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.ccr.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.ccr.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.crossClusterReplication.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.ccr.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.crossClusterReplication.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Cross-Cluster Replication UI, use the "xpack.ccr.ui.enabled" setting instead of "xpack.ccr.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate(
+              'xpack.crossClusterReplication.deprecations.enabled.manualStepOneMessage',
+              {
+                defaultMessage: 'Open the kibana.yml config file.',
+              }
+            ),
+            i18n.translate(
+              'xpack.crossClusterReplication.deprecations.enabled.manualStepTwoMessage',
+              {
+                defaultMessage: 'Change the "xpack.ccr.enabled" setting to "xpack.ccr.ui.enabled".',
+              }
+            ),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type CrossClusterReplicationConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<
+  CrossClusterReplicationConfig | CrossClusterReplicationConfig7x
+> = kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/cross_cluster_replication/server/index.ts b/x-pack/plugins/cross_cluster_replication/server/index.ts
index a6a3ec0fe5753..7a0984a6117bf 100644
--- a/x-pack/plugins/cross_cluster_replication/server/index.ts
+++ b/x-pack/plugins/cross_cluster_replication/server/index.ts
@@ -5,17 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 import { CrossClusterReplicationServerPlugin } from './plugin';
-import { configSchema, CrossClusterReplicationConfig } from './config';
+
+export { config } from './config';
 
 export const plugin = (pluginInitializerContext: PluginInitializerContext) =>
   new CrossClusterReplicationServerPlugin(pluginInitializerContext);
-
-export const config: PluginConfigDescriptor<CrossClusterReplicationConfig> = {
-  schema: configSchema,
-  exposeToBrowser: {
-    ui: true,
-  },
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/add_domain/validation_step_panel.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/add_domain/validation_step_panel.tsx
index dc19b526714a5..6e93fc1f74bb1 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/add_domain/validation_step_panel.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/add_domain/validation_step_panel.tsx
@@ -33,14 +33,9 @@ export const ValidationStepPanel: React.FC<ValidationStepPanelProps> = ({
   action,
 }) => {
   const showErrorMessage = step.state === 'invalid' || step.state === 'warning';
-  const styleOverride = showErrorMessage ? { paddingBottom: 0 } : {};
 
   return (
-    <EuiPanel
-      hasShadow={false}
-      color={domainValidationStateToPanelColor(step.state)}
-      style={styleOverride}
-    >
+    <EuiPanel hasShadow={false} color={domainValidationStateToPanelColor(step.state)}>
       <EuiFlexGroup gutterSize="s" alignItems="center">
         <EuiFlexItem grow={false}>
           <ValidationStateIcon state={step.state} />
@@ -59,8 +54,8 @@ export const ValidationStepPanel: React.FC<ValidationStepPanelProps> = ({
           </EuiMarkdownFormat>
           {action && (
             <>
+              <EuiSpacer size="s" />
               {action}
-              <EuiSpacer />
             </>
           )}
         </>
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
index 28c368d942c1f..439f9dabadee6 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
@@ -88,7 +88,7 @@ describe('SuggestionsTable', () => {
     wrapper = renderColumn(0)('test', {});
     expect(wrapper.find(EuiBadge)).toHaveLength(0);
 
-    wrapper = renderColumn(0)('test', { override_curation_id: '1-2-3' });
+    wrapper = renderColumn(0)('test', { override_manual_curation: true });
     expect(wrapper.find(EuiBadge).prop('children')).toEqual('Overrides');
   });
 
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
index b7a731c1654ca..c91468e67529e 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
@@ -42,7 +42,7 @@ const columns: Array<EuiBasicTableColumn<CurationSuggestion>> = [
     render: (query: string, curation: CurationSuggestion) => (
       <EuiLinkTo to={getSuggestionRoute(query)}>
         {query}
-        {curation.override_curation_id && (
+        {curation.override_manual_curation && (
           <>
             <EuiBadge iconType="alert" color="warning" className="suggestionsTableBadge">
               {i18n.translate(
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts
index f00da5deec7e3..b67664d8efde2 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts
@@ -13,9 +13,17 @@ export interface CurationSuggestion {
   updated_at: string;
   promoted: string[];
   status: 'pending' | 'applied' | 'automated' | 'rejected' | 'disabled';
-  curation_id?: string;
+  curation_id?: string; // The id of an existing curation that this suggestion would affect
   operation: 'create' | 'update' | 'delete';
-  override_curation_id?: string;
+  override_manual_curation?: boolean;
+}
+
+// A curation suggestion with linked ids hydrated with actual values
+export interface HydratedCurationSuggestion
+  extends Omit<CurationSuggestion, 'promoted' | 'curation_id'> {
+  organic: Curation['organic'];
+  promoted: Curation['promoted'];
+  curation?: Curation;
 }
 
 export interface Curation {
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion.test.tsx
index 1c3f4645d89e9..604d2930a4b5d 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion.test.tsx
@@ -14,6 +14,8 @@ import React from 'react';
 
 import { shallow } from 'enzyme';
 
+import { EuiEmptyPrompt } from '@elastic/eui';
+
 import { AppSearchPageTemplate } from '../../../layout';
 
 import { Result } from '../../../result';
@@ -26,44 +28,29 @@ describe('CurationSuggestion', () => {
     suggestion: {
       query: 'foo',
       updated_at: '2021-07-08T14:35:50Z',
-      promoted: ['1', '2', '3'],
-    },
-    suggestedPromotedDocuments: [
-      {
-        id: {
-          raw: '1',
-        },
-        _meta: {
-          id: '1',
-          engine: 'some-engine',
-        },
-      },
-      {
-        id: {
-          raw: '2',
-        },
-        _meta: {
-          id: '2',
-          engine: 'some-engine',
-        },
-      },
-      {
-        id: {
-          raw: '3',
-        },
-        _meta: {
-          id: '3',
-          engine: 'some-engine',
-        },
-      },
-    ],
-    curation: {
-      promoted: [
+      promoted: [{ id: '4', foo: 'foo' }],
+      organic: [
         {
-          id: '4',
-          foo: 'foo',
+          id: { raw: '3', snippet: null },
+          foo: { raw: 'bar', snippet: null },
+          _meta: { id: '3' },
         },
       ],
+      curation: {
+        promoted: [{ id: '1', foo: 'foo' }],
+        organic: [
+          {
+            id: { raw: '5', snippet: null },
+            foo: { raw: 'bar', snippet: null },
+            _meta: { id: '5' },
+          },
+          {
+            id: { raw: '6', snippet: null },
+            foo: { raw: 'bar', snippet: null },
+            _meta: { id: '6' },
+          },
+        ],
+      },
     },
     isMetaEngine: true,
     engine: {
@@ -99,11 +86,10 @@ describe('CurationSuggestion', () => {
   it('shows existing promoted documents', () => {
     const wrapper = shallow(<CurationSuggestion />);
     const suggestedResultsPanel = wrapper.find(CurationResultPanel).at(0);
-    // gets populated from 'curation' in state, and converted to results format (i.e, has raw properties, etc.)
     expect(suggestedResultsPanel.prop('results')).toEqual([
       {
         id: {
-          raw: '4',
+          raw: '1',
           snippet: null,
         },
         foo: {
@@ -111,7 +97,7 @@ describe('CurationSuggestion', () => {
           snippet: null,
         },
         _meta: {
-          id: '4',
+          id: '1',
         },
       },
     ]);
@@ -120,7 +106,21 @@ describe('CurationSuggestion', () => {
   it('shows suggested promoted documents', () => {
     const wrapper = shallow(<CurationSuggestion />);
     const suggestedResultsPanel = wrapper.find(CurationResultPanel).at(1);
-    expect(suggestedResultsPanel.prop('results')).toEqual(values.suggestedPromotedDocuments);
+    expect(suggestedResultsPanel.prop('results')).toEqual([
+      {
+        id: {
+          raw: '4',
+          snippet: null,
+        },
+        foo: {
+          raw: 'foo',
+          snippet: null,
+        },
+        _meta: {
+          id: '4',
+        },
+      },
+    ]);
   });
 
   it('displays the query in the title', () => {
@@ -142,9 +142,15 @@ describe('CurationSuggestion', () => {
   it('displays proposed organic results', () => {
     const wrapper = shallow(<CurationSuggestion />);
     wrapper.find('[data-test-subj="showOrganicResults"]').simulate('click');
-    expect(wrapper.find('[data-test-subj="proposedOrganicResults"]').find(Result).length).toBe(4);
-    expect(wrapper.find(Result).at(0).prop('isMetaEngine')).toEqual(true);
-    expect(wrapper.find(Result).at(0).prop('schemaForTypeHighlights')).toEqual(
+    const resultsWrapper = wrapper.find('[data-test-subj="proposedOrganicResults"]').find(Result);
+    expect(resultsWrapper.length).toBe(1);
+    expect(resultsWrapper.find(Result).at(0).prop('result')).toEqual({
+      id: { raw: '3', snippet: null },
+      foo: { raw: 'bar', snippet: null },
+      _meta: { id: '3' },
+    });
+    expect(resultsWrapper.find(Result).at(0).prop('isMetaEngine')).toEqual(true);
+    expect(resultsWrapper.find(Result).at(0).prop('schemaForTypeHighlights')).toEqual(
       values.engine.schema
     );
   });
@@ -152,10 +158,43 @@ describe('CurationSuggestion', () => {
   it('displays current organic results', () => {
     const wrapper = shallow(<CurationSuggestion />);
     wrapper.find('[data-test-subj="showOrganicResults"]').simulate('click');
-    expect(wrapper.find('[data-test-subj="currentOrganicResults"]').find(Result).length).toBe(4);
-    expect(wrapper.find(Result).at(0).prop('isMetaEngine')).toEqual(true);
-    expect(wrapper.find(Result).at(0).prop('schemaForTypeHighlights')).toEqual(
+    const resultWrapper = wrapper.find('[data-test-subj="currentOrganicResults"]').find(Result);
+    expect(resultWrapper.length).toBe(2);
+    expect(resultWrapper.find(Result).at(0).prop('result')).toEqual({
+      id: { raw: '5', snippet: null },
+      foo: { raw: 'bar', snippet: null },
+      _meta: { id: '5' },
+    });
+    expect(resultWrapper.find(Result).at(0).prop('isMetaEngine')).toEqual(true);
+    expect(resultWrapper.find(Result).at(0).prop('schemaForTypeHighlights')).toEqual(
       values.engine.schema
     );
   });
+
+  it('shows an empty prompt when there are no organic results', () => {
+    setMockValues({
+      ...values,
+      suggestion: {
+        ...values.suggestion,
+        organic: [],
+        curation: {
+          ...values.suggestion.curation,
+          organic: [],
+        },
+      },
+    });
+    const wrapper = shallow(<CurationSuggestion />);
+    wrapper.find('[data-test-subj="showOrganicResults"]').simulate('click');
+    expect(wrapper.find('[data-test-subj="currentOrganicResults"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test-subj="proposedOrganicResults"]').exists()).toBe(false);
+    expect(wrapper.find(EuiEmptyPrompt).exists()).toBe(true);
+  });
+
+  it('renders even if no data is set yet', () => {
+    setMockValues({
+      suggestion: null,
+    });
+    const wrapper = shallow(<CurationSuggestion />);
+    expect(wrapper.find(AppSearchPageTemplate).exists()).toBe(true);
+  });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion.tsx
index 7539055253732..4e344d8cc2a39 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion.tsx
@@ -11,6 +11,7 @@ import { useActions, useValues } from 'kea';
 
 import {
   EuiButtonEmpty,
+  EuiEmptyPrompt,
   EuiFlexGroup,
   EuiFlexItem,
   EuiHorizontalRule,
@@ -20,6 +21,7 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
+import { LeafIcon } from '../../../../../shared/icons';
 import { useDecodedParams } from '../../../../utils/encode_path_params';
 import { EngineLogic } from '../../../engine';
 import { AppSearchPageTemplate } from '../../../layout';
@@ -32,19 +34,23 @@ import { CurationActionBar } from './curation_action_bar';
 import { CurationResultPanel } from './curation_result_panel';
 
 import { CurationSuggestionLogic } from './curation_suggestion_logic';
-import { DATA } from './temp_data';
 
 export const CurationSuggestion: React.FC = () => {
   const { query } = useDecodedParams();
   const { engine, isMetaEngine } = useValues(EngineLogic);
   const curationSuggestionLogic = CurationSuggestionLogic({ query });
   const { loadSuggestion } = useActions(curationSuggestionLogic);
-  const { suggestion, suggestedPromotedDocuments, curation, dataLoading } =
-    useValues(curationSuggestionLogic);
+  const { suggestion, dataLoading } = useValues(curationSuggestionLogic);
   const [showOrganicResults, setShowOrganicResults] = useState(false);
-  const currentOrganicResults = [...DATA].splice(5, 4);
-  const proposedOrganicResults = [...DATA].splice(2, 4);
-  const existingCurationResults = curation ? curation.promoted.map(convertToResultFormat) : [];
+  const currentOrganicResults = suggestion?.curation?.organic || [];
+  const proposedOrganicResults = suggestion?.organic || [];
+  const totalNumberOfOrganicResults = currentOrganicResults.length + proposedOrganicResults.length;
+  const existingCurationResults = suggestion?.curation
+    ? suggestion.curation.promoted.map(convertToResultFormat)
+    : [];
+  const suggestedPromotedDocuments = suggestion?.promoted
+    ? suggestion?.promoted.map(convertToResultFormat)
+    : [];
 
   const suggestionQuery = suggestion?.query || '';
 
@@ -114,7 +120,24 @@ export const CurationSuggestion: React.FC = () => {
                 { defaultMessage: 'Expand organic search results' }
               )}
         </EuiButtonEmpty>
-        {showOrganicResults && (
+        {showOrganicResults && totalNumberOfOrganicResults === 0 && (
+          <EuiEmptyPrompt
+            iconType={LeafIcon}
+            title={
+              <h4>
+                {i18n.translate(
+                  'xpack.enterpriseSearch.appSearch.engine.curations.suggestedCuration.noOrganicResultsTitle',
+                  { defaultMessage: 'No results' }
+                )}
+              </h4>
+            }
+            body={i18n.translate(
+              'xpack.enterpriseSearch.appSearch.engine.curations.suggestedCuration.noOrganicResultsDescription',
+              { defaultMessage: 'No organic search results were returned for this query' }
+            )}
+          />
+        )}
+        {showOrganicResults && totalNumberOfOrganicResults > 0 && (
           <>
             <EuiHorizontalRule margin="none" />
             <EuiPanel hasShadow={false} data-test-subj="organicResults">
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion_logic.test.ts
index 7a91171cc2cc7..e6a847f6e9ec6 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion_logic.test.ts
@@ -12,109 +12,141 @@ import {
   mockKibanaValues,
 } from '../../../../../__mocks__/kea_logic';
 
-import { set } from 'lodash/fp';
-
 import '../../../../__mocks__/engine_logic.mock';
 
 import { nextTick } from '@kbn/test/jest';
 
-import { CurationSuggestion } from '../../types';
+import { HydratedCurationSuggestion } from '../../types';
 
 import { CurationSuggestionLogic } from './curation_suggestion_logic';
 
 const DEFAULT_VALUES = {
   dataLoading: true,
   suggestion: null,
-  suggestedPromotedDocuments: [],
-  curation: null,
 };
 
-const suggestion: CurationSuggestion = {
+const suggestion: HydratedCurationSuggestion = {
   query: 'foo',
   updated_at: '2021-07-08T14:35:50Z',
-  promoted: ['1', '2', '3'],
-  status: 'pending',
-  operation: 'create',
-};
-
-const curation = {
-  id: 'cur-6155e69c7a2f2e4f756303fd',
-  queries: ['foo'],
   promoted: [
     {
-      id: '5',
-    },
-  ],
-  hidden: [],
-  last_updated: 'September 30, 2021 at 04:32PM',
-  organic: [],
-};
-
-const suggestedPromotedDocuments = [
-  {
-    id: {
-      raw: '1',
-    },
-    _meta: {
       id: '1',
-      engine: 'some-engine',
-    },
-  },
-  {
-    id: {
-      raw: '2',
     },
-    _meta: {
+    {
       id: '2',
-      engine: 'some-engine',
-    },
-  },
-  {
-    id: {
-      raw: '3',
     },
-    _meta: {
+    {
       id: '3',
-      engine: 'some-engine',
-    },
-  },
-];
-
-const MOCK_RESPONSE = {
-  meta: {
-    page: {
-      current: 1,
-      size: 10,
-      total_results: 1,
-      total_pages: 1,
     },
+  ],
+  status: 'pending',
+  operation: 'create',
+  curation: {
+    id: 'cur-6155e69c7a2f2e4f756303fd',
+    queries: ['foo'],
+    promoted: [
+      {
+        id: '5',
+      },
+    ],
+    hidden: [],
+    last_updated: 'September 30, 2021 at 04:32PM',
+    organic: [
+      {
+        id: {
+          raw: '1',
+        },
+        _meta: {
+          id: '1',
+          engine: 'some-engine',
+        },
+      },
+    ],
   },
-  results: [suggestion],
-};
-
-const MOCK_DOCUMENTS_RESPONSE = {
-  results: [
+  organic: [
     {
       id: {
-        raw: '2',
+        raw: '1',
       },
       _meta: {
-        id: '2',
+        id: '1',
         engine: 'some-engine',
       },
     },
     {
       id: {
-        raw: '1',
+        raw: '2',
       },
       _meta: {
-        id: '1',
+        id: '2',
         engine: 'some-engine',
       },
     },
   ],
 };
 
+const MOCK_RESPONSE = {
+  query: 'foo',
+  status: 'pending',
+  updated_at: '2021-07-08T14:35:50Z',
+  operation: 'create',
+  suggestion: {
+    promoted: [
+      {
+        id: '1',
+      },
+      {
+        id: '2',
+      },
+      {
+        id: '3',
+      },
+    ],
+    organic: [
+      {
+        id: {
+          raw: '1',
+        },
+        _meta: {
+          id: '1',
+          engine: 'some-engine',
+        },
+      },
+      {
+        id: {
+          raw: '2',
+        },
+        _meta: {
+          id: '2',
+          engine: 'some-engine',
+        },
+      },
+    ],
+  },
+  curation: {
+    id: 'cur-6155e69c7a2f2e4f756303fd',
+    queries: ['foo'],
+    promoted: [
+      {
+        id: '5',
+      },
+    ],
+    hidden: [],
+    last_updated: 'September 30, 2021 at 04:32PM',
+    organic: [
+      {
+        id: {
+          raw: '1',
+        },
+        _meta: {
+          id: '1',
+          engine: 'some-engine',
+        },
+      },
+    ],
+  },
+};
+
 describe('CurationSuggestionLogic', () => {
   const { mount } = new LogicMounter(CurationSuggestionLogic);
   const { flashAPIErrors, setQueuedErrorMessage } = mockFlashMessageHelpers;
@@ -177,14 +209,10 @@ describe('CurationSuggestionLogic', () => {
         mountLogic();
         CurationSuggestionLogic.actions.onSuggestionLoaded({
           suggestion,
-          suggestedPromotedDocuments,
-          curation,
         });
         expect(CurationSuggestionLogic.values).toEqual({
           ...DEFAULT_VALUES,
           suggestion,
-          suggestedPromotedDocuments,
-          curation,
           dataLoading: false,
         });
       });
@@ -205,100 +233,24 @@ describe('CurationSuggestionLogic', () => {
       });
 
       it('should make API calls to fetch data and trigger onSuggestionLoaded', async () => {
-        http.post.mockReturnValueOnce(Promise.resolve(MOCK_RESPONSE));
-        http.post.mockReturnValueOnce(Promise.resolve(MOCK_DOCUMENTS_RESPONSE));
+        http.get.mockReturnValueOnce(Promise.resolve(MOCK_RESPONSE));
         mountLogic();
         jest.spyOn(CurationSuggestionLogic.actions, 'onSuggestionLoaded');
 
         CurationSuggestionLogic.actions.loadSuggestion();
         await nextTick();
 
-        expect(http.post).toHaveBeenCalledWith(
+        expect(http.get).toHaveBeenCalledWith(
           '/internal/app_search/engines/some-engine/search_relevance_suggestions/foo-query',
           {
-            body: JSON.stringify({
-              page: {
-                current: 1,
-                size: 1,
-              },
-              filters: {
-                status: ['pending'],
-                type: 'curation',
-              },
-            }),
-          }
-        );
-
-        expect(http.post).toHaveBeenCalledWith('/internal/app_search/engines/some-engine/search', {
-          query: { query: '' },
-          body: JSON.stringify({
-            page: {
-              size: 100,
-            },
-            filters: {
-              // The results of the first API call are used to make the second http call for document details
-              id: MOCK_RESPONSE.results[0].promoted,
-            },
-          }),
-        });
-
-        expect(CurationSuggestionLogic.actions.onSuggestionLoaded).toHaveBeenCalledWith({
-          suggestion: {
-            query: 'foo',
-            updated_at: '2021-07-08T14:35:50Z',
-            promoted: ['1', '2', '3'],
-            status: 'pending',
-            operation: 'create',
-          },
-          // Note that these were re-ordered to match the 'promoted' list above, and since document
-          // 3 was not found it is not included in this list
-          suggestedPromotedDocuments: [
-            {
-              id: {
-                raw: '1',
-              },
-              _meta: {
-                id: '1',
-                engine: 'some-engine',
-              },
-            },
-            {
-              id: {
-                raw: '2',
-              },
-              _meta: {
-                id: '2',
-                engine: 'some-engine',
-              },
+            query: {
+              type: 'curation',
             },
-          ],
-          curation: null,
-        });
-      });
-
-      it('will also fetch curation details if the suggestion has a curation_id', async () => {
-        http.post.mockReturnValueOnce(
-          Promise.resolve(
-            set('results[0].curation_id', 'cur-6155e69c7a2f2e4f756303fd', MOCK_RESPONSE)
-          )
-        );
-        http.post.mockReturnValueOnce(Promise.resolve(MOCK_DOCUMENTS_RESPONSE));
-        http.get.mockReturnValueOnce(Promise.resolve(curation));
-        mountLogic();
-        jest.spyOn(CurationSuggestionLogic.actions, 'onSuggestionLoaded');
-
-        CurationSuggestionLogic.actions.loadSuggestion();
-        await nextTick();
-
-        expect(http.get).toHaveBeenCalledWith(
-          '/internal/app_search/engines/some-engine/curations/cur-6155e69c7a2f2e4f756303fd',
-          { query: { skip_record_analytics: 'true' } }
+          }
         );
 
         expect(CurationSuggestionLogic.actions.onSuggestionLoaded).toHaveBeenCalledWith({
-          suggestion: expect.any(Object),
-          suggestedPromotedDocuments: expect.any(Object),
-          curation,
+          suggestion,
         });
       });
 
@@ -306,7 +258,12 @@ describe('CurationSuggestionLogic', () => {
       // the back button, etc. The suggestion still exists, it's just not in a "pending" state
       // so we can show it.ga
       it('will redirect if the suggestion is not found', async () => {
-        http.post.mockReturnValueOnce(Promise.resolve(set('results', [], MOCK_RESPONSE)));
+        http.get.mockReturnValueOnce(
+          Promise.reject({
+            response: { status: 404 },
+          })
+        );
+
         mountLogic();
         CurationSuggestionLogic.actions.loadSuggestion();
         await nextTick();
@@ -314,7 +271,7 @@ describe('CurationSuggestionLogic', () => {
         expect(navigateToUrl).toHaveBeenCalledWith('/engines/some-engine/curations');
       });
 
-      itHandlesErrors(http.post, () => {
+      itHandlesErrors(http.get, () => {
         CurationSuggestionLogic.actions.loadSuggestion();
       });
     });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion_logic.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion_logic.ts
index 4ca1b0adb7814..b206c0c79ed26 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/curation_suggestion_logic.ts
@@ -19,33 +19,20 @@ import { HttpLogic } from '../../../../../shared/http';
 import { KibanaLogic } from '../../../../../shared/kibana';
 import { ENGINE_CURATIONS_PATH, ENGINE_CURATION_PATH } from '../../../../routes';
 import { EngineLogic, generateEnginePath } from '../../../engine';
-import { Result } from '../../../result/types';
-import { Curation, CurationSuggestion } from '../../types';
+import { CurationSuggestion, HydratedCurationSuggestion } from '../../types';
 
 interface Error {
   error: string;
 }
 interface CurationSuggestionValues {
   dataLoading: boolean;
-  suggestion: CurationSuggestion | null;
-  suggestedPromotedDocuments: Result[];
-  curation: Curation | null;
+  suggestion: HydratedCurationSuggestion | null;
 }
 
 interface CurationSuggestionActions {
   loadSuggestion(): void;
-  onSuggestionLoaded({
-    suggestion,
-    suggestedPromotedDocuments,
-    curation,
-  }: {
-    suggestion: CurationSuggestion;
-    suggestedPromotedDocuments: Result[];
-    curation: Curation;
-  }): {
-    suggestion: CurationSuggestion;
-    suggestedPromotedDocuments: Result[];
-    curation: Curation;
+  onSuggestionLoaded({ suggestion }: { suggestion: HydratedCurationSuggestion }): {
+    suggestion: HydratedCurationSuggestion;
   };
   acceptSuggestion(): void;
   acceptAndAutomateSuggestion(): void;
@@ -63,10 +50,8 @@ export const CurationSuggestionLogic = kea<
   path: ['enterprise_search', 'app_search', 'curations', 'suggestion_logic'],
   actions: () => ({
     loadSuggestion: true,
-    onSuggestionLoaded: ({ suggestion, suggestedPromotedDocuments, curation }) => ({
+    onSuggestionLoaded: ({ suggestion }) => ({
       suggestion,
-      suggestedPromotedDocuments,
-      curation,
     }),
     acceptSuggestion: true,
     acceptAndAutomateSuggestion: true,
@@ -87,18 +72,6 @@ export const CurationSuggestionLogic = kea<
         onSuggestionLoaded: (_, { suggestion }) => suggestion,
       },
     ],
-    suggestedPromotedDocuments: [
-      [],
-      {
-        onSuggestionLoaded: (_, { suggestedPromotedDocuments }) => suggestedPromotedDocuments,
-      },
-    ],
-    curation: [
-      null,
-      {
-        onSuggestionLoaded: (_, { curation }) => curation,
-      },
-    ],
   }),
   listeners: ({ actions, values, props }) => ({
     loadSuggestion: async () => {
@@ -106,34 +79,41 @@ export const CurationSuggestionLogic = kea<
       const { engineName } = EngineLogic.values;
 
       try {
-        const suggestion = await getSuggestion(http, engineName, props.query);
-        if (!suggestion) return;
-        const promotedIds: string[] = suggestion.promoted;
-        const documentDetailsResopnse = getDocumentDetails(http, engineName, promotedIds);
-
-        let promises = [documentDetailsResopnse];
-        if (suggestion.curation_id) {
-          promises = [...promises, getCuration(http, engineName, suggestion.curation_id)];
-        }
-
-        const [documentDetails, curation] = await Promise.all(promises);
+        const suggestionResponse = await http.get(
+          `/internal/app_search/engines/${engineName}/search_relevance_suggestions/${props.query}`,
+          {
+            query: {
+              type: 'curation',
+            },
+          }
+        );
 
-        // Filter out docs that were not found and maintain promoted order
-        const suggestedPromotedDocuments = promotedIds.reduce((acc: Result[], id: string) => {
-          const found = documentDetails.results.find(
-            (documentDetail: Result) => documentDetail.id.raw === id
-          );
-          if (!found) return acc;
-          return [...acc, found];
-        }, []);
+        // We pull the `organic` and `promoted` fields up to the main body of the suggestion,
+        // out of the nested `suggestion` field on the response
+        const { suggestion, ...baseSuggestion } = suggestionResponse;
+        const suggestionData = {
+          ...baseSuggestion,
+          promoted: suggestion.promoted,
+          organic: suggestion.organic,
+        };
 
         actions.onSuggestionLoaded({
-          suggestion,
-          suggestedPromotedDocuments,
-          curation: curation || null,
+          suggestion: suggestionData,
         });
       } catch (e) {
-        flashAPIErrors(e);
+        if (e.response?.status === 404) {
+          const message = i18n.translate(
+            'xpack.enterpriseSearch.appSearch.engine.curations.suggestedCuration.notFoundError',
+            {
+              defaultMessage:
+                'Could not find suggestion, it may have already been applied or rejected.',
+            }
+          );
+          setQueuedErrorMessage(message);
+          KibanaLogic.values.navigateToUrl(generateEnginePath(ENGINE_CURATIONS_PATH));
+        } else {
+          flashAPIErrors(e);
+        }
       }
     },
     acceptSuggestion: async () => {
@@ -289,63 +269,6 @@ const updateSuggestion = async (
   return response.results[0] as CurationSuggestion;
 };
 
-const getSuggestion = async (
-  http: HttpSetup,
-  engineName: string,
-  query: string
-): Promise<CurationSuggestion | undefined> => {
-  const response = await http.post(
-    `/internal/app_search/engines/${engineName}/search_relevance_suggestions/${query}`,
-    {
-      body: JSON.stringify({
-        page: {
-          current: 1,
-          size: 1,
-        },
-        filters: {
-          status: ['pending'],
-          type: 'curation',
-        },
-      }),
-    }
-  );
-
-  if (response.results.length < 1) {
-    const message = i18n.translate(
-      'xpack.enterpriseSearch.appSearch.engine.curations.suggestedCuration.notFoundError',
-      {
-        defaultMessage: 'Could not find suggestion, it may have already been applied or rejected.',
-      }
-    );
-    setQueuedErrorMessage(message);
-    KibanaLogic.values.navigateToUrl(generateEnginePath(ENGINE_CURATIONS_PATH));
-    return;
-  }
-
-  const suggestion = response.results[0] as CurationSuggestion;
-  return suggestion;
-};
-
-const getDocumentDetails = async (http: HttpSetup, engineName: string, documentIds: string[]) => {
-  return http.post(`/internal/app_search/engines/${engineName}/search`, {
-    query: { query: '' },
-    body: JSON.stringify({
-      page: {
-        size: 100,
-      },
-      filters: {
-        id: documentIds,
-      },
-    }),
-  });
-};
-
-const getCuration = async (http: HttpSetup, engineName: string, curationId: string) => {
-  return http.get(`/internal/app_search/engines/${engineName}/curations/${curationId}`, {
-    query: { skip_record_analytics: 'true' },
-  });
-};
-
 const confirmDialog = (msg: string) => {
   return new Promise(function (resolve) {
     const confirmed = window.confirm(msg);
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/temp_data.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/temp_data.ts
deleted file mode 100644
index 83bbc977427a9..0000000000000
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curation_suggestion/temp_data.ts
+++ /dev/null
@@ -1,470 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { Result } from '../../../result/types';
-
-export const DATA: Result[] = [
-  {
-    visitors: {
-      raw: 5028868.0,
-    },
-    square_km: {
-      raw: 3082.7,
-    },
-    world_heritage_site: {
-      raw: 'true',
-      snippet: 'true',
-    },
-    date_established: {
-      raw: '1890-10-01T05:00:00+00:00',
-    },
-    description: {
-      raw: "Yosemite features sheer granite cliffs, exceptionally tall waterfalls, and old-growth forests at a unique intersection of geology and hydrology. Half Dome and El Capitan rise from the park's centerpiece, the glacier-carved Yosemite Valley, and from its vertical walls drop Yosemite Falls, one of North America's tallest waterfalls at 2,425 feet (739 m) high. Three giant sequoia groves, along with a pristine wilderness in the heart of the Sierra Nevada, are home to a wide variety of rare plant and animal species.",
-      snippet:
-        'Yosemite features sheer granite cliffs, exceptionally tall waterfalls, and old-growth <em>forests</em>',
-    },
-    location: {
-      raw: '37.83,-119.5',
-    },
-    acres: {
-      raw: 761747.5,
-    },
-    title: {
-      raw: 'Yosemite',
-      snippet: 'Yosemite',
-    },
-    nps_link: {
-      raw: 'https://www.nps.gov/yose/index.htm',
-      snippet: 'https://www.nps.gov/yose/index.htm',
-    },
-    states: {
-      raw: ['California'],
-      snippet: 'California',
-    },
-    _meta: {
-      engine: 'national-parks-demo',
-      score: 7543305.0,
-      id: 'park_yosemite',
-    },
-    id: {
-      raw: 'park_yosemite',
-    },
-  },
-  {
-    visitors: {
-      raw: 4517585.0,
-    },
-    square_km: {
-      raw: 1075.6,
-    },
-    world_heritage_site: {
-      raw: 'false',
-      snippet: 'false',
-    },
-    date_established: {
-      raw: '1915-01-26T06:00:00+00:00',
-    },
-    description: {
-      raw: 'Bisected north to south by the Continental Divide, this portion of the Rockies has ecosystems varying from over 150 riparian lakes to montane and subalpine forests to treeless alpine tundra. Wildlife including mule deer, bighorn sheep, black bears, and cougars inhabit its igneous mountains and glacial valleys. Longs Peak, a classic Colorado fourteener, and the scenic Bear Lake are popular destinations, as well as the historic Trail Ridge Road, which reaches an elevation of more than 12,000 feet (3,700 m).',
-      snippet:
-        ' varying from over 150 riparian lakes to montane and subalpine <em>forests</em> to treeless alpine tundra. Wildlife',
-    },
-    location: {
-      raw: '40.4,-105.58',
-    },
-    acres: {
-      raw: 265795.2,
-    },
-    title: {
-      raw: 'Rocky Mountain',
-      snippet: 'Rocky Mountain',
-    },
-    nps_link: {
-      raw: 'https://www.nps.gov/romo/index.htm',
-      snippet: 'https://www.nps.gov/romo/index.htm',
-    },
-    states: {
-      raw: ['Colorado'],
-      snippet: 'Colorado',
-    },
-    _meta: {
-      engine: 'national-parks-demo',
-      score: 6776380.0,
-      id: 'park_rocky-mountain',
-    },
-    id: {
-      raw: 'park_rocky-mountain',
-    },
-  },
-  {
-    visitors: {
-      raw: 4295127.0,
-    },
-    square_km: {
-      raw: 595.8,
-    },
-    world_heritage_site: {
-      raw: 'false',
-      snippet: 'false',
-    },
-    date_established: {
-      raw: '1919-11-19T06:00:00+00:00',
-    },
-    description: {
-      raw: 'Located at the junction of the Colorado Plateau, Great Basin, and Mojave Desert, this park contains sandstone features such as mesas, rock towers, and canyons, including the Virgin River Narrows. The various sandstone formations and the forks of the Virgin River create a wilderness divided into four ecosystems: desert, riparian, woodland, and coniferous forest.',
-      snippet: ' into four ecosystems: desert, riparian, woodland, and coniferous <em>forest</em>.',
-    },
-    location: {
-      raw: '37.3,-113.05',
-    },
-    acres: {
-      raw: 147237.02,
-    },
-    title: {
-      raw: 'Zion',
-      snippet: 'Zion',
-    },
-    nps_link: {
-      raw: 'https://www.nps.gov/zion/index.htm',
-      snippet: 'https://www.nps.gov/zion/index.htm',
-    },
-    states: {
-      raw: ['Utah'],
-      snippet: 'Utah',
-    },
-    _meta: {
-      engine: 'national-parks-demo',
-      score: 6442695.0,
-      id: 'park_zion',
-    },
-    id: {
-      raw: 'park_zion',
-    },
-  },
-  {
-    visitors: {
-      raw: 3303393.0,
-    },
-    square_km: {
-      raw: 198.5,
-    },
-    world_heritage_site: {
-      raw: 'false',
-      snippet: 'false',
-    },
-    date_established: {
-      raw: '1919-02-26T06:00:00+00:00',
-    },
-    description: {
-      raw: 'Covering most of Mount Desert Island and other coastal islands, Acadia features the tallest mountain on the Atlantic coast of the United States, granite peaks, ocean shoreline, woodlands, and lakes. There are freshwater, estuary, forest, and intertidal habitats.',
-      snippet:
-        ' mountain on the Atlantic coast of the United States, granite peaks, ocean shoreline, woodlands, and lakes. There are freshwater, estuary, <em>forest</em>, and intertidal habitats.',
-    },
-    location: {
-      raw: '44.35,-68.21',
-    },
-    acres: {
-      raw: 49057.36,
-    },
-    title: {
-      raw: 'Acadia',
-      snippet: 'Acadia',
-    },
-    nps_link: {
-      raw: 'https://www.nps.gov/acad/index.htm',
-      snippet: 'https://www.nps.gov/acad/index.htm',
-    },
-    states: {
-      raw: ['Maine'],
-      snippet: 'Maine',
-    },
-    _meta: {
-      engine: 'national-parks-demo',
-      score: 4955094.5,
-      id: 'park_acadia',
-    },
-    id: {
-      raw: 'park_acadia',
-    },
-  },
-  {
-    visitors: {
-      raw: 1887580.0,
-    },
-    square_km: {
-      raw: 1308.9,
-    },
-    world_heritage_site: {
-      raw: 'true',
-      snippet: 'true',
-    },
-    date_established: {
-      raw: '1916-08-01T05:00:00+00:00',
-    },
-    description: {
-      raw: "This park on the Big Island protects the Kīlauea and Mauna Loa volcanoes, two of the world's most active geological features. Diverse ecosystems range from tropical forests at sea level to barren lava beds at more than 13,000 feet (4,000 m).",
-      snippet:
-        ' active geological features. Diverse ecosystems range from tropical <em>forests</em> at sea level to barren lava beds at more than 13,000 feet (4,000 m).',
-    },
-    location: {
-      raw: '19.38,-155.2',
-    },
-    acres: {
-      raw: 323431.38,
-    },
-    title: {
-      raw: 'Hawaii Volcanoes',
-      snippet: 'Hawaii Volcanoes',
-    },
-    nps_link: {
-      raw: 'https://www.nps.gov/havo/index.htm',
-      snippet: 'https://www.nps.gov/havo/index.htm',
-    },
-    states: {
-      raw: ['Hawaii'],
-      snippet: 'Hawaii',
-    },
-    _meta: {
-      engine: 'national-parks-demo',
-      score: 2831373.2,
-      id: 'park_hawaii-volcanoes',
-    },
-    id: {
-      raw: 'park_hawaii-volcanoes',
-    },
-  },
-  {
-    visitors: {
-      raw: 1437341.0,
-    },
-    square_km: {
-      raw: 806.1,
-    },
-    world_heritage_site: {
-      raw: 'false',
-      snippet: 'false',
-    },
-    date_established: {
-      raw: '1935-12-26T06:00:00+00:00',
-    },
-    description: {
-      raw: "Shenandoah's Blue Ridge Mountains are covered by hardwood forests that teem with a wide variety of wildlife. The Skyline Drive and Appalachian Trail run the entire length of this narrow park, along with more than 500 miles (800 km) of hiking trails passing scenic overlooks and cataracts of the Shenandoah River.",
-      snippet:
-        'Shenandoah&#x27;s Blue Ridge Mountains are covered by hardwood <em>forests</em> that teem with a wide variety',
-    },
-    location: {
-      raw: '38.53,-78.35',
-    },
-    acres: {
-      raw: 199195.27,
-    },
-    title: {
-      raw: 'Shenandoah',
-      snippet: 'Shenandoah',
-    },
-    nps_link: {
-      raw: 'https://www.nps.gov/shen/index.htm',
-      snippet: 'https://www.nps.gov/shen/index.htm',
-    },
-    states: {
-      raw: ['Virginia'],
-      snippet: 'Virginia',
-    },
-    _meta: {
-      engine: 'national-parks-demo',
-      score: 2156015.5,
-      id: 'park_shenandoah',
-    },
-    id: {
-      raw: 'park_shenandoah',
-    },
-  },
-  {
-    visitors: {
-      raw: 1356913.0,
-    },
-    square_km: {
-      raw: 956.6,
-    },
-    world_heritage_site: {
-      raw: 'false',
-      snippet: 'false',
-    },
-    date_established: {
-      raw: '1899-03-02T06:00:00+00:00',
-    },
-    description: {
-      raw: 'Mount Rainier, an active stratovolcano, is the most prominent peak in the Cascades and is covered by 26 named glaciers including Carbon Glacier and Emmons Glacier, the largest in the contiguous United States. The mountain is popular for climbing, and more than half of the park is covered by subalpine and alpine forests and meadows seasonally in bloom with wildflowers. Paradise on the south slope is the snowiest place on Earth where snowfall is measured regularly. The Longmire visitor center is the start of the Wonderland Trail, which encircles the mountain.',
-      snippet:
-        ' by subalpine and alpine <em>forests</em> and meadows seasonally in bloom with wildflowers. Paradise on the south slope',
-    },
-    location: {
-      raw: '46.85,-121.75',
-    },
-    acres: {
-      raw: 236381.64,
-    },
-    title: {
-      raw: 'Mount Rainier',
-      snippet: 'Mount Rainier',
-    },
-    nps_link: {
-      raw: 'https://www.nps.gov/mora/index.htm',
-      snippet: 'https://www.nps.gov/mora/index.htm',
-    },
-    states: {
-      raw: ['Washington'],
-      snippet: 'Washington',
-    },
-    _meta: {
-      engine: 'national-parks-demo',
-      score: 2035372.0,
-      id: 'park_mount-rainier',
-    },
-    id: {
-      raw: 'park_mount-rainier',
-    },
-  },
-  {
-    visitors: {
-      raw: 1254688.0,
-    },
-    square_km: {
-      raw: 1635.2,
-    },
-    world_heritage_site: {
-      raw: 'false',
-      snippet: 'false',
-    },
-    date_established: {
-      raw: '1890-09-25T05:00:00+00:00',
-    },
-    description: {
-      raw: "This park protects the Giant Forest, which boasts some of the world's largest trees, the General Sherman being the largest measured tree in the park. Other features include over 240 caves, a long segment of the Sierra Nevada including the tallest mountain in the contiguous United States, and Moro Rock, a large granite dome.",
-      snippet:
-        'This park protects the Giant <em>Forest</em>, which boasts some of the world&#x27;s largest trees, the General',
-    },
-    location: {
-      raw: '36.43,-118.68',
-    },
-    acres: {
-      raw: 404062.63,
-    },
-    title: {
-      raw: 'Sequoia',
-      snippet: 'Sequoia',
-    },
-    nps_link: {
-      raw: 'https://www.nps.gov/seki/index.htm',
-      snippet: 'https://www.nps.gov/seki/index.htm',
-    },
-    states: {
-      raw: ['California'],
-      snippet: 'California',
-    },
-    _meta: {
-      engine: 'national-parks-demo',
-      score: 1882038.0,
-      id: 'park_sequoia',
-    },
-    id: {
-      raw: 'park_sequoia',
-    },
-  },
-  {
-    visitors: {
-      raw: 643274.0,
-    },
-    square_km: {
-      raw: 896.0,
-    },
-    world_heritage_site: {
-      raw: 'false',
-      snippet: 'false',
-    },
-    date_established: {
-      raw: '1962-12-09T06:00:00+00:00',
-    },
-    description: {
-      raw: 'This portion of the Chinle Formation has a large concentration of 225-million-year-old petrified wood. The surrounding Painted Desert features eroded cliffs of red-hued volcanic rock called bentonite. Dinosaur fossils and over 350 Native American sites are also protected in this park.',
-      snippet:
-        'This portion of the Chinle Formation has a large concentration of 225-million-year-old petrified',
-    },
-    location: {
-      raw: '35.07,-109.78',
-    },
-    acres: {
-      raw: 221415.77,
-    },
-    title: {
-      raw: 'Petrified Forest',
-      snippet: 'Petrified <em>Forest</em>',
-    },
-    nps_link: {
-      raw: 'https://www.nps.gov/pefo/index.htm',
-      snippet: 'https://www.nps.gov/pefo/index.htm',
-    },
-    states: {
-      raw: ['Arizona'],
-      snippet: 'Arizona',
-    },
-    _meta: {
-      engine: 'national-parks-demo',
-      score: 964919.94,
-      id: 'park_petrified-forest',
-    },
-    id: {
-      raw: 'park_petrified-forest',
-    },
-  },
-  {
-    visitors: {
-      raw: 617377.0,
-    },
-    square_km: {
-      raw: 137.5,
-    },
-    world_heritage_site: {
-      raw: 'false',
-      snippet: 'false',
-    },
-    date_established: {
-      raw: '1903-01-09T06:00:00+00:00',
-    },
-    description: {
-      raw: "Wind Cave is distinctive for its calcite fin formations called boxwork, a unique formation rarely found elsewhere, and needle-like growths called frostwork. The cave is one of the longest and most complex caves in the world. Above ground is a mixed-grass prairie with animals such as bison, black-footed ferrets, and prairie dogs, and ponderosa pine forests that are home to cougars and elk. The cave is culturally significant to the Lakota people as the site 'from which Wakan Tanka, the Great Mystery, sent the buffalo out into their hunting grounds.'",
-      snippet:
-        '-footed ferrets, and prairie dogs, and ponderosa pine <em>forests</em> that are home to cougars and elk',
-    },
-    location: {
-      raw: '43.57,-103.48',
-    },
-    acres: {
-      raw: 33970.84,
-    },
-    title: {
-      raw: 'Wind Cave',
-      snippet: 'Wind Cave',
-    },
-    nps_link: {
-      raw: 'https://www.nps.gov/wica/index.htm',
-      snippet: 'https://www.nps.gov/wica/index.htm',
-    },
-    states: {
-      raw: ['South Dakota'],
-      snippet: 'South Dakota',
-    },
-    _meta: {
-      engine: 'national-parks-demo',
-      score: 926068.7,
-      id: 'park_wind-cave',
-    },
-    id: {
-      raw: 'park_wind-cave',
-    },
-  },
-];
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.test.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.test.ts
index 2bdcfb9fe9d58..daab7c35596bf 100644
--- a/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.test.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.test.ts
@@ -116,9 +116,9 @@ describe('search relevance insights routes', () => {
     });
   });
 
-  describe('POST /internal/app_search/engines/{name}/search_relevance_suggestions/{query}', () => {
+  describe('GET /internal/app_search/engines/{engineName}/search_relevance_suggestions/{query}', () => {
     const mockRouter = new MockRouter({
-      method: 'post',
+      method: 'get',
       path: '/internal/app_search/engines/{engineName}/search_relevance_suggestions/{query}',
     });
 
@@ -132,10 +132,11 @@ describe('search relevance insights routes', () => {
     it('creates a request to enterprise search', () => {
       mockRouter.callRoute({
         params: { engineName: 'some-engine', query: 'foo' },
+        query: { type: 'curation' },
       });
 
       expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
-        path: '/api/as/v0/engines/:engineName/search_relevance_suggestions/:query',
+        path: '/as/engines/:engineName/search_relevance_suggestions/:query',
       });
     });
   });
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.ts
index 8b3b204c24d70..95b50a9c4971e 100644
--- a/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.ts
@@ -81,7 +81,7 @@ export function registerSearchRelevanceSuggestionsRoutes({
     })
   );
 
-  router.post(
+  router.get(
     {
       path: '/internal/app_search/engines/{engineName}/search_relevance_suggestions/{query}',
       validate: {
@@ -89,20 +89,13 @@ export function registerSearchRelevanceSuggestionsRoutes({
           engineName: schema.string(),
           query: schema.string(),
         }),
-        body: schema.object({
-          page: schema.object({
-            current: schema.number(),
-            size: schema.number(),
-          }),
-          filters: schema.object({
-            status: schema.arrayOf(schema.string()),
-            type: schema.string(),
-          }),
+        query: schema.object({
+          type: schema.string(),
         }),
       },
     },
     enterpriseSearchRequestHandler.createRequest({
-      path: '/api/as/v0/engines/:engineName/search_relevance_suggestions/:query',
+      path: '/as/engines/:engineName/search_relevance_suggestions/:query',
     })
   );
 }
diff --git a/x-pack/plugins/fleet/kibana.json b/x-pack/plugins/fleet/kibana.json
index 9de538ee91b8c..1ca88cac1cc11 100644
--- a/x-pack/plugins/fleet/kibana.json
+++ b/x-pack/plugins/fleet/kibana.json
@@ -11,5 +11,5 @@
   "requiredPlugins": ["licensing", "data", "encryptedSavedObjects", "navigation", "customIntegrations", "share"],
   "optionalPlugins": ["security", "features", "cloud", "usageCollection", "home", "globalSearch"],
   "extraPublicDirs": ["common"],
-  "requiredBundles": ["kibanaReact", "esUiShared", "home", "infra", "kibanaUtils"]
+  "requiredBundles": ["kibanaReact", "esUiShared", "home", "infra", "kibanaUtils", "usageCollection"]
 }
diff --git a/x-pack/plugins/fleet/public/applications/integrations/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/index.tsx
index 0abb78f850076..4099879538afa 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/index.tsx
@@ -70,18 +70,21 @@ export function renderApp(
   { element, appBasePath, history, setHeaderActionMenu }: AppMountParameters,
   config: FleetConfigType,
   kibanaVersion: string,
-  extensions: UIExtensionsStorage
+  extensions: UIExtensionsStorage,
+  UsageTracker: React.FC
 ) {
   ReactDOM.render(
-    <IntegrationsApp
-      basepath={appBasePath}
-      startServices={startServices}
-      config={config}
-      history={history}
-      kibanaVersion={kibanaVersion}
-      extensions={extensions}
-      setHeaderActionMenu={setHeaderActionMenu}
-    />,
+    <UsageTracker>
+      <IntegrationsApp
+        basepath={appBasePath}
+        startServices={startServices}
+        config={config}
+        history={history}
+        kibanaVersion={kibanaVersion}
+        extensions={extensions}
+        setHeaderActionMenu={setHeaderActionMenu}
+      />
+    </UsageTracker>,
     element
   );
 
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx
index 091eb4c97183d..7181241776dda 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx
@@ -9,6 +9,8 @@ import React from 'react';
 import styled from 'styled-components';
 import { EuiCard, EuiFlexItem, EuiBadge, EuiToolTip, EuiSpacer } from '@elastic/eui';
 
+import { TrackApplicationView } from '../../../../../../../../../src/plugins/usage_collection/public';
+
 import { CardIcon } from '../../../../../components/package_icon';
 import type { IntegrationCardItem } from '../../../../../../common/types/models/epm';
 
@@ -31,6 +33,7 @@ export function PackageCard({
   integration,
   url,
   release,
+  id,
 }: PackageCardProps) {
   let releaseBadge: React.ReactNode | null = null;
 
@@ -47,26 +50,30 @@ export function PackageCard({
     );
   }
 
+  const testid = `integration-card:${id}`;
   return (
-    <Card
-      layout="horizontal"
-      title={title || ''}
-      titleSize="xs"
-      description={description}
-      hasBorder
-      icon={
-        <CardIcon
-          icons={icons}
-          packageName={name}
-          integrationName={integration}
-          version={version}
-          size="xl"
-        />
-      }
-      href={url}
-      target={url.startsWith('http') || url.startsWith('https') ? '_blank' : undefined}
-    >
-      {releaseBadge}
-    </Card>
+    <TrackApplicationView viewId={testid}>
+      <Card
+        data-test-subj={testid}
+        layout="horizontal"
+        title={title || ''}
+        titleSize="xs"
+        description={description}
+        hasBorder
+        icon={
+          <CardIcon
+            icons={icons}
+            packageName={name}
+            integrationName={integration}
+            version={version}
+            size="xl"
+          />
+        }
+        href={url}
+        target={url.startsWith('http') || url.startsWith('https') ? '_blank' : undefined}
+      >
+        {releaseBadge}
+      </Card>
+    </TrackApplicationView>
   );
 }
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
index f5c521ebacf16..73de0e51bea65 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
@@ -79,7 +79,7 @@ const packageListToIntegrationsList = (packages: PackageList): PackageList => {
             const allCategories = [...topCategories, ...categories];
             return {
               ...restOfPackage,
-              id: `${restOfPackage}-${name}`,
+              id: `${restOfPackage.id}-${name}`,
               integration: name,
               title,
               description,
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
index 4270d360b9294..e3fc5e15488e6 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
@@ -74,7 +74,7 @@ export const mapToCard = (
   }
 
   return {
-    id: `${item.type === 'ui_link' ? 'ui_link' : 'epr'}-${item.id}`,
+    id: `${item.type === 'ui_link' ? 'ui_link' : 'epr'}:${item.id}`,
     description: item.description,
     icons: !item.icons || !item.icons.length ? [] : item.icons,
     title: item.title,
diff --git a/x-pack/plugins/fleet/public/components/enrollment_instructions/manual/index.tsx b/x-pack/plugins/fleet/public/components/enrollment_instructions/manual/index.tsx
index ecbcf309c5992..6d4d6a7172534 100644
--- a/x-pack/plugins/fleet/public/components/enrollment_instructions/manual/index.tsx
+++ b/x-pack/plugins/fleet/public/components/enrollment_instructions/manual/index.tsx
@@ -78,7 +78,7 @@ export const ManualInstructions: React.FunctionComponent<Props> = ({
             defaultMessage="See the {link} for RPM / DEB deploy instructions."
             values={{
               link: (
-                <EuiLink target="_blank" external href={docLinks.links.fleet.elasticAgent}>
+                <EuiLink target="_blank" external href={docLinks.links.fleet.installElasticAgent}>
                   <FormattedMessage
                     id="xpack.fleet.enrollmentInstructions.moreInstructionsLink"
                     defaultMessage="Elastic Agent docs"
diff --git a/x-pack/plugins/fleet/public/plugin.ts b/x-pack/plugins/fleet/public/plugin.ts
index 4a2a6900cc78c..b0e4e56aa344a 100644
--- a/x-pack/plugins/fleet/public/plugin.ts
+++ b/x-pack/plugins/fleet/public/plugin.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import React from 'react';
 import type {
   AppMountParameters,
   CoreSetup,
@@ -23,6 +24,8 @@ import type {
 
 import type { SharePluginStart } from 'src/plugins/share/public';
 
+import type { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/public';
+
 import { DEFAULT_APP_CATEGORIES, AppNavLinkStatus } from '../../../../src/core/public';
 
 import type {
@@ -73,6 +76,7 @@ export interface FleetSetupDeps {
   cloud?: CloudSetup;
   globalSearch?: GlobalSearchPluginSetup;
   customIntegrations: CustomIntegrationsSetup;
+  usageCollection?: UsageCollectionSetup;
 }
 
 export interface FleetStartDeps {
@@ -137,7 +141,17 @@ export class FleetPlugin implements Plugin<FleetSetup, FleetStart, FleetSetupDep
           cloud: deps.cloud,
         };
         const { renderApp, teardownIntegrations } = await import('./applications/integrations');
-        const unmount = renderApp(startServices, params, config, kibanaVersion, extensions);
+
+        const Tracker =
+          deps.usageCollection?.components.ApplicationUsageTrackingProvider ?? React.Fragment;
+        const unmount = renderApp(
+          startServices,
+          params,
+          config,
+          kibanaVersion,
+          extensions,
+          Tracker
+        );
 
         return () => {
           unmount();
diff --git a/x-pack/plugins/fleet/server/mocks/index.ts b/x-pack/plugins/fleet/server/mocks/index.ts
index c7f6b6fefc414..e6577426974a3 100644
--- a/x-pack/plugins/fleet/server/mocks/index.ts
+++ b/x-pack/plugins/fleet/server/mocks/index.ts
@@ -23,7 +23,17 @@ import type { FleetAppContext } from '../plugin';
 // Export all mocks from artifacts
 export * from '../services/artifacts/mocks';
 
-export const createAppContextStartContractMock = (): FleetAppContext => {
+export interface MockedFleetAppContext extends FleetAppContext {
+  elasticsearch: ReturnType<typeof elasticsearchServiceMock.createStart>;
+  data: ReturnType<typeof dataPluginMock.createStartContract>;
+  encryptedSavedObjectsStart?: ReturnType<typeof encryptedSavedObjectsMock.createStart>;
+  savedObjects: ReturnType<typeof savedObjectsServiceMock.createStartContract>;
+  securitySetup?: ReturnType<typeof securityMock.createSetup>;
+  securityStart?: ReturnType<typeof securityMock.createStart>;
+  logger: ReturnType<ReturnType<typeof loggingSystemMock.create>['get']>;
+}
+
+export const createAppContextStartContractMock = (): MockedFleetAppContext => {
   const config = {
     agents: { enabled: true, elasticsearch: {} },
     enabled: true,
diff --git a/x-pack/plugins/fleet/server/plugin.ts b/x-pack/plugins/fleet/server/plugin.ts
index aaee24b39685a..8a95065380b69 100644
--- a/x-pack/plugins/fleet/server/plugin.ts
+++ b/x-pack/plugins/fleet/server/plugin.ts
@@ -80,9 +80,10 @@ import {
 } from './services/agents';
 import { registerFleetUsageCollector } from './collectors/register';
 import { getInstallation, ensureInstalledPackage } from './services/epm/packages';
-import { makeRouterEnforcingSuperuser } from './routes/security';
+import { RouterWrappers } from './routes/security';
 import { startFleetServerSetup } from './services/fleet_server';
 import { FleetArtifactsClient } from './services/artifacts';
+import type { FleetRouter } from './types/request_context';
 
 export interface FleetSetupDeps {
   licensing: LicensingPluginSetup;
@@ -206,6 +207,24 @@ export class FleetPlugin
         category: DEFAULT_APP_CATEGORIES.management,
         app: [PLUGIN_ID, INTEGRATIONS_PLUGIN_ID, 'kibana'],
         catalogue: ['fleet'],
+        reserved: {
+          description:
+            'Privilege to setup Fleet packages and configured policies. Intended for use by the elastic/fleet-server service account only.',
+          privileges: [
+            {
+              id: 'fleet-setup',
+              privilege: {
+                excludeFromBasePrivileges: true,
+                api: ['fleet-setup'],
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: [],
+              },
+            },
+          ],
+        },
         privileges: {
           all: {
             api: [`${PLUGIN_ID}-read`, `${PLUGIN_ID}-all`],
@@ -245,7 +264,7 @@ export class FleetPlugin
       })
     );
 
-    const router = core.http.createRouter<FleetRequestHandlerContext>();
+    const router: FleetRouter = core.http.createRouter<FleetRequestHandlerContext>();
 
     // Register usage collection
     registerFleetUsageCollector(core, config, deps.usageCollection);
@@ -254,24 +273,34 @@ export class FleetPlugin
     registerAppRoutes(router);
     // Allow read-only users access to endpoints necessary for Integrations UI
     // Only some endpoints require superuser so we pass a raw IRouter here
-    registerEPMRoutes(router);
 
     // For all the routes we enforce the user to have role superuser
-    const routerSuperuserOnly = makeRouterEnforcingSuperuser(router);
+    const superuserRouter = RouterWrappers.require.superuser(router);
+    const fleetSetupRouter = RouterWrappers.require.fleetSetupPrivilege(router);
+
+    // Some EPM routes use regular rbac to support integrations app
+    registerEPMRoutes({ rbac: router, superuser: superuserRouter });
+
     // Register rest of routes only if security is enabled
     if (deps.security) {
-      registerSetupRoutes(routerSuperuserOnly, config);
-      registerAgentPolicyRoutes(routerSuperuserOnly);
-      registerPackagePolicyRoutes(routerSuperuserOnly);
-      registerOutputRoutes(routerSuperuserOnly);
-      registerSettingsRoutes(routerSuperuserOnly);
-      registerDataStreamRoutes(routerSuperuserOnly);
-      registerPreconfigurationRoutes(routerSuperuserOnly);
+      registerSetupRoutes(fleetSetupRouter, config);
+      registerAgentPolicyRoutes({
+        fleetSetup: fleetSetupRouter,
+        superuser: superuserRouter,
+      });
+      registerPackagePolicyRoutes(superuserRouter);
+      registerOutputRoutes(superuserRouter);
+      registerSettingsRoutes(superuserRouter);
+      registerDataStreamRoutes(superuserRouter);
+      registerPreconfigurationRoutes(superuserRouter);
 
       // Conditional config routes
       if (config.agents.enabled) {
-        registerAgentAPIRoutes(routerSuperuserOnly, config);
-        registerEnrollmentApiKeyRoutes(routerSuperuserOnly);
+        registerAgentAPIRoutes(superuserRouter, config);
+        registerEnrollmentApiKeyRoutes({
+          fleetSetup: fleetSetupRouter,
+          superuser: superuserRouter,
+        });
       }
     }
   }
diff --git a/x-pack/plugins/fleet/server/routes/agent_policy/index.ts b/x-pack/plugins/fleet/server/routes/agent_policy/index.ts
index a66a9ab9cadc7..4c20358e15085 100644
--- a/x-pack/plugins/fleet/server/routes/agent_policy/index.ts
+++ b/x-pack/plugins/fleet/server/routes/agent_policy/index.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, AGENT_POLICY_API_ROUTES } from '../../constants';
 import {
   GetAgentPoliciesRequestSchema,
@@ -17,6 +15,7 @@ import {
   DeleteAgentPolicyRequestSchema,
   GetFullAgentPolicyRequestSchema,
 } from '../../types';
+import type { FleetRouter } from '../../types/request_context';
 
 import {
   getAgentPoliciesHandler,
@@ -29,19 +28,21 @@ import {
   downloadFullAgentPolicy,
 } from './handlers';
 
-export const registerRoutes = (router: IRouter) => {
-  // List
-  router.get(
+export const registerRoutes = (routers: { superuser: FleetRouter; fleetSetup: FleetRouter }) => {
+  // List - Fleet Server needs access to run setup
+  routers.fleetSetup.get(
     {
       path: AGENT_POLICY_API_ROUTES.LIST_PATTERN,
       validate: GetAgentPoliciesRequestSchema,
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
+      // options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getAgentPoliciesHandler
   );
 
   // Get one
-  router.get(
+  routers.superuser.get(
     {
       path: AGENT_POLICY_API_ROUTES.INFO_PATTERN,
       validate: GetOneAgentPolicyRequestSchema,
@@ -51,7 +52,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Create
-  router.post(
+  routers.superuser.post(
     {
       path: AGENT_POLICY_API_ROUTES.CREATE_PATTERN,
       validate: CreateAgentPolicyRequestSchema,
@@ -61,7 +62,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Update
-  router.put(
+  routers.superuser.put(
     {
       path: AGENT_POLICY_API_ROUTES.UPDATE_PATTERN,
       validate: UpdateAgentPolicyRequestSchema,
@@ -71,7 +72,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Copy
-  router.post(
+  routers.superuser.post(
     {
       path: AGENT_POLICY_API_ROUTES.COPY_PATTERN,
       validate: CopyAgentPolicyRequestSchema,
@@ -81,7 +82,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Delete
-  router.post(
+  routers.superuser.post(
     {
       path: AGENT_POLICY_API_ROUTES.DELETE_PATTERN,
       validate: DeleteAgentPolicyRequestSchema,
@@ -91,7 +92,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Get one full agent policy
-  router.get(
+  routers.superuser.get(
     {
       path: AGENT_POLICY_API_ROUTES.FULL_INFO_PATTERN,
       validate: GetFullAgentPolicyRequestSchema,
@@ -101,7 +102,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Download one full agent policy
-  router.get(
+  routers.superuser.get(
     {
       path: AGENT_POLICY_API_ROUTES.FULL_INFO_DOWNLOAD_PATTERN,
       validate: GetFullAgentPolicyRequestSchema,
diff --git a/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts b/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts
index 0959a9a88704a..9cb07a9050f83 100644
--- a/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts
+++ b/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts
@@ -27,7 +27,8 @@ export const getEnrollmentApiKeysHandler: RequestHandler<
   undefined,
   TypeOf<typeof GetEnrollmentAPIKeysRequestSchema.query>
 > = async (context, request, response) => {
-  const esClient = context.core.elasticsearch.client.asCurrentUser;
+  // Use kibana_system and depend on authz checks on HTTP layer to prevent abuse
+  const esClient = context.core.elasticsearch.client.asInternalUser;
 
   try {
     const { items, total, page, perPage } = await APIKeyService.listEnrollmentApiKeys(esClient, {
@@ -87,7 +88,8 @@ export const deleteEnrollmentApiKeyHandler: RequestHandler<
 export const getOneEnrollmentApiKeyHandler: RequestHandler<
   TypeOf<typeof GetOneEnrollmentAPIKeyRequestSchema.params>
 > = async (context, request, response) => {
-  const esClient = context.core.elasticsearch.client.asCurrentUser;
+  // Use kibana_system and depend on authz checks on HTTP layer to prevent abuse
+  const esClient = context.core.elasticsearch.client.asInternalUser;
   try {
     const apiKey = await APIKeyService.getEnrollmentAPIKey(esClient, request.params.keyId);
     const body: GetOneEnrollmentAPIKeyResponse = { item: apiKey };
diff --git a/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts b/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts
index b37a88e70e085..6429d4d29d5c9 100644
--- a/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts
+++ b/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, ENROLLMENT_API_KEY_ROUTES } from '../../constants';
 import {
   GetEnrollmentAPIKeysRequestSchema,
@@ -14,6 +12,7 @@ import {
   DeleteEnrollmentAPIKeyRequestSchema,
   PostEnrollmentAPIKeyRequestSchema,
 } from '../../types';
+import type { FleetRouter } from '../../types/request_context';
 
 import {
   getEnrollmentApiKeysHandler,
@@ -22,17 +21,19 @@ import {
   postEnrollmentApiKeyHandler,
 } from './handler';
 
-export const registerRoutes = (router: IRouter) => {
-  router.get(
+export const registerRoutes = (routers: { superuser: FleetRouter; fleetSetup: FleetRouter }) => {
+  routers.fleetSetup.get(
     {
       path: ENROLLMENT_API_KEY_ROUTES.INFO_PATTERN,
       validate: GetOneEnrollmentAPIKeyRequestSchema,
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
+      // options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getOneEnrollmentApiKeyHandler
   );
 
-  router.delete(
+  routers.superuser.delete(
     {
       path: ENROLLMENT_API_KEY_ROUTES.DELETE_PATTERN,
       validate: DeleteEnrollmentAPIKeyRequestSchema,
@@ -41,16 +42,18 @@ export const registerRoutes = (router: IRouter) => {
     deleteEnrollmentApiKeyHandler
   );
 
-  router.get(
+  routers.fleetSetup.get(
     {
       path: ENROLLMENT_API_KEY_ROUTES.LIST_PATTERN,
       validate: GetEnrollmentAPIKeysRequestSchema,
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
+      // options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getEnrollmentApiKeysHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: ENROLLMENT_API_KEY_ROUTES.CREATE_PATTERN,
       validate: PostEnrollmentAPIKeyRequestSchema,
diff --git a/x-pack/plugins/fleet/server/routes/epm/index.ts b/x-pack/plugins/fleet/server/routes/epm/index.ts
index 360f2ec1d446e..a2f2df4a00c55 100644
--- a/x-pack/plugins/fleet/server/routes/epm/index.ts
+++ b/x-pack/plugins/fleet/server/routes/epm/index.ts
@@ -5,10 +5,7 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, EPM_API_ROUTES } from '../../constants';
-import type { FleetRequestHandlerContext } from '../../types';
 import {
   GetCategoriesRequestSchema,
   GetPackagesRequestSchema,
@@ -21,7 +18,7 @@ import {
   GetStatsRequestSchema,
   UpdatePackageRequestSchema,
 } from '../../types';
-import { enforceSuperUser } from '../security';
+import type { FleetRouter } from '../../types/request_context';
 
 import {
   getCategoriesHandler,
@@ -39,8 +36,8 @@ import {
 
 const MAX_FILE_SIZE_BYTES = 104857600; // 100MB
 
-export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
-  router.get(
+export const registerRoutes = (routers: { rbac: FleetRouter; superuser: FleetRouter }) => {
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.CATEGORIES_PATTERN,
       validate: GetCategoriesRequestSchema,
@@ -49,7 +46,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getCategoriesHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.LIST_PATTERN,
       validate: GetPackagesRequestSchema,
@@ -58,7 +55,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getListHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.LIMITED_LIST_PATTERN,
       validate: false,
@@ -67,7 +64,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getLimitedListHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.STATS_PATTERN,
       validate: GetStatsRequestSchema,
@@ -76,7 +73,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getStatsHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.FILEPATH_PATTERN,
       validate: GetFileRequestSchema,
@@ -85,7 +82,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getFileHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.INFO_PATTERN,
       validate: GetInfoRequestSchema,
@@ -94,34 +91,34 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getInfoHandler
   );
 
-  router.put(
+  routers.superuser.put(
     {
       path: EPM_API_ROUTES.INFO_PATTERN,
       validate: UpdatePackageRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(updatePackageHandler)
+    updatePackageHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: EPM_API_ROUTES.INSTALL_FROM_REGISTRY_PATTERN,
       validate: InstallPackageFromRegistryRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(installPackageFromRegistryHandler)
+    installPackageFromRegistryHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: EPM_API_ROUTES.BULK_INSTALL_PATTERN,
       validate: BulkUpgradePackagesFromRegistryRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(bulkInstallPackagesFromRegistryHandler)
+    bulkInstallPackagesFromRegistryHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: EPM_API_ROUTES.INSTALL_BY_UPLOAD_PATTERN,
       validate: InstallPackageByUploadRequestSchema,
@@ -134,15 +131,15 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
         },
       },
     },
-    enforceSuperUser(installPackageByUploadHandler)
+    installPackageByUploadHandler
   );
 
-  router.delete(
+  routers.superuser.delete(
     {
       path: EPM_API_ROUTES.DELETE_PATTERN,
       validate: DeletePackageRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(deletePackageHandler)
+    deletePackageHandler
   );
 };
diff --git a/x-pack/plugins/fleet/server/routes/security.test.ts b/x-pack/plugins/fleet/server/routes/security.test.ts
new file mode 100644
index 0000000000000..80ea142541530
--- /dev/null
+++ b/x-pack/plugins/fleet/server/routes/security.test.ts
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IRouter, RequestHandler, RouteConfig } from '../../../../../src/core/server';
+import { coreMock } from '../../../../../src/core/server/mocks';
+import type { AuthenticatedUser } from '../../../security/server';
+import type { CheckPrivilegesDynamically } from '../../../security/server/authorization/check_privileges_dynamically';
+import { createAppContextStartContractMock } from '../mocks';
+import { appContextService } from '../services';
+
+import type { RouterWrapper } from './security';
+import { RouterWrappers } from './security';
+
+describe('RouterWrappers', () => {
+  const runTest = async ({
+    wrapper,
+    security: {
+      roles = [],
+      pluginEnabled = true,
+      licenseEnabled = true,
+      checkPrivilegesDynamically,
+    } = {},
+  }: {
+    wrapper: RouterWrapper;
+    security?: {
+      roles?: string[];
+      pluginEnabled?: boolean;
+      licenseEnabled?: boolean;
+      checkPrivilegesDynamically?: CheckPrivilegesDynamically;
+    };
+  }) => {
+    const fakeRouter = {
+      get: jest.fn(),
+    } as unknown as jest.Mocked<IRouter>;
+    const fakeHandler: RequestHandler = jest.fn((ctx, req, res) => res.ok());
+
+    const mockContext = createAppContextStartContractMock();
+    // @ts-expect-error type doesn't properly respect deeply mocked keys
+    mockContext.securityStart?.authz.actions.api.get.mockImplementation((priv) => `api:${priv}`);
+
+    if (!pluginEnabled) {
+      mockContext.securitySetup = undefined;
+      mockContext.securityStart = undefined;
+    } else {
+      mockContext.securityStart?.authc.getCurrentUser.mockReturnValue({
+        username: 'foo',
+        roles,
+      } as unknown as AuthenticatedUser);
+
+      mockContext.securitySetup?.license.isEnabled.mockReturnValue(licenseEnabled);
+      if (licenseEnabled) {
+        mockContext.securityStart?.authz.mode.useRbacForRequest.mockReturnValue(true);
+      }
+
+      if (checkPrivilegesDynamically) {
+        mockContext.securityStart?.authz.checkPrivilegesDynamicallyWithRequest.mockReturnValue(
+          checkPrivilegesDynamically
+        );
+      }
+    }
+
+    appContextService.start(mockContext);
+
+    const wrappedRouter = wrapper(fakeRouter);
+    wrappedRouter.get({} as RouteConfig<any, any, any, any>, fakeHandler);
+    const wrappedHandler = fakeRouter.get.mock.calls[0][1];
+    const resFactory = { forbidden: jest.fn(() => 'forbidden'), ok: jest.fn(() => 'ok') };
+    const res = await wrappedHandler(
+      { core: coreMock.createRequestHandlerContext() },
+      {} as any,
+      resFactory as any
+    );
+
+    return res as unknown as 'forbidden' | 'ok';
+  };
+
+  describe('require.superuser', () => {
+    it('allow users with the superuser role', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { roles: ['superuser'] },
+        })
+      ).toEqual('ok');
+    });
+
+    it('does not allow users without the superuser role', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { roles: ['foo'] },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security plugin to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { pluginEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security license to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { licenseEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+  });
+
+  describe('require.fleetSetupPrivilege', () => {
+    const mockCheckPrivileges: jest.Mock<
+      ReturnType<CheckPrivilegesDynamically>,
+      Parameters<CheckPrivilegesDynamically>
+    > = jest.fn().mockResolvedValue({ hasAllRequested: true });
+
+    it('executes custom authz check', async () => {
+      await runTest({
+        wrapper: RouterWrappers.require.fleetSetupPrivilege,
+        security: { checkPrivilegesDynamically: mockCheckPrivileges },
+      });
+      expect(mockCheckPrivileges).toHaveBeenCalledWith(
+        { kibana: ['api:fleet-setup'] },
+        {
+          requireLoginAction: false,
+        }
+      );
+    });
+
+    it('allow users with required privileges', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { checkPrivilegesDynamically: mockCheckPrivileges },
+        })
+      ).toEqual('ok');
+    });
+
+    it('does not allow users without required privileges', async () => {
+      mockCheckPrivileges.mockResolvedValueOnce({ hasAllRequested: false } as any);
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { checkPrivilegesDynamically: mockCheckPrivileges },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security plugin to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { pluginEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security license to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { licenseEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+  });
+});
diff --git a/x-pack/plugins/fleet/server/routes/security.ts b/x-pack/plugins/fleet/server/routes/security.ts
index 33a510c27f04e..8a67a7066742a 100644
--- a/x-pack/plugins/fleet/server/routes/security.ts
+++ b/x-pack/plugins/fleet/server/routes/security.ts
@@ -5,56 +5,137 @@
  * 2.0.
  */
 
-import type { IRouter, RequestHandler, RequestHandlerContext } from 'src/core/server';
+import type {
+  IRouter,
+  KibanaRequest,
+  RequestHandler,
+  RequestHandlerContext,
+} from 'src/core/server';
 
 import { appContextService } from '../services';
 
-export function enforceSuperUser<T1, T2, T3, TContext extends RequestHandlerContext>(
+const SUPERUSER_AUTHZ_MESSAGE =
+  'Access to Fleet API requires the superuser role and for stack security features to be enabled.';
+
+function checkSecurityEnabled() {
+  return appContextService.hasSecurity() && appContextService.getSecurityLicense().isEnabled();
+}
+
+function checkSuperuser(req: KibanaRequest) {
+  if (!checkSecurityEnabled()) {
+    return false;
+  }
+
+  const security = appContextService.getSecurity();
+  const user = security.authc.getCurrentUser(req);
+  if (!user) {
+    return false;
+  }
+
+  const userRoles = user.roles || [];
+  if (!userRoles.includes('superuser')) {
+    return false;
+  }
+
+  return true;
+}
+
+function enforceSuperuser<T1, T2, T3, TContext extends RequestHandlerContext>(
   handler: RequestHandler<T1, T2, T3, TContext>
 ): RequestHandler<T1, T2, T3, TContext> {
   return function enforceSuperHandler(context, req, res) {
-    if (!appContextService.hasSecurity() || !appContextService.getSecurityLicense().isEnabled()) {
+    const isSuperuser = checkSuperuser(req);
+    if (!isSuperuser) {
       return res.forbidden({
         body: {
-          message: `Access to this API requires that security is enabled`,
+          message: SUPERUSER_AUTHZ_MESSAGE,
         },
       });
     }
 
-    const security = appContextService.getSecurity();
-    const user = security.authc.getCurrentUser(req);
-    if (!user) {
-      return res.forbidden({
-        body: {
-          message:
-            'Access to Fleet API require the superuser role, and for stack security features to be enabled.',
-        },
-      });
-    }
+    return handler(context, req, res);
+  };
+}
 
-    const userRoles = user.roles || [];
-    if (!userRoles.includes('superuser')) {
-      return res.forbidden({
-        body: {
-          message: 'Access to Fleet API require the superuser role.',
-        },
-      });
+function makeRouterEnforcingSuperuser<TContext extends RequestHandlerContext>(
+  router: IRouter<TContext>
+): IRouter<TContext> {
+  return {
+    get: (options, handler) => router.get(options, enforceSuperuser(handler)),
+    delete: (options, handler) => router.delete(options, enforceSuperuser(handler)),
+    post: (options, handler) => router.post(options, enforceSuperuser(handler)),
+    put: (options, handler) => router.put(options, enforceSuperuser(handler)),
+    patch: (options, handler) => router.patch(options, enforceSuperuser(handler)),
+    handleLegacyErrors: (handler) => router.handleLegacyErrors(handler),
+    getRoutes: () => router.getRoutes(),
+    routerPath: router.routerPath,
+  };
+}
+
+async function checkFleetSetupPrivilege(req: KibanaRequest) {
+  if (!checkSecurityEnabled()) {
+    return false;
+  }
+
+  const security = appContextService.getSecurity();
+
+  if (security.authz.mode.useRbacForRequest(req)) {
+    const checkPrivileges = security.authz.checkPrivilegesDynamicallyWithRequest(req);
+    const { hasAllRequested } = await checkPrivileges(
+      { kibana: [security.authz.actions.api.get('fleet-setup')] },
+      { requireLoginAction: false } // exclude login access requirement
+    );
+
+    return !!hasAllRequested;
+  }
+
+  return true;
+}
+
+function enforceFleetSetupPrivilege<P, Q, B, TContext extends RequestHandlerContext>(
+  handler: RequestHandler<P, Q, B, TContext>
+): RequestHandler<P, Q, B, TContext> {
+  return async (context, req, res) => {
+    const hasFleetSetupPrivilege = await checkFleetSetupPrivilege(req);
+    if (!hasFleetSetupPrivilege) {
+      return res.forbidden({ body: { message: SUPERUSER_AUTHZ_MESSAGE } });
     }
+
     return handler(context, req, res);
   };
 }
 
-export function makeRouterEnforcingSuperuser<TContext extends RequestHandlerContext>(
+function makeRouterEnforcingFleetSetupPrivilege<TContext extends RequestHandlerContext>(
   router: IRouter<TContext>
 ): IRouter<TContext> {
   return {
-    get: (options, handler) => router.get(options, enforceSuperUser(handler)),
-    delete: (options, handler) => router.delete(options, enforceSuperUser(handler)),
-    post: (options, handler) => router.post(options, enforceSuperUser(handler)),
-    put: (options, handler) => router.put(options, enforceSuperUser(handler)),
-    patch: (options, handler) => router.patch(options, enforceSuperUser(handler)),
+    get: (options, handler) => router.get(options, enforceFleetSetupPrivilege(handler)),
+    delete: (options, handler) => router.delete(options, enforceFleetSetupPrivilege(handler)),
+    post: (options, handler) => router.post(options, enforceFleetSetupPrivilege(handler)),
+    put: (options, handler) => router.put(options, enforceFleetSetupPrivilege(handler)),
+    patch: (options, handler) => router.patch(options, enforceFleetSetupPrivilege(handler)),
     handleLegacyErrors: (handler) => router.handleLegacyErrors(handler),
     getRoutes: () => router.getRoutes(),
     routerPath: router.routerPath,
   };
 }
+
+export type RouterWrapper = <T extends RequestHandlerContext>(route: IRouter<T>) => IRouter<T>;
+
+interface RouterWrappersSetup {
+  require: {
+    superuser: RouterWrapper;
+    fleetSetupPrivilege: RouterWrapper;
+  };
+}
+
+export const RouterWrappers: RouterWrappersSetup = {
+  require: {
+    superuser: (router) => {
+      return makeRouterEnforcingSuperuser(router);
+    },
+    fleetSetupPrivilege: (router) => {
+      return makeRouterEnforcingFleetSetupPrivilege(router);
+    },
+  },
+};
diff --git a/x-pack/plugins/fleet/server/routes/setup/handlers.ts b/x-pack/plugins/fleet/server/routes/setup/handlers.ts
index c5b2ef0ade26f..fad5d93c3f5d5 100644
--- a/x-pack/plugins/fleet/server/routes/setup/handlers.ts
+++ b/x-pack/plugins/fleet/server/routes/setup/handlers.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import type { RequestHandler } from 'src/core/server';
-
 import { appContextService } from '../../services';
 import type { GetFleetStatusResponse, PostFleetSetupResponse } from '../../../common';
 import { setupFleet } from '../../services/setup';
@@ -14,12 +12,14 @@ import { hasFleetServers } from '../../services/fleet_server';
 import { defaultIngestErrorHandler } from '../../errors';
 import type { FleetRequestHandler } from '../../types';
 
-export const getFleetStatusHandler: RequestHandler = async (context, request, response) => {
+export const getFleetStatusHandler: FleetRequestHandler = async (context, request, response) => {
   try {
     const isApiKeysEnabled = await appContextService
       .getSecurity()
       .authc.apiKeys.areAPIKeysEnabled();
-    const isFleetServerSetup = await hasFleetServers(appContextService.getInternalUserESClient());
+    const isFleetServerSetup = await hasFleetServers(
+      context.core.elasticsearch.client.asInternalUser
+    );
 
     const missingRequirements: GetFleetStatusResponse['missing_requirements'] = [];
     if (!isApiKeysEnabled) {
diff --git a/x-pack/plugins/fleet/server/routes/setup/index.ts b/x-pack/plugins/fleet/server/routes/setup/index.ts
index 591b9c832172d..d191f1b78e9ae 100644
--- a/x-pack/plugins/fleet/server/routes/setup/index.ts
+++ b/x-pack/plugins/fleet/server/routes/setup/index.ts
@@ -5,55 +5,48 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, AGENTS_SETUP_API_ROUTES, SETUP_API_ROUTE } from '../../constants';
 import type { FleetConfigType } from '../../../common';
 
-import type { FleetRequestHandlerContext } from '../../types/request_context';
+import type { FleetRouter } from '../../types/request_context';
 
 import { getFleetStatusHandler, fleetSetupHandler } from './handlers';
 
-export const registerFleetSetupRoute = (router: IRouter<FleetRequestHandlerContext>) => {
+export const registerFleetSetupRoute = (router: FleetRouter) => {
   router.post(
     {
       path: SETUP_API_ROUTE,
       validate: false,
-      // if this route is set to `-all`, a read-only user get a 404 for this route
-      // and will see `Unable to initialize Ingest Manager` in the UI
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     fleetSetupHandler
   );
 };
 
 // That route is used by agent to setup Fleet
-export const registerCreateFleetSetupRoute = (router: IRouter<FleetRequestHandlerContext>) => {
+export const registerCreateFleetSetupRoute = (router: FleetRouter) => {
   router.post(
     {
       path: AGENTS_SETUP_API_ROUTES.CREATE_PATTERN,
       validate: false,
-      options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
     fleetSetupHandler
   );
 };
 
-export const registerGetFleetStatusRoute = (router: IRouter<FleetRequestHandlerContext>) => {
+export const registerGetFleetStatusRoute = (router: FleetRouter) => {
   router.get(
     {
       path: AGENTS_SETUP_API_ROUTES.INFO_PATTERN,
       validate: false,
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
       options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getFleetStatusHandler
   );
 };
 
-export const registerRoutes = (
-  router: IRouter<FleetRequestHandlerContext>,
-  config: FleetConfigType
-) => {
+export const registerRoutes = (router: FleetRouter, config: FleetConfigType) => {
   // Ingest manager setup
   registerFleetSetupRoute(router);
 
diff --git a/x-pack/plugins/fleet/server/types/request_context.ts b/x-pack/plugins/fleet/server/types/request_context.ts
index a3b414119b685..0d0da9145f073 100644
--- a/x-pack/plugins/fleet/server/types/request_context.ts
+++ b/x-pack/plugins/fleet/server/types/request_context.ts
@@ -11,6 +11,7 @@ import type {
   RequestHandlerContext,
   RouteMethod,
   SavedObjectsClientContract,
+  IRouter,
 } from '../../../../../src/core/server';
 
 /** @internal */
@@ -37,3 +38,9 @@ export type FleetRequestHandler<
   Method extends RouteMethod = any,
   ResponseFactory extends KibanaResponseFactory = KibanaResponseFactory
 > = RequestHandler<P, Q, B, FleetRequestHandlerContext, Method, ResponseFactory>;
+
+/**
+ * Convenience type for routers in Fleet that includes the FleetRequestHandlerContext type
+ * @internal
+ */
+export type FleetRouter = IRouter<FleetRequestHandlerContext>;
diff --git a/x-pack/plugins/index_lifecycle_management/common/constants/index.ts b/x-pack/plugins/index_lifecycle_management/common/constants/index.ts
index 7107489f4e2ba..329f479e128e2 100644
--- a/x-pack/plugins/index_lifecycle_management/common/constants/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/common/constants/index.ts
@@ -19,6 +19,8 @@ export const PLUGIN = {
   }),
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const API_BASE_PATH = '/api/index_lifecycle_management';
 
 export { MIN_SEARCHABLE_SNAPSHOT_LICENSE, MIN_PLUGIN_LICENSE };
diff --git a/x-pack/plugins/index_lifecycle_management/server/config.ts b/x-pack/plugins/index_lifecycle_management/server/config.ts
index f3fdf59cec55b..691cc06708bb5 100644
--- a/x-pack/plugins/index_lifecycle_management/server/config.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/config.ts
@@ -4,16 +4,94 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    // Cloud requires the ability to hide internal node attributes from users.
+    filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<IndexLifecycleManagementConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+export type IndexLifecycleManagementConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-  // Cloud requires the ability to hide internal node attributes from users.
-  filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    // Cloud requires the ability to hide internal node attributes from users.
+    filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
+  },
+  { defaultValue: undefined }
+);
+
+export type IndexLifecycleManagementConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<IndexLifecycleManagementConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.ilm.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.ilm.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.ilm.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Index Lifecycle Policies UI, use the "xpack.ilm.ui.enabled" setting instead of "xpack.ilm.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage: 'Change the "xpack.ilm.enabled" setting to "xpack.ilm.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type IndexLifecycleManagementConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<
+  IndexLifecycleManagementConfig | IndexLifecycleManagementConfig7x
+> = kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/index_lifecycle_management/server/index.ts b/x-pack/plugins/index_lifecycle_management/server/index.ts
index 1f8b01913fd3e..6a74b4c80b2d3 100644
--- a/x-pack/plugins/index_lifecycle_management/server/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/index.ts
@@ -5,17 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'kibana/server';
+import { PluginInitializerContext } from 'kibana/server';
 import { IndexLifecycleManagementServerPlugin } from './plugin';
-import { configSchema, IndexLifecycleManagementConfig } from './config';
+
+export { config } from './config';
 
 export const plugin = (ctx: PluginInitializerContext) =>
   new IndexLifecycleManagementServerPlugin(ctx);
-
-export const config: PluginConfigDescriptor<IndexLifecycleManagementConfig> = {
-  schema: configSchema,
-  exposeToBrowser: {
-    ui: true,
-  },
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
diff --git a/x-pack/plugins/index_management/public/plugin.ts b/x-pack/plugins/index_management/public/plugin.ts
index 4e123b6f474f8..2394167ca61b2 100644
--- a/x-pack/plugins/index_management/public/plugin.ts
+++ b/x-pack/plugins/index_management/public/plugin.ts
@@ -13,7 +13,12 @@ import { setExtensionsService } from './application/store/selectors/extension_se
 
 import { ExtensionsService } from './services';
 
-import { IndexManagementPluginSetup, SetupDependencies, StartDependencies } from './types';
+import {
+  IndexManagementPluginSetup,
+  SetupDependencies,
+  StartDependencies,
+  ClientConfigType,
+} from './types';
 
 // avoid import from index files in plugin.ts, use specific import paths
 import { PLUGIN } from '../common/constants/plugin';
@@ -31,25 +36,30 @@ export class IndexMgmtUIPlugin {
     coreSetup: CoreSetup<StartDependencies>,
     plugins: SetupDependencies
   ): IndexManagementPluginSetup {
-    const { fleet, usageCollection, management } = plugins;
-    const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
-
-    management.sections.section.data.registerApp({
-      id: PLUGIN.id,
-      title: i18n.translate('xpack.idxMgmt.appTitle', { defaultMessage: 'Index Management' }),
-      order: 0,
-      mount: async (params) => {
-        const { mountManagementSection } = await import('./application/mount_management_section');
-        return mountManagementSection(
-          coreSetup,
-          usageCollection,
-          params,
-          this.extensionsService,
-          Boolean(fleet),
-          kibanaVersion
-        );
-      },
-    });
+    const {
+      ui: { enabled: isIndexManagementUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
+
+    if (isIndexManagementUiEnabled) {
+      const { fleet, usageCollection, management } = plugins;
+      const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
+      management.sections.section.data.registerApp({
+        id: PLUGIN.id,
+        title: i18n.translate('xpack.idxMgmt.appTitle', { defaultMessage: 'Index Management' }),
+        order: 0,
+        mount: async (params) => {
+          const { mountManagementSection } = await import('./application/mount_management_section');
+          return mountManagementSection(
+            coreSetup,
+            usageCollection,
+            params,
+            this.extensionsService,
+            Boolean(fleet),
+            kibanaVersion
+          );
+        },
+      });
+    }
 
     return {
       extensionsService: this.extensionsService.setup(),
diff --git a/x-pack/plugins/index_management/public/types.ts b/x-pack/plugins/index_management/public/types.ts
index 05c486e299c7a..e0af6b160cf11 100644
--- a/x-pack/plugins/index_management/public/types.ts
+++ b/x-pack/plugins/index_management/public/types.ts
@@ -23,3 +23,9 @@ export interface SetupDependencies {
 export interface StartDependencies {
   share: SharePluginStart;
 }
+
+export interface ClientConfigType {
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/x-pack/plugins/index_management/server/config.ts b/x-pack/plugins/index_management/server/config.ts
index 0a314c7654b16..88a714db5edca 100644
--- a/x-pack/plugins/index_management/server/config.ts
+++ b/x-pack/plugins/index_management/server/config.ts
@@ -4,11 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<IndexManagementConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type IndexManagementConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
+    enabled: schema.boolean({ defaultValue: true }),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type IndexManagementConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<IndexManagementConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.index_management.enabled') === undefined) {
+        return completeConfig;
+      }
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-});
+      addDeprecation({
+        configPath: 'xpack.index_management.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.idxMgmt.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.index_management.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.idxMgmt.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Index Management UI, use the "xpack.index_management.ui.enabled" setting instead of "xpack.index_management.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.idxMgmt.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.idxMgmt.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.index_management.enabled" setting to "xpack.index_management.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type IndexManagementConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<IndexManagementConfig | IndexManagementConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/index_management/server/index.ts b/x-pack/plugins/index_management/server/index.ts
index 14b67e2ffd581..29291116e44fc 100644
--- a/x-pack/plugins/index_management/server/index.ts
+++ b/x-pack/plugins/index_management/server/index.ts
@@ -5,17 +5,13 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 
 import { IndexMgmtServerPlugin } from './plugin';
-import { configSchema } from './config';
 
-export const plugin = (context: PluginInitializerContext) => new IndexMgmtServerPlugin(context);
+export { config } from './config';
 
-export const config: PluginConfigDescriptor = {
-  schema: configSchema,
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
+export const plugin = (context: PluginInitializerContext) => new IndexMgmtServerPlugin(context);
 
 /** @public */
 export { Dependencies } from './types';
diff --git a/x-pack/plugins/infra/server/deprecations.test.ts b/x-pack/plugins/infra/server/deprecations.test.ts
new file mode 100644
index 0000000000000..318f1e50d6662
--- /dev/null
+++ b/x-pack/plugins/infra/server/deprecations.test.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getInfraDeprecationsFactory } from './deprecations';
+
+describe('Infra plugin deprecations', () => {
+  describe('Source configuration deprecations', () => {
+    test('returns no deprecations when all fields are set to the default values', async () => {
+      const sources = {
+        getAllSourceConfigurations: () => [
+          {
+            configuration: {
+              name: 'Default',
+              fields: {
+                timestamp: '@timestamp',
+                tiebreaker: '_doc',
+                container: 'container.id',
+                host: 'host.name',
+                pod: 'kubernetes.pod.uid',
+              },
+            },
+          },
+          {
+            configuration: {
+              name: 'Alternate',
+              fields: {
+                timestamp: '@timestamp',
+                tiebreaker: '_doc',
+                container: 'container.id',
+                host: 'host.name',
+                pod: 'kubernetes.pod.uid',
+              },
+            },
+          },
+        ],
+      };
+      const getDeprecations = getInfraDeprecationsFactory(sources as any);
+      const deprecations = await getDeprecations({} as any);
+      expect(deprecations.length).toBe(0);
+    });
+  });
+  test('returns expected deprecations when some fields are not set to default values in one or more source configurations', async () => {
+    const sources = {
+      getAllSourceConfigurations: () => [
+        {
+          configuration: {
+            name: 'Default',
+            fields: {
+              timestamp: 'not-@timestamp',
+              tiebreaker: '_doc',
+              container: 'not-container.id',
+              host: 'host.name',
+              pod: 'not-kubernetes.pod.uid',
+            },
+          },
+        },
+        {
+          configuration: {
+            name: 'Alternate',
+            fields: {
+              timestamp: 'not-@timestamp',
+              tiebreaker: 'not-_doc',
+              container: 'container.id',
+              host: 'not-host.name',
+              pod: 'kubernetes.pod.uid',
+            },
+          },
+        },
+      ],
+    };
+    const getDeprecations = getInfraDeprecationsFactory(sources as any);
+    const deprecations = await getDeprecations({} as any);
+    expect(deprecations.length).toBe(5);
+    expect(
+      deprecations.map((d) =>
+        d.title.replace(/Source configuration field "(.*)" is deprecated./, '$1')
+      )
+    ).toEqual(
+      expect.arrayContaining(['timestamp', 'tiebreaker', 'container ID', 'host name', 'pod ID'])
+    );
+  });
+});
diff --git a/x-pack/plugins/infra/server/deprecations.ts b/x-pack/plugins/infra/server/deprecations.ts
new file mode 100644
index 0000000000000..27c2b235f769b
--- /dev/null
+++ b/x-pack/plugins/infra/server/deprecations.ts
@@ -0,0 +1,211 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
+import {
+  ConfigDeprecationProvider,
+  ConfigDeprecation,
+  DeprecationsDetails,
+  GetDeprecationsContext,
+} from 'src/core/server';
+import { InfraSources } from './lib/sources';
+
+const deprecatedFieldMessage = (fieldName: string, defaultValue: string, configNames: string[]) =>
+  i18n.translate('xpack.infra.deprecations.deprecatedFieldDescription', {
+    defaultMessage:
+      'Configuring the "{fieldName}" field has been deprecated and will be removed in 8.0.0. This plugin is designed to work with ECS, and expects this field to have a value of `{defaultValue}`. It has a different value configured in Source {configCount, plural, one {Configuration} other {Configurations}}: {configNames}',
+    values: {
+      fieldName,
+      defaultValue,
+      configNames: configNames.join(', '),
+      configCount: configNames.length,
+    },
+  });
+
+const DEFAULT_VALUES = {
+  timestamp: '@timestamp',
+  tiebreaker: '_doc',
+  container: 'container.id',
+  host: 'host.name',
+  pod: 'kubernetes.pod.uid',
+};
+
+const FIELD_DEPRECATION_FACTORIES: Record<string, (configNames: string[]) => DeprecationsDetails> =
+  {
+    timestamp: (configNames) => ({
+      level: 'critical',
+      title: i18n.translate('xpack.infra.deprecations.timestampFieldTitle', {
+        defaultMessage: 'Source configuration field "timestamp" is deprecated.',
+      }),
+      message: deprecatedFieldMessage(
+        i18n.translate('xpack.infra.deprecations.timestampFieldName', {
+          defaultMessage: 'timestamp',
+        }),
+        DEFAULT_VALUES.timestamp,
+        configNames
+      ),
+      correctiveActions: {
+        manualSteps: [
+          i18n.translate('xpack.infra.deprecations.timestampAdjustIndexing', {
+            defaultMessage: 'Adjust your indexing to use "{field}" as a timestamp.',
+            values: { field: '@timestamp' },
+          }),
+        ],
+      },
+    }),
+    tiebreaker: (configNames) => ({
+      level: 'critical',
+      title: i18n.translate('xpack.infra.deprecations.tiebreakerFieldTitle', {
+        defaultMessage: 'Source configuration field "tiebreaker" is deprecated.',
+      }),
+      message: deprecatedFieldMessage(
+        i18n.translate('xpack.infra.deprecations.tiebreakerFieldName', {
+          defaultMessage: 'tiebreaker',
+        }),
+        DEFAULT_VALUES.tiebreaker,
+        configNames
+      ),
+      correctiveActions: {
+        manualSteps: [
+          i18n.translate('xpack.infra.deprecations.tiebreakerAdjustIndexing', {
+            defaultMessage: 'Adjust your indexing to use "{field}" as a tiebreaker.',
+            values: { field: '_doc' },
+          }),
+        ],
+      },
+    }),
+    host: (configNames) => ({
+      level: 'critical',
+      title: i18n.translate('xpack.infra.deprecations.hostnameFieldTitle', {
+        defaultMessage: 'Source configuration field "host name" is deprecated.',
+      }),
+      message: deprecatedFieldMessage(
+        i18n.translate('xpack.infra.deprecations.hostnameFieldName', {
+          defaultMessage: 'host name',
+        }),
+        DEFAULT_VALUES.host,
+        configNames
+      ),
+      correctiveActions: {
+        manualSteps: [
+          i18n.translate('xpack.infra.deprecations.hostAdjustIndexing', {
+            defaultMessage: 'Adjust your indexing to identify hosts using "{field}"',
+            values: { field: 'host.name' },
+          }),
+        ],
+      },
+    }),
+    pod: (configNames) => ({
+      level: 'critical',
+      title: i18n.translate('xpack.infra.deprecations.podIdFieldTitle', {
+        defaultMessage: 'Source configuration field "pod ID" is deprecated.',
+      }),
+      message: deprecatedFieldMessage(
+        i18n.translate('xpack.infra.deprecations.podIdFieldName', { defaultMessage: 'pod ID' }),
+        DEFAULT_VALUES.pod,
+        configNames
+      ),
+      correctiveActions: {
+        manualSteps: [
+          i18n.translate('xpack.infra.deprecations.podAdjustIndexing', {
+            defaultMessage: 'Adjust your indexing to identify Kubernetes pods using "{field}"',
+            values: { field: 'kubernetes.pod.uid' },
+          }),
+        ],
+      },
+    }),
+    container: (configNames) => ({
+      level: 'critical',
+      title: i18n.translate('xpack.infra.deprecations.containerIdFieldTitle', {
+        defaultMessage: 'Source configuration field "container ID" is deprecated.',
+      }),
+      message: deprecatedFieldMessage(
+        i18n.translate('xpack.infra.deprecations.containerIdFieldName', {
+          defaultMessage: 'container ID',
+        }),
+        DEFAULT_VALUES.container,
+        configNames
+      ),
+      correctiveActions: {
+        manualSteps: [
+          i18n.translate('xpack.infra.deprecations.containerAdjustIndexing', {
+            defaultMessage: 'Adjust your indexing to identify Docker containers using "{field}"',
+            values: { field: 'container.id' },
+          }),
+        ],
+      },
+    }),
+  };
+
+export const configDeprecations: ConfigDeprecationProvider = () => [
+  ...Object.keys(FIELD_DEPRECATION_FACTORIES).map(
+    (key): ConfigDeprecation =>
+      (completeConfig, rootPath, addDeprecation) => {
+        const configuredValue = get(completeConfig, `xpack.infra.sources.default.fields.${key}`);
+        if (typeof configuredValue === 'undefined') {
+          return completeConfig;
+        }
+        addDeprecation({
+          title: i18n.translate('xpack.infra.deprecations.deprecatedFieldConfigTitle', {
+            defaultMessage: '"{fieldKey}" is deprecated.',
+            values: {
+              fieldKey: key,
+            },
+          }),
+          message: i18n.translate('xpack.infra.deprecations.deprecatedFieldConfigDescription', {
+            defaultMessage:
+              'Configuring "xpack.infra.sources.default.fields.{fieldKey}" has been deprecated and will be removed in 8.0.0.',
+            values: {
+              fieldKey: key,
+            },
+          }),
+          level: 'warning',
+          correctiveActions: {
+            manualSteps: [
+              i18n.translate('xpack.infra.deprecations.removeConfigField', {
+                defaultMessage:
+                  'Remove "xpack.infra.sources.default.fields.{fieldKey}" from your Kibana configuration.',
+                values: { fieldKey: key },
+              }),
+            ],
+          },
+        } as Parameters<typeof addDeprecation>[0]);
+
+        return completeConfig;
+      }
+  ),
+];
+
+export const getInfraDeprecationsFactory =
+  (sources: InfraSources) =>
+  async ({ savedObjectsClient }: GetDeprecationsContext) => {
+    const deprecatedFieldsToSourceConfigMap: Map<string, string[]> = new Map();
+    const sourceConfigurations = await sources.getAllSourceConfigurations(savedObjectsClient);
+
+    for (const { configuration } of sourceConfigurations) {
+      const { name, fields } = configuration;
+      for (const [key, defaultValue] of Object.entries(DEFAULT_VALUES)) {
+        const configuredValue = Reflect.get(fields, key);
+        if (configuredValue !== defaultValue) {
+          const affectedConfigNames = deprecatedFieldsToSourceConfigMap.get(key) ?? [];
+          affectedConfigNames.push(name);
+          deprecatedFieldsToSourceConfigMap.set(key, affectedConfigNames);
+        }
+      }
+    }
+
+    const deprecations: DeprecationsDetails[] = [];
+    if (deprecatedFieldsToSourceConfigMap.size > 0) {
+      for (const [fieldName, affectedConfigNames] of deprecatedFieldsToSourceConfigMap.entries()) {
+        const deprecationFactory = Reflect.get(FIELD_DEPRECATION_FACTORIES, fieldName);
+        deprecations.push(deprecationFactory(affectedConfigNames));
+      }
+    }
+
+    return deprecations;
+  };
diff --git a/x-pack/plugins/infra/server/plugin.ts b/x-pack/plugins/infra/server/plugin.ts
index d1ea60dd23dfc..bf9c5a152058e 100644
--- a/x-pack/plugins/infra/server/plugin.ts
+++ b/x-pack/plugins/infra/server/plugin.ts
@@ -40,6 +40,7 @@ import { UsageCollector } from './usage/usage_collector';
 import { createGetLogQueryFields } from './services/log_queries/get_log_query_fields';
 import { handleEsError } from '../../../../src/plugins/es_ui_shared/server';
 import { RulesService } from './services/rules';
+import { configDeprecations, getInfraDeprecationsFactory } from './deprecations';
 
 export const config: PluginConfigDescriptor = {
   schema: schema.object({
@@ -67,6 +68,7 @@ export const config: PluginConfigDescriptor = {
       })
     ),
   }),
+  deprecations: configDeprecations,
 };
 
 export type InfraConfig = TypeOf<typeof config.schema>;
@@ -191,6 +193,11 @@ export class InfraServerPlugin implements Plugin<InfraPluginSetup> {
     const logEntriesService = new LogEntriesService();
     logEntriesService.setup(core, { ...plugins, sources });
 
+    // register deprecated source configuration fields
+    core.deprecations.registerDeprecations({
+      getDeprecations: getInfraDeprecationsFactory(sources),
+    });
+
     return {
       defineInternalSourceConfiguration(sourceId, sourceProperties) {
         sources.defineInternalSourceConfiguration(sourceId, sourceProperties);
diff --git a/x-pack/plugins/license_management/common/constants/index.ts b/x-pack/plugins/license_management/common/constants/index.ts
index 0567b0008f0c8..9735eabeb1e40 100644
--- a/x-pack/plugins/license_management/common/constants/index.ts
+++ b/x-pack/plugins/license_management/common/constants/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export { PLUGIN } from './plugin';
+export { PLUGIN, MAJOR_VERSION } from './plugin';
 export { API_BASE_PATH } from './base_path';
 export { EXTERNAL_LINKS } from './external_links';
 export { APP_PERMISSION } from './permissions';
diff --git a/x-pack/plugins/license_management/common/constants/plugin.ts b/x-pack/plugins/license_management/common/constants/plugin.ts
index ae7fd0f6e8a2e..76f4d94a0188a 100644
--- a/x-pack/plugins/license_management/common/constants/plugin.ts
+++ b/x-pack/plugins/license_management/common/constants/plugin.ts
@@ -13,3 +13,5 @@ export const PLUGIN = {
   }),
   id: 'license_management',
 };
+
+export const MAJOR_VERSION = '8.0.0';
diff --git a/x-pack/plugins/license_management/server/config.ts b/x-pack/plugins/license_management/server/config.ts
index 0e4de29b718be..e378a10191684 100644
--- a/x-pack/plugins/license_management/server/config.ts
+++ b/x-pack/plugins/license_management/server/config.ts
@@ -4,14 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<LicenseManagementConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+export type LicenseManagementConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type LicenseManagementConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<LicenseManagementConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.license_management.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.license_management.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.licenseMgmt.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.license_management.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.licenseMgmt.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the License Management UI, use the "xpack.license_management.ui.enabled" setting instead of "xpack.license_management.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.licenseMgmt.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.licenseMgmt.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.license_management.enabled" setting to "xpack.license_management.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type LicenseManagementConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<LicenseManagementConfig | LicenseManagementConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/license_management/server/index.ts b/x-pack/plugins/license_management/server/index.ts
index e78ffe07b50c0..7aa6bfb06d54d 100644
--- a/x-pack/plugins/license_management/server/index.ts
+++ b/x-pack/plugins/license_management/server/index.ts
@@ -5,17 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 
 import { LicenseManagementServerPlugin } from './plugin';
-import { configSchema, LicenseManagementConfig } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) => new LicenseManagementServerPlugin();
+export { config } from './config';
 
-export const config: PluginConfigDescriptor<LicenseManagementConfig> = {
-  schema: configSchema,
-  exposeToBrowser: {
-    ui: true,
-  },
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
+export const plugin = (ctx: PluginInitializerContext) => new LicenseManagementServerPlugin();
diff --git a/x-pack/plugins/metrics_entities/server/index.ts b/x-pack/plugins/metrics_entities/server/index.ts
index e61dc8b7dc642..bb80ac8e8be73 100644
--- a/x-pack/plugins/metrics_entities/server/index.ts
+++ b/x-pack/plugins/metrics_entities/server/index.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { schema } from '@kbn/config-schema';
+
 import { PluginInitializerContext } from '../../../../src/core/server';
 
 import { MetricsEntitiesPlugin } from './plugin';
@@ -17,3 +19,10 @@ export const plugin = (initializerContext: PluginInitializerContext): MetricsEnt
 };
 
 export { MetricsEntitiesPluginSetup, MetricsEntitiesPluginStart } from './types';
+
+export const config = {
+  schema: schema.object({
+    // This plugin is experimental and should be disabled by default.
+    enabled: schema.boolean({ defaultValue: false }),
+  }),
+};
diff --git a/x-pack/plugins/ml/common/constants/index_patterns.ts b/x-pack/plugins/ml/common/constants/index_patterns.ts
index d7d6c343e282b..9a8e5c1b8ae78 100644
--- a/x-pack/plugins/ml/common/constants/index_patterns.ts
+++ b/x-pack/plugins/ml/common/constants/index_patterns.ts
@@ -7,7 +7,6 @@
 
 export const ML_ANNOTATIONS_INDEX_ALIAS_READ = '.ml-annotations-read';
 export const ML_ANNOTATIONS_INDEX_ALIAS_WRITE = '.ml-annotations-write';
-export const ML_ANNOTATIONS_INDEX_PATTERN = '.ml-annotations-6';
 
 export const ML_RESULTS_INDEX_PATTERN = '.ml-anomalies-*';
 export const ML_NOTIFICATION_INDEX_PATTERN = '.ml-notifications*';
diff --git a/x-pack/plugins/ml/common/types/job_validation.ts b/x-pack/plugins/ml/common/types/job_validation.ts
new file mode 100644
index 0000000000000..0c1db63ff3762
--- /dev/null
+++ b/x-pack/plugins/ml/common/types/job_validation.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ErrorType } from '../util/errors';
+
+export interface DatafeedValidationResponse {
+  valid: boolean;
+  documentsFound: boolean;
+  error?: ErrorType;
+}
diff --git a/x-pack/plugins/ml/common/types/saved_objects.ts b/x-pack/plugins/ml/common/types/saved_objects.ts
index 0e48800dd845d..e376fddbe6272 100644
--- a/x-pack/plugins/ml/common/types/saved_objects.ts
+++ b/x-pack/plugins/ml/common/types/saved_objects.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { ErrorType } from '../util/errors';
+import type { ErrorType } from '../util/errors';
 export type JobType = 'anomaly-detector' | 'data-frame-analytics';
 export const ML_SAVED_OBJECT_TYPE = 'ml-job';
 export const ML_MODULE_SAVED_OBJECT_TYPE = 'ml-module';
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts b/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts
index 951d9d6dfded9..00050803b97c6 100644
--- a/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts
@@ -23,7 +23,7 @@ export const useNavigateToPath = () => {
   const location = useLocation();
 
   return useCallback(
-    async (path: string | undefined, preserveSearch = false) => {
+    async (path: string | undefined, preserveSearch: boolean = false) => {
       if (path === undefined) return;
       const modifiedPath = `${path}${preserveSearch === true ? location.search : ''}`;
       /**
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
index a44b4bdef60c4..607a4fcf9a73c 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
@@ -502,6 +502,10 @@ export class JobCreator {
     return this._datafeed_config.indices;
   }
 
+  public set indices(indics: string[]) {
+    this._datafeed_config.indices = indics;
+  }
+
   public get scriptFields(): Field[] {
     return this._scriptFields;
   }
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
index 78903e64686f5..46315ac3b02d8 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
@@ -258,17 +258,21 @@ export function convertToMultiMetricJob(
   jobCreator.createdBy = CREATED_BY_LABEL.MULTI_METRIC;
   jobCreator.modelPlot = false;
   stashJobForCloning(jobCreator, true, true);
-
   navigateToPath(`jobs/new_job/${JOB_TYPE.MULTI_METRIC}`, true);
 }
 
 export function convertToAdvancedJob(jobCreator: JobCreatorType, navigateToPath: NavigateToPath) {
   jobCreator.createdBy = null;
   stashJobForCloning(jobCreator, true, true);
-
   navigateToPath(`jobs/new_job/${JOB_TYPE.ADVANCED}`, true);
 }
 
+export function resetAdvancedJob(jobCreator: JobCreatorType, navigateToPath: NavigateToPath) {
+  jobCreator.createdBy = null;
+  stashJobForCloning(jobCreator, true, false);
+  navigateToPath('/jobs/new_job');
+}
+
 export function resetJob(jobCreator: JobCreatorType, navigateToPath: NavigateToPath) {
   jobCreator.jobId = '';
   stashJobForCloning(jobCreator, true, true);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/common/json_editor_flyout/json_editor_flyout.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/common/json_editor_flyout/json_editor_flyout.tsx
index ce71cd80e45c0..9e5d1ac5eef6f 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/common/json_editor_flyout/json_editor_flyout.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/common/json_editor_flyout/json_editor_flyout.tsx
@@ -204,7 +204,7 @@ export const JsonEditorFlyout: FC<Props> = ({ isDisabled, jobEditorMode, datafee
                 >
                   <FormattedMessage
                     id="xpack.ml.newJob.wizard.jsonFlyout.indicesChange.calloutText"
-                    defaultMessage="It is not possible to alter the indices being used by the datafeed here. If you wish to select a different index pattern or saved search, please start the job creation again, selecting a different index pattern."
+                    defaultMessage="You cannot alter the indices being used by the datafeed here. To select a different index pattern or saved search, go to step 1 of the wizard and select the Change index pattern option."
                   />
                 </EuiCallOut>
               </>
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx
new file mode 100644
index 0000000000000..c402ee4bf9799
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx
@@ -0,0 +1,326 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC, useState, useEffect, useCallback, useContext } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import { i18n } from '@kbn/i18n';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+  EuiModal,
+  EuiButton,
+  EuiCallOut,
+  EuiSpacer,
+  EuiModalHeader,
+  EuiLoadingSpinner,
+  EuiModalHeaderTitle,
+  EuiModalBody,
+} from '@elastic/eui';
+
+import { JobCreatorContext } from '../../../job_creator_context';
+import { AdvancedJobCreator } from '../../../../../common/job_creator';
+import { resetAdvancedJob } from '../../../../../common/job_creator/util/general';
+import {
+  CombinedJob,
+  Datafeed,
+} from '../../../../../../../../../common/types/anomaly_detection_jobs';
+import { extractErrorMessage } from '../../../../../../../../../common/util/errors';
+import type { DatafeedValidationResponse } from '../../../../../../../../../common/types/job_validation';
+
+import { SavedObjectFinderUi } from '../../../../../../../../../../../../src/plugins/saved_objects/public';
+import {
+  useMlKibana,
+  useMlApiContext,
+  useNavigateToPath,
+} from '../../../../../../../contexts/kibana';
+
+const fixedPageSize: number = 8;
+
+enum STEP {
+  PICK_DATA_VIEW,
+  VALIDATE,
+}
+
+interface Props {
+  onClose: () => void;
+}
+
+export const ChangeDataViewModal: FC<Props> = ({ onClose }) => {
+  const {
+    services: {
+      savedObjects,
+      uiSettings,
+      data: { dataViews },
+    },
+  } = useMlKibana();
+  const navigateToPath = useNavigateToPath();
+  const { validateDatafeedPreview } = useMlApiContext();
+
+  const { jobCreator: jc } = useContext(JobCreatorContext);
+  const jobCreator = jc as AdvancedJobCreator;
+
+  const [validating, setValidating] = useState(false);
+  const [step, setStep] = useState(STEP.PICK_DATA_VIEW);
+
+  const [currentDataViewTitle, setCurrentDataViewTitle] = useState<string>('');
+  const [newDataViewTitle, setNewDataViewTitle] = useState<string>('');
+  const [validationResponse, setValidationResponse] = useState<DatafeedValidationResponse | null>(
+    null
+  );
+
+  useEffect(function initialPageLoad() {
+    setCurrentDataViewTitle(jobCreator.indexPatternTitle);
+  }, []);
+
+  useEffect(
+    function stepChange() {
+      if (step === STEP.PICK_DATA_VIEW) {
+        setValidationResponse(null);
+      }
+    },
+    [step]
+  );
+
+  function onDataViewSelected(dataViewId: string) {
+    if (validating === false) {
+      setStep(STEP.VALIDATE);
+      validate(dataViewId);
+    }
+  }
+
+  const validate = useCallback(
+    async (dataViewId: string) => {
+      setValidating(true);
+
+      const { title } = await dataViews.get(dataViewId);
+      setNewDataViewTitle(title);
+
+      const indices = title.split(',');
+      if (jobCreator.detectors.length) {
+        const datafeed: Datafeed = { ...jobCreator.datafeedConfig, indices };
+        const resp = await validateDatafeedPreview({
+          job: {
+            ...jobCreator.jobConfig,
+            datafeed_config: datafeed,
+          } as CombinedJob,
+        });
+        setValidationResponse(resp);
+      }
+      setValidating(false);
+    },
+    [dataViews, validateDatafeedPreview, jobCreator]
+  );
+
+  const applyDataView = useCallback(() => {
+    const newIndices = newDataViewTitle.split(',');
+    jobCreator.indices = newIndices;
+    resetAdvancedJob(jobCreator, navigateToPath);
+  }, [jobCreator, newDataViewTitle, navigateToPath]);
+
+  return (
+    <>
+      <EuiModal onClose={onClose} data-test-subj="mlJobMgmtImportJobsFlyout">
+        <EuiModalHeader>
+          <EuiModalHeaderTitle>
+            <FormattedMessage
+              id="xpack.ml.newJob.wizard.datafeedStep.dataView.step0.title"
+              defaultMessage="Change index pattern"
+            />
+          </EuiModalHeaderTitle>
+        </EuiModalHeader>
+
+        <EuiModalBody>
+          {step === STEP.PICK_DATA_VIEW && (
+            <>
+              <FormattedMessage
+                id="xpack.ml.newJob.wizard.datafeedStep.dataView.step1.title"
+                defaultMessage="Select new index pattern for the job"
+              />
+
+              <EuiSpacer size="s" />
+
+              <SavedObjectFinderUi
+                key="searchSavedObjectFinder"
+                onChoose={onDataViewSelected}
+                showFilter
+                noItemsMessage={i18n.translate(
+                  'xpack.ml.newJob.wizard.datafeedStep.dataView.step1.noMatchingError',
+                  {
+                    defaultMessage: 'No matching indices or saved searches found.',
+                  }
+                )}
+                savedObjectMetaData={[
+                  {
+                    type: 'index-pattern',
+                    getIconForSavedObject: () => 'indexPatternApp',
+                    name: i18n.translate(
+                      'xpack.ml.newJob.wizard.datafeedStep.dataView.step1.dataView',
+                      {
+                        defaultMessage: 'Index pattern',
+                      }
+                    ),
+                  },
+                ]}
+                fixedPageSize={fixedPageSize}
+                uiSettings={uiSettings}
+                savedObjects={savedObjects}
+              />
+            </>
+          )}
+          {step === STEP.VALIDATE && (
+            <>
+              <FormattedMessage
+                id="xpack.ml.newJob.wizard.datafeedStep.dataView.step2.title"
+                defaultMessage="Changing {dv1} for {dv2}"
+                values={{ dv1: currentDataViewTitle, dv2: newDataViewTitle }}
+              />
+
+              <EuiSpacer size="s" />
+
+              {validating === true ? (
+                <>
+                  <EuiLoadingSpinner />
+                  <FormattedMessage
+                    id="xpack.ml.newJob.wizard.datafeedStep.dataView.step2.validatingText"
+                    defaultMessage="Checking index pattern and job compatibility"
+                  />
+                </>
+              ) : (
+                <ValidationMessage
+                  validationResponse={validationResponse}
+                  dataViewTitle={newDataViewTitle}
+                />
+              )}
+
+              <EuiSpacer size="s" />
+
+              <EuiFlexGroup justifyContent="spaceBetween">
+                <EuiFlexItem grow={false}>
+                  <EuiButtonEmpty
+                    onClick={setStep.bind(null, STEP.PICK_DATA_VIEW)}
+                    isDisabled={validating}
+                    flush="left"
+                  >
+                    <FormattedMessage
+                      id="xpack.ml.newJob.wizard.datafeedStep.dataView.step2.backButton"
+                      defaultMessage="Back"
+                    />
+                  </EuiButtonEmpty>
+                </EuiFlexItem>
+                <EuiFlexItem grow={false}>
+                  <EuiButton
+                    onClick={() => applyDataView()}
+                    isDisabled={validating}
+                    data-test-subj="mlJobsImportButton"
+                  >
+                    <FormattedMessage
+                      id="xpack.ml.newJob.wizard.datafeedStep.dataView.step2.ApplyButton"
+                      defaultMessage="Apply"
+                    />
+                  </EuiButton>
+                </EuiFlexItem>
+              </EuiFlexGroup>
+            </>
+          )}
+        </EuiModalBody>
+      </EuiModal>
+    </>
+  );
+};
+
+const ValidationMessage: FC<{
+  validationResponse: DatafeedValidationResponse | null;
+  dataViewTitle: string;
+}> = ({ validationResponse, dataViewTitle }) => {
+  if (validationResponse === null) {
+    return (
+      <EuiCallOut
+        title={i18n.translate(
+          'xpack.ml.newJob.wizard.datafeedStep.dataView.validation.noDetectors.title',
+          {
+            defaultMessage: 'Index pattern valid',
+          }
+        )}
+        color="primary"
+      >
+        <FormattedMessage
+          id="xpack.ml.newJob.wizard.datafeedStep.dataView.validation.noDetectors.message"
+          defaultMessage="No detectors have been configured; this index pattern can be applied to the job."
+        />
+      </EuiCallOut>
+    );
+  }
+  if (validationResponse.valid === true) {
+    if (validationResponse.documentsFound === true) {
+      return (
+        <EuiCallOut
+          title={i18n.translate(
+            'xpack.ml.newJob.wizard.datafeedStep.dataView.validation.valid.title',
+            {
+              defaultMessage: 'Index pattern valid',
+            }
+          )}
+          color="primary"
+        >
+          <FormattedMessage
+            id="xpack.ml.newJob.wizard.datafeedStep.dataView.validation.valid.message"
+            defaultMessage="This index pattern can be applied to this job."
+          />
+        </EuiCallOut>
+      );
+    } else {
+      return (
+        <EuiCallOut
+          title={i18n.translate(
+            'xpack.ml.newJob.wizard.datafeedStep.dataView.validation.possiblyInvalid.title',
+            {
+              defaultMessage: 'Index pattern possibly invalid',
+            }
+          )}
+          color="warning"
+        >
+          <FormattedMessage
+            id="xpack.ml.newJob.wizard.datafeedStep.dataView.validation.possiblyInvalid.message"
+            defaultMessage="This index pattern produced no results when previewing the datafeed. There may be no documents in {dataViewTitle}."
+            values={{ dataViewTitle }}
+          />
+        </EuiCallOut>
+      );
+    }
+  } else {
+    return (
+      <EuiCallOut
+        title={i18n.translate(
+          'xpack.ml.newJob.wizard.datafeedStep.dataView.validation.invalid.title',
+          {
+            defaultMessage: 'Index pattern invalid',
+          }
+        )}
+        color="danger"
+      >
+        <FormattedMessage
+          id="xpack.ml.newJob.wizard.datafeedStep.dataView.validation.invalid.message"
+          defaultMessage="This index pattern produced an error when attempting to preview the datafeed. The fields selected for this job might not exist in {dataViewTitle}."
+          values={{ dataViewTitle }}
+        />
+
+        <EuiSpacer size="s" />
+
+        <FormattedMessage
+          id="xpack.ml.newJob.wizard.datafeedStep.dataView.validation.invalid.reason"
+          defaultMessage="Reason:"
+        />
+
+        <EuiSpacer size="s" />
+
+        {validationResponse.error ? extractErrorMessage(validationResponse.error) : null}
+      </EuiCallOut>
+    );
+  }
+};
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view_button.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view_button.tsx
new file mode 100644
index 0000000000000..dc9af26236d8c
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view_button.tsx
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC, useState } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import { EuiButtonEmpty } from '@elastic/eui';
+import { Description } from './description';
+import { ChangeDataViewModal } from './change_data_view';
+
+export const ChangeDataView: FC<{ isDisabled: boolean }> = ({ isDisabled }) => {
+  const [showFlyout, setShowFlyout] = useState(false);
+
+  return (
+    <>
+      {showFlyout && <ChangeDataViewModal onClose={setShowFlyout.bind(null, false)} />}
+
+      <Description>
+        <EuiButtonEmpty
+          onClick={setShowFlyout.bind(null, true)}
+          isDisabled={isDisabled}
+          data-test-subj="mlJobsImportButton"
+        >
+          <FormattedMessage
+            id="xpack.ml.newJob.wizard.datafeedStep.dataView.changeDataView.button"
+            defaultMessage="Change index pattern"
+          />
+        </EuiButtonEmpty>
+      </Description>
+    </>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/description.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/description.tsx
new file mode 100644
index 0000000000000..2632660738a58
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/description.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { memo, FC } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiDescribedFormGroup, EuiFormRow } from '@elastic/eui';
+
+export const Description: FC = memo(({ children }) => {
+  const title = i18n.translate('xpack.ml.newJob.wizard.datafeedStep.dataView.title', {
+    defaultMessage: 'Index pattern',
+  });
+  return (
+    <EuiDescribedFormGroup
+      title={<h3>{title}</h3>}
+      description={
+        <FormattedMessage
+          id="xpack.ml.newJob.wizard.datafeedStep.dataView.description"
+          defaultMessage="The index pattern that is currently used for this job."
+        />
+      }
+    >
+      <EuiFormRow>
+        <>{children}</>
+      </EuiFormRow>
+    </EuiDescribedFormGroup>
+  );
+});
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/index.ts
new file mode 100644
index 0000000000000..ef7c451b4889c
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { ChangeDataView } from './change_data_view_button';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/datafeed.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/datafeed.tsx
index 77db2eb2419cd..47e488ab201ec 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/datafeed.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/datafeed.tsx
@@ -14,6 +14,7 @@ import { FrequencyInput } from './components/frequency';
 import { ScrollSizeInput } from './components/scroll_size';
 import { ResetQueryButton } from './components/reset_query';
 import { TimeField } from './components/time_field';
+import { ChangeDataView } from './components/data_view';
 import { WIZARD_STEPS, StepProps } from '../step_types';
 import { JobCreatorContext } from '../job_creator_context';
 import { JsonEditorFlyout, EDITOR_MODE } from '../common/json_editor_flyout';
@@ -46,6 +47,7 @@ export const DatafeedStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep }) =
               <FrequencyInput />
               <ScrollSizeInput />
               <TimeField />
+              <ChangeDataView isDisabled={false} />
             </EuiFlexItem>
           </EuiFlexGroup>
           <ResetQueryButton />
diff --git a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
index 883e5d499c3d4..720e54e386cbc 100644
--- a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
+++ b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
@@ -43,6 +43,7 @@ import type { FieldHistogramRequestConfig } from '../../datavisualizer/index_bas
 import type { DataRecognizerConfigResponse, Module } from '../../../../common/types/modules';
 import { getHttp } from '../../util/dependency_cache';
 import type { RuntimeMappings } from '../../../../common/types/fields';
+import type { DatafeedValidationResponse } from '../../../../common/types/job_validation';
 
 export interface MlInfoResponse {
   defaults: MlServerDefaults;
@@ -194,7 +195,7 @@ export function mlApiServicesProvider(httpService: HttpService) {
     },
 
     validateJob(payload: {
-      job: Job;
+      job: CombinedJob;
       duration: {
         start?: number;
         end?: number;
@@ -209,6 +210,15 @@ export function mlApiServicesProvider(httpService: HttpService) {
       });
     },
 
+    validateDatafeedPreview(payload: { job: CombinedJob }) {
+      const body = JSON.stringify(payload);
+      return httpService.http<DatafeedValidationResponse>({
+        path: `${basePath()}/validate/datafeed_preview`,
+        method: 'POST',
+        body,
+      });
+    },
+
     validateCardinality$(job: CombinedJob): Observable<CardinalityValidationResults> {
       const body = JSON.stringify(job);
       return httpService.http$({
diff --git a/x-pack/plugins/ml/server/lib/check_annotations/index.ts b/x-pack/plugins/ml/server/lib/check_annotations/index.ts
index a388a24d082a6..e64b4658588cb 100644
--- a/x-pack/plugins/ml/server/lib/check_annotations/index.ts
+++ b/x-pack/plugins/ml/server/lib/check_annotations/index.ts
@@ -11,22 +11,15 @@ import { mlLog } from '../../lib/log';
 import {
   ML_ANNOTATIONS_INDEX_ALIAS_READ,
   ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
-  ML_ANNOTATIONS_INDEX_PATTERN,
 } from '../../../common/constants/index_patterns';
 
 // Annotations Feature is available if:
-// - ML_ANNOTATIONS_INDEX_PATTERN index is present
 // - ML_ANNOTATIONS_INDEX_ALIAS_READ alias is present
 // - ML_ANNOTATIONS_INDEX_ALIAS_WRITE alias is present
+// Note there is no need to check for the existence of the indices themselves as aliases are stored
+// in the metadata of the indices they point to, so it's impossible to have an alias that doesn't point to any index.
 export async function isAnnotationsFeatureAvailable({ asInternalUser }: IScopedClusterClient) {
   try {
-    const indexParams = { index: ML_ANNOTATIONS_INDEX_PATTERN };
-
-    const { body: annotationsIndexExists } = await asInternalUser.indices.exists(indexParams);
-    if (!annotationsIndexExists) {
-      return false;
-    }
-
     const { body: annotationsReadAliasExists } = await asInternalUser.indices.existsAlias({
       index: ML_ANNOTATIONS_INDEX_ALIAS_READ,
       name: ML_ANNOTATIONS_INDEX_ALIAS_READ,
diff --git a/x-pack/plugins/ml/server/lib/node_utils.ts b/x-pack/plugins/ml/server/lib/node_utils.ts
index 82e5d7f469849..a13e44b307a7b 100644
--- a/x-pack/plugins/ml/server/lib/node_utils.ts
+++ b/x-pack/plugins/ml/server/lib/node_utils.ts
@@ -17,8 +17,8 @@ export async function getMlNodeCount(client: IScopedClusterClient): Promise<MlNo
   if (typeof body.nodes === 'object') {
     Object.keys(body.nodes).forEach((k) => {
       if (body.nodes[k].attributes !== undefined) {
-        const maxOpenJobs = +body.nodes[k].attributes['ml.max_open_jobs'];
-        if (maxOpenJobs !== null && maxOpenJobs > 0) {
+        const machineMemory = +body.nodes[k].attributes['ml.machine_memory'];
+        if (machineMemory !== null && machineMemory > 0) {
           count++;
         }
       }
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
index 725e0ac494944..975070e92a7ec 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
@@ -9,7 +9,6 @@ import getAnnotationsRequestMock from './__mocks__/get_annotations_request.json'
 import getAnnotationsResponseMock from './__mocks__/get_annotations_response.json';
 
 import { ANNOTATION_TYPE } from '../../../common/constants/annotations';
-import { ML_ANNOTATIONS_INDEX_ALIAS_WRITE } from '../../../common/constants/index_patterns';
 import { Annotation, isAnnotations } from '../../../common/types/annotations';
 
 import { DeleteParams, GetResponse, IndexAnnotationArgs } from './annotation';
@@ -42,7 +41,7 @@ describe('annotation_service', () => {
 
       const annotationMockId = 'mockId';
       const deleteParamsMock: DeleteParams = {
-        index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
+        index: '.ml-annotations-6',
         id: annotationMockId,
         refresh: 'wait_for',
       };
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
index c6ed72de18d05..5807d181cc566 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
@@ -71,6 +71,7 @@ export interface IndexParams {
   index: string;
   body: Annotation;
   refresh: boolean | 'wait_for' | undefined;
+  require_alias?: boolean;
   id?: string;
 }
 
@@ -99,6 +100,7 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
       index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
       body: annotation,
       refresh: 'wait_for',
+      require_alias: true,
     };
 
     if (typeof annotation._id !== 'undefined') {
@@ -407,14 +409,37 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
   }
 
   async function deleteAnnotation(id: string) {
-    const params: DeleteParams = {
-      index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
+    // Find the index the annotation is stored in.
+    const searchParams: estypes.SearchRequest = {
+      index: ML_ANNOTATIONS_INDEX_ALIAS_READ,
+      size: 1,
+      body: {
+        query: {
+          ids: {
+            values: [id],
+          },
+        },
+      },
+    };
+
+    const { body } = await asInternalUser.search(searchParams);
+    const totalCount =
+      typeof body.hits.total === 'number' ? body.hits.total : body.hits.total.value;
+
+    if (totalCount === 0) {
+      throw Boom.notFound(`Cannot find annotation with ID ${id}`);
+    }
+
+    const index = body.hits.hits[0]._index;
+
+    const deleteParams: DeleteParams = {
+      index,
       id,
       refresh: 'wait_for',
     };
 
-    const { body } = await asInternalUser.delete(params);
-    return body;
+    const { body: deleteResponse } = await asInternalUser.delete(deleteParams);
+    return deleteResponse;
   }
 
   return {
diff --git a/x-pack/plugins/ml/server/models/job_validation/index.ts b/x-pack/plugins/ml/server/models/job_validation/index.ts
index 92d3e7d613efc..a527b9dcf3d4b 100644
--- a/x-pack/plugins/ml/server/models/job_validation/index.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/index.ts
@@ -7,3 +7,7 @@
 
 export { validateJob } from './job_validation';
 export { validateCardinality } from './validate_cardinality';
+export {
+  validateDatafeedPreviewWithMessages,
+  validateDatafeedPreview,
+} from './validate_datafeed_preview';
diff --git a/x-pack/plugins/ml/server/models/job_validation/job_validation.ts b/x-pack/plugins/ml/server/models/job_validation/job_validation.ts
index 838f188455d44..4cd2d8a95ee79 100644
--- a/x-pack/plugins/ml/server/models/job_validation/job_validation.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/job_validation.ts
@@ -17,7 +17,7 @@ import { basicJobValidation, uniqWithIsEqual } from '../../../common/util/job_ut
 import { validateBucketSpan } from './validate_bucket_span';
 import { validateCardinality } from './validate_cardinality';
 import { validateInfluencers } from './validate_influencers';
-import { validateDatafeedPreview } from './validate_datafeed_preview';
+import { validateDatafeedPreviewWithMessages } from './validate_datafeed_preview';
 import { validateModelMemoryLimit } from './validate_model_memory_limit';
 import { validateTimeRange, isValidTimeField } from './validate_time_range';
 import { validateJobSchema } from '../../routes/schemas/job_validation_schema';
@@ -111,7 +111,9 @@ export async function validateJob(
         validationMessages.push({ id: 'missing_summary_count_field_name' });
       }
 
-      validationMessages.push(...(await validateDatafeedPreview(mlClient, authHeader, job)));
+      validationMessages.push(
+        ...(await validateDatafeedPreviewWithMessages(mlClient, authHeader, job))
+      );
     } else {
       validationMessages = basicValidation.messages;
       validationMessages.push({ id: 'skipped_extended_tests' });
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_datafeed_preview.ts b/x-pack/plugins/ml/server/models/job_validation/validate_datafeed_preview.ts
index 4ae94229a930b..0775de7ae0e13 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_datafeed_preview.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_datafeed_preview.ts
@@ -9,12 +9,25 @@ import type { MlClient } from '../../lib/ml_client';
 import type { AuthorizationHeader } from '../../lib/request_authorization';
 import type { CombinedJob } from '../../../common/types/anomaly_detection_jobs';
 import type { JobValidationMessage } from '../../../common/constants/messages';
+import type { DatafeedValidationResponse } from '../../../common/types/job_validation';
 
-export async function validateDatafeedPreview(
+export async function validateDatafeedPreviewWithMessages(
   mlClient: MlClient,
   authHeader: AuthorizationHeader,
   job: CombinedJob
 ): Promise<JobValidationMessage[]> {
+  const { valid, documentsFound } = await validateDatafeedPreview(mlClient, authHeader, job);
+  if (valid) {
+    return documentsFound ? [] : [{ id: 'datafeed_preview_no_documents' }];
+  }
+  return [{ id: 'datafeed_preview_failed' }];
+}
+
+export async function validateDatafeedPreview(
+  mlClient: MlClient,
+  authHeader: AuthorizationHeader,
+  job: CombinedJob
+): Promise<DatafeedValidationResponse> {
   const { datafeed_config: datafeed, ...tempJob } = job;
   try {
     const { body } = (await mlClient.previewDatafeed(
@@ -28,11 +41,15 @@ export async function validateDatafeedPreview(
       // previewDatafeed response type is incorrect
     )) as unknown as { body: unknown[] };
 
-    if (Array.isArray(body) === false || body.length === 0) {
-      return [{ id: 'datafeed_preview_no_documents' }];
-    }
-    return [];
+    return {
+      valid: true,
+      documentsFound: Array.isArray(body) && body.length > 0,
+    };
   } catch (error) {
-    return [{ id: 'datafeed_preview_failed' }];
+    return {
+      valid: false,
+      documentsFound: false,
+      error: error.body ?? error,
+    };
   }
 }
diff --git a/x-pack/plugins/ml/server/routes/apidoc.json b/x-pack/plugins/ml/server/routes/apidoc.json
index 7f53ebb92b68a..226b69e06b48a 100644
--- a/x-pack/plugins/ml/server/routes/apidoc.json
+++ b/x-pack/plugins/ml/server/routes/apidoc.json
@@ -123,11 +123,13 @@
     "GetJobAuditMessages",
     "GetAllJobAuditMessages",
     "ClearJobAuditMessages",
+    
     "JobValidation",
     "EstimateBucketSpan",
     "CalculateModelMemoryLimit",
     "ValidateCardinality",
     "ValidateJob",
+    "ValidateDataFeedPreview",
 
     "DatafeedService",
     "CreateDatafeed",
diff --git a/x-pack/plugins/ml/server/routes/job_validation.ts b/x-pack/plugins/ml/server/routes/job_validation.ts
index b75eab20e7bc0..bceb59fa33fc6 100644
--- a/x-pack/plugins/ml/server/routes/job_validation.ts
+++ b/x-pack/plugins/ml/server/routes/job_validation.ts
@@ -16,12 +16,18 @@ import {
   modelMemoryLimitSchema,
   validateCardinalitySchema,
   validateJobSchema,
+  validateDatafeedPreviewSchema,
 } from './schemas/job_validation_schema';
 import { estimateBucketSpanFactory } from '../models/bucket_span_estimator';
 import { calculateModelMemoryLimitProvider } from '../models/calculate_model_memory_limit';
-import { validateJob, validateCardinality } from '../models/job_validation';
+import {
+  validateJob,
+  validateCardinality,
+  validateDatafeedPreview,
+} from '../models/job_validation';
 import { getAuthorizationHeader } from '../lib/request_authorization';
 import type { MlClient } from '../lib/ml_client';
+import { CombinedJob } from '../../common/types/anomaly_detection_jobs';
 
 type CalculateModelMemoryLimitPayload = TypeOf<typeof modelMemoryLimitSchema>;
 
@@ -205,4 +211,40 @@ export function jobValidationRoutes({ router, mlLicense, routeGuard }: RouteInit
       }
     })
   );
+
+  /**
+   * @apiGroup DataFeedPreviewValidation
+   *
+   * @api {post} /api/ml/validate/datafeed_preview Validates datafeed preview
+   * @apiName ValidateDataFeedPreview
+   * @apiDescription Validates that the datafeed preview runs successfully and produces results
+   *
+   * @apiSchema (body) validateDatafeedPreviewSchema
+   */
+  router.post(
+    {
+      path: '/api/ml/validate/datafeed_preview',
+      validate: {
+        body: validateDatafeedPreviewSchema,
+      },
+      options: {
+        tags: ['access:ml:canCreateJob'],
+      },
+    },
+    routeGuard.fullLicenseAPIGuard(async ({ client, mlClient, request, response }) => {
+      try {
+        const resp = await validateDatafeedPreview(
+          mlClient,
+          getAuthorizationHeader(request),
+          request.body.job as CombinedJob
+        );
+
+        return response.ok({
+          body: resp,
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
 }
diff --git a/x-pack/plugins/ml/server/routes/schemas/job_validation_schema.ts b/x-pack/plugins/ml/server/routes/schemas/job_validation_schema.ts
index a83bbbff6cec9..a481713f67359 100644
--- a/x-pack/plugins/ml/server/routes/schemas/job_validation_schema.ts
+++ b/x-pack/plugins/ml/server/routes/schemas/job_validation_schema.ts
@@ -60,6 +60,13 @@ export const validateJobSchema = schema.object({
   }),
 });
 
+export const validateDatafeedPreviewSchema = schema.object({
+  job: schema.object({
+    ...anomalyDetectionJobSchema,
+    datafeed_config: datafeedConfigSchema,
+  }),
+});
+
 export const validateCardinalitySchema = schema.object({
   ...anomalyDetectionJobSchema,
   datafeed_config: datafeedConfigSchema,
diff --git a/x-pack/plugins/remote_clusters/common/constants.ts b/x-pack/plugins/remote_clusters/common/constants.ts
index b11292141672d..5a36924b26433 100644
--- a/x-pack/plugins/remote_clusters/common/constants.ts
+++ b/x-pack/plugins/remote_clusters/common/constants.ts
@@ -20,6 +20,8 @@ export const PLUGIN = {
   },
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const API_BASE_PATH = '/api/remote_clusters';
 
 export const SNIFF_MODE = 'sniff';
diff --git a/x-pack/plugins/remote_clusters/server/config.ts b/x-pack/plugins/remote_clusters/server/config.ts
index 8f379ec5613c8..5b4972f0a5259 100644
--- a/x-pack/plugins/remote_clusters/server/config.ts
+++ b/x-pack/plugins/remote_clusters/server/config.ts
@@ -4,23 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
-import { PluginConfigDescriptor } from 'kibana/server';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<RemoteClustersConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type RemoteClustersConfig = TypeOf<typeof schemaLatest>;
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
 
-export type ConfigType = TypeOf<typeof configSchema>;
+export type RemoteClustersConfig7x = TypeOf<typeof schema7x>;
 
-export const config: PluginConfigDescriptor<ConfigType> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
+const config7x: PluginConfigDescriptor<RemoteClustersConfig7x> = {
   exposeToBrowser: {
     ui: true,
   },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.remote_clusters.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.remote_clusters.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.remoteClusters.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.remote_clusters.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.remoteClusters.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Remote Clusters UI, use the "xpack.remote_clusters.ui.enabled" setting instead of "xpack.remote_clusters.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.remoteClusters.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.remoteClusters.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.remote_clusters.enabled" setting to "xpack.remote_clusters.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
 };
+
+export const config: PluginConfigDescriptor<RemoteClustersConfig | RemoteClustersConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/remote_clusters/server/plugin.ts b/x-pack/plugins/remote_clusters/server/plugin.ts
index b13773c27034a..fde71677b8448 100644
--- a/x-pack/plugins/remote_clusters/server/plugin.ts
+++ b/x-pack/plugins/remote_clusters/server/plugin.ts
@@ -11,7 +11,7 @@ import { CoreSetup, Logger, Plugin, PluginInitializerContext } from 'src/core/se
 
 import { PLUGIN } from '../common/constants';
 import { Dependencies, LicenseStatus, RouteDependencies } from './types';
-import { ConfigType } from './config';
+import { RemoteClustersConfig, RemoteClustersConfig7x } from './config';
 import {
   registerGetRoute,
   registerAddRoute,
@@ -30,7 +30,7 @@ export class RemoteClustersServerPlugin
 {
   licenseStatus: LicenseStatus;
   log: Logger;
-  config: ConfigType;
+  config: RemoteClustersConfig | RemoteClustersConfig7x;
 
   constructor({ logger, config }: PluginInitializerContext) {
     this.log = logger.get();
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
index 6c2989d54309d..77ad4fba1ab60 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
@@ -356,7 +356,7 @@ export class CsvGenerator {
 
         let table: Datatable | undefined;
         try {
-          table = tabifyDocs(results, index, { shallow: true });
+          table = tabifyDocs(results, index, { shallow: true, includeIgnoredValues: true });
         } catch (err) {
           this.logger.error(err);
         }
diff --git a/x-pack/plugins/rollup/common/index.ts b/x-pack/plugins/rollup/common/index.ts
index dffbfbd182092..c912a905d061d 100644
--- a/x-pack/plugins/rollup/common/index.ts
+++ b/x-pack/plugins/rollup/common/index.ts
@@ -14,6 +14,8 @@ export const PLUGIN = {
   minimumLicenseType: basicLicense,
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const CONFIG_ROLLUPS = 'rollups:enableIndexPatterns';
 
 export const API_BASE_PATH = '/api/rollup';
diff --git a/x-pack/plugins/rollup/public/index.ts b/x-pack/plugins/rollup/public/index.ts
index b70ce86493382..f740971b4bcb0 100644
--- a/x-pack/plugins/rollup/public/index.ts
+++ b/x-pack/plugins/rollup/public/index.ts
@@ -4,7 +4,8 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { PluginInitializerContext } from 'src/core/public';
 
 import { RollupPlugin } from './plugin';
 
-export const plugin = () => new RollupPlugin();
+export const plugin = (ctx: PluginInitializerContext) => new RollupPlugin(ctx);
diff --git a/x-pack/plugins/rollup/public/plugin.ts b/x-pack/plugins/rollup/public/plugin.ts
index 0d345e326193c..e458a13ee0e0e 100644
--- a/x-pack/plugins/rollup/public/plugin.ts
+++ b/x-pack/plugins/rollup/public/plugin.ts
@@ -6,7 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
+import { CoreSetup, CoreStart, Plugin, PluginInitializerContext } from 'kibana/public';
 import { rollupBadgeExtension, rollupToggleExtension } from './extend_index_management';
 // @ts-ignore
 import { RollupIndexPatternCreationConfig } from './index_pattern_creation/rollup_index_pattern_creation_config';
@@ -23,6 +23,7 @@ import { IndexManagementPluginSetup } from '../../index_management/public';
 import { setHttp, init as initDocumentation } from './crud_app/services/index';
 import { setNotifications, setFatalErrors, setUiStatsReporter } from './kibana_services';
 import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/public';
+import { ClientConfigType } from './types';
 
 export interface RollupPluginSetupDependencies {
   home?: HomePublicPluginSetup;
@@ -32,10 +33,16 @@ export interface RollupPluginSetupDependencies {
 }
 
 export class RollupPlugin implements Plugin {
+  constructor(private ctx: PluginInitializerContext) {}
+
   setup(
     core: CoreSetup,
     { home, management, indexManagement, usageCollection }: RollupPluginSetupDependencies
   ) {
+    const {
+      ui: { enabled: isRollupUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
+
     setFatalErrors(core.fatalErrors);
     if (usageCollection) {
       setUiStatsReporter(usageCollection.reportUiCounter.bind(usageCollection, UIM_APP_NAME));
@@ -46,7 +53,7 @@ export class RollupPlugin implements Plugin {
       indexManagement.extensionsService.addToggle(rollupToggleExtension);
     }
 
-    if (home) {
+    if (home && isRollupUiEnabled) {
       home.featureCatalogue.register({
         id: 'rollup_jobs',
         title: 'Rollups',
@@ -61,33 +68,35 @@ export class RollupPlugin implements Plugin {
       });
     }
 
-    const pluginName = i18n.translate('xpack.rollupJobs.appTitle', {
-      defaultMessage: 'Rollup Jobs',
-    });
+    if (isRollupUiEnabled) {
+      const pluginName = i18n.translate('xpack.rollupJobs.appTitle', {
+        defaultMessage: 'Rollup Jobs',
+      });
 
-    management.sections.section.data.registerApp({
-      id: 'rollup_jobs',
-      title: pluginName,
-      order: 4,
-      async mount(params) {
-        const [coreStart] = await core.getStartServices();
+      management.sections.section.data.registerApp({
+        id: 'rollup_jobs',
+        title: pluginName,
+        order: 4,
+        async mount(params) {
+          const [coreStart] = await core.getStartServices();
 
-        const {
-          chrome: { docTitle },
-        } = coreStart;
+          const {
+            chrome: { docTitle },
+          } = coreStart;
 
-        docTitle.change(pluginName);
-        params.setBreadcrumbs([{ text: pluginName }]);
+          docTitle.change(pluginName);
+          params.setBreadcrumbs([{ text: pluginName }]);
 
-        const { renderApp } = await import('./application');
-        const unmountAppCallback = await renderApp(core, params);
+          const { renderApp } = await import('./application');
+          const unmountAppCallback = await renderApp(core, params);
 
-        return () => {
-          docTitle.reset();
-          unmountAppCallback();
-        };
-      },
-    });
+          return () => {
+            docTitle.reset();
+            unmountAppCallback();
+          };
+        },
+      });
+    }
   }
 
   start(core: CoreStart) {
diff --git a/x-pack/plugins/rollup/public/types.ts b/x-pack/plugins/rollup/public/types.ts
new file mode 100644
index 0000000000000..dc5e55e9268f8
--- /dev/null
+++ b/x-pack/plugins/rollup/public/types.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export interface ClientConfigType {
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/x-pack/plugins/rollup/server/config.ts b/x-pack/plugins/rollup/server/config.ts
index d20b317422107..c0cca4bbb4d33 100644
--- a/x-pack/plugins/rollup/server/config.ts
+++ b/x-pack/plugins/rollup/server/config.ts
@@ -4,11 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<RollupConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type RollupConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
+    enabled: schema.boolean({ defaultValue: true }),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type RollupConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<RollupConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.rollup.enabled') === undefined) {
+        return completeConfig;
+      }
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-});
+      addDeprecation({
+        configPath: 'xpack.rollup.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.rollupJobs.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.rollup.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.rollupJobs.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Rollup Jobs UI, use the "xpack.rollup.ui.enabled" setting instead of "xpack.rollup.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.rollupJobs.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.rollupJobs.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.rollup.enabled" setting to "xpack.rollup.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type RollupConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<RollupConfig | RollupConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/rollup/server/index.ts b/x-pack/plugins/rollup/server/index.ts
index e77e0e6f15d72..6ae1d9f24b8b9 100644
--- a/x-pack/plugins/rollup/server/index.ts
+++ b/x-pack/plugins/rollup/server/index.ts
@@ -5,14 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 import { RollupPlugin } from './plugin';
-import { configSchema, RollupConfig } from './config';
+
+export { config } from './config';
 
 export const plugin = (pluginInitializerContext: PluginInitializerContext) =>
   new RollupPlugin(pluginInitializerContext);
-
-export const config: PluginConfigDescriptor<RollupConfig> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
-};
diff --git a/x-pack/plugins/security/server/authorization/check_privileges.test.ts b/x-pack/plugins/security/server/authorization/check_privileges.test.ts
index 75c8229bb37d6..d8906d91f152b 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges.test.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges.test.ts
@@ -878,6 +878,42 @@ describe('#atSpace', () => {
       `);
     });
   });
+
+  test('omits login privilege when requireLoginAction: false', async () => {
+    const { mockClusterClient, mockScopedClusterClient } = createMockClusterClient({
+      has_all_requested: true,
+      username: 'foo-username',
+      index: {},
+      application: {
+        [application]: {
+          'space:space_1': {
+            [mockActions.version]: true,
+          },
+        },
+      },
+    });
+    const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
+      mockActions,
+      () => Promise.resolve(mockClusterClient),
+      application
+    );
+    const request = httpServerMock.createKibanaRequest();
+    const checkPrivileges = checkPrivilegesWithRequest(request);
+    await checkPrivileges.atSpace('space_1', {}, { requireLoginAction: false });
+
+    expect(mockScopedClusterClient.asCurrentUser.security.hasPrivileges).toHaveBeenCalledWith({
+      body: {
+        index: [],
+        application: [
+          {
+            application,
+            resources: [`space:space_1`],
+            privileges: [mockActions.version],
+          },
+        ],
+      },
+    });
+  });
 });
 
 describe('#atSpaces', () => {
@@ -2083,6 +2119,42 @@ describe('#atSpaces', () => {
       `);
     });
   });
+
+  test('omits login privilege when requireLoginAction: false', async () => {
+    const { mockClusterClient, mockScopedClusterClient } = createMockClusterClient({
+      has_all_requested: true,
+      username: 'foo-username',
+      index: {},
+      application: {
+        [application]: {
+          'space:space_1': {
+            [mockActions.version]: true,
+          },
+        },
+      },
+    });
+    const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
+      mockActions,
+      () => Promise.resolve(mockClusterClient),
+      application
+    );
+    const request = httpServerMock.createKibanaRequest();
+    const checkPrivileges = checkPrivilegesWithRequest(request);
+    await checkPrivileges.atSpaces(['space_1'], {}, { requireLoginAction: false });
+
+    expect(mockScopedClusterClient.asCurrentUser.security.hasPrivileges).toHaveBeenCalledWith({
+      body: {
+        index: [],
+        application: [
+          {
+            application,
+            resources: [`space:space_1`],
+            privileges: [mockActions.version],
+          },
+        ],
+      },
+    });
+  });
 });
 
 describe('#globally', () => {
@@ -2937,4 +3009,40 @@ describe('#globally', () => {
       `);
     });
   });
+
+  test('omits login privilege when requireLoginAction: false', async () => {
+    const { mockClusterClient, mockScopedClusterClient } = createMockClusterClient({
+      has_all_requested: true,
+      username: 'foo-username',
+      index: {},
+      application: {
+        [application]: {
+          [GLOBAL_RESOURCE]: {
+            [mockActions.version]: true,
+          },
+        },
+      },
+    });
+    const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
+      mockActions,
+      () => Promise.resolve(mockClusterClient),
+      application
+    );
+    const request = httpServerMock.createKibanaRequest();
+    const checkPrivileges = checkPrivilegesWithRequest(request);
+    await checkPrivileges.globally({}, { requireLoginAction: false });
+
+    expect(mockScopedClusterClient.asCurrentUser.security.hasPrivileges).toHaveBeenCalledWith({
+      body: {
+        index: [],
+        application: [
+          {
+            application,
+            resources: [GLOBAL_RESOURCE],
+            privileges: [mockActions.version],
+          },
+        ],
+      },
+    });
+  });
 });
diff --git a/x-pack/plugins/security/server/authorization/check_privileges.ts b/x-pack/plugins/security/server/authorization/check_privileges.ts
index 3a35cf164ad85..36c364f1ff7da 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges.ts
@@ -13,6 +13,7 @@ import { GLOBAL_RESOURCE } from '../../common/constants';
 import { ResourceSerializer } from './resource_serializer';
 import type {
   CheckPrivileges,
+  CheckPrivilegesOptions,
   CheckPrivilegesPayload,
   CheckPrivilegesResponse,
   HasPrivilegesResponse,
@@ -41,14 +42,20 @@ export function checkPrivilegesWithRequestFactory(
   return function checkPrivilegesWithRequest(request: KibanaRequest): CheckPrivileges {
     const checkPrivilegesAtResources = async (
       resources: string[],
-      privileges: CheckPrivilegesPayload
+      privileges: CheckPrivilegesPayload,
+      { requireLoginAction = true }: CheckPrivilegesOptions = {}
     ): Promise<CheckPrivilegesResponse> => {
       const kibanaPrivileges = Array.isArray(privileges.kibana)
         ? privileges.kibana
         : privileges.kibana
         ? [privileges.kibana]
         : [];
-      const allApplicationPrivileges = uniq([actions.version, actions.login, ...kibanaPrivileges]);
+
+      const allApplicationPrivileges = uniq([
+        actions.version,
+        ...(requireLoginAction ? [actions.login] : []),
+        ...kibanaPrivileges,
+      ]);
 
       const clusterClient = await getClusterClient();
       const { body } = await clusterClient.asScoped(request).asCurrentUser.security.hasPrivileges({
@@ -135,18 +142,26 @@ export function checkPrivilegesWithRequestFactory(
     };
 
     return {
-      async atSpace(spaceId: string, privileges: CheckPrivilegesPayload) {
+      async atSpace(
+        spaceId: string,
+        privileges: CheckPrivilegesPayload,
+        options?: CheckPrivilegesOptions
+      ) {
         const spaceResource = ResourceSerializer.serializeSpaceResource(spaceId);
-        return await checkPrivilegesAtResources([spaceResource], privileges);
+        return await checkPrivilegesAtResources([spaceResource], privileges, options);
       },
-      async atSpaces(spaceIds: string[], privileges: CheckPrivilegesPayload) {
+      async atSpaces(
+        spaceIds: string[],
+        privileges: CheckPrivilegesPayload,
+        options?: CheckPrivilegesOptions
+      ) {
         const spaceResources = spaceIds.map((spaceId) =>
           ResourceSerializer.serializeSpaceResource(spaceId)
         );
-        return await checkPrivilegesAtResources(spaceResources, privileges);
+        return await checkPrivilegesAtResources(spaceResources, privileges, options);
       },
-      async globally(privileges: CheckPrivilegesPayload) {
-        return await checkPrivilegesAtResources([GLOBAL_RESOURCE], privileges);
+      async globally(privileges: CheckPrivilegesPayload, options?: CheckPrivilegesOptions) {
+        return await checkPrivilegesAtResources([GLOBAL_RESOURCE], privileges, options);
       },
     };
   };
diff --git a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts
index 547782bbd1ba1..9fd14c6d29806 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts
@@ -8,6 +8,7 @@
 import { httpServerMock } from 'src/core/server/mocks';
 
 import { checkPrivilegesDynamicallyWithRequestFactory } from './check_privileges_dynamically';
+import type { CheckPrivilegesOptions } from './types';
 
 test(`checkPrivileges.atSpace when spaces is enabled`, async () => {
   const expectedResult = Symbol();
@@ -25,13 +26,18 @@ test(`checkPrivileges.atSpace when spaces is enabled`, async () => {
       namespaceToSpaceId: jest.fn(),
     })
   )(request);
-  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges });
+  const options: CheckPrivilegesOptions = { requireLoginAction: true };
+  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges }, options);
 
   expect(result).toBe(expectedResult);
   expect(mockCheckPrivilegesWithRequest).toHaveBeenCalledWith(request);
-  expect(mockCheckPrivileges.atSpace).toHaveBeenCalledWith(spaceId, {
-    kibana: privilegeOrPrivileges,
-  });
+  expect(mockCheckPrivileges.atSpace).toHaveBeenCalledWith(
+    spaceId,
+    {
+      kibana: privilegeOrPrivileges,
+    },
+    options
+  );
 });
 
 test(`checkPrivileges.globally when spaces is disabled`, async () => {
@@ -46,9 +52,13 @@ test(`checkPrivileges.globally when spaces is disabled`, async () => {
     mockCheckPrivilegesWithRequest,
     () => undefined
   )(request);
-  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges });
+  const options: CheckPrivilegesOptions = { requireLoginAction: true };
+  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges }, options);
 
   expect(result).toBe(expectedResult);
   expect(mockCheckPrivilegesWithRequest).toHaveBeenCalledWith(request);
-  expect(mockCheckPrivileges.globally).toHaveBeenCalledWith({ kibana: privilegeOrPrivileges });
+  expect(mockCheckPrivileges.globally).toHaveBeenCalledWith(
+    { kibana: privilegeOrPrivileges },
+    options
+  );
 });
diff --git a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts
index 4ce59c8706270..d4e335ba04058 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts
@@ -9,13 +9,15 @@ import type { KibanaRequest } from 'src/core/server';
 
 import type { SpacesService } from '../plugin';
 import type {
+  CheckPrivilegesOptions,
   CheckPrivilegesPayload,
   CheckPrivilegesResponse,
   CheckPrivilegesWithRequest,
 } from './types';
 
 export type CheckPrivilegesDynamically = (
-  privileges: CheckPrivilegesPayload
+  privileges: CheckPrivilegesPayload,
+  options?: CheckPrivilegesOptions
 ) => Promise<CheckPrivilegesResponse>;
 
 export type CheckPrivilegesDynamicallyWithRequest = (
@@ -28,11 +30,15 @@ export function checkPrivilegesDynamicallyWithRequestFactory(
 ): CheckPrivilegesDynamicallyWithRequest {
   return function checkPrivilegesDynamicallyWithRequest(request: KibanaRequest) {
     const checkPrivileges = checkPrivilegesWithRequest(request);
-    return async function checkPrivilegesDynamically(privileges: CheckPrivilegesPayload) {
+
+    return async function checkPrivilegesDynamically(
+      privileges: CheckPrivilegesPayload,
+      options?: CheckPrivilegesOptions
+    ) {
       const spacesService = getSpacesService();
       return spacesService
-        ? await checkPrivileges.atSpace(spacesService.getSpaceId(request), privileges)
-        : await checkPrivileges.globally(privileges);
+        ? await checkPrivileges.atSpace(spacesService.getSpaceId(request), privileges, options)
+        : await checkPrivileges.globally(privileges, options);
     };
   };
 }
diff --git a/x-pack/plugins/security/server/authorization/types.ts b/x-pack/plugins/security/server/authorization/types.ts
index 8bfe892840637..aee059fb8becb 100644
--- a/x-pack/plugins/security/server/authorization/types.ts
+++ b/x-pack/plugins/security/server/authorization/types.ts
@@ -29,6 +29,18 @@ export interface HasPrivilegesResponse {
   };
 }
 
+/**
+ * Options to influce the privilege checks.
+ */
+export interface CheckPrivilegesOptions {
+  /**
+   * Whether or not the `login` action should be required (default: true).
+   * Setting this to false is not advised except for special circumstances, when you do not require
+   * the request to belong to a user capable of logging into Kibana.
+   */
+  requireLoginAction?: boolean;
+}
+
 export interface CheckPrivilegesResponse {
   hasAllRequested: boolean;
   username: string;
@@ -59,12 +71,20 @@ export interface CheckPrivilegesResponse {
 export type CheckPrivilegesWithRequest = (request: KibanaRequest) => CheckPrivileges;
 
 export interface CheckPrivileges {
-  atSpace(spaceId: string, privileges: CheckPrivilegesPayload): Promise<CheckPrivilegesResponse>;
+  atSpace(
+    spaceId: string,
+    privileges: CheckPrivilegesPayload,
+    options?: CheckPrivilegesOptions
+  ): Promise<CheckPrivilegesResponse>;
   atSpaces(
     spaceIds: string[],
-    privileges: CheckPrivilegesPayload
+    privileges: CheckPrivilegesPayload,
+    options?: CheckPrivilegesOptions
+  ): Promise<CheckPrivilegesResponse>;
+  globally(
+    privileges: CheckPrivilegesPayload,
+    options?: CheckPrivilegesOptions
   ): Promise<CheckPrivilegesResponse>;
-  globally(privileges: CheckPrivilegesPayload): Promise<CheckPrivilegesResponse>;
 }
 
 export interface CheckPrivilegesPayload {
diff --git a/x-pack/plugins/security/server/config.test.ts b/x-pack/plugins/security/server/config.test.ts
index 1baf3fd4aac50..4034a7a79e6dd 100644
--- a/x-pack/plugins/security/server/config.test.ts
+++ b/x-pack/plugins/security/server/config.test.ts
@@ -63,7 +63,7 @@ describe('config schema', () => {
         "secureCookies": false,
         "session": Object {
           "cleanupInterval": "PT1H",
-          "idleTimeout": "PT1H",
+          "idleTimeout": "PT8H",
           "lifespan": "P30D",
         },
         "showInsecureClusterWarning": true,
@@ -117,7 +117,7 @@ describe('config schema', () => {
         "secureCookies": false,
         "session": Object {
           "cleanupInterval": "PT1H",
-          "idleTimeout": "PT1H",
+          "idleTimeout": "PT8H",
           "lifespan": "P30D",
         },
         "showInsecureClusterWarning": true,
@@ -170,7 +170,7 @@ describe('config schema', () => {
         "secureCookies": false,
         "session": Object {
           "cleanupInterval": "PT1H",
-          "idleTimeout": "PT1H",
+          "idleTimeout": "PT8H",
           "lifespan": "P30D",
         },
         "showInsecureClusterWarning": true,
@@ -1768,7 +1768,7 @@ describe('createConfig()', () => {
       expect(createMockConfig().session.getExpirationTimeouts({ type: 'basic', name: 'basic1' }))
         .toMatchInlineSnapshot(`
         Object {
-          "idleTimeout": "PT1H",
+          "idleTimeout": "PT8H",
           "lifespan": "P30D",
         }
       `);
@@ -1818,7 +1818,7 @@ describe('createConfig()', () => {
         })
       ).toMatchInlineSnapshot(`
         Object {
-          "idleTimeout": "PT1H",
+          "idleTimeout": "PT8H",
           "lifespan": "PT0.456S",
         }
       `);
@@ -1852,7 +1852,7 @@ describe('createConfig()', () => {
           createMockConfig({ session: { lifespan: 456 } }).session.getExpirationTimeouts(provider)
         ).toMatchInlineSnapshot(`
           Object {
-            "idleTimeout": "PT1H",
+            "idleTimeout": "PT8H",
             "lifespan": "PT0.456S",
           }
         `);
@@ -1933,14 +1933,14 @@ describe('createConfig()', () => {
       expect(configWithoutGlobal.session.getExpirationTimeouts({ type: 'basic', name: 'basic1' }))
         .toMatchInlineSnapshot(`
         Object {
-          "idleTimeout": "PT1H",
+          "idleTimeout": "PT8H",
           "lifespan": "PT0.654S",
         }
       `);
       expect(configWithoutGlobal.session.getExpirationTimeouts({ type: 'saml', name: 'saml1' }))
         .toMatchInlineSnapshot(`
         Object {
-          "idleTimeout": "PT1H",
+          "idleTimeout": "PT8H",
           "lifespan": "PT11M5.544S",
         }
       `);
@@ -1957,7 +1957,7 @@ describe('createConfig()', () => {
       expect(configWithGlobal.session.getExpirationTimeouts({ type: 'basic', name: 'basic1' }))
         .toMatchInlineSnapshot(`
         Object {
-          "idleTimeout": "PT1H",
+          "idleTimeout": "PT8H",
           "lifespan": "PT0.654S",
         }
       `);
diff --git a/x-pack/plugins/security/server/config.ts b/x-pack/plugins/security/server/config.ts
index 89918e73369d3..23a1fd2efa382 100644
--- a/x-pack/plugins/security/server/config.ts
+++ b/x-pack/plugins/security/server/config.ts
@@ -211,7 +211,7 @@ export const ConfigSchema = schema.object({
   ),
   session: schema.object({
     idleTimeout: schema.oneOf([schema.duration(), schema.literal(null)], {
-      defaultValue: schema.duration().validate('1h'),
+      defaultValue: schema.duration().validate('8h'),
     }),
     lifespan: schema.oneOf([schema.duration(), schema.literal(null)], {
       defaultValue: schema.duration().validate('30d'),
diff --git a/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts b/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts
index 83f09ef017b01..3a53a2422770c 100644
--- a/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts
+++ b/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts
@@ -47,7 +47,7 @@ describe('Security UsageCollector', () => {
     enabledAuthProviders: ['basic'],
     loginSelectorEnabled: false,
     httpAuthSchemes: ['apikey', 'bearer'],
-    sessionIdleTimeoutInMinutes: 60,
+    sessionIdleTimeoutInMinutes: 480,
     sessionLifespanInMinutes: 43200,
     sessionCleanupInMinutes: 60,
   };
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 5a7e19e2cdd05..442718e0975ee 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { ENABLE_ITOM } from '../../actions/server/constants/connectors';
 import type { TransformConfigSchema } from './transforms/types';
 import { ENABLE_CASE_CONNECTOR } from '../../cases/common';
 import { METADATA_TRANSFORMS_PATTERN } from './endpoint/constants';
@@ -296,21 +298,27 @@ export const ML_GROUP_IDS = [ML_GROUP_ID, LEGACY_ML_GROUP_ID];
 */
 export const NOTIFICATION_SUPPORTED_ACTION_TYPES_IDS = [
   '.email',
-  '.slack',
+  '.index',
+  '.jira',
   '.pagerduty',
-  '.swimlane',
-  '.webhook',
+  '.resilient',
   '.servicenow',
   '.servicenow-sir',
-  '.jira',
-  '.resilient',
+  '.slack',
+  '.swimlane',
   '.teams',
+  '.webhook',
 ];
 
 if (ENABLE_CASE_CONNECTOR) {
   NOTIFICATION_SUPPORTED_ACTION_TYPES_IDS.push('.case');
 }
 
+// TODO: Remove when ITOM is ready
+if (ENABLE_ITOM) {
+  NOTIFICATION_SUPPORTED_ACTION_TYPES_IDS.push('.servicenow-itom');
+}
+
 export const NOTIFICATION_THROTTLE_NO_ACTIONS = 'no_actions';
 export const NOTIFICATION_THROTTLE_RULE = 'rule';
 
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
index 674114188632b..7b792f8d560f1 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import { ALERT_FLYOUT, CELL_TEXT, JSON_LINES, TABLE_ROWS } from '../../screens/alerts_details';
+import { ALERT_FLYOUT, CELL_TEXT, JSON_TEXT, TABLE_ROWS } from '../../screens/alerts_details';
 
 import {
   expandFirstAlert,
   waitForAlertsIndexToBeCreated,
   waitForAlertsPanelToBeLoaded,
 } from '../../tasks/alerts';
-import { openJsonView, openTable, scrollJsonViewToBottom } from '../../tasks/alerts_details';
+import { openJsonView, openTable } from '../../tasks/alerts_details';
 import { createCustomRuleActivated } from '../../tasks/api_calls/rules';
 import { cleanKibana } from '../../tasks/common';
 import { esArchiverLoad } from '../../tasks/es_archiver';
@@ -36,20 +36,14 @@ describe('Alert details with unmapped fields', () => {
   });
 
   it('Displays the unmapped field on the JSON view', () => {
-    const expectedUnmappedField = { line: 2, text: '  "unmapped": "This is the unmapped field"' };
+    const expectedUnmappedValue = 'This is the unmapped field';
 
     openJsonView();
-    scrollJsonViewToBottom();
 
-    cy.get(ALERT_FLYOUT)
-      .find(JSON_LINES)
-      .then((elements) => {
-        const length = elements.length;
-        cy.wrap(elements)
-          .eq(length - expectedUnmappedField.line)
-          .invoke('text')
-          .should('include', expectedUnmappedField.text);
-      });
+    cy.get(JSON_TEXT).then((x) => {
+      const parsed = JSON.parse(x.text());
+      expect(parsed._source.unmapped).to.equal(expectedUnmappedValue);
+    });
   });
 
   it('Displays the unmapped field on the table', () => {
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
index b3c6abcd8e426..f15e7adbbca44 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
@@ -10,7 +10,7 @@ import { cleanKibana, reload } from '../../tasks/common';
 import { esArchiverLoad, esArchiverUnload } from '../../tasks/es_archiver';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import {
-  JSON_LINES,
+  JSON_TEXT,
   TABLE_CELL,
   TABLE_ROWS,
   THREAT_DETAILS_VIEW,
@@ -28,11 +28,7 @@ import {
   viewThreatIntelTab,
 } from '../../tasks/alerts';
 import { createCustomIndicatorRule } from '../../tasks/api_calls/rules';
-import {
-  openJsonView,
-  openThreatIndicatorDetails,
-  scrollJsonViewToBottom,
-} from '../../tasks/alerts_details';
+import { openJsonView, openThreatIndicatorDetails } from '../../tasks/alerts_details';
 
 import { ALERTS_URL } from '../../urls/navigation';
 import { addsFieldsToTimeline } from '../../tasks/rule_details';
@@ -76,26 +72,39 @@ describe('CTI Enrichment', () => {
 
   it('Displays persisted enrichments on the JSON view', () => {
     const expectedEnrichment = [
-      { line: 4, text: '  "threat": {' },
       {
-        line: 3,
-        text: '    "enrichments": "{\\"indicator\\":{\\"first_seen\\":\\"2021-03-10T08:02:14.000Z\\",\\"file\\":{\\"size\\":80280,\\"pe\\":{},\\"type\\":\\"elf\\",\\"hash\\":{\\"sha256\\":\\"a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3\\",\\"tlsh\\":\\"6D7312E017B517CC1371A8353BED205E9128223972AE35302E97528DF957703BAB2DBE\\",\\"ssdeep\\":\\"1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL\\",\\"md5\\":\\"9b6c3518a91d23ed77504b5416bfb5b3\\"}},\\"type\\":\\"file\\"},\\"matched\\":{\\"atomic\\":\\"a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3\\",\\"field\\":\\"myhash.mysha256\\",\\"id\\":\\"84cf452c1e0375c3d4412cb550bd1783358468a3b3b777da4829d72c7d6fb74f\\",\\"index\\":\\"logs-ti_abusech.malware\\",\\"type\\":\\"indicator_match_rule\\"}}"',
+        indicator: {
+          first_seen: '2021-03-10T08:02:14.000Z',
+          file: {
+            size: 80280,
+            pe: {},
+            type: 'elf',
+            hash: {
+              sha256: 'a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3',
+              tlsh: '6D7312E017B517CC1371A8353BED205E9128223972AE35302E97528DF957703BAB2DBE',
+              ssdeep:
+                '1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL',
+              md5: '9b6c3518a91d23ed77504b5416bfb5b3',
+            },
+          },
+          type: 'file',
+        },
+        matched: {
+          atomic: 'a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3',
+          field: 'myhash.mysha256',
+          id: '84cf452c1e0375c3d4412cb550bd1783358468a3b3b777da4829d72c7d6fb74f',
+          index: 'logs-ti_abusech.malware',
+          type: 'indicator_match_rule',
+        },
       },
-      { line: 2, text: '  }' },
     ];
 
     expandFirstAlert();
     openJsonView();
-    scrollJsonViewToBottom();
-
-    cy.get(JSON_LINES).then((elements) => {
-      const length = elements.length;
-      expectedEnrichment.forEach((enrichment) => {
-        cy.wrap(elements)
-          .eq(length - enrichment.line)
-          .invoke('text')
-          .should('include', enrichment.text);
-      });
+
+    cy.get(JSON_TEXT).then((x) => {
+      const parsed = JSON.parse(x.text());
+      expect(parsed._source.threat.enrichments).to.deep.equal(expectedEnrichment);
     });
   });
 
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
index c740a669d059a..584fba05452f0 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
@@ -28,6 +28,8 @@ export const JSON_LINES = '.euiCodeBlock__line';
 
 export const JSON_VIEW_TAB = '[data-test-subj="jsonViewTab"]';
 
+export const JSON_TEXT = '[data-test-subj="jsonView"]';
+
 export const TABLE_CELL = '.euiTableRowCell';
 
 export const TABLE_TAB = '[data-test-subj="tableTab"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/timeline.ts b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
index 2e412bbed6fdc..bc3a4282df1c9 100644
--- a/x-pack/plugins/security_solution/cypress/screens/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
@@ -28,6 +28,8 @@ export const CLOSE_TIMELINE_BTN = '[data-test-subj="close-timeline"]';
 
 export const COMBO_BOX = '.euiComboBoxOption__content';
 
+export const COMBO_BOX_INPUT = '[data-test-subj="comboBoxInput"]';
+
 export const CREATE_NEW_TIMELINE = '[data-test-subj="timeline-new"]';
 
 export const CREATE_NEW_TIMELINE_TEMPLATE = '[data-test-subj="template-timeline-new"]';
diff --git a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
index 4c6b73de80940..c7cb56c89e9df 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
@@ -20,6 +20,7 @@ import {
   CASE,
   CLOSE_TIMELINE_BTN,
   COMBO_BOX,
+  COMBO_BOX_INPUT,
   CREATE_NEW_TIMELINE,
   FIELD_BROWSER,
   ID_HEADER_FIELD,
@@ -164,9 +165,12 @@ export const addDataProvider = (filter: TimelineFilter): Cypress.Chainable<JQuer
   cy.get(TIMELINE_ADD_FIELD_BUTTON).click();
   cy.get(TIMELINE_DATA_PROVIDER_VALUE).should('have.focus'); // make sure the focus is ready before start typing
 
-  cy.get(TIMELINE_DATA_PROVIDER_FIELD).type(`${filter.field}{downarrow}{enter}`);
-  cy.get(TIMELINE_DATA_PROVIDER_OPERATOR).type(filter.operator);
-  cy.get(COMBO_BOX).contains(filter.operator).click();
+  cy.get(TIMELINE_DATA_PROVIDER_FIELD)
+    .find(COMBO_BOX_INPUT)
+    .type(`${filter.field}{downarrow}{enter}`);
+  cy.get(TIMELINE_DATA_PROVIDER_OPERATOR)
+    .find(COMBO_BOX_INPUT)
+    .type(`${filter.operator}{downarrow}{enter}`);
   if (filter.operator !== 'exists') {
     cy.get(TIMELINE_DATA_PROVIDER_VALUE).type(`${filter.value}{enter}`);
   }
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
index d367c68586be1..772badd80ce53 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
@@ -86,7 +86,6 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
             class="euiTableHeaderCell"
             data-test-subj="tableHeaderCell_title_0"
             role="columnheader"
-            scope="col"
             style="width: 220px;"
           >
             <span
@@ -101,7 +100,6 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
             class="euiTableHeaderCell"
             data-test-subj="tableHeaderCell_description_1"
             role="columnheader"
-            scope="col"
           >
             <span
               class="euiTableCellContent"
@@ -138,12 +136,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.status"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  open
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    open
+                  </div>
                 </div>
               </div>
               <div
@@ -204,10 +207,11 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-@timestamp"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor eui-textTruncate eui-alignMiddle"
@@ -274,12 +278,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  xxx
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    xxx
+                  </div>
                 </div>
               </div>
               <div
@@ -340,12 +349,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.severity"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  low
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    low
+                  </div>
                 </div>
               </div>
               <div
@@ -406,12 +420,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.risk_score"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  21
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    21
+                  </div>
                 </div>
               </div>
               <div
@@ -472,12 +491,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-host.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  windows-native
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    windows-native
+                  </div>
                 </div>
               </div>
               <div
@@ -538,12 +562,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-user.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  administrator
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    administrator
+                  </div>
                 </div>
               </div>
               <div
@@ -604,10 +633,11 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-source.ip"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor"
@@ -748,7 +778,6 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
             class="euiTableHeaderCell"
             data-test-subj="tableHeaderCell_title_0"
             role="columnheader"
-            scope="col"
             style="width: 220px;"
           >
             <span
@@ -763,7 +792,6 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
             class="euiTableHeaderCell"
             data-test-subj="tableHeaderCell_description_1"
             role="columnheader"
-            scope="col"
           >
             <span
               class="euiTableCellContent"
@@ -800,12 +828,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.status"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  open
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    open
+                  </div>
                 </div>
               </div>
               <div
@@ -866,10 +899,11 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-@timestamp"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor eui-textTruncate eui-alignMiddle"
@@ -936,12 +970,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  xxx
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    xxx
+                  </div>
                 </div>
               </div>
               <div
@@ -1002,12 +1041,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.severity"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  low
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    low
+                  </div>
                 </div>
               </div>
               <div
@@ -1068,12 +1112,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.risk_score"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  21
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    21
+                  </div>
                 </div>
               </div>
               <div
@@ -1134,12 +1183,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-host.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  windows-native
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    windows-native
+                  </div>
                 </div>
               </div>
               <div
@@ -1200,12 +1254,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-user.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  administrator
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    administrator
+                  </div>
                 </div>
               </div>
               <div
@@ -1266,10 +1325,11 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-source.ip"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor"
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
index d4e839c4bef77..a2e4971899dcc 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
@@ -10,40 +10,325 @@ exports[`JSON View rendering should match snapshot 1`] = `
     paddingSize="m"
   >
     {
-  "_id": "pEMaMmkBUV60JmNWmWVi",
-  "_index": "filebeat-8.0.0-2019.02.19-000001",
+  "_index": ".ds-logs-endpoint.events.network-default-2021.09.28-000001",
+  "_id": "TUWyf3wBFCFU0qRJTauW",
   "_score": 1,
-  "_type": "_doc",
-  "@timestamp": "2019-02-28T16:50:54.621Z",
-  "agent": {
-    "ephemeral_id": "9d391ef2-a734-4787-8891-67031178c641",
-    "hostname": "siem-kibana",
-    "id": "5de03d5f-52f3-482e-91d4-853c7de073c3",
-    "type": "filebeat",
-    "version": "8.0.0"
-  },
-  "cloud": {
-    "availability_zone": "projects/189716325846/zones/us-east1-b",
-    "instance": {
-      "id": "5412578377715150143",
-      "name": "siem-kibana"
+  "_source": {
+    "agent": {
+      "id": "2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624",
+      "type": "endpoint",
+      "version": "8.0.0-SNAPSHOT"
     },
-    "machine": {
-      "type": "projects/189716325846/machineTypes/n1-standard-1"
+    "process": {
+      "Ext": {
+        "ancestry": [
+          "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=",
+          "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA=="
+        ]
+      },
+      "name": "filebeat",
+      "pid": 22535,
+      "entity_id": "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=",
+      "executable": "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
     },
-    "project": {
-      "id": "elastic-beats"
+    "destination": {
+      "address": "127.0.0.1",
+      "port": 9200,
+      "ip": "127.0.0.1"
     },
-    "provider": "gce"
-  },
-  "destination": {
-    "bytes": 584,
-    "ip": "10.47.8.200",
-    "packets": 4,
-    "port": 902
+    "source": {
+      "address": "127.0.0.1",
+      "port": 54146,
+      "ip": "127.0.0.1"
+    },
+    "message": "Endpoint network event",
+    "network": {
+      "transport": "tcp",
+      "type": "ipv4"
+    },
+    "@timestamp": "2021-10-14T16:45:58.0310772Z",
+    "ecs": {
+      "version": "1.11.0"
+    },
+    "data_stream": {
+      "namespace": "default",
+      "type": "logs",
+      "dataset": "endpoint.events.network"
+    },
+    "elastic": {
+      "agent": {
+        "id": "12345"
+      }
+    },
+    "host": {
+      "hostname": "test-linux-1",
+      "os": {
+        "Ext": {
+          "variant": "Debian"
+        },
+        "kernel": "4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)",
+        "name": "Linux",
+        "family": "debian",
+        "type": "linux",
+        "version": "10",
+        "platform": "debian",
+        "full": "Debian 10"
+      },
+      "ip": [
+        "127.0.0.1",
+        "::1",
+        "10.1.2.3",
+        "2001:0DB8:AC10:FE01::"
+      ],
+      "name": "test-linux-1",
+      "id": "76ea303129f249aa7382338e4263eac1",
+      "mac": [
+        "aa:bb:cc:dd:ee:ff"
+      ],
+      "architecture": "x86_64"
+    },
+    "event": {
+      "agent_id_status": "verified",
+      "sequence": 44872,
+      "ingested": "2021-10-14T16:46:04Z",
+      "created": "2021-10-14T16:45:58.0310772Z",
+      "kind": "event",
+      "module": "endpoint",
+      "action": "connection_attempted",
+      "id": "MKPXftjGeHiQzUNj++++nn6R",
+      "category": [
+        "network"
+      ],
+      "type": [
+        "start"
+      ],
+      "dataset": "endpoint.events.network",
+      "outcome": "unknown"
+    },
+    "user": {
+      "Ext": {
+        "real": {
+          "name": "root",
+          "id": 0
+        }
+      },
+      "name": "root",
+      "id": 0
+    },
+    "group": {
+      "Ext": {
+        "real": {
+          "name": "root",
+          "id": 0
+        }
+      },
+      "name": "root",
+      "id": 0
+    }
   },
-  "event": {
-    "kind": "event"
+  "fields": {
+    "host.os.full.text": [
+      "Debian 10"
+    ],
+    "event.category": [
+      "network"
+    ],
+    "process.name.text": [
+      "filebeat"
+    ],
+    "host.os.name.text": [
+      "Linux"
+    ],
+    "host.os.full": [
+      "Debian 10"
+    ],
+    "host.hostname": [
+      "test-linux-1"
+    ],
+    "process.pid": [
+      22535
+    ],
+    "host.mac": [
+      "42:01:0a:c8:00:32"
+    ],
+    "elastic.agent.id": [
+      "abcdefg-f6d5-4ce6-915d-8f1f8f413624"
+    ],
+    "host.os.version": [
+      "10"
+    ],
+    "host.os.name": [
+      "Linux"
+    ],
+    "source.ip": [
+      "127.0.0.1"
+    ],
+    "destination.address": [
+      "127.0.0.1"
+    ],
+    "host.name": [
+      "test-linux-1"
+    ],
+    "event.agent_id_status": [
+      "verified"
+    ],
+    "event.kind": [
+      "event"
+    ],
+    "event.outcome": [
+      "unknown"
+    ],
+    "group.name": [
+      "root"
+    ],
+    "user.id": [
+      "0"
+    ],
+    "host.os.type": [
+      "linux"
+    ],
+    "process.Ext.ancestry": [
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=",
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA=="
+    ],
+    "user.Ext.real.id": [
+      "0"
+    ],
+    "data_stream.type": [
+      "logs"
+    ],
+    "host.architecture": [
+      "x86_64"
+    ],
+    "process.name": [
+      "filebeat"
+    ],
+    "agent.id": [
+      "2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624"
+    ],
+    "source.port": [
+      54146
+    ],
+    "ecs.version": [
+      "1.11.0"
+    ],
+    "event.created": [
+      "2021-10-14T16:45:58.031Z"
+    ],
+    "agent.version": [
+      "8.0.0-SNAPSHOT"
+    ],
+    "host.os.family": [
+      "debian"
+    ],
+    "destination.port": [
+      9200
+    ],
+    "group.id": [
+      "0"
+    ],
+    "user.name": [
+      "root"
+    ],
+    "source.address": [
+      "127.0.0.1"
+    ],
+    "process.entity_id": [
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA="
+    ],
+    "host.ip": [
+      "127.0.0.1",
+      "::1",
+      "10.1.2.3",
+      "2001:0DB8:AC10:FE01::"
+    ],
+    "process.executable.caseless": [
+      "/opt/elastic/agent/data/elastic-agent-058c40/install/filebeat-8.0.0-snapshot-linux-x86_64/filebeat"
+    ],
+    "event.sequence": [
+      44872
+    ],
+    "agent.type": [
+      "endpoint"
+    ],
+    "process.executable.text": [
+      "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
+    ],
+    "group.Ext.real.name": [
+      "root"
+    ],
+    "event.module": [
+      "endpoint"
+    ],
+    "host.os.kernel": [
+      "4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)"
+    ],
+    "host.os.full.caseless": [
+      "debian 10"
+    ],
+    "host.id": [
+      "76ea303129f249aa7382338e4263eac1"
+    ],
+    "process.name.caseless": [
+      "filebeat"
+    ],
+    "network.type": [
+      "ipv4"
+    ],
+    "process.executable": [
+      "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
+    ],
+    "user.Ext.real.name": [
+      "root"
+    ],
+    "data_stream.namespace": [
+      "default"
+    ],
+    "message": [
+      "Endpoint network event"
+    ],
+    "destination.ip": [
+      "127.0.0.1"
+    ],
+    "network.transport": [
+      "tcp"
+    ],
+    "host.os.Ext.variant": [
+      "Debian"
+    ],
+    "group.Ext.real.id": [
+      "0"
+    ],
+    "event.ingested": [
+      "2021-10-14T16:46:04.000Z"
+    ],
+    "event.action": [
+      "connection_attempted"
+    ],
+    "@timestamp": [
+      "2021-10-14T16:45:58.031Z"
+    ],
+    "host.os.platform": [
+      "debian"
+    ],
+    "data_stream.dataset": [
+      "endpoint.events.network"
+    ],
+    "event.type": [
+      "start"
+    ],
+    "event.id": [
+      "MKPXftjGeHiQzUNj++++nn6R"
+    ],
+    "host.os.name.caseless": [
+      "linux"
+    ],
+    "event.dataset": [
+      "endpoint.events.network"
+    ],
+    "user.name.text": [
+      "root"
+    ]
   }
 }
   </EuiCodeBlock>
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
index a8ba536a75541..37ca3b0b897a6 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
@@ -11,7 +11,7 @@ import React from 'react';
 
 import '../../mock/match_media';
 import '../../mock/react_beautiful_dnd';
-import { mockDetailItemData, mockDetailItemDataId, TestProviders } from '../../mock';
+import { mockDetailItemData, mockDetailItemDataId, rawEventData, TestProviders } from '../../mock';
 
 import { EventDetails, EventsViewType } from './event_details';
 import { mockBrowserFields } from '../../containers/source/mock';
@@ -48,6 +48,7 @@ describe('EventDetails', () => {
     timelineId: 'test',
     eventView: EventsViewType.summaryView,
     hostRisk: { fields: [], loading: true },
+    rawEventData,
   };
 
   const alertsProps = {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
index e7092d9d6f466..a8305a635f157 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
@@ -61,6 +61,7 @@ interface Props {
   id: string;
   isAlert: boolean;
   isDraggable?: boolean;
+  rawEventData: object | undefined;
   timelineTabType: TimelineTabs | 'flyout';
   timelineId: string;
   hostRisk: HostRisk | null;
@@ -106,6 +107,7 @@ const EventDetailsComponent: React.FC<Props> = ({
   id,
   isAlert,
   isDraggable,
+  rawEventData,
   timelineId,
   timelineTabType,
   hostRisk,
@@ -278,12 +280,12 @@ const EventDetailsComponent: React.FC<Props> = ({
         <>
           <EuiSpacer size="m" />
           <TabContentWrapper data-test-subj="jsonViewWrapper">
-            <JsonView data={data} />
+            <JsonView rawEventData={rawEventData} />
           </TabContentWrapper>
         </>
       ),
     }),
-    [data]
+    [rawEventData]
   );
 
   const tabs = useMemo(() => {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
index 696fac6016603..b20270266602d 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
@@ -8,58 +8,15 @@
 import { shallow } from 'enzyme';
 import React from 'react';
 
-import { mockDetailItemData } from '../../mock';
+import { rawEventData } from '../../mock';
 
-import { buildJsonView, JsonView } from './json_view';
+import { JsonView } from './json_view';
 
 describe('JSON View', () => {
   describe('rendering', () => {
     test('should match snapshot', () => {
-      const wrapper = shallow(<JsonView data={mockDetailItemData} />);
+      const wrapper = shallow(<JsonView rawEventData={rawEventData} />);
       expect(wrapper).toMatchSnapshot();
     });
   });
-
-  describe('buildJsonView', () => {
-    test('should match a json', () => {
-      const expectedData = {
-        '@timestamp': '2019-02-28T16:50:54.621Z',
-        _id: 'pEMaMmkBUV60JmNWmWVi',
-        _index: 'filebeat-8.0.0-2019.02.19-000001',
-        _score: 1,
-        _type: '_doc',
-        agent: {
-          ephemeral_id: '9d391ef2-a734-4787-8891-67031178c641',
-          hostname: 'siem-kibana',
-          id: '5de03d5f-52f3-482e-91d4-853c7de073c3',
-          type: 'filebeat',
-          version: '8.0.0',
-        },
-        cloud: {
-          availability_zone: 'projects/189716325846/zones/us-east1-b',
-          instance: {
-            id: '5412578377715150143',
-            name: 'siem-kibana',
-          },
-          machine: {
-            type: 'projects/189716325846/machineTypes/n1-standard-1',
-          },
-          project: {
-            id: 'elastic-beats',
-          },
-          provider: 'gce',
-        },
-        destination: {
-          bytes: 584,
-          ip: '10.47.8.200',
-          packets: 4,
-          port: 902,
-        },
-        event: {
-          kind: 'event',
-        },
-      };
-      expect(buildJsonView(mockDetailItemData)).toEqual(expectedData);
-    });
-  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
index 0614f131bcd10..0227d44f32305 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
@@ -6,15 +6,13 @@
  */
 
 import { EuiCodeBlock } from '@elastic/eui';
-import { set } from '@elastic/safer-lodash-set/fp';
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
-import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
 import { omitTypenameAndEmpty } from '../../../timelines/components/timeline/body/helpers';
 
 interface Props {
-  data: TimelineEventsDetailsItem[];
+  rawEventData: object | undefined;
 }
 
 const EuiCodeEditorContainer = styled.div`
@@ -23,15 +21,15 @@ const EuiCodeEditorContainer = styled.div`
   }
 `;
 
-export const JsonView = React.memo<Props>(({ data }) => {
+export const JsonView = React.memo<Props>(({ rawEventData }) => {
   const value = useMemo(
     () =>
       JSON.stringify(
-        buildJsonView(data),
+        rawEventData,
         omitTypenameAndEmpty,
         2 // indent level
       ),
-    [data]
+    [rawEventData]
   );
 
   return (
@@ -50,16 +48,3 @@ export const JsonView = React.memo<Props>(({ data }) => {
 });
 
 JsonView.displayName = 'JsonView';
-
-export const buildJsonView = (data: TimelineEventsDetailsItem[]) =>
-  data
-    .sort((a, b) => a.field.localeCompare(b.field))
-    .reduce(
-      (accumulator, item) =>
-        set(
-          item.field,
-          Array.isArray(item.originalValue) ? item.originalValue.join() : item.originalValue,
-          accumulator
-        ),
-      {}
-    );
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
new file mode 100644
index 0000000000000..f6c43da2da8ac
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
@@ -0,0 +1,193 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { render, screen } from '@testing-library/react';
+import React from 'react';
+
+import { BrowserField } from '../../../containers/source';
+import { FieldValueCell } from './field_value_cell';
+import { TestProviders } from '../../../mock';
+import { EventFieldsData } from '../types';
+
+const contextId = 'test';
+
+const eventId = 'TUWyf3wBFCFU0qRJTauW';
+
+const hostIpData: EventFieldsData = {
+  aggregatable: true,
+  ariaRowindex: 35,
+  category: 'host',
+  description: 'Host ip addresses.',
+  example: '127.0.0.1',
+  field: 'host.ip',
+  fields: {},
+  format: '',
+  indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+  isObjectArray: false,
+  name: 'host.ip',
+  originalValue: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+  searchable: true,
+  type: 'ip',
+  values: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+};
+const hostIpValues = ['127.0.0.1', '::1', '10.1.2.3', 'fe80::4001:aff:fec8:32'];
+
+describe('FieldValueCell', () => {
+  describe('common behavior', () => {
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it formats multiple values such that each value is displayed on a single line', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`)).toHaveClass(
+        'euiFlexGroup--directionColumn'
+      );
+    });
+  });
+
+  describe('when `BrowserField` metadata is NOT available', () => {
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            fieldFromBrowserField={undefined} // <-- no metadata
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders each of the expected values when `fieldFromBrowserField` is undefined', () => {
+      hostIpValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+
+    test('it renders values formatted as plain text (without `eventFieldsTable__fieldValue` formatting)', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`).firstChild).not.toHaveClass(
+        'eventFieldsTable__fieldValue'
+      );
+    });
+  });
+
+  describe('`message` field formatting', () => {
+    const messageData: EventFieldsData = {
+      aggregatable: false,
+      ariaRowindex: 50,
+      category: 'base',
+      description:
+        'For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.',
+      example: 'Hello World',
+      field: 'message',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      isObjectArray: false,
+      name: 'message',
+      originalValue: ['Endpoint network event'],
+      searchable: true,
+      type: 'string',
+      values: ['Endpoint network event'],
+    };
+    const messageValues = ['Endpoint network event'];
+
+    const messageFieldFromBrowserField: BrowserField = {
+      aggregatable: false,
+      category: 'base',
+      description:
+        'For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.',
+      example: 'Hello World',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      name: 'message',
+      searchable: true,
+      type: 'string',
+    };
+
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={messageData}
+            eventId={eventId}
+            fieldFromBrowserField={messageFieldFromBrowserField}
+            values={messageValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders special formatting for the `message` field', () => {
+      expect(screen.getByTestId('event-field-message')).toBeInTheDocument();
+    });
+
+    test('it renders the expected message value', () => {
+      messageValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('when `BrowserField` metadata IS available', () => {
+    const hostIpFieldFromBrowserField: BrowserField = {
+      aggregatable: true,
+      category: 'host',
+      description: 'Host ip addresses.',
+      example: '127.0.0.1',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      name: 'host.ip',
+      searchable: true,
+      type: 'ip',
+    };
+
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            fieldFromBrowserField={hostIpFieldFromBrowserField} // <-- metadata
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders values formatted with the expected class', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`).firstChild).toHaveClass(
+        'eventFieldsTable__fieldValue'
+      );
+    });
+
+    test('it renders link buttons for each of the host ip addresses', () => {
+      expect(screen.getAllByRole('button').length).toBe(hostIpValues.length);
+    });
+
+    test('it renders each of the expected values when `fieldFromBrowserField` is provided', () => {
+      hostIpValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
index fc20f84d3650d..dc6c84b8138fe 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
@@ -6,7 +6,7 @@
  */
 
 import React from 'react';
-import { EuiText } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
 import { BrowserField } from '../../../containers/source';
 import { OverflowField } from '../../tables/helpers';
 import { FormattedFieldValue } from '../../../../timelines/components/timeline/body/renderers/formatted_field';
@@ -36,18 +36,28 @@ export const FieldValueCell = React.memo(
     values,
   }: FieldValueCellProps) => {
     return (
-      <div data-test-subj={`event-field-${data.field}`}>
+      <EuiFlexGroup
+        data-test-subj={`event-field-${data.field}`}
+        direction="column"
+        gutterSize="none"
+      >
         {values != null &&
           values.map((value, i) => {
             if (fieldFromBrowserField == null) {
               return (
-                <EuiText size="xs" key={value}>
-                  {value}
-                </EuiText>
+                <EuiFlexItem grow={false} key={`${i}-${value}`}>
+                  <EuiText size="xs" key={`${i}-${value}`}>
+                    {value}
+                  </EuiText>
+                </EuiFlexItem>
               );
             }
             return (
-              <div className="eventFieldsTable__fieldValue" key={value}>
+              <EuiFlexItem
+                className="eventFieldsTable__fieldValue"
+                grow={false}
+                key={`${i}-${value}`}
+              >
                 {data.field === MESSAGE_FIELD_NAME ? (
                   <OverflowField value={value} />
                 ) : (
@@ -63,10 +73,10 @@ export const FieldValueCell = React.memo(
                     linkValue={(getLinkValue && getLinkValue(data.field)) ?? linkValue}
                   />
                 )}
-              </div>
+              </EuiFlexItem>
             );
           })}
-      </div>
+      </EuiFlexGroup>
     );
   }
 );
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts b/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
index 3712d389edeb1..035bdbbceff88 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
@@ -139,3 +139,191 @@ export const generateMockDetailItemData = (): TimelineEventsDetailsItem[] => [
 ];
 
 export const mockDetailItemData: TimelineEventsDetailsItem[] = generateMockDetailItemData();
+
+export const rawEventData = {
+  _index: '.ds-logs-endpoint.events.network-default-2021.09.28-000001',
+  _id: 'TUWyf3wBFCFU0qRJTauW',
+  _score: 1,
+  _source: {
+    agent: {
+      id: '2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624',
+      type: 'endpoint',
+      version: '8.0.0-SNAPSHOT',
+    },
+    process: {
+      Ext: {
+        ancestry: [
+          'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=',
+          'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA==',
+        ],
+      },
+      name: 'filebeat',
+      pid: 22535,
+      entity_id: 'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=',
+      executable:
+        '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    },
+    destination: {
+      address: '127.0.0.1',
+      port: 9200,
+      ip: '127.0.0.1',
+    },
+    source: {
+      address: '127.0.0.1',
+      port: 54146,
+      ip: '127.0.0.1',
+    },
+    message: 'Endpoint network event',
+    network: {
+      transport: 'tcp',
+      type: 'ipv4',
+    },
+    '@timestamp': '2021-10-14T16:45:58.0310772Z',
+    ecs: {
+      version: '1.11.0',
+    },
+    data_stream: {
+      namespace: 'default',
+      type: 'logs',
+      dataset: 'endpoint.events.network',
+    },
+    elastic: {
+      agent: {
+        id: '12345',
+      },
+    },
+    host: {
+      hostname: 'test-linux-1',
+      os: {
+        Ext: {
+          variant: 'Debian',
+        },
+        kernel: '4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)',
+        name: 'Linux',
+        family: 'debian',
+        type: 'linux',
+        version: '10',
+        platform: 'debian',
+        full: 'Debian 10',
+      },
+      ip: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+      name: 'test-linux-1',
+      id: '76ea303129f249aa7382338e4263eac1',
+      mac: ['aa:bb:cc:dd:ee:ff'],
+      architecture: 'x86_64',
+    },
+    event: {
+      agent_id_status: 'verified',
+      sequence: 44872,
+      ingested: '2021-10-14T16:46:04Z',
+      created: '2021-10-14T16:45:58.0310772Z',
+      kind: 'event',
+      module: 'endpoint',
+      action: 'connection_attempted',
+      id: 'MKPXftjGeHiQzUNj++++nn6R',
+      category: ['network'],
+      type: ['start'],
+      dataset: 'endpoint.events.network',
+      outcome: 'unknown',
+    },
+    user: {
+      Ext: {
+        real: {
+          name: 'root',
+          id: 0,
+        },
+      },
+      name: 'root',
+      id: 0,
+    },
+    group: {
+      Ext: {
+        real: {
+          name: 'root',
+          id: 0,
+        },
+      },
+      name: 'root',
+      id: 0,
+    },
+  },
+  fields: {
+    'host.os.full.text': ['Debian 10'],
+    'event.category': ['network'],
+    'process.name.text': ['filebeat'],
+    'host.os.name.text': ['Linux'],
+    'host.os.full': ['Debian 10'],
+    'host.hostname': ['test-linux-1'],
+    'process.pid': [22535],
+    'host.mac': ['42:01:0a:c8:00:32'],
+    'elastic.agent.id': ['abcdefg-f6d5-4ce6-915d-8f1f8f413624'],
+    'host.os.version': ['10'],
+    'host.os.name': ['Linux'],
+    'source.ip': ['127.0.0.1'],
+    'destination.address': ['127.0.0.1'],
+    'host.name': ['test-linux-1'],
+    'event.agent_id_status': ['verified'],
+    'event.kind': ['event'],
+    'event.outcome': ['unknown'],
+    'group.name': ['root'],
+    'user.id': ['0'],
+    'host.os.type': ['linux'],
+    'process.Ext.ancestry': [
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=',
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA==',
+    ],
+    'user.Ext.real.id': ['0'],
+    'data_stream.type': ['logs'],
+    'host.architecture': ['x86_64'],
+    'process.name': ['filebeat'],
+    'agent.id': ['2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624'],
+    'source.port': [54146],
+    'ecs.version': ['1.11.0'],
+    'event.created': ['2021-10-14T16:45:58.031Z'],
+    'agent.version': ['8.0.0-SNAPSHOT'],
+    'host.os.family': ['debian'],
+    'destination.port': [9200],
+    'group.id': ['0'],
+    'user.name': ['root'],
+    'source.address': ['127.0.0.1'],
+    'process.entity_id': [
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=',
+    ],
+    'host.ip': ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+    'process.executable.caseless': [
+      '/opt/elastic/agent/data/elastic-agent-058c40/install/filebeat-8.0.0-snapshot-linux-x86_64/filebeat',
+    ],
+    'event.sequence': [44872],
+    'agent.type': ['endpoint'],
+    'process.executable.text': [
+      '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    ],
+    'group.Ext.real.name': ['root'],
+    'event.module': ['endpoint'],
+    'host.os.kernel': ['4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)'],
+    'host.os.full.caseless': ['debian 10'],
+    'host.id': ['76ea303129f249aa7382338e4263eac1'],
+    'process.name.caseless': ['filebeat'],
+    'network.type': ['ipv4'],
+    'process.executable': [
+      '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    ],
+    'user.Ext.real.name': ['root'],
+    'data_stream.namespace': ['default'],
+    message: ['Endpoint network event'],
+    'destination.ip': ['127.0.0.1'],
+    'network.transport': ['tcp'],
+    'host.os.Ext.variant': ['Debian'],
+    'group.Ext.real.id': ['0'],
+    'event.ingested': ['2021-10-14T16:46:04.000Z'],
+    'event.action': ['connection_attempted'],
+    '@timestamp': ['2021-10-14T16:45:58.031Z'],
+    'host.os.platform': ['debian'],
+    'data_stream.dataset': ['endpoint.events.network'],
+    'event.type': ['start'],
+    'event.id': ['MKPXftjGeHiQzUNj++++nn6R'],
+    'host.os.name.caseless': ['linux'],
+    'event.dataset': ['endpoint.events.network'],
+    'user.name.text': ['root'],
+  },
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
index 06d61b3f0b284..a9b6eabecff86 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
@@ -34,7 +34,6 @@ import { useExceptionActions } from './use_add_exception_actions';
 import { useEventFilterModal } from './use_event_filter_modal';
 import { Status } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { useKibana } from '../../../../common/lib/kibana';
-import { useInvestigateInResolverContextItem } from './investigate_in_resolver';
 import { ATTACH_ALERT_TO_CASE_FOR_ROW } from '../../../../timelines/components/timeline/body/translations';
 import { useEventFilterAction } from './use_event_filter_action';
 import { useAddToCaseActions } from './use_add_to_case_actions';
@@ -163,30 +162,19 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps & PropsFromRedux
     isEndpointAlert: isAlertFromEndpointAlert({ ecsData: ecsRowData }),
     onAddExceptionTypeClick: handleOnAddExceptionTypeClick,
   });
-  const investigateInResolverActionItems = useInvestigateInResolverContextItem({
-    timelineId,
-    ecsData: ecsRowData,
-    onClose: afterItemSelection,
-  });
   const { eventFilterActionItems } = useEventFilterAction({
     onAddEventFilterClick: handleOnAddEventFilterClick,
   });
   const items: React.ReactElement[] = useMemo(
     () =>
       !isEvent && ruleId
-        ? [
-            ...investigateInResolverActionItems,
-            ...addToCaseActionItems,
-            ...statusActionItems,
-            ...exceptionActionItems,
-          ]
-        : [...investigateInResolverActionItems, ...addToCaseActionItems, ...eventFilterActionItems],
+        ? [...addToCaseActionItems, ...statusActionItems, ...exceptionActionItems]
+        : [...addToCaseActionItems, ...eventFilterActionItems],
     [
       statusActionItems,
       addToCaseActionItems,
       eventFilterActionItems,
       exceptionActionItems,
-      investigateInResolverActionItems,
       isEvent,
       ruleId,
     ]
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
index 17d43d80a5a9a..6a7f0602c3675 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
@@ -33,6 +33,7 @@ interface Props {
   isDraggable?: boolean;
   loading: boolean;
   messageHeight?: number;
+  rawEventData: object | undefined;
   timelineTabType: TimelineTabs | 'flyout';
   timelineId: string;
   hostRisk: HostRisk | null;
@@ -93,6 +94,7 @@ export const ExpandableEvent = React.memo<Props>(
     loading,
     detailsData,
     hostRisk,
+    rawEventData,
   }) => {
     if (!event.eventId) {
       return <EuiTextColor color="subdued">{i18n.EVENT_DETAILS_PLACEHOLDER}</EuiTextColor>;
@@ -111,6 +113,7 @@ export const ExpandableEvent = React.memo<Props>(
             id={event.eventId}
             isAlert={isAlert}
             isDraggable={isDraggable}
+            rawEventData={rawEventData}
             timelineId={timelineId}
             timelineTabType={timelineTabType}
             hostRisk={hostRisk}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
index f8786e0706834..b9d7e0a8c024f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
@@ -79,7 +79,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
   tabType,
   timelineId,
 }) => {
-  const [loading, detailsData] = useTimelineEventsDetails({
+  const [loading, detailsData, rawEventData] = useTimelineEventsDetails({
     docValueFields,
     entityType,
     indexName: expandedEvent.indexName ?? '',
@@ -195,6 +195,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
             isAlert={isAlert}
             isDraggable={isDraggable}
             loading={loading}
+            rawEventData={rawEventData}
             timelineId={timelineId}
             timelineTabType="flyout"
             hostRisk={hostRisk}
@@ -228,6 +229,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
         isAlert={isAlert}
         isDraggable={isDraggable}
         loading={loading}
+        rawEventData={rawEventData}
         timelineId={timelineId}
         timelineTabType={tabType}
         hostRisk={hostRisk}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
index 5ed9398a621e8..1da09bcf4e25f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
@@ -185,5 +185,34 @@ describe('Actions', () => {
         wrapper.find('[data-test-subj="timeline-context-menu-button"]').first().prop('isDisabled')
       ).toBe(false);
     });
+    test('it shows the analyze event button when the event is from an endpoint', () => {
+      const ecsData = {
+        ...mockTimelineData[0].ecs,
+        event: { kind: ['alert'] },
+        agent: { type: ['endpoint'] },
+        process: { entity_id: ['1'] },
+      };
+      const wrapper = mount(
+        <TestProviders>
+          <Actions {...defaultProps} ecsData={ecsData} />
+        </TestProviders>
+      );
+
+      expect(wrapper.find('[data-test-subj="view-in-analyzer"]').exists()).toBe(true);
+    });
+    test('it does not render the analyze event button when the event is from an unsupported source', () => {
+      const ecsData = {
+        ...mockTimelineData[0].ecs,
+        event: { kind: ['alert'] },
+        agent: { type: ['notendpoint'] },
+      };
+      const wrapper = mount(
+        <TestProviders>
+          <Actions {...defaultProps} ecsData={ecsData} />
+        </TestProviders>
+      );
+
+      expect(wrapper.find('[data-test-subj="view-in-analyzer"]').exists()).toBe(false);
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
index 73650bd320f32..c4dae739cb251 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
@@ -21,9 +21,23 @@ import { EventsTdContent } from '../../styles';
 import * as i18n from '../translations';
 import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
 import { useShallowEqualSelector } from '../../../../../common/hooks/use_selector';
-import { TimelineId, ActionProps, OnPinEvent } from '../../../../../../common/types/timeline';
+import {
+  setActiveTabTimeline,
+  updateTimelineGraphEventId,
+} from '../../../../store/timeline/actions';
+import {
+  useGlobalFullScreen,
+  useTimelineFullScreen,
+} from '../../../../../common/containers/use_full_screen';
+import {
+  TimelineId,
+  ActionProps,
+  OnPinEvent,
+  TimelineTabs,
+} from '../../../../../../common/types/timeline';
 import { timelineActions, timelineSelectors } from '../../../../store/timeline';
 import { timelineDefaults } from '../../../../store/timeline/defaults';
+import { isInvestigateInResolverActionEnabled } from '../../../../../detections/components/alerts_table/timeline_actions/investigate_in_resolver';
 
 const ActionsContainer = styled.div`
   align-items: center;
@@ -100,6 +114,24 @@ const ActionsComponent: React.FC<ActionProps> = ({
     [eventType, ecsData.event?.kind, ecsData.agent?.type]
   );
 
+  const isDisabled = useMemo(() => !isInvestigateInResolverActionEnabled(ecsData), [ecsData]);
+  const { setGlobalFullScreen } = useGlobalFullScreen();
+  const { setTimelineFullScreen } = useTimelineFullScreen();
+  const handleClick = useCallback(() => {
+    const dataGridIsFullScreen = document.querySelector('.euiDataGrid--fullScreen');
+    dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: ecsData._id }));
+    if (timelineId === TimelineId.active) {
+      if (dataGridIsFullScreen) {
+        setTimelineFullScreen(true);
+      }
+      dispatch(setActiveTabTimeline({ id: timelineId, activeTab: TimelineTabs.graph }));
+    } else {
+      if (dataGridIsFullScreen) {
+        setGlobalFullScreen(true);
+      }
+    }
+  }, [dispatch, ecsData._id, timelineId, setGlobalFullScreen, setTimelineFullScreen]);
+
   return (
     <ActionsContainer>
       {showCheckboxes && !tGridEnabled && (
@@ -171,6 +203,26 @@ const ActionsComponent: React.FC<ActionProps> = ({
           refetch={refetch ?? noop}
           onRuleChange={onRuleChange}
         />
+        {isDisabled === false ? (
+          <div>
+            <EventsTdContent textAlign="center" width={36}>
+              <EuiToolTip
+                data-test-subj="view-in-analyzer-tool-tip"
+                content={i18n.ACTION_INVESTIGATE_IN_RESOLVER}
+              >
+                <EuiButtonIcon
+                  aria-label={i18n.ACTION_INVESTIGATE_IN_RESOLVER_FOR_ROW({
+                    ariaRowindex,
+                    columnValues,
+                  })}
+                  data-test-subj="view-in-analyzer"
+                  iconType="analyzeEvent"
+                  onClick={handleClick}
+                />
+              </EuiToolTip>
+            </EventsTdContent>
+          </div>
+        ) : null}
       </>
     </ActionsContainer>
   );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
index 6bc2dc089494d..25d5104a98d95 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
@@ -521,7 +521,7 @@ exports[`ColumnHeaders rendering renders correctly against snapshot 1`] = `
           "compare": null,
           "type": [Function],
         },
-        "width": 108,
+        "width": 140,
       },
     ]
   }
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/control_columns/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/control_columns/index.tsx
index d38bf2136513e..2cdc8d5f4e284 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/control_columns/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/control_columns/index.tsx
@@ -9,7 +9,7 @@ import { ControlColumnProps } from '../../../../../../common/types/timeline';
 import { Actions } from '../actions';
 import { HeaderActions } from '../actions/header_actions';
 
-const DEFAULT_CONTROL_COLUMN_WIDTH = 108;
+const DEFAULT_CONTROL_COLUMN_WIDTH = 140;
 
 export const defaultControlColumn: ControlColumnProps = {
   id: 'default-timeline-control-column',
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
index 5b993110d38b5..7032319b59333 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
@@ -17,8 +17,10 @@ import {
 import { OnPinEvent, OnUnPinEvent } from '../events';
 import * as i18n from './translations';
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export const omitTypenameAndEmpty = (k: string, v: any): any | undefined =>
+export const omitTypenameAndEmpty = (
+  k: string,
+  v: string | object | Array<string | object>
+): string | object | Array<string | object> | undefined =>
   k !== '__typename' && v != null ? v : undefined;
 
 export const stringifyEvent = (ecs: Ecs): string => JSON.stringify(ecs, omitTypenameAndEmpty, 2);
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
index e59eaeed4f2a6..f05966bd97870 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
@@ -42,7 +42,7 @@ export const useTimelineEventsDetails = ({
   indexName,
   eventId,
   skip,
-}: UseTimelineEventsDetailsProps): [boolean, EventsArgs['detailsData']] => {
+}: UseTimelineEventsDetailsProps): [boolean, EventsArgs['detailsData'], object | undefined] => {
   const { data } = useKibana().services;
   const refetch = useRef<inputsModel.Refetch>(noop);
   const abortCtrl = useRef(new AbortController());
@@ -55,6 +55,8 @@ export const useTimelineEventsDetails = ({
   const [timelineDetailsResponse, setTimelineDetailsResponse] =
     useState<EventsArgs['detailsData']>(null);
 
+  const [rawEventData, setRawEventData] = useState<object | undefined>(undefined);
+
   const timelineDetailsSearch = useCallback(
     (request: TimelineEventsDetailsRequestOptions | null) => {
       if (request == null || skip || isEmpty(request.eventId)) {
@@ -78,6 +80,7 @@ export const useTimelineEventsDetails = ({
               if (isCompleteResponse(response)) {
                 setLoading(false);
                 setTimelineDetailsResponse(response.data || []);
+                setRawEventData(response.rawResponse.hits.hits[0]);
                 searchSubscription$.current.unsubscribe();
               } else if (isErrorResponse(response)) {
                 setLoading(false);
@@ -125,5 +128,5 @@ export const useTimelineEventsDetails = ({
     };
   }, [timelineDetailsRequest, timelineDetailsSearch]);
 
-  return [loading, timelineDetailsResponse];
+  return [loading, timelineDetailsResponse, rawEventData];
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts
index fed34743e220a..ddf4e956beac4 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts
@@ -171,6 +171,7 @@ export const createPrepackagedRules = async (
   );
   await updatePrepackagedRules(
     rulesClient,
+    savedObjectsClient,
     context.securitySolution.getSpaceId(),
     ruleStatusClient,
     rulesToUpdate,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/export_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/export_rules_route.ts
index e4b99e63cb6c6..c84dd8147ebcc 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/export_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/export_rules_route.ts
@@ -6,6 +6,7 @@
  */
 
 import { transformError } from '@kbn/securitysolution-es-utils';
+import { Logger } from 'src/core/server';
 import {
   exportRulesQuerySchema,
   ExportRulesQuerySchemaDecoded,
@@ -24,6 +25,7 @@ import { buildSiemResponse } from '../utils';
 export const exportRulesRoute = (
   router: SecuritySolutionPluginRouter,
   config: ConfigType,
+  logger: Logger,
   isRuleRegistryEnabled: boolean
 ) => {
   router.post(
@@ -44,6 +46,7 @@ export const exportRulesRoute = (
     async (context, request, response) => {
       const siemResponse = buildSiemResponse(response);
       const rulesClient = context.alerting?.getRulesClient();
+      const savedObjectsClient = context.core.savedObjects.client;
 
       if (!rulesClient) {
         return siemResponse.error({ statusCode: 404 });
@@ -71,8 +74,14 @@ export const exportRulesRoute = (
 
         const exported =
           request.body?.objects != null
-            ? await getExportByObjectIds(rulesClient, request.body.objects, isRuleRegistryEnabled)
-            : await getExportAll(rulesClient, isRuleRegistryEnabled);
+            ? await getExportByObjectIds(
+                rulesClient,
+                savedObjectsClient,
+                request.body.objects,
+                logger,
+                isRuleRegistryEnabled
+              )
+            : await getExportAll(rulesClient, savedObjectsClient, logger, isRuleRegistryEnabled);
 
         const responseBody = request.query.exclude_export_details
           ? exported.rulesNdjson
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
index 8269fe8b36132..3752128d3daa3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -40,6 +40,7 @@ import {
 } from '../utils';
 
 import { patchRules } from '../../rules/patch_rules';
+import { legacyMigrate } from '../../rules/utils';
 import { getTupleDuplicateErrorsAndUniqueRules } from './utils';
 import { createRulesStreamFromNdJson } from '../../rules/create_rules_stream_from_ndjson';
 import { buildRouteValidation } from '../../../../utils/build_validation/route_validation';
@@ -193,6 +194,7 @@ export const importRulesRoute = (
                       throttle,
                       version,
                       exceptions_list: exceptionsList,
+                      actions,
                     } = parsedRule;
 
                     try {
@@ -264,15 +266,21 @@ export const importRulesRoute = (
                           note,
                           version,
                           exceptionsList,
-                          actions: [], // Actions are not imported nor exported at this time
+                          actions,
                         });
                         resolve({
                           rule_id: ruleId,
                           status_code: 200,
                         });
                       } else if (rule != null && request.query.overwrite) {
+                        const migratedRule = await legacyMigrate({
+                          rulesClient,
+                          savedObjectsClient,
+                          rule,
+                        });
                         await patchRules({
                           rulesClient,
+                          savedObjectsClient,
                           author,
                           buildingBlockType,
                           spaceId: context.securitySolution.getSpaceId(),
@@ -291,7 +299,7 @@ export const importRulesRoute = (
                           timelineTitle,
                           meta,
                           filters,
-                          rule,
+                          rule: migratedRule,
                           index,
                           interval,
                           maxSignals,
@@ -321,7 +329,7 @@ export const importRulesRoute = (
                           exceptionsList,
                           anomalyThreshold,
                           machineLearningJobId,
-                          actions: undefined,
+                          actions,
                         });
                         resolve({
                           rule_id: ruleId,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
index 67d68221d846f..2b514ba911091 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
@@ -24,6 +24,7 @@ import { transformValidateBulkError } from './validate';
 import { patchRules } from '../../rules/patch_rules';
 import { readRules } from '../../rules/read_rules';
 import { PartialFilter } from '../../types';
+import { legacyMigrate } from '../../rules/utils';
 
 export const patchRulesBulkRoute = (
   router: SecuritySolutionPluginRouter,
@@ -133,9 +134,16 @@ export const patchRulesBulkRoute = (
               throwHttpError(await mlAuthz.validateRuleType(existingRule?.params.type));
             }
 
-            const rule = await patchRules({
+            const migratedRule = await legacyMigrate({
+              rulesClient,
+              savedObjectsClient,
               rule: existingRule,
+            });
+
+            const rule = await patchRules({
+              rule: migratedRule,
               rulesClient,
+              savedObjectsClient,
               author,
               buildingBlockType,
               description,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
index cf140f22289de..0096cd2e38180 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
@@ -24,6 +24,7 @@ import { buildSiemResponse } from '../utils';
 import { getIdError } from './utils';
 import { transformValidate } from './validate';
 import { readRules } from '../../rules/read_rules';
+import { legacyMigrate } from '../../rules/utils';
 import { PartialFilter } from '../../types';
 
 export const patchRulesRoute = (
@@ -134,8 +135,15 @@ export const patchRulesRoute = (
           throwHttpError(await mlAuthz.validateRuleType(existingRule?.params.type));
         }
 
+        const migratedRule = await legacyMigrate({
+          rulesClient,
+          savedObjectsClient,
+          rule: existingRule,
+        });
+
         const rule = await patchRules({
           rulesClient,
+          savedObjectsClient,
           author,
           buildingBlockType,
           description,
@@ -154,7 +162,7 @@ export const patchRulesRoute = (
           timelineTitle,
           meta,
           filters,
-          rule: existingRule,
+          rule: migratedRule,
           index,
           interval,
           maxSignals,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.test.ts
index 41b909bd718c0..3e85b4898d01c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.test.ts
@@ -17,6 +17,7 @@ import {
 import { requestContextMock, serverMock, requestMock } from '../__mocks__';
 import { performBulkActionRoute } from './perform_bulk_action_route';
 import { getPerformBulkActionSchemaMock } from '../../../../../common/detection_engine/schemas/request/perform_bulk_action_schema.mock';
+import { loggingSystemMock } from 'src/core/server/mocks';
 
 jest.mock('../../../machine_learning/authz', () => mockMlAuthzFactory.create());
 
@@ -27,15 +28,17 @@ describe.each([
   let server: ReturnType<typeof serverMock.create>;
   let { clients, context } = requestContextMock.createTools();
   let ml: ReturnType<typeof mlServicesMock.createSetupContract>;
+  let logger: ReturnType<typeof loggingSystemMock.createLogger>;
 
   beforeEach(() => {
     server = serverMock.create();
+    logger = loggingSystemMock.createLogger();
     ({ clients, context } = requestContextMock.createTools());
     ml = mlServicesMock.createSetupContract();
 
     clients.rulesClient.find.mockResolvedValue(getFindResultWithSingleHit(isRuleRegistryEnabled));
 
-    performBulkActionRoute(server.router, ml, isRuleRegistryEnabled);
+    performBulkActionRoute(server.router, ml, logger, isRuleRegistryEnabled);
   });
 
   describe('status codes', () => {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.ts
index 0eba5af4e063a..fb5a2315479da 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.ts
@@ -6,6 +6,8 @@
  */
 
 import { transformError } from '@kbn/securitysolution-es-utils';
+import { Logger } from 'src/core/server';
+
 import { DETECTION_ENGINE_RULES_BULK_ACTION } from '../../../../../common/constants';
 import { BulkAction } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { performBulkActionSchema } from '../../../../../common/detection_engine/schemas/request/perform_bulk_action_schema';
@@ -26,6 +28,7 @@ const BULK_ACTION_RULES_LIMIT = 10000;
 export const performBulkActionRoute = (
   router: SecuritySolutionPluginRouter,
   ml: SetupPlugins['ml'],
+  logger: Logger,
   isRuleRegistryEnabled: boolean
 ) => {
   router.post(
@@ -133,7 +136,9 @@ export const performBulkActionRoute = (
           case BulkAction.export:
             const exported = await getExportByObjectIds(
               rulesClient,
+              savedObjectsClient,
               rules.data.map(({ params }) => ({ rule_id: params.ruleId })),
+              logger,
               isRuleRegistryEnabled
             );
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.test.ts
index f7bef76944a97..22e8f6543eb7c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.test.ts
@@ -41,6 +41,8 @@ describe.each([
       getAlertMock(isRuleRegistryEnabled, getQueryRuleParams())
     );
 
+    clients.appClient.getSignalsIndex.mockReturnValue('.siem-signals-test-index');
+
     updateRulesBulkRoute(server.router, ml, isRuleRegistryEnabled);
   });
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
index 6138690070b62..d8b7e8cb2b724 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
@@ -19,6 +19,8 @@ import { getIdBulkError } from './utils';
 import { transformValidateBulkError } from './validate';
 import { transformBulkError, buildSiemResponse, createBulkErrorObject } from '../utils';
 import { updateRules } from '../../rules/update_rules';
+import { legacyMigrate } from '../../rules/utils';
+import { readRules } from '../../rules/read_rules';
 
 export const updateRulesBulkRoute = (
   router: SecuritySolutionPluginRouter,
@@ -69,10 +71,24 @@ export const updateRulesBulkRoute = (
 
             throwHttpError(await mlAuthz.validateRuleType(payloadRule.type));
 
+            const existingRule = await readRules({
+              isRuleRegistryEnabled,
+              rulesClient,
+              ruleId: payloadRule.rule_id,
+              id: payloadRule.id,
+            });
+
+            await legacyMigrate({
+              rulesClient,
+              savedObjectsClient,
+              rule: existingRule,
+            });
+
             const rule = await updateRules({
               spaceId: context.securitySolution.getSpaceId(),
               rulesClient,
               ruleStatusClient,
+              savedObjectsClient,
               defaultOutputIndex: siemClient.getSignalsIndex(),
               ruleUpdate: payloadRule,
               isRuleRegistryEnabled,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.test.ts
index 7d611f3cccbf2..37df792b421b0 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.test.ts
@@ -44,7 +44,7 @@ describe.each([
       getAlertMock(isRuleRegistryEnabled, getQueryRuleParams())
     ); // successful update
     clients.ruleExecutionLogClient.find.mockResolvedValue([]); // successful transform: ;
-
+    clients.appClient.getSignalsIndex.mockReturnValue('.siem-signals-test-index');
     updateRulesRoute(server.router, ml, isRuleRegistryEnabled);
   });
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
index 7cfe83093a549..cf443e3293510 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
@@ -19,6 +19,8 @@ import { getIdError } from './utils';
 import { transformValidate } from './validate';
 import { updateRules } from '../../rules/update_rules';
 import { buildRouteValidation } from '../../../../utils/build_validation/route_validation';
+import { legacyMigrate } from '../../rules/utils';
+import { readRules } from '../../rules/read_rules';
 
 export const updateRulesRoute = (
   router: SecuritySolutionPluginRouter,
@@ -59,11 +61,25 @@ export const updateRulesRoute = (
         throwHttpError(await mlAuthz.validateRuleType(request.body.type));
 
         const ruleStatusClient = context.securitySolution.getExecutionLogClient();
+
+        const existingRule = await readRules({
+          isRuleRegistryEnabled,
+          rulesClient,
+          ruleId: request.body.rule_id,
+          id: request.body.id,
+        });
+
+        await legacyMigrate({
+          rulesClient,
+          savedObjectsClient,
+          rule: existingRule,
+        });
         const rule = await updateRules({
           defaultOutputIndex: siemClient.getSignalsIndex(),
           isRuleRegistryEnabled,
           rulesClient,
           ruleStatusClient,
+          savedObjectsClient,
           ruleUpdate: request.body,
           spaceId: context.securitySolution.getSpaceId(),
         });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts
index c5a30c349d497..366ae607f0ba8 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts
@@ -469,12 +469,12 @@ describe.each([
 
   describe('transformAlertsToRules', () => {
     test('given an empty array returns an empty array', () => {
-      expect(transformAlertsToRules([])).toEqual([]);
+      expect(transformAlertsToRules([], {})).toEqual([]);
     });
 
     test('given single alert will return the alert transformed', () => {
       const result1 = getAlertMock(isRuleRegistryEnabled, getQueryRuleParams());
-      const transformed = transformAlertsToRules([result1]);
+      const transformed = transformAlertsToRules([result1], {});
       const expected = getOutputRuleAlertForRest();
       expect(transformed).toEqual([expected]);
     });
@@ -485,7 +485,7 @@ describe.each([
       result2.id = 'some other id';
       result2.params.ruleId = 'some other id';
 
-      const transformed = transformAlertsToRules([result1, result2]);
+      const transformed = transformAlertsToRules([result1, result2], {});
       const expected1 = getOutputRuleAlertForRest();
       const expected2 = getOutputRuleAlertForRest();
       expected2.id = 'some other id';
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.ts
index afc48386a2986..bb2e35d189ca1 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.ts
@@ -103,8 +103,11 @@ export const transformAlertToRule = (
   return internalRuleToAPIResponse(alert, ruleStatus?.attributes, legacyRuleActions);
 };
 
-export const transformAlertsToRules = (alerts: RuleAlertType[]): Array<Partial<RulesSchema>> => {
-  return alerts.map((alert) => transformAlertToRule(alert));
+export const transformAlertsToRules = (
+  alerts: RuleAlertType[],
+  legacyRuleActions: Record<string, LegacyRulesActionsSavedObject>
+): Array<Partial<RulesSchema>> => {
+  return alerts.map((alert) => transformAlertToRule(alert, undefined, legacyRuleActions[alert.id]));
 };
 
 export const transformFindAlerts = (
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts
index 3ca5960d7d4e1..92e4f0bbb4a5e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts
@@ -9,21 +9,33 @@ import {
   getAlertMock,
   getFindResultWithSingleHit,
   FindHit,
+  getEmptySavedObjectsResponse,
 } from '../routes/__mocks__/request_responses';
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
 import { getExportAll } from './get_export_all';
 import { getListArrayMock } from '../../../../common/detection_engine/schemas/types/lists.mock';
 import { getThreatMock } from '../../../../common/detection_engine/schemas/types/threat.mock';
+
 import { getQueryRuleParams } from '../schemas/rule_schemas.mock';
+import { loggingSystemMock } from 'src/core/server/mocks';
+import { requestContextMock } from '../routes/__mocks__/request_context';
 
 describe.each([
   ['Legacy', false],
   ['RAC', true],
 ])('getExportAll - %s', (_, isRuleRegistryEnabled) => {
+  let logger: ReturnType<typeof loggingSystemMock.createLogger>;
+  const { clients } = requestContextMock.createTools();
+
+  beforeEach(async () => {
+    clients.savedObjectsClient.find.mockResolvedValue(getEmptySavedObjectsResponse());
+  });
+
   test('it exports everything from the alerts client', async () => {
     const rulesClient = rulesClientMock.create();
     const result = getFindResultWithSingleHit(isRuleRegistryEnabled);
     const alert = getAlertMock(isRuleRegistryEnabled, getQueryRuleParams());
+
     alert.params = {
       ...alert.params,
       filters: [{ query: { match_phrase: { 'host.name': 'some-host' } } }],
@@ -35,7 +47,12 @@ describe.each([
     result.data = [alert];
     rulesClient.find.mockResolvedValue(result);
 
-    const exports = await getExportAll(rulesClient, isRuleRegistryEnabled);
+    const exports = await getExportAll(
+      rulesClient,
+      clients.savedObjectsClient,
+      logger,
+      isRuleRegistryEnabled
+    );
     const rulesJson = JSON.parse(exports.rulesNdjson);
     const detailsJson = JSON.parse(exports.exportDetails);
     expect(rulesJson).toEqual({
@@ -97,7 +114,12 @@ describe.each([
 
     rulesClient.find.mockResolvedValue(findResult);
 
-    const exports = await getExportAll(rulesClient, isRuleRegistryEnabled);
+    const exports = await getExportAll(
+      rulesClient,
+      clients.savedObjectsClient,
+      logger,
+      isRuleRegistryEnabled
+    );
     expect(exports).toEqual({
       rulesNdjson: '',
       exportDetails: '{"exported_count":0,"missing_rules":[],"missing_rules_count":0}\n',
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts
index 71079ccefc97a..cbbda5df7e2bf 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts
@@ -7,20 +7,33 @@
 
 import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 
-import { RulesClient } from '../../../../../alerting/server';
+import { Logger } from 'src/core/server';
+import { RulesClient, AlertServices } from '../../../../../alerting/server';
 import { getNonPackagedRules } from './get_existing_prepackaged_rules';
 import { getExportDetailsNdjson } from './get_export_details_ndjson';
 import { transformAlertsToRules } from '../routes/rules/utils';
 
+// eslint-disable-next-line no-restricted-imports
+import { legacyGetBulkRuleActionsSavedObject } from '../rule_actions/legacy_get_bulk_rule_actions_saved_object';
+
 export const getExportAll = async (
   rulesClient: RulesClient,
+  savedObjectsClient: AlertServices['savedObjectsClient'],
+  logger: Logger,
   isRuleRegistryEnabled: boolean
 ): Promise<{
   rulesNdjson: string;
   exportDetails: string;
 }> => {
   const ruleAlertTypes = await getNonPackagedRules({ rulesClient, isRuleRegistryEnabled });
-  const rules = transformAlertsToRules(ruleAlertTypes);
+  const alertIds = ruleAlertTypes.map((rule) => rule.id);
+  const legacyActions = await legacyGetBulkRuleActionsSavedObject({
+    alertIds,
+    savedObjectsClient,
+    logger,
+  });
+
+  const rules = transformAlertsToRules(ruleAlertTypes, legacyActions);
   // We do not support importing/exporting actions. When we do, delete this line of code
   const rulesWithoutActions = rules.map((rule) => ({ ...rule, actions: [] }));
   const rulesNdjson = transformDataToNdjson(rulesWithoutActions);
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts
index 740427e44b560..961f2c6a41866 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts
@@ -10,28 +10,43 @@ import {
   getAlertMock,
   getFindResultWithSingleHit,
   FindHit,
+  getEmptySavedObjectsResponse,
 } from '../routes/__mocks__/request_responses';
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
 import { getListArrayMock } from '../../../../common/detection_engine/schemas/types/lists.mock';
 import { getThreatMock } from '../../../../common/detection_engine/schemas/types/threat.mock';
 import { getQueryRuleParams } from '../schemas/rule_schemas.mock';
+import { loggingSystemMock } from 'src/core/server/mocks';
+import { requestContextMock } from '../routes/__mocks__/request_context';
 
 describe.each([
   ['Legacy', false],
   ['RAC', true],
 ])('get_export_by_object_ids - %s', (_, isRuleRegistryEnabled) => {
+  let logger: ReturnType<typeof loggingSystemMock.createLogger>;
+  const { clients } = requestContextMock.createTools();
+
   beforeEach(() => {
     jest.resetAllMocks();
     jest.restoreAllMocks();
     jest.clearAllMocks();
+
+    clients.savedObjectsClient.find.mockResolvedValue(getEmptySavedObjectsResponse());
   });
+
   describe('getExportByObjectIds', () => {
     test('it exports object ids into an expected string with new line characters', async () => {
       const rulesClient = rulesClientMock.create();
       rulesClient.find.mockResolvedValue(getFindResultWithSingleHit(isRuleRegistryEnabled));
 
       const objects = [{ rule_id: 'rule-1' }];
-      const exports = await getExportByObjectIds(rulesClient, objects, isRuleRegistryEnabled);
+      const exports = await getExportByObjectIds(
+        rulesClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        isRuleRegistryEnabled
+      );
       const exportsObj = {
         rulesNdjson: JSON.parse(exports.rulesNdjson),
         exportDetails: JSON.parse(exports.exportDetails),
@@ -102,7 +117,13 @@ describe.each([
       rulesClient.find.mockResolvedValue(findResult);
 
       const objects = [{ rule_id: 'rule-1' }];
-      const exports = await getExportByObjectIds(rulesClient, objects, isRuleRegistryEnabled);
+      const exports = await getExportByObjectIds(
+        rulesClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        isRuleRegistryEnabled
+      );
       expect(exports).toEqual({
         rulesNdjson: '',
         exportDetails:
@@ -117,7 +138,13 @@ describe.each([
       rulesClient.find.mockResolvedValue(getFindResultWithSingleHit(isRuleRegistryEnabled));
 
       const objects = [{ rule_id: 'rule-1' }];
-      const exports = await getRulesFromObjects(rulesClient, objects, isRuleRegistryEnabled);
+      const exports = await getRulesFromObjects(
+        rulesClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        isRuleRegistryEnabled
+      );
       const expected: RulesErrors = {
         exportedCount: 1,
         missingRules: [],
@@ -192,7 +219,13 @@ describe.each([
       rulesClient.find.mockResolvedValue(findResult);
 
       const objects = [{ rule_id: 'rule-1' }];
-      const exports = await getRulesFromObjects(rulesClient, objects, isRuleRegistryEnabled);
+      const exports = await getRulesFromObjects(
+        rulesClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        isRuleRegistryEnabled
+      );
       const expected: RulesErrors = {
         exportedCount: 0,
         missingRules: [{ rule_id: 'rule-1' }],
@@ -215,7 +248,13 @@ describe.each([
       rulesClient.find.mockResolvedValue(findResult);
 
       const objects = [{ rule_id: 'rule-1' }];
-      const exports = await getRulesFromObjects(rulesClient, objects, isRuleRegistryEnabled);
+      const exports = await getRulesFromObjects(
+        rulesClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        isRuleRegistryEnabled
+      );
       const expected: RulesErrors = {
         exportedCount: 0,
         missingRules: [{ rule_id: 'rule-1' }],
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
index 4cf3ad9133a71..8233fe6d4948c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
@@ -8,14 +8,20 @@
 import { chunk } from 'lodash';
 import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 
+import { Logger } from 'src/core/server';
 import { RulesSchema } from '../../../../common/detection_engine/schemas/response/rules_schema';
-import { RulesClient } from '../../../../../alerting/server';
+import { RulesClient, AlertServices } from '../../../../../alerting/server';
+
 import { getExportDetailsNdjson } from './get_export_details_ndjson';
+
 import { isAlertType } from '../rules/types';
 import { transformAlertToRule } from '../routes/rules/utils';
 import { INTERNAL_RULE_ID_KEY } from '../../../../common/constants';
 import { findRules } from './find_rules';
 
+// eslint-disable-next-line no-restricted-imports
+import { legacyGetBulkRuleActionsSavedObject } from '../rule_actions/legacy_get_bulk_rule_actions_saved_object';
+
 interface ExportSuccessRule {
   statusCode: 200;
   rule: Partial<RulesSchema>;
@@ -34,23 +40,32 @@ export interface RulesErrors {
 
 export const getExportByObjectIds = async (
   rulesClient: RulesClient,
+  savedObjectsClient: AlertServices['savedObjectsClient'],
   objects: Array<{ rule_id: string }>,
+  logger: Logger,
   isRuleRegistryEnabled: boolean
 ): Promise<{
   rulesNdjson: string;
   exportDetails: string;
 }> => {
-  const rulesAndErrors = await getRulesFromObjects(rulesClient, objects, isRuleRegistryEnabled);
-  // We do not support importing/exporting actions. When we do, delete this line of code
-  const rulesWithoutActions = rulesAndErrors.rules.map((rule) => ({ ...rule, actions: [] }));
-  const rulesNdjson = transformDataToNdjson(rulesWithoutActions);
-  const exportDetails = getExportDetailsNdjson(rulesWithoutActions, rulesAndErrors.missingRules);
+  const rulesAndErrors = await getRulesFromObjects(
+    rulesClient,
+    savedObjectsClient,
+    objects,
+    logger,
+    isRuleRegistryEnabled
+  );
+
+  const rulesNdjson = transformDataToNdjson(rulesAndErrors.rules);
+  const exportDetails = getExportDetailsNdjson(rulesAndErrors.rules, rulesAndErrors.missingRules);
   return { rulesNdjson, exportDetails };
 };
 
 export const getRulesFromObjects = async (
   rulesClient: RulesClient,
+  savedObjectsClient: AlertServices['savedObjectsClient'],
   objects: Array<{ rule_id: string }>,
+  logger: Logger,
   isRuleRegistryEnabled: boolean
 ): Promise<RulesErrors> => {
   // If we put more than 1024 ids in one block like "alert.attributes.tags: (id1 OR id2 OR ... OR id1100)"
@@ -78,6 +93,13 @@ export const getRulesFromObjects = async (
     sortField: undefined,
     sortOrder: undefined,
   });
+  const alertIds = rules.data.map((rule) => rule.id);
+  const legacyActions = await legacyGetBulkRuleActionsSavedObject({
+    alertIds,
+    savedObjectsClient,
+    logger,
+  });
+
   const alertsAndErrors = objects.map(({ rule_id: ruleId }) => {
     const matchingRule = rules.data.find((rule) => rule.params.ruleId === ruleId);
     if (
@@ -87,7 +109,7 @@ export const getRulesFromObjects = async (
     ) {
       return {
         statusCode: 200,
-        rule: transformAlertToRule(matchingRule),
+        rule: transformAlertToRule(matchingRule, undefined, legacyActions[matchingRule.id]),
       };
     } else {
       return {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.mock.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.mock.ts
index 1d09e4ca5c508..3626bcd5f127e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.mock.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.mock.ts
@@ -7,6 +7,7 @@
 
 import { PatchRulesOptions } from './types';
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
+import { savedObjectsClientMock } from '../../../../../../../src/core/server/mocks';
 import { getAlertMock } from '../routes/__mocks__/request_responses';
 import { getMlRuleParams, getQueryRuleParams } from '../schemas/rule_schemas.mock';
 import { ruleExecutionLogClientMock } from '../rule_execution_log/__mocks__/rule_execution_log_client';
@@ -15,6 +16,7 @@ export const getPatchRulesOptionsMock = (isRuleRegistryEnabled: boolean): PatchR
   author: ['Elastic'],
   buildingBlockType: undefined,
   rulesClient: rulesClientMock.create(),
+  savedObjectsClient: savedObjectsClientMock.create(),
   spaceId: 'default',
   ruleStatusClient: ruleExecutionLogClientMock.create(),
   anomalyThreshold: undefined,
@@ -68,6 +70,7 @@ export const getPatchMlRulesOptionsMock = (isRuleRegistryEnabled: boolean): Patc
   author: ['Elastic'],
   buildingBlockType: undefined,
   rulesClient: rulesClientMock.create(),
+  savedObjectsClient: savedObjectsClientMock.create(),
   spaceId: 'default',
   ruleStatusClient: ruleExecutionLogClientMock.create(),
   anomalyThreshold: 55,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.ts
index c3b7e7288dc57..fd48cd4eebc2c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.ts
@@ -37,6 +37,7 @@ class PatchError extends Error {
 
 export const patchRules = async ({
   rulesClient,
+  savedObjectsClient,
   author,
   buildingBlockType,
   ruleStatusClient,
@@ -191,14 +192,14 @@ export const patchRules = async ({
 
   const newRule = {
     tags: addTags(tags ?? rule.tags, rule.params.ruleId, rule.params.immutable),
-    throttle: throttle !== undefined ? transformToAlertThrottle(throttle) : rule.throttle,
-    notifyWhen: throttle !== undefined ? transformToNotifyWhen(throttle) : rule.notifyWhen,
     name: calculateName({ updatedName: name, originalName: rule.name }),
     schedule: {
       interval: calculateInterval(interval, rule.schedule.interval),
     },
-    actions: actions?.map(transformRuleToAlertAction) ?? rule.actions,
     params: removeUndefined(nextParams),
+    actions: actions?.map(transformRuleToAlertAction) ?? rule.actions,
+    throttle: throttle !== undefined ? transformToAlertThrottle(throttle) : rule.throttle,
+    notifyWhen: throttle !== undefined ? transformToNotifyWhen(throttle) : rule.notifyWhen,
   };
 
   const [validated, errors] = validate(newRule, internalRuleUpdate);
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/types.ts
index 53a83d61da78d..a4ef081154010 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/types.ts
@@ -8,7 +8,12 @@
 import { get } from 'lodash/fp';
 import { Readable } from 'stream';
 
-import { SavedObject, SavedObjectAttributes, SavedObjectsFindResult } from 'kibana/server';
+import {
+  SavedObject,
+  SavedObjectAttributes,
+  SavedObjectsClientContract,
+  SavedObjectsFindResult,
+} from 'kibana/server';
 import type {
   MachineLearningJobIdOrUndefined,
   From,
@@ -271,12 +276,14 @@ export interface UpdateRulesOptions {
   rulesClient: RulesClient;
   defaultOutputIndex: string;
   ruleUpdate: UpdateRulesSchema;
+  savedObjectsClient: SavedObjectsClientContract;
 }
 
 export interface PatchRulesOptions {
   spaceId: string;
   ruleStatusClient: IRuleExecutionLogClient;
   rulesClient: RulesClient;
+  savedObjectsClient: SavedObjectsClientContract;
   anomalyThreshold: AnomalyThresholdOrUndefined;
   author: AuthorOrUndefined;
   buildingBlockType: BuildingBlockTypeOrUndefined;
@@ -323,7 +330,7 @@ export interface PatchRulesOptions {
   version: VersionOrUndefined;
   exceptionsList: ListArrayOrUndefined;
   actions: RuleAlertAction[] | undefined;
-  rule: SanitizedAlert<RuleParams> | null;
+  rule: SanitizedAlert<RuleParams> | null | undefined;
   namespace?: NamespaceOrUndefined;
 }
 
@@ -351,3 +358,9 @@ export interface FindRuleOptions {
   fields: FieldsOrUndefined;
   sortOrder: SortOrderOrUndefined;
 }
+
+export interface LegacyMigrateParams {
+  rulesClient: RulesClient;
+  savedObjectsClient: SavedObjectsClientContract;
+  rule: SanitizedAlert<RuleParams> | null | undefined;
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.test.ts
index 7c9f0c9ec67a3..9bd0fe3cef59a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.test.ts
@@ -6,6 +6,7 @@
  */
 
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
+import { savedObjectsClientMock } from '../../../../../../../src/core/server/mocks';
 import { getFindResultWithSingleHit } from '../routes/__mocks__/request_responses';
 import { updatePrepackagedRules } from './update_prepacked_rules';
 import { patchRules } from './patch_rules';
@@ -19,10 +20,12 @@ describe.each([
 ])('updatePrepackagedRules - %s', (_, isRuleRegistryEnabled) => {
   let rulesClient: ReturnType<typeof rulesClientMock.create>;
   let ruleStatusClient: ReturnType<typeof ruleExecutionLogClientMock.create>;
+  let savedObjectsClient: ReturnType<typeof savedObjectsClientMock.create>;
 
   beforeEach(() => {
     rulesClient = rulesClientMock.create();
     ruleStatusClient = ruleExecutionLogClientMock.create();
+    savedObjectsClient = savedObjectsClientMock.create();
   });
 
   it('should omit actions and enabled when calling patchRules', async () => {
@@ -40,6 +43,7 @@ describe.each([
 
     await updatePrepackagedRules(
       rulesClient,
+      savedObjectsClient,
       'default',
       ruleStatusClient,
       [{ ...prepackagedRule, actions }],
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.ts
index d9c2ecd1b5732..dcf43d41e8d78 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.ts
@@ -6,6 +6,7 @@
  */
 
 import { chunk } from 'lodash/fp';
+import { SavedObjectsClientContract } from 'kibana/server';
 import { AddPrepackagedRulesSchemaDecoded } from '../../../../common/detection_engine/schemas/request/add_prepackaged_rules_schema';
 import { RulesClient, PartialAlert } from '../../../../../alerting/server';
 import { patchRules } from './patch_rules';
@@ -13,6 +14,7 @@ import { readRules } from './read_rules';
 import { PartialFilter } from '../types';
 import { RuleParams } from '../schemas/rule_schemas';
 import { IRuleExecutionLogClient } from '../rule_execution_log/types';
+import { legacyMigrate } from './utils';
 
 /**
  * How many rules to update at a time is set to 50 from errors coming from
@@ -51,6 +53,7 @@ export const UPDATE_CHUNK_SIZE = 50;
  */
 export const updatePrepackagedRules = async (
   rulesClient: RulesClient,
+  savedObjectsClient: SavedObjectsClientContract,
   spaceId: string,
   ruleStatusClient: IRuleExecutionLogClient,
   rules: AddPrepackagedRulesSchemaDecoded[],
@@ -61,6 +64,7 @@ export const updatePrepackagedRules = async (
   for (const ruleChunk of ruleChunks) {
     const rulePromises = createPromises(
       rulesClient,
+      savedObjectsClient,
       spaceId,
       ruleStatusClient,
       ruleChunk,
@@ -82,6 +86,7 @@ export const updatePrepackagedRules = async (
  */
 export const createPromises = (
   rulesClient: RulesClient,
+  savedObjectsClient: SavedObjectsClientContract,
   spaceId: string,
   ruleStatusClient: IRuleExecutionLogClient,
   rules: AddPrepackagedRulesSchemaDecoded[],
@@ -146,10 +151,17 @@ export const createPromises = (
     // TODO: Fix these either with an is conversion or by better typing them within io-ts
     const filters: PartialFilter[] | undefined = filtersObject as PartialFilter[];
 
+    const migratedRule = await legacyMigrate({
+      rulesClient,
+      savedObjectsClient,
+      rule: existingRule,
+    });
+
     // Note: we do not pass down enabled as we do not want to suddenly disable
     // or enable rules on the user when they were not expecting it if a rule updates
     return patchRules({
       rulesClient,
+      savedObjectsClient,
       author,
       buildingBlockType,
       description,
@@ -160,7 +172,7 @@ export const createPromises = (
       language,
       license,
       outputIndex,
-      rule: existingRule,
+      rule: migratedRule,
       savedId,
       spaceId,
       ruleStatusClient,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.mock.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.mock.ts
index 58d6cf1fd5e6b..9a7711fcc8987 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.mock.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.mock.ts
@@ -6,6 +6,7 @@
  */
 
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
+import { savedObjectsClientMock } from '../../../../../../../src/core/server/mocks';
 import {
   getUpdateMachineLearningSchemaMock,
   getUpdateRulesSchemaMock,
@@ -16,6 +17,7 @@ export const getUpdateRulesOptionsMock = (isRuleRegistryEnabled: boolean) => ({
   spaceId: 'default',
   rulesClient: rulesClientMock.create(),
   ruleStatusClient: ruleExecutionLogClientMock.create(),
+  savedObjectsClient: savedObjectsClientMock.create(),
   defaultOutputIndex: '.siem-signals-default',
   ruleUpdate: getUpdateRulesSchemaMock(),
   isRuleRegistryEnabled,
@@ -25,6 +27,7 @@ export const getUpdateMlRulesOptionsMock = (isRuleRegistryEnabled: boolean) => (
   spaceId: 'default',
   rulesClient: rulesClientMock.create(),
   ruleStatusClient: ruleExecutionLogClientMock.create(),
+  savedObjectsClient: savedObjectsClientMock.create(),
   defaultOutputIndex: '.siem-signals-default',
   ruleUpdate: getUpdateMachineLearningSchemaMock(),
   isRuleRegistryEnabled,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.ts
index f4060f7f831a9..4268ed9014066 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.ts
@@ -6,7 +6,7 @@
  */
 
 /* eslint-disable complexity */
-
+import { validate } from '@kbn/securitysolution-io-ts-utils';
 import { DEFAULT_MAX_SIGNALS } from '../../../../common/constants';
 import { transformRuleToAlertAction } from '../../../../common/detection_engine/transform_actions';
 import { PartialAlert } from '../../../../../alerting/server';
@@ -14,10 +14,18 @@ import { readRules } from './read_rules';
 import { UpdateRulesOptions } from './types';
 import { addTags } from './add_tags';
 import { typeSpecificSnakeToCamel } from '../schemas/rule_converters';
-import { RuleParams } from '../schemas/rule_schemas';
+import { internalRuleUpdate, RuleParams } from '../schemas/rule_schemas';
 import { enableRule } from './enable_rule';
 import { maybeMute, transformToAlertThrottle, transformToNotifyWhen } from './utils';
 
+class UpdateError extends Error {
+  public readonly statusCode: number;
+  constructor(message: string, statusCode: number) {
+    super(message);
+    this.statusCode = statusCode;
+  }
+}
+
 export const updateRules = async ({
   isRuleRegistryEnabled,
   spaceId,
@@ -25,6 +33,7 @@ export const updateRules = async ({
   ruleStatusClient,
   defaultOutputIndex,
   ruleUpdate,
+  savedObjectsClient,
 }: UpdateRulesOptions): Promise<PartialAlert<RuleParams> | null> => {
   const existingRule = await readRules({
     isRuleRegistryEnabled,
@@ -82,9 +91,14 @@ export const updateRules = async ({
     notifyWhen: transformToNotifyWhen(ruleUpdate.throttle),
   };
 
+  const [validated, errors] = validate(newInternalRule, internalRuleUpdate);
+  if (errors != null || validated === null) {
+    throw new UpdateError(`Applying update would create invalid rule: ${errors}`, 400);
+  }
+
   const update = await rulesClient.update({
     id: existingRule.id,
-    data: newInternalRule,
+    data: validated,
   });
 
   await maybeMute({
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts
index 4647a4a9951df..a558024a73e34 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts
@@ -65,6 +65,9 @@ import { RulesClient } from '../../../../../alerting/server';
 import { LegacyRuleActions } from '../rule_actions/legacy_types';
 import { FullResponseSchema } from '../../../../common/detection_engine/schemas/request';
 import { transformAlertToRuleAction } from '../../../../common/detection_engine/transform_actions';
+// eslint-disable-next-line no-restricted-imports
+import { legacyRuleActionsSavedObjectType } from '../rule_actions/legacy_saved_object_mappings';
+import { LegacyMigrateParams } from './types';
 
 export const calculateInterval = (
   interval: string | undefined,
@@ -296,3 +299,62 @@ export const maybeMute = async ({
     // Do nothing, no-operation
   }
 };
+
+/**
+ * Determines if rule needs to be migrated from legacy actions
+ * and returns necessary pieces for the updated rule
+ */
+export const legacyMigrate = async ({
+  rulesClient,
+  savedObjectsClient,
+  rule,
+}: LegacyMigrateParams): Promise<SanitizedAlert<RuleParams> | null | undefined> => {
+  if (rule == null || rule.id == null) {
+    return rule;
+  }
+  /**
+   * On update / patch I'm going to take the actions as they are, better off taking rules client.find (siem.notification) result
+   * and putting that into the actions array of the rule, then set the rules onThrottle property, notifyWhen and throttle from null -> actualy value (1hr etc..)
+   * Then use the rules client to delete the siem.notification
+   * Then with the legacy Rule Actions saved object type, just delete it.
+   */
+
+  // find it using the references array, not params.ruleAlertId
+  const [siemNotification, legacyRuleActionsSO] = await Promise.all([
+    rulesClient.find({
+      options: {
+        hasReference: {
+          type: 'alert',
+          id: rule.id,
+        },
+      },
+    }),
+    savedObjectsClient.find({
+      type: legacyRuleActionsSavedObjectType,
+    }),
+  ]);
+
+  if (siemNotification != null && siemNotification.data.length > 0) {
+    await Promise.all([
+      rulesClient.delete({ id: siemNotification.data[0].id }),
+      legacyRuleActionsSO != null && legacyRuleActionsSO.saved_objects.length > 0
+        ? savedObjectsClient.delete(
+            legacyRuleActionsSavedObjectType,
+            legacyRuleActionsSO.saved_objects[0].id
+          )
+        : null,
+    ]);
+    const migratedRule = {
+      ...rule,
+      actions: siemNotification.data[0].actions,
+      throttle: siemNotification.data[0].schedule.interval,
+      notifyWhen: transformToNotifyWhen(siemNotification.data[0].throttle),
+    };
+    await rulesClient.update({
+      id: rule.id,
+      data: migratedRule,
+    });
+    return migratedRule;
+  }
+  return rule;
+};
diff --git a/x-pack/plugins/security_solution/server/routes/index.ts b/x-pack/plugins/security_solution/server/routes/index.ts
index d045c6b129e43..148580d5c4477 100644
--- a/x-pack/plugins/security_solution/server/routes/index.ts
+++ b/x-pack/plugins/security_solution/server/routes/index.ts
@@ -91,12 +91,12 @@ export const initRoutes = (
   updateRulesBulkRoute(router, ml, isRuleRegistryEnabled);
   patchRulesBulkRoute(router, ml, isRuleRegistryEnabled);
   deleteRulesBulkRoute(router, isRuleRegistryEnabled);
-  performBulkActionRoute(router, ml, isRuleRegistryEnabled);
+  performBulkActionRoute(router, ml, logger, isRuleRegistryEnabled);
 
   createTimelinesRoute(router, config, security);
   patchTimelinesRoute(router, config, security);
   importRulesRoute(router, config, ml, isRuleRegistryEnabled);
-  exportRulesRoute(router, config, isRuleRegistryEnabled);
+  exportRulesRoute(router, config, logger, isRuleRegistryEnabled);
 
   importTimelinesRoute(router, config, security);
   exportTimelinesRoute(router, config, security);
diff --git a/x-pack/plugins/snapshot_restore/common/constants.ts b/x-pack/plugins/snapshot_restore/common/constants.ts
index b18e118dc5ff6..df13bd4c2f1f0 100644
--- a/x-pack/plugins/snapshot_restore/common/constants.ts
+++ b/x-pack/plugins/snapshot_restore/common/constants.ts
@@ -20,6 +20,8 @@ export const PLUGIN = {
   },
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const API_BASE_PATH = '/api/snapshot_restore/';
 
 export enum REPOSITORY_TYPES {
diff --git a/x-pack/plugins/snapshot_restore/public/plugin.ts b/x-pack/plugins/snapshot_restore/public/plugin.ts
index bb091a1fd1831..0351716fad5b5 100644
--- a/x-pack/plugins/snapshot_restore/public/plugin.ts
+++ b/x-pack/plugins/snapshot_restore/public/plugin.ts
@@ -42,52 +42,58 @@ export class SnapshotRestoreUIPlugin {
 
   public setup(coreSetup: CoreSetup, plugins: PluginsDependencies): void {
     const config = this.initializerContext.config.get<ClientConfigType>();
-    const { http } = coreSetup;
-    const { home, management, usageCollection } = plugins;
+    const {
+      ui: { enabled: isSnapshotRestoreUiEnabled },
+    } = config;
 
-    // Initialize services
-    this.uiMetricService.setup(usageCollection);
-    textService.setup(i18n);
-    httpService.setup(http);
+    if (isSnapshotRestoreUiEnabled) {
+      const { http } = coreSetup;
+      const { home, management, usageCollection } = plugins;
 
-    management.sections.section.data.registerApp({
-      id: PLUGIN.id,
-      title: i18n.translate('xpack.snapshotRestore.appTitle', {
-        defaultMessage: 'Snapshot and Restore',
-      }),
-      order: 3,
-      mount: async (params) => {
-        const { mountManagementSection } = await import('./application/mount_management_section');
-        const services = {
-          uiMetricService: this.uiMetricService,
-        };
-        return await mountManagementSection(coreSetup, services, config, params);
-      },
-    });
+      // Initialize services
+      this.uiMetricService.setup(usageCollection);
+      textService.setup(i18n);
+      httpService.setup(http);
 
-    if (home) {
-      home.featureCatalogue.register({
+      management.sections.section.data.registerApp({
         id: PLUGIN.id,
-        title: i18n.translate('xpack.snapshotRestore.featureCatalogueTitle', {
-          defaultMessage: 'Back up and restore',
+        title: i18n.translate('xpack.snapshotRestore.appTitle', {
+          defaultMessage: 'Snapshot and Restore',
         }),
-        description: i18n.translate('xpack.snapshotRestore.featureCatalogueDescription', {
-          defaultMessage:
-            'Save snapshots to a backup repository, and restore to recover index and cluster state.',
-        }),
-        icon: 'storage',
-        path: '/app/management/data/snapshot_restore',
-        showOnHomePage: true,
-        category: FeatureCatalogueCategory.ADMIN,
-        order: 630,
+        order: 3,
+        mount: async (params) => {
+          const { mountManagementSection } = await import('./application/mount_management_section');
+          const services = {
+            uiMetricService: this.uiMetricService,
+          };
+          return await mountManagementSection(coreSetup, services, config, params);
+        },
       });
-    }
 
-    plugins.share.url.locators.create(
-      new SnapshotRestoreLocatorDefinition({
-        managementAppLocator: plugins.management.locator,
-      })
-    );
+      if (home) {
+        home.featureCatalogue.register({
+          id: PLUGIN.id,
+          title: i18n.translate('xpack.snapshotRestore.featureCatalogueTitle', {
+            defaultMessage: 'Back up and restore',
+          }),
+          description: i18n.translate('xpack.snapshotRestore.featureCatalogueDescription', {
+            defaultMessage:
+              'Save snapshots to a backup repository, and restore to recover index and cluster state.',
+          }),
+          icon: 'storage',
+          path: '/app/management/data/snapshot_restore',
+          showOnHomePage: true,
+          category: FeatureCatalogueCategory.ADMIN,
+          order: 630,
+        });
+      }
+
+      plugins.share.url.locators.create(
+        new SnapshotRestoreLocatorDefinition({
+          managementAppLocator: plugins.management.locator,
+        })
+      );
+    }
   }
 
   public start() {}
diff --git a/x-pack/plugins/snapshot_restore/public/types.ts b/x-pack/plugins/snapshot_restore/public/types.ts
index b73170ad9d578..c58c942b4bc16 100644
--- a/x-pack/plugins/snapshot_restore/public/types.ts
+++ b/x-pack/plugins/snapshot_restore/public/types.ts
@@ -7,4 +7,5 @@
 
 export interface ClientConfigType {
   slm_ui: { enabled: boolean };
+  ui: { enabled: boolean };
 }
diff --git a/x-pack/plugins/snapshot_restore/server/config.ts b/x-pack/plugins/snapshot_restore/server/config.ts
index f0ca416ef2032..cc430f4756610 100644
--- a/x-pack/plugins/snapshot_restore/server/config.ts
+++ b/x-pack/plugins/snapshot_restore/server/config.ts
@@ -4,14 +4,98 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    slm_ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<SnapshotRestoreConfig> = {
+  exposeToBrowser: {
+    ui: true,
+    slm_ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  slm_ui: schema.object({
+export type SnapshotRestoreConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    slm_ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type SnapshotRestoreConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<SnapshotRestoreConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+    slm_ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.snapshot_restore.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.snapshot_restore.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.snapshotRestore.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.snapshot_restore.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.snapshotRestore.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Snapshot and Restore UI, use the "xpack.snapshot_restore.ui.enabled" setting instead of "xpack.snapshot_restore.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.snapshotRestore.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.snapshotRestore.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.snapshot_restore.enabled" setting to "xpack.snapshot_restore.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type SnapshotRestoreConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<SnapshotRestoreConfig | SnapshotRestoreConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/snapshot_restore/server/index.ts b/x-pack/plugins/snapshot_restore/server/index.ts
index e10bffd6073d2..1e9d2b55aa20b 100644
--- a/x-pack/plugins/snapshot_restore/server/index.ts
+++ b/x-pack/plugins/snapshot_restore/server/index.ts
@@ -5,16 +5,9 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'kibana/server';
+import { PluginInitializerContext } from 'kibana/server';
 import { SnapshotRestoreServerPlugin } from './plugin';
-import { configSchema, SnapshotRestoreConfig } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) => new SnapshotRestoreServerPlugin(ctx);
+export { config } from './config';
 
-export const config: PluginConfigDescriptor<SnapshotRestoreConfig> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
-  exposeToBrowser: {
-    slm_ui: true,
-  },
-};
+export const plugin = (ctx: PluginInitializerContext) => new SnapshotRestoreServerPlugin(ctx);
diff --git a/x-pack/plugins/snapshot_restore/server/plugin.ts b/x-pack/plugins/snapshot_restore/server/plugin.ts
index 4414e3735959b..d737807ec8dad 100644
--- a/x-pack/plugins/snapshot_restore/server/plugin.ts
+++ b/x-pack/plugins/snapshot_restore/server/plugin.ts
@@ -28,16 +28,9 @@ export class SnapshotRestoreServerPlugin implements Plugin<void, void, any, any>
     this.license = new License();
   }
 
-  public setup(
-    { http, getStartServices }: CoreSetup,
-    { licensing, features, security, cloud }: Dependencies
-  ): void {
+  public setup({ http }: CoreSetup, { licensing, features, security, cloud }: Dependencies): void {
     const pluginConfig = this.context.config.get<SnapshotRestoreConfig>();
 
-    if (!pluginConfig.enabled) {
-      return;
-    }
-
     const router = http.createRouter();
 
     this.license.setup(
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
index 5bceb31081687..f9f6a2ea57917 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
@@ -24,6 +24,7 @@ export interface TimelineEventsDetailsItem {
 export interface TimelineEventsDetailsStrategyResponse extends IEsSearchResponse {
   data?: Maybe<TimelineEventsDetailsItem[]>;
   inspect?: Maybe<Inspect>;
+  rawEventData?: Maybe<object>;
 }
 
 export interface TimelineEventsDetailsRequestOptions
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
index c82d9af938a98..b60add2515ec9 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
@@ -57,10 +57,14 @@ export const timelineEventsDetails: TimelineFactory<TimelineEventsQueries.detail
     );
 
     const data = unionBy('field', fieldsData, sourceData);
+
+    const rawEventData = response.rawResponse.hits.hits[0];
+
     return {
       ...response,
       data,
       inspect,
+      rawEventData,
     };
   },
 };
diff --git a/x-pack/plugins/transform/common/api_schemas/transforms.ts b/x-pack/plugins/transform/common/api_schemas/transforms.ts
index 7fb1a62a67bb8..8867ecb5cc760 100644
--- a/x-pack/plugins/transform/common/api_schemas/transforms.ts
+++ b/x-pack/plugins/transform/common/api_schemas/transforms.ts
@@ -12,7 +12,7 @@ import type { ES_FIELD_TYPES } from '../../../../../src/plugins/data/common';
 import type { Dictionary } from '../types/common';
 import type { PivotAggDict } from '../types/pivot_aggs';
 import type { PivotGroupByDict } from '../types/pivot_group_by';
-import type { TransformId, TransformPivotConfig } from '../types/transform';
+import type { TransformId, TransformConfigUnion } from '../types/transform';
 
 import { transformStateSchema, runtimeMappingsSchema } from './common';
 
@@ -33,7 +33,7 @@ export type GetTransformsRequestSchema = TypeOf<typeof getTransformsRequestSchem
 
 export interface GetTransformsResponseSchema {
   count: number;
-  transforms: TransformPivotConfig[];
+  transforms: TransformConfigUnion[];
 }
 
 // schemas shared by parts of the preview, create and update endpoint
diff --git a/x-pack/plugins/transform/common/types/alerting.ts b/x-pack/plugins/transform/common/types/alerting.ts
index 48a80a3889107..dde9a360d9473 100644
--- a/x-pack/plugins/transform/common/types/alerting.ts
+++ b/x-pack/plugins/transform/common/types/alerting.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { AlertTypeParams } from '../../../alerting/common';
+import type { Alert, AlertTypeParams } from '../../../alerting/common';
 
 export type TransformHealthRuleParams = {
   includeTransforms?: string[];
@@ -20,3 +20,5 @@ export type TransformHealthRuleParams = {
 export type TransformHealthRuleTestsConfig = TransformHealthRuleParams['testsConfig'];
 
 export type TransformHealthTests = keyof Exclude<TransformHealthRuleTestsConfig, null | undefined>;
+
+export type TransformHealthAlertRule = Omit<Alert<TransformHealthRuleParams>, 'apiKey'>;
diff --git a/x-pack/plugins/transform/common/types/transform.ts b/x-pack/plugins/transform/common/types/transform.ts
index f1e7efdadca9d..a478946ff917c 100644
--- a/x-pack/plugins/transform/common/types/transform.ts
+++ b/x-pack/plugins/transform/common/types/transform.ts
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
-import { EuiComboBoxOptionOption } from '@elastic/eui/src/components/combo_box/types';
+import type { EuiComboBoxOptionOption } from '@elastic/eui/src/components/combo_box/types';
 import type { LatestFunctionConfig, PutTransformsRequestSchema } from '../api_schemas/transforms';
 import { isPopulatedObject } from '../shared_imports';
-import { PivotGroupByDict } from './pivot_group_by';
-import { PivotAggDict } from './pivot_aggs';
+import type { PivotGroupByDict } from './pivot_group_by';
+import type { PivotAggDict } from './pivot_aggs';
+import type { TransformHealthAlertRule } from './alerting';
 
 export type IndexName = string;
 export type IndexPattern = string;
@@ -22,6 +23,7 @@ export type TransformBaseConfig = PutTransformsRequestSchema & {
   id: TransformId;
   create_time?: number;
   version?: string;
+  alerting_rules?: TransformHealthAlertRule[];
 };
 
 export interface PivotConfigDefinition {
@@ -45,6 +47,11 @@ export type TransformLatestConfig = Omit<TransformBaseConfig, 'pivot'> & {
 
 export type TransformConfigUnion = TransformPivotConfig | TransformLatestConfig;
 
+export type ContinuousTransform = Omit<TransformConfigUnion, 'sync'> &
+  Required<{
+    sync: TransformConfigUnion['sync'];
+  }>;
+
 export function isPivotTransform(transform: unknown): transform is TransformPivotConfig {
   return isPopulatedObject(transform, ['pivot']);
 }
@@ -53,6 +60,10 @@ export function isLatestTransform(transform: unknown): transform is TransformLat
   return isPopulatedObject(transform, ['latest']);
 }
 
+export function isContinuousTransform(transform: unknown): transform is ContinuousTransform {
+  return isPopulatedObject(transform, ['sync']);
+}
+
 export interface LatestFunctionConfigUI {
   unique_key: Array<EuiComboBoxOptionOption<string>> | undefined;
   sort: EuiComboBoxOptionOption<string> | undefined;
diff --git a/x-pack/plugins/transform/public/alerting/transform_alerting_flyout.tsx b/x-pack/plugins/transform/public/alerting/transform_alerting_flyout.tsx
new file mode 100644
index 0000000000000..63d00f280f3f3
--- /dev/null
+++ b/x-pack/plugins/transform/public/alerting/transform_alerting_flyout.tsx
@@ -0,0 +1,127 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { createContext, FC, useContext, useMemo } from 'react';
+import { memoize } from 'lodash';
+import { BehaviorSubject, Observable } from 'rxjs';
+import { pluck } from 'rxjs/operators';
+import useObservable from 'react-use/lib/useObservable';
+import { useAppDependencies } from '../app/app_dependencies';
+import { TransformHealthAlertRule, TransformHealthRuleParams } from '../../common/types/alerting';
+import { TRANSFORM_RULE_TYPE } from '../../common';
+
+interface TransformAlertFlyoutProps {
+  initialAlert?: TransformHealthAlertRule | null;
+  ruleParams?: TransformHealthRuleParams | null;
+  onSave?: () => void;
+  onCloseFlyout: () => void;
+}
+
+export const TransformAlertFlyout: FC<TransformAlertFlyoutProps> = ({
+  initialAlert,
+  ruleParams,
+  onCloseFlyout,
+  onSave,
+}) => {
+  const { triggersActionsUi } = useAppDependencies();
+
+  const AlertFlyout = useMemo(() => {
+    if (!triggersActionsUi) return;
+
+    const commonProps = {
+      onClose: () => {
+        onCloseFlyout();
+      },
+      onSave: async () => {
+        if (onSave) {
+          onSave();
+        }
+      },
+    };
+
+    if (initialAlert) {
+      return triggersActionsUi.getEditAlertFlyout({
+        ...commonProps,
+        initialAlert,
+      });
+    }
+
+    return triggersActionsUi.getAddAlertFlyout({
+      ...commonProps,
+      consumer: 'stackAlerts',
+      canChangeTrigger: false,
+      alertTypeId: TRANSFORM_RULE_TYPE.TRANSFORM_HEALTH,
+      metadata: {},
+      initialValues: {
+        params: ruleParams!,
+      },
+    });
+    // deps on id to avoid re-rendering on auto-refresh
+  }, [triggersActionsUi, initialAlert, ruleParams, onCloseFlyout, onSave]);
+
+  return <>{AlertFlyout}</>;
+};
+
+interface AlertRulesManage {
+  editAlertRule$: Observable<TransformHealthAlertRule | null>;
+  createAlertRule$: Observable<TransformHealthRuleParams | null>;
+  setEditAlertRule: (alertRule: TransformHealthAlertRule) => void;
+  setCreateAlertRule: (transformId: string) => void;
+  hideAlertFlyout: () => void;
+}
+
+export const getAlertRuleManageContext = memoize(function (): AlertRulesManage {
+  const ruleState$ = new BehaviorSubject<{
+    editAlertRule: null | TransformHealthAlertRule;
+    createAlertRule: null | TransformHealthRuleParams;
+  }>({
+    editAlertRule: null,
+    createAlertRule: null,
+  });
+  return {
+    editAlertRule$: ruleState$.pipe(pluck('editAlertRule')),
+    createAlertRule$: ruleState$.pipe(pluck('createAlertRule')),
+    setEditAlertRule: (initialRule) => {
+      ruleState$.next({
+        createAlertRule: null,
+        editAlertRule: initialRule,
+      });
+    },
+    setCreateAlertRule: (transformId: string) => {
+      ruleState$.next({
+        createAlertRule: { includeTransforms: [transformId] },
+        editAlertRule: null,
+      });
+    },
+    hideAlertFlyout: () => {
+      ruleState$.next({
+        createAlertRule: null,
+        editAlertRule: null,
+      });
+    },
+  };
+});
+
+export const AlertRulesManageContext = createContext<AlertRulesManage>(getAlertRuleManageContext());
+
+export function useAlertRuleFlyout(): AlertRulesManage {
+  return useContext(AlertRulesManageContext);
+}
+
+export const TransformAlertFlyoutWrapper = () => {
+  const { editAlertRule$, createAlertRule$, hideAlertFlyout } = useAlertRuleFlyout();
+  const editAlertRule = useObservable(editAlertRule$);
+  const createAlertRule = useObservable(createAlertRule$);
+
+  return editAlertRule || createAlertRule ? (
+    <TransformAlertFlyout
+      initialAlert={editAlertRule}
+      ruleParams={createAlertRule!}
+      onCloseFlyout={hideAlertFlyout}
+    />
+  ) : null;
+};
diff --git a/x-pack/plugins/transform/public/app/__mocks__/app_dependencies.tsx b/x-pack/plugins/transform/public/app/__mocks__/app_dependencies.tsx
index 8dc0e277c284d..ab38d05ec9f8f 100644
--- a/x-pack/plugins/transform/public/app/__mocks__/app_dependencies.tsx
+++ b/x-pack/plugins/transform/public/app/__mocks__/app_dependencies.tsx
@@ -19,6 +19,7 @@ import { Storage } from '../../../../../../src/plugins/kibana_utils/public';
 import type { AppDependencies } from '../app_dependencies';
 import { MlSharedContext } from './shared_context';
 import type { GetMlSharedImportsReturnType } from '../../shared_imports';
+import type { TriggersAndActionsUIPublicPluginStart } from '../../../../triggers_actions_ui/public';
 
 const coreSetup = coreMock.createSetup();
 const coreStart = coreMock.createStart();
@@ -43,6 +44,7 @@ const appDependencies: AppDependencies = {
   savedObjectsPlugin: savedObjectsPluginMock.createStartContract(),
   share: { urlGenerators: { getUrlGenerator: jest.fn() } } as unknown as SharePluginStart,
   ml: {} as GetMlSharedImportsReturnType,
+  triggersActionsUi: {} as jest.Mocked<TriggersAndActionsUIPublicPluginStart>,
 };
 
 export const useAppDependencies = () => {
diff --git a/x-pack/plugins/transform/public/app/app_dependencies.tsx b/x-pack/plugins/transform/public/app/app_dependencies.tsx
index d3f356f3e83b3..da1178e395720 100644
--- a/x-pack/plugins/transform/public/app/app_dependencies.tsx
+++ b/x-pack/plugins/transform/public/app/app_dependencies.tsx
@@ -16,6 +16,7 @@ import { useKibana } from '../../../../../src/plugins/kibana_react/public';
 import type { Storage } from '../../../../../src/plugins/kibana_utils/public';
 
 import type { GetMlSharedImportsReturnType } from '../shared_imports';
+import type { TriggersAndActionsUIPublicPluginStart } from '../../../triggers_actions_ui/public';
 
 export interface AppDependencies {
   application: CoreStart['application'];
@@ -34,6 +35,7 @@ export interface AppDependencies {
   share: SharePluginStart;
   ml: GetMlSharedImportsReturnType;
   spaces?: SpacesPluginStart;
+  triggersActionsUi: TriggersAndActionsUIPublicPluginStart;
 }
 
 export const useAppDependencies = () => {
diff --git a/x-pack/plugins/transform/public/app/common/transform_list.ts b/x-pack/plugins/transform/public/app/common/transform_list.ts
index d73018e284a8c..c8ddd32f6a8ff 100644
--- a/x-pack/plugins/transform/public/app/common/transform_list.ts
+++ b/x-pack/plugins/transform/public/app/common/transform_list.ts
@@ -5,10 +5,10 @@
  * 2.0.
  */
 
-import { EuiTableActionsColumnType } from '@elastic/eui';
-
-import { TransformConfigUnion, TransformId } from '../../../common/types/transform';
-import { TransformStats } from '../../../common/types/transform_stats';
+import type { EuiTableActionsColumnType } from '@elastic/eui';
+import type { TransformConfigUnion, TransformId } from '../../../common/types/transform';
+import type { TransformStats } from '../../../common/types/transform_stats';
+import type { TransformHealthAlertRule } from '../../../common/types/alerting';
 
 // Used to pass on attribute names to table columns
 export enum TRANSFORM_LIST_COLUMN {
@@ -21,6 +21,7 @@ export interface TransformListRow {
   config: TransformConfigUnion;
   mode?: string; // added property on client side to allow filtering by this field
   stats: TransformStats;
+  alerting_rules?: TransformHealthAlertRule[];
 }
 
 // The single Action type is not exported as is
diff --git a/x-pack/plugins/transform/public/app/hooks/use_get_transforms.ts b/x-pack/plugins/transform/public/app/hooks/use_get_transforms.ts
index 2d3425dfeedca..7879e15118a33 100644
--- a/x-pack/plugins/transform/public/app/hooks/use_get_transforms.ts
+++ b/x-pack/plugins/transform/public/app/hooks/use_get_transforms.ts
@@ -87,6 +87,7 @@ export const useGetTransforms = (
           mode:
             typeof config.sync !== 'undefined' ? TRANSFORM_MODE.CONTINUOUS : TRANSFORM_MODE.BATCH,
           stats,
+          alerting_rules: config.alerting_rules,
         });
         return reducedtableRows;
       }, [] as TransformListRow[]);
diff --git a/x-pack/plugins/transform/public/app/lib/authorization/components/authorization_provider.tsx b/x-pack/plugins/transform/public/app/lib/authorization/components/authorization_provider.tsx
index 875c0f60969ed..cc6313bf058c6 100644
--- a/x-pack/plugins/transform/public/app/lib/authorization/components/authorization_provider.tsx
+++ b/x-pack/plugins/transform/public/app/lib/authorization/components/authorization_provider.tsx
@@ -20,12 +20,14 @@ interface Authorization {
   capabilities: Capabilities;
 }
 
-const initialCapabalities: Capabilities = {
+const initialCapabilities: Capabilities = {
   canGetTransform: false,
   canDeleteTransform: false,
   canPreviewTransform: false,
   canCreateTransform: false,
   canStartStopTransform: false,
+  canCreateTransformAlerts: false,
+  canUseTransformAlerts: false,
 };
 
 const initialValue: Authorization = {
@@ -35,7 +37,7 @@ const initialValue: Authorization = {
     hasAllPrivileges: false,
     missingPrivileges: {},
   },
-  capabilities: initialCapabalities,
+  capabilities: initialCapabilities,
 };
 
 export const AuthorizationContext = createContext<Authorization>({ ...initialValue });
@@ -58,7 +60,7 @@ export const AuthorizationProvider = ({ privilegesEndpoint, children }: Props) =
   const value = {
     isLoading,
     privileges: isLoading ? { ...initialValue.privileges } : privilegesData,
-    capabilities: { ...initialCapabalities },
+    capabilities: { ...initialCapabilities },
     apiError: error ? (error as Error) : null,
   };
 
@@ -85,6 +87,10 @@ export const AuthorizationProvider = ({ privilegesEndpoint, children }: Props) =
     hasPrivilege(['cluster', 'cluster:admin/transform/start_task']) &&
     hasPrivilege(['cluster', 'cluster:admin/transform/stop']);
 
+  value.capabilities.canCreateTransformAlerts = value.capabilities.canCreateTransform;
+
+  value.capabilities.canUseTransformAlerts = value.capabilities.canGetTransform;
+
   return (
     <AuthorizationContext.Provider value={{ ...value }}>{children}</AuthorizationContext.Provider>
   );
diff --git a/x-pack/plugins/transform/public/app/lib/authorization/components/common.ts b/x-pack/plugins/transform/public/app/lib/authorization/components/common.ts
index d059f73a76137..d430a4d059e5c 100644
--- a/x-pack/plugins/transform/public/app/lib/authorization/components/common.ts
+++ b/x-pack/plugins/transform/public/app/lib/authorization/components/common.ts
@@ -16,6 +16,8 @@ export interface Capabilities {
   canPreviewTransform: boolean;
   canCreateTransform: boolean;
   canStartStopTransform: boolean;
+  canCreateTransformAlerts: boolean;
+  canUseTransformAlerts: boolean;
 }
 
 export type Privilege = [string, string];
@@ -67,6 +69,14 @@ export function createCapabilityFailureMessage(
         defaultMessage: 'You do not have permission to create transforms.',
       });
       break;
+    case 'canCreateTransformAlerts':
+      message = i18n.translate(
+        'xpack.transform.capability.noPermission.canCreateTransformAlertsTooltip',
+        {
+          defaultMessage: 'You do not have permission to create transform alert rules.',
+        }
+      );
+      break;
     case 'canStartStopTransform':
       message = i18n.translate(
         'xpack.transform.capability.noPermission.startOrStopTransformTooltip',
diff --git a/x-pack/plugins/transform/public/app/mount_management_section.ts b/x-pack/plugins/transform/public/app/mount_management_section.ts
index 1747330818547..6e63094064584 100644
--- a/x-pack/plugins/transform/public/app/mount_management_section.ts
+++ b/x-pack/plugins/transform/public/app/mount_management_section.ts
@@ -29,7 +29,7 @@ export async function mountManagementSection(
   const startServices = await getStartServices();
   const [core, plugins] = startServices;
   const { application, chrome, docLinks, i18n, overlays, savedObjects, uiSettings } = core;
-  const { data, share, spaces } = plugins;
+  const { data, share, spaces, triggersActionsUi } = plugins;
   const { docTitle } = chrome;
 
   // Initialize services
@@ -55,6 +55,7 @@ export async function mountManagementSection(
     share,
     spaces,
     ml: await getMlSharedImports(),
+    triggersActionsUi,
   };
 
   const unmountAppCallback = renderApp(element, appDependencies);
diff --git a/x-pack/plugins/transform/public/app/sections/clone_transform/clone_transform_section.tsx b/x-pack/plugins/transform/public/app/sections/clone_transform/clone_transform_section.tsx
index 8aecf403186c5..218edb95c5f4f 100644
--- a/x-pack/plugins/transform/public/app/sections/clone_transform/clone_transform_section.tsx
+++ b/x-pack/plugins/transform/public/app/sections/clone_transform/clone_transform_section.tsx
@@ -21,7 +21,7 @@ import {
 } from '@elastic/eui';
 
 import { APP_CREATE_TRANSFORM_CLUSTER_PRIVILEGES } from '../../../../common/constants';
-import { TransformPivotConfig } from '../../../../common/types/transform';
+import { TransformConfigUnion } from '../../../../common/types/transform';
 
 import { isHttpFetchError } from '../../common/request';
 import { useApi } from '../../hooks/use_api';
@@ -50,7 +50,7 @@ export const CloneTransformSection: FC<Props> = ({ match, location }) => {
 
   const transformId = match.params.transformId;
 
-  const [transformConfig, setTransformConfig] = useState<TransformPivotConfig>();
+  const [transformConfig, setTransformConfig] = useState<TransformConfigUnion>();
   const [errorMessage, setErrorMessage] = useState<string>();
   const [isInitialized, setIsInitialized] = useState(false);
   const { error: searchItemsError, searchItems, setSavedObjectId } = useSearchItems(undefined);
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_create/step_create_form.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_create/step_create_form.tsx
index 7ccf986d5d497..859ea77ea5a14 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_create/step_create_form.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_create/step_create_form.tsx
@@ -23,6 +23,7 @@ import {
   EuiText,
 } from '@elastic/eui';
 
+import { FormattedMessage } from '@kbn/i18n/react';
 import { toMountPoint } from '../../../../../../../../../src/plugins/kibana_react/public';
 
 import {
@@ -52,7 +53,8 @@ import {
 } from '../../../../../../common/api_schemas/transforms';
 import type { RuntimeField } from '../../../../../../../../../src/plugins/data/common';
 import { isPopulatedObject } from '../../../../../../common/shared_imports';
-import { isLatestTransform } from '../../../../../../common/types/transform';
+import { isContinuousTransform, isLatestTransform } from '../../../../../../common/types/transform';
+import { TransformAlertFlyout } from '../../../../../alerting/transform_alerting_flyout';
 
 export interface StepDetailsExposedState {
   created: boolean;
@@ -86,6 +88,7 @@ export const StepCreateForm: FC<StepCreateFormProps> = React.memo(
     const [loading, setLoading] = useState(false);
     const [created, setCreated] = useState(defaults.created);
     const [started, setStarted] = useState(defaults.started);
+    const [alertFlyoutVisible, setAlertFlyoutVisible] = useState(false);
     const [indexPatternId, setIndexPatternId] = useState(defaults.indexPatternId);
     const [progressPercentComplete, setProgressPercentComplete] = useState<undefined | number>(
       undefined
@@ -398,6 +401,31 @@ export const StepCreateForm: FC<StepCreateFormProps> = React.memo(
               </EuiFlexItem>
             </EuiFlexGroup>
           )}
+          {isContinuousTransform(transformConfig) && created ? (
+            <EuiFlexGroup alignItems="center" style={FLEX_GROUP_STYLE}>
+              <EuiFlexItem grow={false} style={FLEX_ITEM_STYLE}>
+                <EuiButton
+                  fill
+                  isDisabled={loading}
+                  onClick={setAlertFlyoutVisible.bind(null, true)}
+                  data-test-subj="transformWizardCreateAlertButton"
+                >
+                  <FormattedMessage
+                    id="xpack.transform.stepCreateForm.createAlertRuleButton"
+                    defaultMessage="Create alert rule"
+                  />
+                </EuiButton>
+              </EuiFlexItem>
+              <EuiFlexItem>
+                <EuiText color="subdued" size="s">
+                  {i18n.translate('xpack.transform.stepCreateForm.createAlertRuleDescription', {
+                    defaultMessage:
+                      'Opens a wizard to create an alert rule for monitoring transform health.',
+                  })}
+                </EuiText>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          ) : null}
           <EuiFlexGroup alignItems="center" style={FLEX_GROUP_STYLE}>
             <EuiFlexItem grow={false} style={FLEX_ITEM_STYLE}>
               <EuiButton
@@ -414,7 +442,7 @@ export const StepCreateForm: FC<StepCreateFormProps> = React.memo(
               <EuiText color="subdued" size="s">
                 {i18n.translate('xpack.transform.stepCreateForm.createTransformDescription', {
                   defaultMessage:
-                    'Create the transform without starting it. You will be able to start the transform later by returning to the transforms list.',
+                    'Creates the transform without starting it. You will be able to start the transform later by returning to the transforms list.',
                 })}
               </EuiText>
             </EuiFlexItem>
@@ -535,6 +563,12 @@ export const StepCreateForm: FC<StepCreateFormProps> = React.memo(
             </Fragment>
           )}
         </EuiForm>
+        {alertFlyoutVisible ? (
+          <TransformAlertFlyout
+            ruleParams={{ includeTransforms: [transformId] }}
+            onCloseFlyout={setAlertFlyoutVisible.bind(null, false)}
+          />
+        ) : null}
       </div>
     );
   }
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/common.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/common.ts
index fbe32e9bea12f..39b1a2de26f8e 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/common.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/common.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { TransformId, TransformPivotConfig } from '../../../../../../common/types/transform';
+import type { TransformConfigUnion, TransformId } from '../../../../../../common/types/transform';
 
 export type EsIndexName = string;
 export type IndexPatternTitle = string;
@@ -55,7 +55,7 @@ export function getDefaultStepDetailsState(): StepDetailsExposedState {
 
 export function applyTransformConfigToDetailsState(
   state: StepDetailsExposedState,
-  transformConfig?: TransformPivotConfig
+  transformConfig?: TransformConfigUnion
 ): StepDetailsExposedState {
   // apply the transform configuration to wizard DETAILS state
   if (transformConfig !== undefined) {
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/step_details_form.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/step_details_form.tsx
index 0d39ec77d059f..7a47cc539c4aa 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/step_details_form.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/step_details_form.tsx
@@ -29,7 +29,7 @@ import {
   isEsIndices,
   isPostTransformsPreviewResponseSchema,
 } from '../../../../../../common/api_schemas/type_guards';
-import { TransformId, TransformPivotConfig } from '../../../../../../common/types/transform';
+import { TransformId } from '../../../../../../common/types/transform';
 import { isValidIndexName } from '../../../../../../common/utils/es_utils';
 
 import { getErrorMessage } from '../../../../../../common/utils/errors';
@@ -158,7 +158,7 @@ export const StepDetailsForm: FC<StepDetailsFormProps> = React.memo(
             ),
           });
         } else {
-          setTransformIds(resp.transforms.map((transform: TransformPivotConfig) => transform.id));
+          setTransformIds(resp.transforms.map((transform) => transform.id));
         }
 
         const indices = await api.getEsIndices();
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/wizard/wizard.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/wizard/wizard.tsx
index 63e21e5d8aa14..27c43ed01a934 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/wizard/wizard.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/wizard/wizard.tsx
@@ -11,7 +11,7 @@ import { i18n } from '@kbn/i18n';
 
 import { EuiSteps, EuiStepStatus } from '@elastic/eui';
 
-import { TransformPivotConfig } from '../../../../../../common/types/transform';
+import type { TransformConfigUnion } from '../../../../../../common/types/transform';
 
 import { getCreateTransformRequestBody } from '../../../../common';
 import { SearchItems } from '../../../../hooks/use_search_items';
@@ -81,7 +81,7 @@ const StepDefine: FC<DefinePivotStepProps> = ({
 };
 
 interface WizardProps {
-  cloneConfig?: TransformPivotConfig;
+  cloneConfig?: TransformConfigUnion;
   searchItems: SearchItems;
 }
 
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_create_alert/create_alert_rule_action_name.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_create_alert/create_alert_rule_action_name.tsx
new file mode 100644
index 0000000000000..c8d67a86d579a
--- /dev/null
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_create_alert/create_alert_rule_action_name.tsx
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC } from 'react';
+import { EuiToolTip } from '@elastic/eui';
+
+import { i18n } from '@kbn/i18n';
+import { createCapabilityFailureMessage } from '../../../../lib/authorization';
+
+interface CreateAlertRuleActionProps {
+  disabled: boolean;
+}
+
+export const crateAlertRuleActionNameText = i18n.translate(
+  'xpack.transform.transformList.createAlertRuleNameText',
+  {
+    defaultMessage: 'Create alert rule',
+  }
+);
+
+export const CreateAlertRuleActionName: FC<CreateAlertRuleActionProps> = ({ disabled }) => {
+  if (disabled) {
+    return (
+      <EuiToolTip
+        position="top"
+        content={createCapabilityFailureMessage('canCreateTransformAlerts')}
+      >
+        <>{crateAlertRuleActionNameText}</>
+      </EuiToolTip>
+    );
+  }
+
+  return <>{crateAlertRuleActionNameText}</>;
+};
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_create_alert/index.ts b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_create_alert/index.ts
new file mode 100644
index 0000000000000..80999d774bdcb
--- /dev/null
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_create_alert/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { useCreateAlertRuleAction } from './use_create_alert_rule_action';
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_create_alert/use_create_alert_rule_action.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_create_alert/use_create_alert_rule_action.tsx
new file mode 100644
index 0000000000000..070f1eb08ac60
--- /dev/null
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_create_alert/use_create_alert_rule_action.tsx
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useContext, useMemo } from 'react';
+import { AuthorizationContext } from '../../../../lib/authorization';
+import { TransformListAction, TransformListRow } from '../../../../common';
+import {
+  crateAlertRuleActionNameText,
+  CreateAlertRuleActionName,
+} from './create_alert_rule_action_name';
+import { useAlertRuleFlyout } from '../../../../../alerting/transform_alerting_flyout';
+import { isContinuousTransform } from '../../../../../../common/types/transform';
+
+export type CreateAlertRuleAction = ReturnType<typeof useCreateAlertRuleAction>;
+export const useCreateAlertRuleAction = (forceDisable: boolean) => {
+  const { canCreateTransformAlerts } = useContext(AuthorizationContext).capabilities;
+  const { setCreateAlertRule } = useAlertRuleFlyout();
+
+  const clickHandler = useCallback(
+    (item: TransformListRow) => {
+      setCreateAlertRule(item.id);
+    },
+    [setCreateAlertRule]
+  );
+
+  const action: TransformListAction = useMemo(
+    () => ({
+      name: (item: TransformListRow) => (
+        <CreateAlertRuleActionName disabled={!canCreateTransformAlerts} />
+      ),
+      available: (item: TransformListRow) => isContinuousTransform(item.config),
+      enabled: () => canCreateTransformAlerts && !forceDisable,
+      description: crateAlertRuleActionNameText,
+      type: 'icon',
+      icon: 'bell',
+      onClick: clickHandler,
+      'data-test-subj': 'transformActionCreateAlertRule',
+    }),
+    [canCreateTransformAlerts, forceDisable, clickHandler]
+  );
+
+  return { action };
+};
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.test.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.test.tsx
index bccd3aff72c58..af85049ce6915 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.test.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.test.tsx
@@ -22,6 +22,7 @@ import { getMlSharedImports } from '../../../../../shared_imports';
 
 // FLAKY https://github.com/elastic/kibana/issues/112922
 describe.skip('Transform: Transform List <ExpandedRow />', () => {
+  const onAlertEdit = jest.fn();
   // Set timezone to US/Eastern for consistent test results.
   beforeEach(() => {
     moment.tz.setDefault('US/Eastern');
@@ -38,7 +39,7 @@ describe.skip('Transform: Transform List <ExpandedRow />', () => {
 
     render(
       <MlSharedContext.Provider value={mlShared}>
-        <ExpandedRow item={item} />
+        <ExpandedRow item={item} onAlertEdit={onAlertEdit} />
       </MlSharedContext.Provider>
     );
 
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.tsx
index dff2ba17cb3f0..84110e67d701e 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.tsx
@@ -7,17 +7,18 @@
 
 import React, { FC } from 'react';
 
-import { EuiTabbedContent } from '@elastic/eui';
+import { EuiButtonEmpty, EuiTabbedContent } from '@elastic/eui';
 import { Optional } from '@kbn/utility-types';
 import { i18n } from '@kbn/i18n';
 
 import moment from 'moment-timezone';
 import { TransformListRow } from '../../../../common';
 import { useAppDependencies } from '../../../../app_dependencies';
-import { ExpandedRowDetailsPane, SectionConfig } from './expanded_row_details_pane';
+import { ExpandedRowDetailsPane, SectionConfig, SectionItem } from './expanded_row_details_pane';
 import { ExpandedRowJsonPane } from './expanded_row_json_pane';
 import { ExpandedRowMessagesPane } from './expanded_row_messages_pane';
 import { ExpandedRowPreviewPane } from './expanded_row_preview_pane';
+import { TransformHealthAlertRule } from '../../../../../../common/types/alerting';
 
 function getItemDescription(value: any) {
   if (typeof value === 'object') {
@@ -44,18 +45,16 @@ export function stringHash(str: string): number {
   return hash < 0 ? hash * -2 : hash;
 }
 
-interface Item {
-  title: string;
-  description: any;
-}
+type Item = SectionItem;
 
 interface Props {
   item: TransformListRow;
+  onAlertEdit: (alertRule: TransformHealthAlertRule) => void;
 }
 
 type StateValues = Optional<TransformListRow['stats'], 'stats' | 'checkpointing'>;
 
-export const ExpandedRow: FC<Props> = ({ item }) => {
+export const ExpandedRow: FC<Props> = ({ item, onAlertEdit }) => {
   const {
     ml: { formatHumanReadableDateTimeSeconds },
   } = useAppDependencies();
@@ -166,12 +165,40 @@ export const ExpandedRow: FC<Props> = ({ item }) => {
     }
   }
 
+  const alertRuleItems: Item[] | undefined = item.alerting_rules?.map((rule) => {
+    return {
+      title: (
+        <EuiButtonEmpty
+          iconType={'documentEdit'}
+          iconSide={'left'}
+          onClick={() => {
+            onAlertEdit(rule);
+          }}
+          flush="left"
+          size={'xs'}
+          iconSize={'s'}
+        >
+          {rule.name}
+        </EuiButtonEmpty>
+      ),
+      description: rule.executionStatus.status,
+    };
+  });
+
   const checkpointing: SectionConfig = {
     title: 'Checkpointing',
     items: checkpointingItems,
     position: 'right',
   };
 
+  const alertingRules: SectionConfig = {
+    title: i18n.translate('xpack.transform.transformList.transformDetails.alertRulesTitle', {
+      defaultMessage: 'Alert rules',
+    }),
+    items: alertRuleItems!,
+    position: 'right',
+  };
+
   const stats: SectionConfig = {
     title: 'Stats',
     items: Object.entries(item.stats.stats).map((s) => {
@@ -192,7 +219,16 @@ export const ExpandedRow: FC<Props> = ({ item }) => {
           defaultMessage: 'Details',
         }
       ),
-      content: <ExpandedRowDetailsPane sections={[general, state, checkpointing]} />,
+      content: (
+        <ExpandedRowDetailsPane
+          sections={[
+            general,
+            state,
+            checkpointing,
+            ...(alertingRules.items ? [alertingRules] : []),
+          ]}
+        />
+      ),
     },
     {
       id: `transform-stats-tab-${tabId}`,
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row_details_pane.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row_details_pane.tsx
index 03e2fb2115d62..1b2dde0a2e576 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row_details_pane.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row_details_pane.tsx
@@ -17,9 +17,10 @@ import {
 } from '@elastic/eui';
 
 export interface SectionItem {
-  title: string;
-  description: string;
+  title: string | JSX.Element;
+  description: string | number | JSX.Element;
 }
+
 export interface SectionConfig {
   title: string;
   position: 'left' | 'right';
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx
index ab30f4793a315..8b7aaf1cf8fd2 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx
@@ -50,15 +50,18 @@ import { useColumns } from './use_columns';
 import { ExpandedRow } from './expanded_row';
 import { transformFilters, filterTransforms } from './transform_search_bar_filters';
 import { useTableSettings } from './use_table_settings';
+import { useAlertRuleFlyout } from '../../../../../alerting/transform_alerting_flyout';
+import { TransformHealthAlertRule } from '../../../../../../common/types/alerting';
 
 function getItemIdToExpandedRowMap(
   itemIds: TransformId[],
-  transforms: TransformListRow[]
+  transforms: TransformListRow[],
+  onAlertEdit: (alertRule: TransformHealthAlertRule) => void
 ): ItemIdToExpandedRowMap {
   return itemIds.reduce((m: ItemIdToExpandedRowMap, transformId: TransformId) => {
     const item = transforms.find((transform) => transform.config.id === transformId);
     if (item !== undefined) {
-      m[transformId] = <ExpandedRow item={item} />;
+      m[transformId] = <ExpandedRow item={item} onAlertEdit={onAlertEdit} />;
     }
     return m;
   }, {} as ItemIdToExpandedRowMap);
@@ -79,6 +82,7 @@ export const TransformList: FC<TransformListProps> = ({
 }) => {
   const [isLoading, setIsLoading] = useState(false);
   const { refresh } = useRefreshTransformList({ isLoading: setIsLoading });
+  const { setEditAlertRule } = useAlertRuleFlyout();
 
   const [filterActive, setFilterActive] = useState(false);
 
@@ -171,7 +175,11 @@ export const TransformList: FC<TransformListProps> = ({
     );
   }
 
-  const itemIdToExpandedRowMap = getItemIdToExpandedRowMap(expandedRowItemIds, transforms);
+  const itemIdToExpandedRowMap = getItemIdToExpandedRowMap(
+    expandedRowItemIds,
+    transforms,
+    setEditAlertRule
+  );
 
   const bulkActionMenuItems = [
     <div key="startAction" className="transform__BulkActionItem">
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_actions.test.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_actions.test.tsx
index b7d5a2b7104ae..20d2f784a4d8b 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_actions.test.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_actions.test.tsx
@@ -27,6 +27,7 @@ describe('Transform: Transform List Actions', () => {
     // in the runtime result here anyway.
     expect(actions.map((a: any) => a['data-test-subj'])).toStrictEqual([
       'transformActionDiscover',
+      'transformActionCreateAlertRule',
       'transformActionStart',
       'transformActionStop',
       'transformActionEdit',
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_actions.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_actions.tsx
index 81e51cdafc32e..40b40cfa8c7ba 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_actions.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_actions.tsx
@@ -18,6 +18,7 @@ import { EditTransformFlyout } from '../edit_transform_flyout';
 import { useEditAction } from '../action_edit';
 import { useStartAction, StartActionModal } from '../action_start';
 import { useStopAction } from '../action_stop';
+import { useCreateAlertRuleAction } from '../action_create_alert';
 
 export const useActions = ({
   forceDisable,
@@ -35,6 +36,7 @@ export const useActions = ({
   const editAction = useEditAction(forceDisable, transformNodes);
   const startAction = useStartAction(forceDisable, transformNodes);
   const stopAction = useStopAction(forceDisable);
+  const createAlertRuleAction = useCreateAlertRuleAction(forceDisable);
 
   return {
     modals: (
@@ -52,6 +54,7 @@ export const useActions = ({
     ),
     actions: [
       discoverAction.action,
+      createAlertRuleAction.action,
       startAction.action,
       stopAction.action,
       editAction.action,
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.test.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.test.tsx
index af2325ede2021..a26ccf0348c9a 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.test.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.test.tsx
@@ -20,14 +20,15 @@ describe('Transform: Job List Columns', () => {
 
     const columns: ReturnType<typeof useColumns>['columns'] = result.current.columns;
 
-    expect(columns).toHaveLength(8);
+    expect(columns).toHaveLength(9);
     expect(columns[0].isExpander).toBeTruthy();
     expect(columns[1].name).toBe('ID');
-    expect(columns[2].name).toBe('Description');
-    expect(columns[3].name).toBe('Type');
-    expect(columns[4].name).toBe('Status');
-    expect(columns[5].name).toBe('Mode');
-    expect(columns[6].name).toBe('Progress');
-    expect(columns[7].name).toBe('Actions');
+    expect(columns[2].id).toBe('alertRule');
+    expect(columns[3].name).toBe('Description');
+    expect(columns[4].name).toBe('Type');
+    expect(columns[5].name).toBe('Status');
+    expect(columns[6].name).toBe('Mode');
+    expect(columns[7].name).toBe('Progress');
+    expect(columns[8].name).toBe('Actions');
   });
 });
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.tsx
index dbdd3409c7e34..bad42c212293d 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.tsx
@@ -21,6 +21,7 @@ import {
   EuiText,
   EuiToolTip,
   RIGHT_ALIGNMENT,
+  EuiIcon,
 } from '@elastic/eui';
 
 import {
@@ -95,6 +96,7 @@ export const useColumns = (
   const columns: [
     EuiTableComputedColumnType<TransformListRow>,
     EuiTableFieldDataColumnType<TransformListRow>,
+    EuiTableComputedColumnType<TransformListRow>,
     EuiTableFieldDataColumnType<TransformListRow>,
     EuiTableComputedColumnType<TransformListRow>,
     EuiTableComputedColumnType<TransformListRow>,
@@ -143,6 +145,38 @@ export const useColumns = (
       truncateText: true,
       scope: 'row',
     },
+    {
+      id: 'alertRule',
+      name: (
+        <EuiScreenReaderOnly>
+          <p>
+            <FormattedMessage
+              id="xpack.transform.transformList.alertingRules.screenReaderDescription"
+              defaultMessage="This column displays an icon when there are alert rules associated with a transform"
+            />
+          </p>
+        </EuiScreenReaderOnly>
+      ),
+      width: '30px',
+      render: (item) => {
+        return Array.isArray(item.alerting_rules) ? (
+          <EuiToolTip
+            position="bottom"
+            content={
+              <FormattedMessage
+                id="xpack.transform.transformList.alertingRules.tooltipContent"
+                defaultMessage="Transform has {rulesCount} associated alert {rulesCount, plural, one { rule} other { rules}}"
+                values={{ rulesCount: item.alerting_rules.length }}
+              />
+            }
+          >
+            <EuiIcon type="bell" />
+          </EuiToolTip>
+        ) : (
+          <span />
+        );
+      },
+    },
     {
       field: TRANSFORM_LIST_COLUMN.DESCRIPTION,
       'data-test-subj': 'transformListColumnDescription',
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/transform_management_section.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/transform_management_section.tsx
index 2479d34f1579a..055e1e50701f8 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/transform_management_section.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/transform_management_section.tsx
@@ -35,6 +35,11 @@ import { useRefreshInterval } from './components/transform_list/use_refresh_inte
 import { SearchSelection } from './components/search_selection';
 import { TransformList } from './components/transform_list';
 import { TransformStatsBar } from './components/transform_list/transforms_stats_bar';
+import {
+  AlertRulesManageContext,
+  getAlertRuleManageContext,
+  TransformAlertFlyoutWrapper,
+} from '../../../alerting/transform_alerting_flyout';
 
 export const TransformManagement: FC = () => {
   const { esTransform } = useDocumentationLinks();
@@ -149,12 +154,15 @@ export const TransformManagement: FC = () => {
               </EuiFlexGroup>
             )}
             {typeof errorMessage === 'undefined' && (
-              <TransformList
-                onCreateTransform={onOpenModal}
-                transformNodes={transformNodes}
-                transforms={transforms}
-                transformsLoading={transformsLoading}
-              />
+              <AlertRulesManageContext.Provider value={getAlertRuleManageContext()}>
+                <TransformList
+                  onCreateTransform={onOpenModal}
+                  transformNodes={transformNodes}
+                  transforms={transforms}
+                  transformsLoading={transformsLoading}
+                />
+                <TransformAlertFlyoutWrapper />
+              </AlertRulesManageContext.Provider>
             )}
           </>
         )}
diff --git a/x-pack/plugins/transform/public/plugin.ts b/x-pack/plugins/transform/public/plugin.ts
index da280452c1f0f..a7d0dce256640 100644
--- a/x-pack/plugins/transform/public/plugin.ts
+++ b/x-pack/plugins/transform/public/plugin.ts
@@ -16,7 +16,7 @@ import type { SharePluginStart } from 'src/plugins/share/public';
 import type { SpacesApi } from '../../spaces/public';
 import { registerFeature } from './register_feature';
 import type { PluginSetupContract as AlertingSetup } from '../../alerting/public';
-import type { TriggersAndActionsUIPublicPluginSetup } from '../../triggers_actions_ui/public';
+import type { TriggersAndActionsUIPublicPluginStart } from '../../triggers_actions_ui/public';
 import { getTransformHealthRuleType } from './alerting';
 
 export interface PluginsDependencies {
@@ -27,7 +27,7 @@ export interface PluginsDependencies {
   share: SharePluginStart;
   spaces?: SpacesApi;
   alerting?: AlertingSetup;
-  triggersActionsUi?: TriggersAndActionsUIPublicPluginSetup;
+  triggersActionsUi: TriggersAndActionsUIPublicPluginStart;
 }
 
 export class TransformUiPlugin {
diff --git a/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts b/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts
index 88b5396c7b110..eb51c04e0bca7 100644
--- a/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts
+++ b/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts
@@ -8,16 +8,21 @@
 import { ElasticsearchClient } from 'kibana/server';
 import { i18n } from '@kbn/i18n';
 import type { Transform as EsTransform } from '@elastic/elasticsearch/api/types';
+import { keyBy } from 'lodash';
 import { TransformHealthRuleParams } from './schema';
 import {
   ALL_TRANSFORMS_SELECTION,
   TRANSFORM_HEALTH_CHECK_NAMES,
+  TRANSFORM_RULE_TYPE,
 } from '../../../../common/constants';
 import { getResultTestConfig } from '../../../../common/utils/alerts';
 import {
   NotStartedTransformResponse,
   TransformHealthAlertContext,
 } from './register_transform_health_rule_type';
+import type { RulesClient } from '../../../../../alerting/server';
+import type { TransformHealthAlertRule } from '../../../../common/types/alerting';
+import { isContinuousTransform } from '../../../../common/types/transform';
 
 interface TestResult {
   name: string;
@@ -27,37 +32,48 @@ interface TestResult {
 // @ts-ignore FIXME update types in the elasticsearch client
 type Transform = EsTransform & { id: string; description?: string; sync: object };
 
-export function transformHealthServiceProvider(esClient: ElasticsearchClient) {
+type TransformWithAlertingRules = Transform & { alerting_rules: TransformHealthAlertRule[] };
+
+export function transformHealthServiceProvider(
+  esClient: ElasticsearchClient,
+  rulesClient?: RulesClient
+) {
   const transformsDict = new Map<string, Transform>();
 
   /**
    * Resolves result transform selection.
    * @param includeTransforms
    * @param excludeTransforms
+   * @param skipIDsCheck
    */
   const getResultsTransformIds = async (
     includeTransforms: string[],
-    excludeTransforms: string[] | null
+    excludeTransforms: string[] | null,
+    skipIDsCheck = false
   ): Promise<string[]> => {
     const includeAll = includeTransforms.some((id) => id === ALL_TRANSFORMS_SELECTION);
 
-    // Fetch transforms to make sure assigned transforms exists.
-    const transformsResponse = (
-      await esClient.transform.getTransform({
-        ...(includeAll ? {} : { transform_id: includeTransforms.join(',') }),
-        allow_no_match: true,
-        size: 1000,
-      })
-    ).body.transforms as Transform[];
-
     let resultTransformIds: string[] = [];
 
-    transformsResponse.forEach((t) => {
-      transformsDict.set(t.id, t);
-      if (t.sync) {
-        resultTransformIds.push(t.id);
-      }
-    });
+    if (skipIDsCheck) {
+      resultTransformIds = includeTransforms;
+    } else {
+      // Fetch transforms to make sure assigned transforms exists.
+      const transformsResponse = (
+        await esClient.transform.getTransform({
+          ...(includeAll ? {} : { transform_id: includeTransforms.join(',') }),
+          allow_no_match: true,
+          size: 1000,
+        })
+      ).body.transforms as Transform[];
+
+      transformsResponse.forEach((t) => {
+        transformsDict.set(t.id, t);
+        if (t.sync) {
+          resultTransformIds.push(t.id);
+        }
+      });
+    }
 
     if (excludeTransforms && excludeTransforms.length > 0) {
       const excludeIdsSet = new Set(excludeTransforms);
@@ -129,6 +145,53 @@ export function transformHealthServiceProvider(esClient: ElasticsearchClient) {
 
       return result;
     },
+
+    /**
+     * Updates transform list with associated alerting rules.
+     */
+    async populateTransformsWithAssignedRules(
+      transforms: Transform[]
+    ): Promise<TransformWithAlertingRules[]> {
+      const newList = transforms.filter(isContinuousTransform) as TransformWithAlertingRules[];
+
+      if (!rulesClient) {
+        throw new Error('Rules client is missing');
+      }
+
+      const transformMap = keyBy(newList, 'id');
+
+      const transformAlertingRules = await rulesClient.find<TransformHealthRuleParams>({
+        options: {
+          perPage: 1000,
+          filter: `alert.attributes.alertTypeId:${TRANSFORM_RULE_TYPE.TRANSFORM_HEALTH}`,
+        },
+      });
+
+      for (const ruleInstance of transformAlertingRules.data) {
+        // Retrieve result transform IDs
+        const resultTransformIds: string[] = await getResultsTransformIds(
+          ruleInstance.params.includeTransforms.includes(ALL_TRANSFORMS_SELECTION)
+            ? Object.keys(transformMap)
+            : ruleInstance.params.includeTransforms,
+          ruleInstance.params.excludeTransforms,
+          true
+        );
+
+        resultTransformIds.forEach((transformId) => {
+          const transformRef = transformMap[transformId] as TransformWithAlertingRules;
+
+          if (transformRef) {
+            if (Array.isArray(transformRef.alerting_rules)) {
+              transformRef.alerting_rules.push(ruleInstance);
+            } else {
+              transformRef.alerting_rules = [ruleInstance];
+            }
+          }
+        });
+      }
+
+      return newList;
+    },
   };
 }
 
diff --git a/x-pack/plugins/transform/server/routes/api/transforms.ts b/x-pack/plugins/transform/server/routes/api/transforms.ts
index 76aac9686c37e..4a657ae615d94 100644
--- a/x-pack/plugins/transform/server/routes/api/transforms.ts
+++ b/x-pack/plugins/transform/server/routes/api/transforms.ts
@@ -63,6 +63,7 @@ import { registerTransformNodesRoutes } from './transforms_nodes';
 import { IIndexPattern } from '../../../../../../src/plugins/data/common';
 import { isLatestTransform } from '../../../common/types/transform';
 import { isKeywordDuplicate } from '../../../common/utils/field_utils';
+import { transformHealthServiceProvider } from '../../lib/alerting/transform_health_rule_type/transform_health_service';
 
 enum TRANSFORM_ACTIONS {
   STOP = 'stop',
@@ -90,6 +91,17 @@ export function registerTransformsRoutes(routeDependencies: RouteDependencies) {
           size: 1000,
           ...req.params,
         });
+
+        if (ctx.alerting) {
+          const transformHealthService = transformHealthServiceProvider(
+            ctx.core.elasticsearch.client.asCurrentUser,
+            ctx.alerting.getRulesClient()
+          );
+
+          // @ts-ignore
+          await transformHealthService.populateTransformsWithAssignedRules(body.transforms);
+        }
+
         return res.ok({ body });
       } catch (e) {
         return res.customError(wrapError(wrapEsError(e)));
diff --git a/x-pack/plugins/transform/server/services/license.ts b/x-pack/plugins/transform/server/services/license.ts
index 978912ce08baf..ce28e0365bb21 100644
--- a/x-pack/plugins/transform/server/services/license.ts
+++ b/x-pack/plugins/transform/server/services/license.ts
@@ -15,6 +15,7 @@ import {
 } from 'kibana/server';
 
 import { LicensingPluginSetup, LicenseType } from '../../../licensing/server';
+import type { AlertingApiRequestHandlerContext } from '../../../alerting/server';
 
 export interface LicenseStatus {
   isValid: boolean;
@@ -28,6 +29,10 @@ interface SetupSettings {
   defaultErrorMessage: string;
 }
 
+type TransformRequestHandlerContext = RequestHandlerContext & {
+  alerting?: AlertingApiRequestHandlerContext;
+};
+
 export class License {
   private licenseStatus: LicenseStatus = {
     isValid: false,
@@ -64,7 +69,9 @@ export class License {
     });
   }
 
-  guardApiRoute<Params, Query, Body>(handler: RequestHandler<Params, Query, Body>) {
+  guardApiRoute<Params, Query, Body>(
+    handler: RequestHandler<Params, Query, Body, TransformRequestHandlerContext>
+  ) {
     const license = this;
 
     return function licenseCheck(
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index aac0f651b8dee..f831f3b91eaa5 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -2424,7 +2424,6 @@
     "discover.docViews.table.toggleFieldDetails": "フィールド詳細を切り替える",
     "discover.docViews.table.unableToFilterForPresenceOfMetaFieldsTooltip": "メタフィールドの有無でフィルタリングできません",
     "discover.docViews.table.unableToFilterForPresenceOfScriptedFieldsTooltip": "スクリプトフィールドの有無でフィルタリングできません",
-    "discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip": "インデックスされていないフィールドは検索できません",
     "discover.embeddable.inspectorRequestDataTitle": "データ",
     "discover.embeddable.inspectorRequestDescription": "このリクエストはElasticsearchにクエリをかけ、検索データを取得します。",
     "discover.embeddable.search.displayName": "検索",
@@ -2915,7 +2914,6 @@
     "home.addData.sampleDataButtonLabel": "サンプルデータを試す",
     "home.addData.sectionTitle": "データを追加して開始する",
     "home.addData.text": "データの操作を開始するには、多数の取り込みオプションのいずれかを使用します。アプリまたはサービスからデータを収集するか、ファイルをアップロードします。独自のデータを使用する準備ができていない場合は、サンプルデータセットを追加してください。",
-    "home.breadcrumbs.addDataTitle": "データの追加",
     "home.breadcrumbs.homeTitle": "ホーム",
     "home.dataManagementDisableCollection": " 収集を停止するには、",
     "home.dataManagementDisableCollectionLink": "ここで使用状況データを無効にします。",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 50d90f5144585..5fbcd26340be3 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -2449,7 +2449,6 @@
     "discover.docViews.table.toggleFieldDetails": "切换字段详细信息",
     "discover.docViews.table.unableToFilterForPresenceOfMetaFieldsTooltip": "无法筛选元数据字段是否存在",
     "discover.docViews.table.unableToFilterForPresenceOfScriptedFieldsTooltip": "无法筛选脚本字段是否存在",
-    "discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip": "无法搜索未索引字段",
     "discover.embeddable.inspectorRequestDataTitle": "数据",
     "discover.embeddable.inspectorRequestDescription": "此请求将查询 Elasticsearch 以获取搜索的数据。",
     "discover.embeddable.search.displayName": "搜索",
@@ -2944,7 +2943,6 @@
     "home.addData.sampleDataButtonLabel": "试用样例数据",
     "home.addData.sectionTitle": "首先添加您的数据",
     "home.addData.text": "要开始使用您的数据，请使用我们众多采集选项中的一个选项。从应用或服务收集数据，或上传文件。如果未准备好使用自己的数据，请添加示例数据集。",
-    "home.breadcrumbs.addDataTitle": "添加数据",
     "home.breadcrumbs.homeTitle": "主页",
     "home.dataManagementDisableCollection": " 要停止收集，",
     "home.dataManagementDisableCollectionLink": "请在此禁用使用情况数据。",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/index.ts
index 4266822bda1fc..d9bad9677c6b8 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/index.ts
@@ -14,10 +14,16 @@ import { getSwimlaneActionType } from './swimlane';
 import { getWebhookActionType } from './webhook';
 import { TypeRegistry } from '../../type_registry';
 import { ActionTypeModel } from '../../../types';
-import { getServiceNowITSMActionType, getServiceNowSIRActionType } from './servicenow';
+import {
+  getServiceNowITSMActionType,
+  getServiceNowSIRActionType,
+  getServiceNowITOMActionType,
+} from './servicenow';
 import { getJiraActionType } from './jira';
 import { getResilientActionType } from './resilient';
 import { getTeamsActionType } from './teams';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { ENABLE_ITOM } from '../../../../../actions/server/constants/connectors';
 
 export function registerBuiltInActionTypes({
   actionTypeRegistry,
@@ -36,4 +42,9 @@ export function registerBuiltInActionTypes({
   actionTypeRegistry.register(getJiraActionType());
   actionTypeRegistry.register(getResilientActionType());
   actionTypeRegistry.register(getTeamsActionType());
+
+  // TODO: Remove when ITOM is ready
+  if (ENABLE_ITOM) {
+    actionTypeRegistry.register(getServiceNowITOMActionType());
+  }
 }
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/helpers.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/helpers.test.ts
index e37d8dd3b4147..e40db85bcb12d 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/helpers.test.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/helpers.test.ts
@@ -35,6 +35,10 @@ describe('helpers', () => {
       expect(isFieldInvalid(undefined, ['required'])).toBeFalsy();
     });
 
+    test('should return if false the field is null', async () => {
+      expect(isFieldInvalid(null, ['required'])).toBeFalsy();
+    });
+
     test('should return if false the error is not defined', async () => {
       // @ts-expect-error
       expect(isFieldInvalid('description', undefined)).toBeFalsy();
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/helpers.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/helpers.ts
index 0134133645bb3..e6acb2e0976a8 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/helpers.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/helpers.ts
@@ -23,9 +23,9 @@ export const isRESTApiError = (res: AppInfo | RESTApiError): res is RESTApiError
   (res as RESTApiError).error != null || (res as RESTApiError).status === 'failure';
 
 export const isFieldInvalid = (
-  field: string | undefined,
+  field: string | undefined | null,
   error: string | IErrorObject | string[]
-): boolean => error !== undefined && error.length > 0 && field !== undefined;
+): boolean => error !== undefined && error.length > 0 && field != null;
 
 // TODO: Remove when the applications are certified
 export const isLegacyConnector = (connector: ServiceNowActionConnector) => {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/index.ts
index b5b006b764e41..c313fd5d0edd6 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/index.ts
@@ -5,4 +5,8 @@
  * 2.0.
  */
 
-export { getServiceNowITSMActionType, getServiceNowSIRActionType } from './servicenow';
+export {
+  getServiceNowITSMActionType,
+  getServiceNowSIRActionType,
+  getServiceNowITOMActionType,
+} from './servicenow';
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.test.tsx
index b40db9c2dabda..eb3e1c01887c9 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.test.tsx
@@ -12,6 +12,7 @@ import { ServiceNowActionConnector } from './types';
 
 const SERVICENOW_ITSM_ACTION_TYPE_ID = '.servicenow';
 const SERVICENOW_SIR_ACTION_TYPE_ID = '.servicenow-sir';
+const SERVICENOW_ITOM_ACTION_TYPE_ID = '.servicenow-itom';
 let actionTypeRegistry: TypeRegistry<ActionTypeModel>;
 
 beforeAll(() => {
@@ -20,7 +21,11 @@ beforeAll(() => {
 });
 
 describe('actionTypeRegistry.get() works', () => {
-  [SERVICENOW_ITSM_ACTION_TYPE_ID, SERVICENOW_SIR_ACTION_TYPE_ID].forEach((id) => {
+  [
+    SERVICENOW_ITSM_ACTION_TYPE_ID,
+    SERVICENOW_SIR_ACTION_TYPE_ID,
+    SERVICENOW_ITOM_ACTION_TYPE_ID,
+  ].forEach((id) => {
     test(`${id}: action type static data is as expected`, () => {
       const actionTypeModel = actionTypeRegistry.get(id);
       expect(actionTypeModel.id).toEqual(id);
@@ -29,7 +34,11 @@ describe('actionTypeRegistry.get() works', () => {
 });
 
 describe('servicenow connector validation', () => {
-  [SERVICENOW_ITSM_ACTION_TYPE_ID, SERVICENOW_SIR_ACTION_TYPE_ID].forEach((id) => {
+  [
+    SERVICENOW_ITSM_ACTION_TYPE_ID,
+    SERVICENOW_SIR_ACTION_TYPE_ID,
+    SERVICENOW_ITOM_ACTION_TYPE_ID,
+  ].forEach((id) => {
     test(`${id}: connector validation succeeds when connector config is valid`, async () => {
       const actionTypeModel = actionTypeRegistry.get(id);
       const actionConnector = {
@@ -106,7 +115,7 @@ describe('servicenow action params validation', () => {
       });
     });
 
-    test(`${id}: params validation fails when body is not valid`, async () => {
+    test(`${id}: params validation fails when short_description is not valid`, async () => {
       const actionTypeModel = actionTypeRegistry.get(id);
       const actionParams = {
         subActionParams: { incident: { short_description: '' }, comments: [] },
@@ -119,4 +128,22 @@ describe('servicenow action params validation', () => {
       });
     });
   });
+
+  test(`${SERVICENOW_ITOM_ACTION_TYPE_ID}: action params validation succeeds when action params is valid`, async () => {
+    const actionTypeModel = actionTypeRegistry.get(SERVICENOW_ITOM_ACTION_TYPE_ID);
+    const actionParams = { subActionParams: { severity: 'Critical' } };
+
+    expect(await actionTypeModel.validateParams(actionParams)).toEqual({
+      errors: { ['severity']: [] },
+    });
+  });
+
+  test(`${SERVICENOW_ITOM_ACTION_TYPE_ID}: params validation fails when severity is not valid`, async () => {
+    const actionTypeModel = actionTypeRegistry.get(SERVICENOW_ITOM_ACTION_TYPE_ID);
+    const actionParams = { subActionParams: { severity: null } };
+
+    expect(await actionTypeModel.validateParams(actionParams)).toEqual({
+      errors: { ['severity']: ['Severity is required.'] },
+    });
+  });
 });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.tsx
index bb4a645f10bbc..6b6d536ff303b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.tsx
@@ -18,6 +18,7 @@ import {
   ServiceNowSecrets,
   ServiceNowITSMActionParams,
   ServiceNowSIRActionParams,
+  ServiceNowITOMActionParams,
 } from './types';
 import { isValidUrl } from '../../../lib/value_validators';
 
@@ -90,6 +91,20 @@ export const SERVICENOW_SIR_TITLE = i18n.translate(
   }
 );
 
+export const SERVICENOW_ITOM_TITLE = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.serviceNowITOM.actionTypeTitle',
+  {
+    defaultMessage: 'ServiceNow ITOM',
+  }
+);
+
+export const SERVICENOW_ITOM_DESC = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.serviceNowITOM.selectMessageText',
+  {
+    defaultMessage: 'Create an event in ServiceNow ITOM.',
+  }
+);
+
 export function getServiceNowITSMActionType(): ActionTypeModel<
   ServiceNowConfig,
   ServiceNowSecrets,
@@ -161,3 +176,34 @@ export function getServiceNowSIRActionType(): ActionTypeModel<
     actionParamsFields: lazy(() => import('./servicenow_sir_params')),
   };
 }
+
+export function getServiceNowITOMActionType(): ActionTypeModel<
+  ServiceNowConfig,
+  ServiceNowSecrets,
+  ServiceNowITOMActionParams
+> {
+  return {
+    id: '.servicenow-itom',
+    iconClass: lazy(() => import('./logo')),
+    selectMessage: SERVICENOW_ITOM_DESC,
+    actionTypeTitle: SERVICENOW_ITOM_TITLE,
+    validateConnector,
+    actionConnectorFields: lazy(() => import('./servicenow_connectors_no_app')),
+    validateParams: async (
+      actionParams: ServiceNowITOMActionParams
+    ): Promise<GenericValidationResult<unknown>> => {
+      const translations = await import('./translations');
+      const errors = {
+        severity: new Array<string>(),
+      };
+      const validationResult = { errors };
+
+      if (actionParams?.subActionParams?.severity == null) {
+        errors.severity.push(translations.SEVERITY_REQUIRED);
+      }
+
+      return validationResult;
+    },
+    actionParamsFields: lazy(() => import('./servicenow_itom_params')),
+  };
+}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors_no_app.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors_no_app.tsx
new file mode 100644
index 0000000000000..f49c2d34d3a8d
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors_no_app.tsx
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { ActionConnectorFieldsProps } from '../../../../types';
+
+import { ServiceNowActionConnector } from './types';
+import { Credentials } from './credentials';
+
+const ServiceNowConnectorFieldsNoApp: React.FC<
+  ActionConnectorFieldsProps<ServiceNowActionConnector>
+> = ({ action, editActionSecrets, editActionConfig, errors, readOnly }) => {
+  return (
+    <>
+      <Credentials
+        action={action}
+        errors={errors}
+        readOnly={readOnly}
+        isLoading={false}
+        editActionSecrets={editActionSecrets}
+        editActionConfig={editActionConfig}
+      />
+    </>
+  );
+};
+
+// eslint-disable-next-line import/no-default-export
+export { ServiceNowConnectorFieldsNoApp as default };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_itom_params.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_itom_params.test.tsx
new file mode 100644
index 0000000000000..ef934d4ebacd7
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_itom_params.test.tsx
@@ -0,0 +1,179 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+
+import { ActionConnector } from '../../../../types';
+import { useChoices } from './use_choices';
+import ServiceNowITOMParamsFields from './servicenow_itom_params';
+
+jest.mock('./use_choices');
+jest.mock('../../../../common/lib/kibana');
+
+const useChoicesMock = useChoices as jest.Mock;
+
+const actionParams = {
+  subAction: 'addEvent',
+  subActionParams: {
+    source: 'A source',
+    event_class: 'An event class',
+    resource: 'C:',
+    node: 'node.example.com',
+    metric_name: 'Percentage Logical Disk Free Space',
+    type: 'Disk space',
+    severity: '4',
+    description: 'desc',
+    additional_info: '{"alert": "test"}',
+    message_key: 'a key',
+    time_of_event: '2021-10-13T10:51:44.981Z',
+  },
+};
+
+const connector: ActionConnector = {
+  secrets: {},
+  config: {},
+  id: 'test',
+  actionTypeId: '.test',
+  name: 'Test',
+  isPreconfigured: false,
+};
+
+const editAction = jest.fn();
+const defaultProps = {
+  actionConnector: connector,
+  actionParams,
+  errors: { ['subActionParams.incident.short_description']: [] },
+  editAction,
+  index: 0,
+  messageVariables: [],
+};
+
+const choicesResponse = {
+  isLoading: false,
+  choices: {
+    severity: [
+      {
+        dependent_value: '',
+        label: '1 - Critical',
+        value: '1',
+        element: 'severity',
+      },
+      {
+        dependent_value: '',
+        label: '2 - Major',
+        value: '2',
+        element: 'severity',
+      },
+    ],
+  },
+};
+
+describe('ServiceNowITOMParamsFields renders', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    useChoicesMock.mockImplementation((args) => {
+      return choicesResponse;
+    });
+  });
+
+  test('all params fields is rendered', () => {
+    const wrapper = mount(<ServiceNowITOMParamsFields {...defaultProps} />);
+    expect(wrapper.find('[data-test-subj="sourceInput"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="nodeInput"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="typeInput"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="resourceInput"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="metric_nameInput"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="event_classInput"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="message_keyInput"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="severitySelect"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="descriptionTextArea"]').exists()).toBeTruthy();
+  });
+
+  test('If severity has errors, form row is invalid', () => {
+    const newProps = {
+      ...defaultProps,
+      errors: { severity: ['error'] },
+    };
+    const wrapper = mount(<ServiceNowITOMParamsFields {...newProps} />);
+    const severity = wrapper.find('[data-test-subj="severitySelect"]').first();
+    expect(severity.prop('isInvalid')).toBeTruthy();
+  });
+
+  test('When subActionParams is undefined, set to default', () => {
+    const { subActionParams, ...newParams } = actionParams;
+
+    const newProps = {
+      ...defaultProps,
+      actionParams: newParams,
+    };
+
+    mount(<ServiceNowITOMParamsFields {...newProps} />);
+    expect(editAction.mock.calls[0][1]).toEqual({
+      message_key: '{{rule.id}}:{{alert.id}}',
+      additional_info:
+        '{"alert":{"id":"{{alert.id}}","actionGroup":"{{alert.actionGroup}}","actionSubgroup":"{{alert.actionSubgroup}}","actionGroupName":"{{alert.actionGroupName}}"},"rule":{"id":"{{rule.id}}","name":"{{rule.name}}","type":"{{rule.type}}"},"date":"{{date}}"}',
+    });
+  });
+
+  test('When subAction is undefined, set to default', () => {
+    const { subAction, ...newParams } = actionParams;
+
+    const newProps = {
+      ...defaultProps,
+      actionParams: newParams,
+    };
+    mount(<ServiceNowITOMParamsFields {...newProps} />);
+    expect(editAction.mock.calls[0][1]).toEqual('addEvent');
+  });
+
+  test('Resets fields when connector changes', () => {
+    const wrapper = mount(<ServiceNowITOMParamsFields {...defaultProps} />);
+    expect(editAction.mock.calls.length).toEqual(0);
+    wrapper.setProps({ actionConnector: { ...connector, id: '1234' } });
+    expect(editAction.mock.calls.length).toEqual(1);
+    expect(editAction.mock.calls[0][1]).toEqual({
+      message_key: '{{rule.id}}:{{alert.id}}',
+      additional_info:
+        '{"alert":{"id":"{{alert.id}}","actionGroup":"{{alert.actionGroup}}","actionSubgroup":"{{alert.actionSubgroup}}","actionGroupName":"{{alert.actionGroupName}}"},"rule":{"id":"{{rule.id}}","name":"{{rule.name}}","type":"{{rule.type}}"},"date":"{{date}}"}',
+    });
+  });
+
+  test('it transforms the categories to options correctly', async () => {
+    const wrapper = mount(<ServiceNowITOMParamsFields {...defaultProps} />);
+
+    wrapper.update();
+    expect(wrapper.find('[data-test-subj="severitySelect"]').first().prop('options')).toEqual([
+      { value: '1', text: '1 - Critical' },
+      { value: '2', text: '2 - Major' },
+    ]);
+  });
+
+  describe('UI updates', () => {
+    const changeEvent = { target: { value: 'Bug' } } as React.ChangeEvent<HTMLSelectElement>;
+    const simpleFields = [
+      { dataTestSubj: 'input[data-test-subj="sourceInput"]', key: 'source' },
+      { dataTestSubj: 'textarea[data-test-subj="descriptionTextArea"]', key: 'description' },
+      { dataTestSubj: '[data-test-subj="nodeInput"]', key: 'node' },
+      { dataTestSubj: '[data-test-subj="typeInput"]', key: 'type' },
+      { dataTestSubj: '[data-test-subj="resourceInput"]', key: 'resource' },
+      { dataTestSubj: '[data-test-subj="metric_nameInput"]', key: 'metric_name' },
+      { dataTestSubj: '[data-test-subj="event_classInput"]', key: 'event_class' },
+      { dataTestSubj: '[data-test-subj="message_keyInput"]', key: 'message_key' },
+      { dataTestSubj: '[data-test-subj="severitySelect"]', key: 'severity' },
+    ];
+
+    simpleFields.forEach((field) =>
+      test(`${field.key} update triggers editAction :D`, () => {
+        const wrapper = mount(<ServiceNowITOMParamsFields {...defaultProps} />);
+        const theField = wrapper.find(field.dataTestSubj).first();
+        theField.prop('onChange')!(changeEvent);
+        expect(editAction.mock.calls[0][1][field.key]).toEqual(changeEvent.target.value);
+      })
+    );
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_itom_params.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_itom_params.tsx
new file mode 100644
index 0000000000000..8ad32fc0bc86b
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_itom_params.tsx
@@ -0,0 +1,160 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useEffect, useRef, useMemo } from 'react';
+import { EuiFormRow, EuiSpacer, EuiTitle, EuiSelect } from '@elastic/eui';
+import { useKibana } from '../../../../common/lib/kibana';
+import { ActionParamsProps } from '../../../../types';
+import { TextAreaWithMessageVariables } from '../../text_area_with_message_variables';
+import { TextFieldWithMessageVariables } from '../../text_field_with_message_variables';
+
+import * as i18n from './translations';
+import { useChoices } from './use_choices';
+import { ServiceNowITOMActionParams } from './types';
+import { choicesToEuiOptions, isFieldInvalid } from './helpers';
+
+const choicesFields = ['severity'];
+
+const fields: Array<{
+  label: string;
+  fieldKey: keyof ServiceNowITOMActionParams['subActionParams'];
+}> = [
+  { label: i18n.SOURCE, fieldKey: 'source' },
+  { label: i18n.NODE, fieldKey: 'node' },
+  { label: i18n.TYPE, fieldKey: 'type' },
+  { label: i18n.RESOURCE, fieldKey: 'resource' },
+  { label: i18n.METRIC_NAME, fieldKey: 'metric_name' },
+  { label: i18n.EVENT_CLASS, fieldKey: 'event_class' },
+  { label: i18n.MESSAGE_KEY, fieldKey: 'message_key' },
+];
+
+const additionalInformation = JSON.stringify({
+  alert: {
+    id: '{{alert.id}}',
+    actionGroup: '{{alert.actionGroup}}',
+    actionSubgroup: '{{alert.actionSubgroup}}',
+    actionGroupName: '{{alert.actionGroupName}}',
+  },
+  rule: {
+    id: '{{rule.id}}',
+    name: '{{rule.name}}',
+    type: '{{rule.type}}',
+  },
+  date: '{{date}}',
+});
+
+const ServiceNowITOMParamsFields: React.FunctionComponent<
+  ActionParamsProps<ServiceNowITOMActionParams>
+> = ({ actionConnector, actionParams, editAction, index, messageVariables, errors }) => {
+  const params = useMemo(
+    () => (actionParams.subActionParams ?? {}) as ServiceNowITOMActionParams['subActionParams'],
+    [actionParams.subActionParams]
+  );
+
+  const { description, severity } = params;
+
+  const {
+    http,
+    notifications: { toasts },
+  } = useKibana().services;
+
+  const actionConnectorRef = useRef(actionConnector?.id ?? '');
+  const { choices, isLoading: isLoadingChoices } = useChoices({
+    http,
+    toastNotifications: toasts,
+    actionConnector,
+    fields: choicesFields,
+  });
+
+  const severityOptions = useMemo(() => choicesToEuiOptions(choices.severity), [choices.severity]);
+
+  const editSubActionProperty = useCallback(
+    (key: string, value: any) => {
+      editAction('subActionParams', { ...params, [key]: value }, index);
+    },
+    [editAction, index, params]
+  );
+
+  useEffect(() => {
+    if (actionConnector != null && actionConnectorRef.current !== actionConnector.id) {
+      actionConnectorRef.current = actionConnector.id;
+      editAction(
+        'subActionParams',
+        { additional_info: additionalInformation, message_key: '{{rule.id}}:{{alert.id}}' },
+        index
+      );
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [actionConnector]);
+
+  useEffect(() => {
+    if (!actionParams.subAction) {
+      editAction('subAction', 'addEvent', index);
+    }
+
+    if (!actionParams.subActionParams) {
+      editAction(
+        'subActionParams',
+        { additional_info: additionalInformation, message_key: '{{rule.id}}:{{alert.id}}' },
+        index
+      );
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [actionParams]);
+
+  return (
+    <>
+      <EuiTitle size="s">
+        <h3>{i18n.EVENT}</h3>
+      </EuiTitle>
+      <EuiSpacer size="m" />
+      {fields.map((field) => (
+        <React.Fragment key={field.fieldKey}>
+          <EuiFormRow fullWidth label={field.label}>
+            <TextFieldWithMessageVariables
+              index={index}
+              editAction={editSubActionProperty}
+              messageVariables={messageVariables}
+              paramsProperty={field.fieldKey}
+              inputTargetValue={params[field.fieldKey] ?? undefined}
+            />
+          </EuiFormRow>
+          <EuiSpacer size="m" />
+        </React.Fragment>
+      ))}
+      <EuiFormRow
+        fullWidth
+        label={i18n.SEVERITY_REQUIRED_LABEL}
+        error={errors.severity}
+        isInvalid={isFieldInvalid(severity, errors.severity)}
+      >
+        <EuiSelect
+          fullWidth
+          hasNoInitialSelection
+          data-test-subj="severitySelect"
+          isLoading={isLoadingChoices}
+          disabled={isLoadingChoices}
+          options={severityOptions}
+          value={severity ?? ''}
+          onChange={(e) => editSubActionProperty('severity', e.target.value)}
+          isInvalid={isFieldInvalid(severity, errors.severity)}
+        />
+      </EuiFormRow>
+      <TextAreaWithMessageVariables
+        index={index}
+        editAction={editSubActionProperty}
+        messageVariables={messageVariables}
+        paramsProperty={'description'}
+        inputTargetValue={description ?? undefined}
+        label={i18n.DESCRIPTION_LABEL}
+      />
+    </>
+  );
+};
+
+// eslint-disable-next-line import/no-default-export
+export { ServiceNowITOMParamsFields as default };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_sir_params.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_sir_params.tsx
index 72f6d7635268f..42758250408d9 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_sir_params.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_sir_params.tsx
@@ -152,7 +152,7 @@ const ServiceNowSIRParamsFields: React.FunctionComponent<
   return (
     <>
       <EuiTitle size="s">
-        <h3>{i18n.INCIDENT}</h3>
+        <h3>{i18n.SECURITY_INCIDENT}</h3>
       </EuiTitle>
       <EuiSpacer size="m" />
       <EuiFormRow
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts
index d068b120bd7ce..e8bd3cbbbf04b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts
@@ -106,6 +106,13 @@ export const INCIDENT = i18n.translate(
   }
 );
 
+export const SECURITY_INCIDENT = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenowSIR.title',
+  {
+    defaultMessage: 'Security Incident',
+  }
+);
+
 export const SHORT_DESCRIPTION_LABEL = i18n.translate(
   'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.titleFieldLabel',
   {
@@ -256,3 +263,76 @@ export const CORRELATION_DISPLAY = i18n.translate(
     defaultMessage: 'Correlation display (optional)',
   }
 );
+
+export const EVENT = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenowITOM.event',
+  {
+    defaultMessage: 'Event',
+  }
+);
+
+/**
+ * ITOM
+ */
+export const SOURCE = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.sourceTextAreaFieldLabel',
+  {
+    defaultMessage: 'Source',
+  }
+);
+
+export const EVENT_CLASS = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.eventClassTextAreaFieldLabel',
+  {
+    defaultMessage: 'Source instance',
+  }
+);
+
+export const RESOURCE = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.resourceTextAreaFieldLabel',
+  {
+    defaultMessage: 'Resource',
+  }
+);
+
+export const NODE = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.nodeTextAreaFieldLabel',
+  {
+    defaultMessage: 'Node',
+  }
+);
+
+export const METRIC_NAME = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.metricNameTextAreaFieldLabel',
+  {
+    defaultMessage: 'Metric name',
+  }
+);
+
+export const TYPE = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.typeTextAreaFieldLabel',
+  {
+    defaultMessage: 'Type',
+  }
+);
+
+export const MESSAGE_KEY = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.messageKeyTextAreaFieldLabel',
+  {
+    defaultMessage: 'Message key',
+  }
+);
+
+export const SEVERITY_REQUIRED = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.requiredSeverityTextField',
+  {
+    defaultMessage: 'Severity is required.',
+  }
+);
+
+export const SEVERITY_REQUIRED_LABEL = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.severityRequiredSelectFieldLabel',
+  {
+    defaultMessage: 'Severity (required)',
+  }
+);
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/types.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/types.ts
index b24883359dde5..ecbb4f9de726b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/types.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/types.ts
@@ -9,6 +9,7 @@ import { UserConfiguredActionConnector } from '../../../../types';
 import {
   ExecutorSubActionPushParamsITSM,
   ExecutorSubActionPushParamsSIR,
+  ExecutorSubActionAddEventParams,
   // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 } from '../../../../../../actions/server/builtin_action_types/servicenow/types';
 
@@ -27,6 +28,11 @@ export interface ServiceNowSIRActionParams {
   subActionParams: ExecutorSubActionPushParamsSIR;
 }
 
+export interface ServiceNowITOMActionParams {
+  subAction: string;
+  subActionParams: ExecutorSubActionAddEventParams;
+}
+
 export interface ServiceNowConfig {
   apiUrl: string;
   isLegacy: boolean;
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_choices.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_choices.test.tsx
new file mode 100644
index 0000000000000..48c0fb2109f55
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_choices.test.tsx
@@ -0,0 +1,164 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { renderHook } from '@testing-library/react-hooks';
+
+import { useKibana } from '../../../../common/lib/kibana';
+import { ActionConnector } from '../../../../types';
+import { useChoices, UseChoices, UseChoicesProps } from './use_choices';
+import { getChoices } from './api';
+
+jest.mock('./api');
+jest.mock('../../../../common/lib/kibana');
+
+const useKibanaMock = useKibana as jest.Mocked<typeof useKibana>;
+const getChoicesMock = getChoices as jest.Mock;
+
+const actionConnector = {
+  secrets: {
+    username: 'user',
+    password: 'pass',
+  },
+  id: 'test',
+  actionTypeId: '.servicenow',
+  name: 'ServiceNow ITSM',
+  isPreconfigured: false,
+  config: {
+    apiUrl: 'https://dev94428.service-now.com/',
+  },
+} as ActionConnector;
+
+const getChoicesResponse = [
+  {
+    dependent_value: '',
+    label: 'Priviledge Escalation',
+    value: 'Priviledge Escalation',
+    element: 'category',
+  },
+  {
+    dependent_value: '',
+    label: 'Criminal activity/investigation',
+    value: 'Criminal activity/investigation',
+    element: 'category',
+  },
+  {
+    dependent_value: '',
+    label: 'Denial of Service',
+    value: 'Denial of Service',
+    element: 'category',
+  },
+];
+
+const useChoicesResponse = {
+  isLoading: false,
+  choices: { category: getChoicesResponse },
+};
+
+describe('UseChoices', () => {
+  const { services } = useKibanaMock();
+  getChoicesMock.mockResolvedValue({
+    data: getChoicesResponse,
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  const fields = ['category'];
+
+  it('init', async () => {
+    const { result, waitForNextUpdate } = renderHook<UseChoicesProps, UseChoices>(() =>
+      useChoices({
+        http: services.http,
+        actionConnector,
+        toastNotifications: services.notifications.toasts,
+        fields,
+      })
+    );
+
+    await waitForNextUpdate();
+
+    expect(result.current).toEqual(useChoicesResponse);
+  });
+
+  it('returns an empty array if the field is not in response', async () => {
+    const { result, waitForNextUpdate } = renderHook<UseChoicesProps, UseChoices>(() =>
+      useChoices({
+        http: services.http,
+        actionConnector,
+        toastNotifications: services.notifications.toasts,
+        fields: ['priority'],
+      })
+    );
+
+    await waitForNextUpdate();
+
+    expect(result.current).toEqual({
+      isLoading: false,
+      choices: { priority: [], category: getChoicesResponse },
+    });
+  });
+
+  it('returns an empty array when connector is not presented', async () => {
+    const { result } = renderHook<UseChoicesProps, UseChoices>(() =>
+      useChoices({
+        http: services.http,
+        actionConnector: undefined,
+        toastNotifications: services.notifications.toasts,
+        fields,
+      })
+    );
+
+    expect(result.current).toEqual({
+      isLoading: false,
+      choices: { category: [] },
+    });
+  });
+
+  it('it displays an error when service fails', async () => {
+    getChoicesMock.mockResolvedValue({
+      status: 'error',
+      service_message: 'An error occurred',
+    });
+
+    const { waitForNextUpdate } = renderHook<UseChoicesProps, UseChoices>(() =>
+      useChoices({
+        http: services.http,
+        actionConnector,
+        toastNotifications: services.notifications.toasts,
+        fields,
+      })
+    );
+
+    await waitForNextUpdate();
+
+    expect(services.notifications.toasts.addDanger).toHaveBeenCalledWith({
+      text: 'An error occurred',
+      title: 'Unable to get choices',
+    });
+  });
+
+  it('it displays an error when http throws an error', async () => {
+    getChoicesMock.mockImplementation(() => {
+      throw new Error('An error occurred');
+    });
+
+    renderHook<UseChoicesProps, UseChoices>(() =>
+      useChoices({
+        http: services.http,
+        actionConnector,
+        toastNotifications: services.notifications.toasts,
+        fields,
+      })
+    );
+
+    expect(services.notifications.toasts.addDanger).toHaveBeenCalledWith({
+      text: 'An error occurred',
+      title: 'Unable to get choices',
+    });
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_choices.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_choices.tsx
new file mode 100644
index 0000000000000..5493fdaee8bfa
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_choices.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback, useMemo, useState } from 'react';
+import { HttpSetup, ToastsApi } from 'kibana/public';
+
+import { ActionConnector } from '../../../../types';
+import { Choice, Fields } from './types';
+import { useGetChoices } from './use_get_choices';
+
+export interface UseChoicesProps {
+  http: HttpSetup;
+  toastNotifications: Pick<
+    ToastsApi,
+    'get$' | 'add' | 'remove' | 'addSuccess' | 'addWarning' | 'addDanger' | 'addError'
+  >;
+  actionConnector?: ActionConnector;
+  fields: string[];
+}
+
+export interface UseChoices {
+  choices: Fields;
+  isLoading: boolean;
+}
+
+export const useChoices = ({
+  http,
+  actionConnector,
+  toastNotifications,
+  fields,
+}: UseChoicesProps): UseChoices => {
+  const defaultFields: Record<string, Choice[]> = useMemo(
+    () => fields.reduce((acc, field) => ({ ...acc, [field]: [] }), {}),
+    [fields]
+  );
+  const [choices, setChoices] = useState<Fields>(defaultFields);
+
+  const onChoicesSuccess = useCallback(
+    (values: Choice[]) => {
+      setChoices(
+        values.reduce(
+          (acc, value) => ({
+            ...acc,
+            [value.element]: [...(acc[value.element] ?? []), value],
+          }),
+          defaultFields
+        )
+      );
+    },
+    [defaultFields]
+  );
+
+  const { isLoading } = useGetChoices({
+    http,
+    toastNotifications,
+    actionConnector,
+    fields,
+    onSuccess: onChoicesSuccess,
+  });
+
+  return { choices, isLoading };
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_get_choices.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_get_choices.test.tsx
index 01347a32e6da9..532789385e8bd 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_get_choices.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_get_choices.test.tsx
@@ -121,7 +121,7 @@ describe('useGetChoices', () => {
   it('it displays an error when service fails', async () => {
     getChoicesMock.mockResolvedValue({
       status: 'error',
-      serviceMessage: 'An error occurred',
+      service_message: 'An error occurred',
     });
 
     const { waitForNextUpdate } = renderHook<UseGetChoicesProps, UseGetChoices>(() =>
@@ -162,4 +162,26 @@ describe('useGetChoices', () => {
       title: 'Unable to get choices',
     });
   });
+
+  it('returns an empty array if the response is not an array', async () => {
+    getChoicesMock.mockResolvedValue({
+      status: 'ok',
+      data: {},
+    });
+
+    const { result } = renderHook<UseGetChoicesProps, UseGetChoices>(() =>
+      useGetChoices({
+        http: services.http,
+        actionConnector: undefined,
+        toastNotifications: services.notifications.toasts,
+        fields,
+        onSuccess,
+      })
+    );
+
+    expect(result.current).toEqual({
+      isLoading: false,
+      choices: [],
+    });
+  });
 });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_get_choices.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_get_choices.tsx
index ef80c99955542..f4c881c633cdc 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_get_choices.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/use_get_choices.tsx
@@ -60,15 +60,16 @@ export const useGetChoices = ({
       });
 
       if (!didCancel.current) {
+        const data = Array.isArray(res.data) ? res.data : [];
         setIsLoading(false);
-        setChoices(res.data ?? []);
+        setChoices(data);
         if (res.status && res.status === 'error') {
           toastNotifications.addDanger({
             title: i18n.CHOICES_API_ERROR,
-            text: `${res.serviceMessage ?? res.message}`,
+            text: `${res.service_message ?? res.message}`,
           });
         } else if (onSuccess) {
-          onSuccess(res.data ?? []);
+          onSuccess(data);
         }
       }
     } catch (error) {
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
index b19c8b3d0f082..b2a1c4e80ec7d 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
@@ -9,4 +9,4 @@ export { setup as setupOverviewPage, OverviewTestBed } from './overview.helpers'
 export { setup as setupElasticsearchPage, ElasticsearchTestBed } from './elasticsearch.helpers';
 export { setup as setupKibanaPage, KibanaTestBed } from './kibana.helpers';
 
-export { setupEnvironment } from './setup_environment';
+export { setupEnvironment, kibanaVersion } from './setup_environment';
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx
index a1cdfaa3446cb..fbbbc0e07853c 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 import axios from 'axios';
 // @ts-ignore
 import axiosXhrAdapter from 'axios/lib/adapters/xhr';
-
+import SemVer from 'semver/classes/semver';
 import {
   deprecationsServiceMock,
   docLinksServiceMock,
@@ -19,7 +19,7 @@ import {
 import { HttpSetup } from 'src/core/public';
 
 import { KibanaContextProvider } from '../../../public/shared_imports';
-import { mockKibanaSemverVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { AppContextProvider } from '../../../public/application/app_context';
 import { apiService } from '../../../public/application/lib/api';
 import { breadcrumbService } from '../../../public/application/lib/breadcrumbs';
@@ -31,6 +31,8 @@ const { GlobalFlyoutProvider } = GlobalFlyout;
 
 const mockHttpClient = axios.create({ adapter: axiosXhrAdapter });
 
+export const kibanaVersion = new SemVer(MAJOR_VERSION);
+
 export const WithAppDependencies =
   (Comp: any, overrides: Record<string, unknown> = {}) =>
   (props: Record<string, unknown>) => {
@@ -41,9 +43,9 @@ export const WithAppDependencies =
       http: mockHttpClient as unknown as HttpSetup,
       docLinks: docLinksServiceMock.createStartContract(),
       kibanaVersionInfo: {
-        currentMajor: mockKibanaSemverVersion.major,
-        prevMajor: mockKibanaSemverVersion.major - 1,
-        nextMajor: mockKibanaSemverVersion.major + 1,
+        currentMajor: kibanaVersion.major,
+        prevMajor: kibanaVersion.major - 1,
+        nextMajor: kibanaVersion.major + 1,
       },
       notifications: notificationServiceMock.createStartContract(),
       isReadOnlyMode: false,
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx
index 0acf5ae65c6cc..7831ab0110e4f 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import { mockKibanaSemverVersion } from '../../../common/constants';
-import { OverviewTestBed, setupOverviewPage, setupEnvironment } from '../helpers';
+import { OverviewTestBed, setupOverviewPage, setupEnvironment, kibanaVersion } from '../helpers';
 
 describe('Overview Page', () => {
   let testBed: OverviewTestBed;
@@ -24,7 +23,7 @@ describe('Overview Page', () => {
   describe('Documentation links', () => {
     test('Has a whatsNew link and it references nextMajor version', () => {
       const { exists, find } = testBed;
-      const nextMajor = mockKibanaSemverVersion.major + 1;
+      const nextMajor = kibanaVersion.major + 1;
 
       expect(exists('whatsNewLink')).toBe(true);
       expect(find('whatsNewLink').text()).toContain(`${nextMajor}.0`);
diff --git a/x-pack/plugins/upgrade_assistant/common/config.ts b/x-pack/plugins/upgrade_assistant/common/config.ts
deleted file mode 100644
index e74fe5cc1bf16..0000000000000
--- a/x-pack/plugins/upgrade_assistant/common/config.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { schema, TypeOf } from '@kbn/config-schema';
-
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  /*
-   * This will default to true up until the last minor before the next major.
-   * In readonly mode, the user will not be able to perform any actions in the UI
-   * and will be presented with a message indicating as such.
-   */
-  readonly: schema.boolean({ defaultValue: true }),
-});
-
-export type Config = TypeOf<typeof configSchema>;
diff --git a/x-pack/plugins/upgrade_assistant/common/constants.ts b/x-pack/plugins/upgrade_assistant/common/constants.ts
index 893d61d329534..68a6b9e9cdb83 100644
--- a/x-pack/plugins/upgrade_assistant/common/constants.ts
+++ b/x-pack/plugins/upgrade_assistant/common/constants.ts
@@ -4,15 +4,11 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import SemVer from 'semver/classes/semver';
-
 /*
- * These constants are used only in tests to add conditional logic based on Kibana version
  * On master, the version should represent the next major version (e.g., master --> 8.0.0)
  * The release branch should match the release version (e.g., 7.x --> 7.0.0)
  */
-export const mockKibanaVersion = '8.0.0';
-export const mockKibanaSemverVersion = new SemVer(mockKibanaVersion);
+export const MAJOR_VERSION = '8.0.0';
 
 /*
  * Map of 7.0 --> 8.0 index setting deprecation log messages and associated settings
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx
index ff11b9f1a8450..d2cafd69e94eb 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx
@@ -8,12 +8,20 @@
 import { I18nProvider } from '@kbn/i18n/react';
 import { mount, shallow } from 'enzyme';
 import React from 'react';
+import SemVer from 'semver/classes/semver';
 
 import { ReindexWarning } from '../../../../../../../common/types';
-import { mockKibanaSemverVersion } from '../../../../../../../common/constants';
+import { MAJOR_VERSION } from '../../../../../../../common/constants';
 
 import { idForWarning, WarningsFlyoutStep } from './warnings_step';
 
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+const mockKibanaVersionInfo = {
+  currentMajor: kibanaVersion.major,
+  prevMajor: kibanaVersion.major - 1,
+  nextMajor: kibanaVersion.major + 1,
+};
+
 jest.mock('../../../../../app_context', () => {
   const { docLinksServiceMock } = jest.requireActual(
     '../../../../../../../../../../src/core/public/doc_links/doc_links_service.mock'
@@ -23,11 +31,7 @@ jest.mock('../../../../../app_context', () => {
     useAppContext: () => {
       return {
         docLinks: docLinksServiceMock.createStartContract(),
-        kibanaVersionInfo: {
-          currentMajor: mockKibanaSemverVersion.major,
-          prevMajor: mockKibanaSemverVersion.major - 1,
-          nextMajor: mockKibanaSemverVersion.major + 1,
-        },
+        kibanaVersionInfo: mockKibanaVersionInfo,
       };
     },
   };
@@ -45,7 +49,7 @@ describe('WarningsFlyoutStep', () => {
     expect(shallow(<WarningsFlyoutStep {...defaultProps} />)).toMatchSnapshot();
   });
 
-  if (mockKibanaSemverVersion.major === 7) {
+  if (kibanaVersion.major === 7) {
     it('does not allow proceeding until all are checked', () => {
       const defaultPropsWithWarnings = {
         ...defaultProps,
diff --git a/x-pack/plugins/upgrade_assistant/public/plugin.ts b/x-pack/plugins/upgrade_assistant/public/plugin.ts
index 5edb638e1bc5b..32e825fbdc20d 100644
--- a/x-pack/plugins/upgrade_assistant/public/plugin.ts
+++ b/x-pack/plugins/upgrade_assistant/public/plugin.ts
@@ -9,59 +9,69 @@ import SemVer from 'semver/classes/semver';
 import { i18n } from '@kbn/i18n';
 import { Plugin, CoreSetup, PluginInitializerContext } from 'src/core/public';
 
-import { SetupDependencies, StartDependencies, AppServicesContext } from './types';
-import { Config } from '../common/config';
+import {
+  SetupDependencies,
+  StartDependencies,
+  AppServicesContext,
+  ClientConfigType,
+} from './types';
 
 export class UpgradeAssistantUIPlugin
   implements Plugin<void, void, SetupDependencies, StartDependencies>
 {
   constructor(private ctx: PluginInitializerContext) {}
+
   setup(coreSetup: CoreSetup<StartDependencies>, { management, cloud }: SetupDependencies) {
-    const { readonly } = this.ctx.config.get<Config>();
+    const {
+      readonly,
+      ui: { enabled: isUpgradeAssistantUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
 
-    const appRegistrar = management.sections.section.stack;
-    const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
+    if (isUpgradeAssistantUiEnabled) {
+      const appRegistrar = management.sections.section.stack;
+      const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
 
-    const kibanaVersionInfo = {
-      currentMajor: kibanaVersion.major,
-      prevMajor: kibanaVersion.major - 1,
-      nextMajor: kibanaVersion.major + 1,
-    };
+      const kibanaVersionInfo = {
+        currentMajor: kibanaVersion.major,
+        prevMajor: kibanaVersion.major - 1,
+        nextMajor: kibanaVersion.major + 1,
+      };
 
-    const pluginName = i18n.translate('xpack.upgradeAssistant.appTitle', {
-      defaultMessage: '{version} Upgrade Assistant',
-      values: { version: `${kibanaVersionInfo.nextMajor}.0` },
-    });
+      const pluginName = i18n.translate('xpack.upgradeAssistant.appTitle', {
+        defaultMessage: '{version} Upgrade Assistant',
+        values: { version: `${kibanaVersionInfo.nextMajor}.0` },
+      });
 
-    appRegistrar.registerApp({
-      id: 'upgrade_assistant',
-      title: pluginName,
-      order: 1,
-      async mount(params) {
-        const [coreStart, { discover, data }] = await coreSetup.getStartServices();
-        const services: AppServicesContext = { discover, data, cloud };
+      appRegistrar.registerApp({
+        id: 'upgrade_assistant',
+        title: pluginName,
+        order: 1,
+        async mount(params) {
+          const [coreStart, { discover, data }] = await coreSetup.getStartServices();
+          const services: AppServicesContext = { discover, data, cloud };
 
-        const {
-          chrome: { docTitle },
-        } = coreStart;
+          const {
+            chrome: { docTitle },
+          } = coreStart;
 
-        docTitle.change(pluginName);
+          docTitle.change(pluginName);
 
-        const { mountManagementSection } = await import('./application/mount_management_section');
-        const unmountAppCallback = await mountManagementSection(
-          coreSetup,
-          params,
-          kibanaVersionInfo,
-          readonly,
-          services
-        );
+          const { mountManagementSection } = await import('./application/mount_management_section');
+          const unmountAppCallback = await mountManagementSection(
+            coreSetup,
+            params,
+            kibanaVersionInfo,
+            readonly,
+            services
+          );
 
-        return () => {
-          docTitle.reset();
-          unmountAppCallback();
-        };
-      },
-    });
+          return () => {
+            docTitle.reset();
+            unmountAppCallback();
+          };
+        },
+      });
+    }
   }
 
   start() {}
diff --git a/x-pack/plugins/upgrade_assistant/public/types.ts b/x-pack/plugins/upgrade_assistant/public/types.ts
index a2b49305c32d4..cbeaf22bb095b 100644
--- a/x-pack/plugins/upgrade_assistant/public/types.ts
+++ b/x-pack/plugins/upgrade_assistant/public/types.ts
@@ -26,3 +26,10 @@ export interface StartDependencies {
   discover: DiscoverStart;
   data: DataPublicPluginStart;
 }
+
+export interface ClientConfigType {
+  readonly: boolean;
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/x-pack/plugins/upgrade_assistant/server/config.ts b/x-pack/plugins/upgrade_assistant/server/config.ts
new file mode 100644
index 0000000000000..4183ea337def1
--- /dev/null
+++ b/x-pack/plugins/upgrade_assistant/server/config.ts
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
+import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    /*
+     * This will default to true up until the last minor before the next major.
+     * In readonly mode, the user will not be able to perform any actions in the UI
+     * and will be presented with a message indicating as such.
+     */
+    readonly: schema.boolean({ defaultValue: true }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<UpgradeAssistantConfig> = {
+  exposeToBrowser: {
+    ui: true,
+    readonly: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type UpgradeAssistantConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
+    enabled: schema.boolean({ defaultValue: true }),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    /*
+     * This will default to true up until the last minor before the next major.
+     * In readonly mode, the user will not be able to perform any actions in the UI
+     * and will be presented with a message indicating as such.
+     */
+    readonly: schema.boolean({ defaultValue: true }),
+  },
+  { defaultValue: undefined }
+);
+
+export type UpgradeAssistantConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<UpgradeAssistantConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+    readonly: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.upgrade_assistant.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.upgrade_assistant.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.upgradeAssistant.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.upgrade_assistant.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.upgradeAssistant.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Upgrade Assistant UI, use the "xpack.upgrade_assistant.ui.enabled" setting instead of "xpack.upgrade_assistant.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.upgradeAssistant.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.upgradeAssistant.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.upgrade_assistant.enabled" setting to "xpack.upgrade_assistant.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
+
+export const config: PluginConfigDescriptor<UpgradeAssistantConfig | UpgradeAssistantConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/upgrade_assistant/server/index.ts b/x-pack/plugins/upgrade_assistant/server/index.ts
index 5591276b2fa34..660aa107292e8 100644
--- a/x-pack/plugins/upgrade_assistant/server/index.ts
+++ b/x-pack/plugins/upgrade_assistant/server/index.ts
@@ -5,18 +5,11 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 import { UpgradeAssistantServerPlugin } from './plugin';
-import { configSchema, Config } from '../common/config';
+
+export { config } from './config';
 
 export const plugin = (ctx: PluginInitializerContext) => {
   return new UpgradeAssistantServerPlugin(ctx);
 };
-
-export const config: PluginConfigDescriptor<Config> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
-  exposeToBrowser: {
-    readonly: true,
-  },
-};
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts b/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts
index d93fe7920f1d7..5f39e902c75d9 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts
@@ -4,14 +4,16 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { SemVer } from 'semver';
+import { MAJOR_VERSION } from '../../../common/constants';
 
-import { mockKibanaSemverVersion } from '../../../common/constants';
+const kibanaVersion = new SemVer(MAJOR_VERSION);
 
 export const getMockVersionInfo = () => {
-  const currentMajor = mockKibanaSemverVersion.major;
+  const currentMajor = kibanaVersion.major;
 
   return {
-    currentVersion: mockKibanaSemverVersion,
+    currentVersion: kibanaVersion,
     currentMajor,
     prevMajor: currentMajor - 1,
     nextMajor: currentMajor + 1,
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts
index e1817ef63927d..1785491e5da45 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts
@@ -9,7 +9,7 @@ import { SemVer } from 'semver';
 import { IScopedClusterClient, kibanaResponseFactory } from 'src/core/server';
 import { coreMock } from 'src/core/server/mocks';
 import { licensingMock } from '../../../../plugins/licensing/server/mocks';
-import { mockKibanaVersion } from '../../common/constants';
+import { MAJOR_VERSION } from '../../common/constants';
 import { getMockVersionInfo } from './__fixtures__/version';
 
 import {
@@ -98,7 +98,7 @@ describe('verifyAllMatchKibanaVersion', () => {
 
 describe('EsVersionPrecheck', () => {
   beforeEach(() => {
-    versionService.setup(mockKibanaVersion);
+    versionService.setup(MAJOR_VERSION);
   });
 
   it('returns a 403 when callCluster fails with a 403', async () => {
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts
index 30093a9fb6e50..957198cde8da9 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { mockKibanaSemverVersion, mockKibanaVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { versionService } from '../version';
 import { getMockVersionInfo } from '../__fixtures__/version';
 
@@ -131,7 +131,7 @@ describe('transformFlatSettings', () => {
 
   describe('sourceNameForIndex', () => {
     beforeEach(() => {
-      versionService.setup(mockKibanaVersion);
+      versionService.setup(MAJOR_VERSION);
     });
 
     it('parses internal indices', () => {
@@ -152,7 +152,7 @@ describe('transformFlatSettings', () => {
 
   describe('generateNewIndexName', () => {
     beforeEach(() => {
-      versionService.setup(mockKibanaVersion);
+      versionService.setup(MAJOR_VERSION);
     });
 
     it('parses internal indices', () => {
@@ -186,7 +186,7 @@ describe('transformFlatSettings', () => {
       ).toEqual([]);
     });
 
-    if (mockKibanaSemverVersion.major === 7) {
+    if (currentMajor === 7) {
       describe('[7.x] customTypeName warning', () => {
         it('returns customTypeName warning for non-_doc mapping types', () => {
           expect(
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts
index 3cfdb1fdd3167..ce1e8e11eb2d1 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts
@@ -19,7 +19,7 @@ import {
   ReindexStatus,
   ReindexStep,
 } from '../../../common/types';
-import { mockKibanaVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { versionService } from '../version';
 import { LOCK_WINDOW, ReindexActions, reindexActionsFactory } from './reindex_actions';
 import { getMockVersionInfo } from '../__fixtures__/version';
@@ -54,7 +54,7 @@ describe('ReindexActions', () => {
 
   describe('createReindexOp', () => {
     beforeEach(() => {
-      versionService.setup(mockKibanaVersion);
+      versionService.setup(MAJOR_VERSION);
       client.create.mockResolvedValue();
     });
 
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts
index 7a5bf1c187698..6017691a9328d 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts
@@ -20,7 +20,7 @@ import {
   ReindexStatus,
   ReindexStep,
 } from '../../../common/types';
-import { mockKibanaVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { licensingMock } from '../../../../licensing/server/mocks';
 import { LicensingPluginSetup } from '../../../../licensing/server';
 
@@ -89,7 +89,7 @@ describe('reindexService', () => {
       licensingPluginSetup
     );
 
-    versionService.setup(mockKibanaVersion);
+    versionService.setup(MAJOR_VERSION);
   });
 
   describe('hasRequiredPrivileges', () => {
diff --git a/x-pack/plugins/uptime/public/components/common/charts/__snapshots__/donut_chart.test.tsx.snap b/x-pack/plugins/uptime/public/components/common/charts/__snapshots__/donut_chart.test.tsx.snap
index 45b162e13fb9b..c9299bf7bf3ea 100644
--- a/x-pack/plugins/uptime/public/components/common/charts/__snapshots__/donut_chart.test.tsx.snap
+++ b/x-pack/plugins/uptime/public/components/common/charts/__snapshots__/donut_chart.test.tsx.snap
@@ -353,8 +353,6 @@ exports[`DonutChart component passes correct props without errors for valid prop
               },
               "fill": Object {
                 "textBorder": 0,
-                "textContrast": true,
-                "textInvertible": true,
               },
               "fontFamily": "'Inter', 'Inter UI', -apple-system, BlinkMacSystemFont,
   'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'",
diff --git a/x-pack/test/alerting_api_integration/common/config.ts b/x-pack/test/alerting_api_integration/common/config.ts
index 0618d379dc77d..3fe5ecb6076e2 100644
--- a/x-pack/test/alerting_api_integration/common/config.ts
+++ b/x-pack/test/alerting_api_integration/common/config.ts
@@ -35,6 +35,7 @@ const enabledActionTypes = [
   '.server-log',
   '.servicenow',
   '.servicenow-sir',
+  '.servicenow-itom',
   '.jira',
   '.resilient',
   '.slack',
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions_simulators/server/servicenow_simulation.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions_simulators/server/servicenow_simulation.ts
index 19a789659fd7f..f5f08bd0de246 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions_simulators/server/servicenow_simulation.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions_simulators/server/servicenow_simulation.ts
@@ -175,6 +175,14 @@ const handler = async (request: http.IncomingMessage, response: http.ServerRespo
     });
   }
 
+  if (pathName === '/api/global/em/jsonv2') {
+    return sendResponse(response, {
+      result: {
+        'Default Bulk Endpoint': '1 events were inserted',
+      },
+    });
+  }
+
   // Return an 400 error if endpoint is not supported
   response.statusCode = 400;
   response.setHeader('Content-Type', 'application/json');
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
index 7e8272b0a8afa..41a0d65b624b7 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
@@ -231,10 +231,6 @@ export default function jiraTest({ getService }: FtrProviderContext) {
               expect(Object.keys(resp.body)).to.eql(['status', 'message', 'retry', 'connector_id']);
               expect(resp.body.connector_id).to.eql(simulatedActionId);
               expect(resp.body.status).to.eql('error');
-              expect(resp.body.retry).to.eql(false);
-              expect(resp.body.message).to.be(
-                `error validating action params: Cannot destructure property 'Symbol(Symbol.iterator)' of 'undefined' as it is undefined.`
-              );
             });
         });
 
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
index 4421c984b4aed..8e2036ce688ea 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
@@ -233,10 +233,6 @@ export default function resilientTest({ getService }: FtrProviderContext) {
               expect(Object.keys(resp.body)).to.eql(['status', 'message', 'retry', 'connector_id']);
               expect(resp.body.connector_id).to.eql(simulatedActionId);
               expect(resp.body.status).to.eql('error');
-              expect(resp.body.retry).to.eql(false);
-              expect(resp.body.message).to.be(
-                `error validating action params: Cannot destructure property 'Symbol(Symbol.iterator)' of 'undefined' as it is undefined.`
-              );
             });
         });
 
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itom.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itom.ts
new file mode 100644
index 0000000000000..6f1ddc6ee2748
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itom.ts
@@ -0,0 +1,342 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import httpProxy from 'http-proxy';
+import expect from '@kbn/expect';
+import getPort from 'get-port';
+import http from 'http';
+
+import { getHttpProxyServer } from '../../../../common/lib/get_proxy_server';
+import { FtrProviderContext } from '../../../../common/ftr_provider_context';
+import { getServiceNowServer } from '../../../../common/fixtures/plugins/actions_simulators/server/plugin';
+
+// eslint-disable-next-line import/no-default-export
+export default function serviceNowITOMTest({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const configService = getService('config');
+
+  const mockServiceNow = {
+    config: {
+      apiUrl: 'www.servicenowisinkibanaactions.com',
+    },
+    secrets: {
+      password: 'elastic',
+      username: 'changeme',
+    },
+    params: {
+      subAction: 'addEvent',
+      subActionParams: {
+        source: 'A source',
+        event_class: 'An event class',
+        resource: 'C:',
+        node: 'node.example.com',
+        metric_name: 'Percentage Logical Disk Free Space',
+        type: 'Disk space',
+        severity: '4',
+        description: 'desc',
+        additional_info: '{"alert": "test"}',
+        message_key: 'a key',
+        time_of_event: '2021-10-13T10:51:44.981Z',
+      },
+    },
+  };
+
+  describe('ServiceNow ITOM', () => {
+    let simulatedActionId = '';
+    let serviceNowSimulatorURL: string = '';
+    let serviceNowServer: http.Server;
+    let proxyServer: httpProxy | undefined;
+    let proxyHaveBeenCalled = false;
+
+    before(async () => {
+      serviceNowServer = await getServiceNowServer();
+      const availablePort = await getPort({ port: getPort.makeRange(9000, 9100) });
+      if (!serviceNowServer.listening) {
+        serviceNowServer.listen(availablePort);
+      }
+      serviceNowSimulatorURL = `http://localhost:${availablePort}`;
+      proxyServer = await getHttpProxyServer(
+        serviceNowSimulatorURL,
+        configService.get('kbnTestServer.serverArgs'),
+        () => {
+          proxyHaveBeenCalled = true;
+        }
+      );
+    });
+
+    after(() => {
+      serviceNowServer.close();
+      if (proxyServer) {
+        proxyServer.close();
+      }
+    });
+
+    describe('ServiceNow ITOM - Action Creation', () => {
+      it('should return 200 when creating a servicenow action successfully', async () => {
+        const { body: createdAction } = await supertest
+          .post('/api/actions/connector')
+          .set('kbn-xsrf', 'foo')
+          .send({
+            name: 'A servicenow action',
+            connector_type_id: '.servicenow-itom',
+            config: {
+              apiUrl: serviceNowSimulatorURL,
+            },
+            secrets: mockServiceNow.secrets,
+          })
+          .expect(200);
+
+        expect(createdAction).to.eql({
+          id: createdAction.id,
+          is_preconfigured: false,
+          name: 'A servicenow action',
+          connector_type_id: '.servicenow-itom',
+          is_missing_secrets: false,
+          config: {
+            apiUrl: serviceNowSimulatorURL,
+          },
+        });
+
+        const { body: fetchedAction } = await supertest
+          .get(`/api/actions/connector/${createdAction.id}`)
+          .expect(200);
+
+        expect(fetchedAction).to.eql({
+          id: fetchedAction.id,
+          is_preconfigured: false,
+          name: 'A servicenow action',
+          connector_type_id: '.servicenow-itom',
+          is_missing_secrets: false,
+          config: {
+            apiUrl: serviceNowSimulatorURL,
+          },
+        });
+      });
+
+      it('should respond with a 400 Bad Request when creating a servicenow action with no apiUrl', async () => {
+        await supertest
+          .post('/api/actions/connector')
+          .set('kbn-xsrf', 'foo')
+          .send({
+            name: 'A servicenow action',
+            connector_type_id: '.servicenow-itom',
+            config: {},
+          })
+          .expect(400)
+          .then((resp: any) => {
+            expect(resp.body).to.eql({
+              statusCode: 400,
+              error: 'Bad Request',
+              message:
+                'error validating action type config: [apiUrl]: expected value of type [string] but got [undefined]',
+            });
+          });
+      });
+
+      it('should respond with a 400 Bad Request when creating a servicenow action with a not present in allowedHosts apiUrl', async () => {
+        await supertest
+          .post('/api/actions/connector')
+          .set('kbn-xsrf', 'foo')
+          .send({
+            name: 'A servicenow action',
+            connector_type_id: '.servicenow-itom',
+            config: {
+              apiUrl: 'http://servicenow.mynonexistent.com',
+            },
+            secrets: mockServiceNow.secrets,
+          })
+          .expect(400)
+          .then((resp: any) => {
+            expect(resp.body).to.eql({
+              statusCode: 400,
+              error: 'Bad Request',
+              message:
+                'error validating action type config: error configuring connector action: target url "http://servicenow.mynonexistent.com" is not added to the Kibana config xpack.actions.allowedHosts',
+            });
+          });
+      });
+
+      it('should respond with a 400 Bad Request when creating a servicenow action without secrets', async () => {
+        await supertest
+          .post('/api/actions/connector')
+          .set('kbn-xsrf', 'foo')
+          .send({
+            name: 'A servicenow action',
+            connector_type_id: '.servicenow-itom',
+            config: {
+              apiUrl: serviceNowSimulatorURL,
+            },
+          })
+          .expect(400)
+          .then((resp: any) => {
+            expect(resp.body).to.eql({
+              statusCode: 400,
+              error: 'Bad Request',
+              message:
+                'error validating action type secrets: [password]: expected value of type [string] but got [undefined]',
+            });
+          });
+      });
+    });
+
+    describe('ServiceNow ITOM - Executor', () => {
+      before(async () => {
+        const { body } = await supertest
+          .post('/api/actions/connector')
+          .set('kbn-xsrf', 'foo')
+          .send({
+            name: 'A servicenow simulator',
+            connector_type_id: '.servicenow-itom',
+            config: {
+              apiUrl: serviceNowSimulatorURL,
+            },
+            secrets: mockServiceNow.secrets,
+          });
+        simulatedActionId = body.id;
+      });
+
+      describe('Validation', () => {
+        it('should handle failing with a simulated success without action', async () => {
+          await supertest
+            .post(`/api/actions/connector/${simulatedActionId}/_execute`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              params: {},
+            })
+            .then((resp: any) => {
+              expect(Object.keys(resp.body)).to.eql(['status', 'message', 'retry', 'connector_id']);
+              expect(resp.body.connector_id).to.eql(simulatedActionId);
+              expect(resp.body.status).to.eql('error');
+            });
+        });
+
+        it('should handle failing with a simulated success without unsupported action', async () => {
+          await supertest
+            .post(`/api/actions/connector/${simulatedActionId}/_execute`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              params: { subAction: 'non-supported' },
+            })
+            .then((resp: any) => {
+              expect(resp.body).to.eql({
+                connector_id: simulatedActionId,
+                status: 'error',
+                retry: false,
+                message:
+                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [addEvent]\n- [1.subAction]: expected value to equal [getChoices]',
+              });
+            });
+        });
+
+        it('should handle failing with a simulated success without subActionParams', async () => {
+          await supertest
+            .post(`/api/actions/connector/${simulatedActionId}/_execute`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              params: { subAction: 'pushToService' },
+            })
+            .then((resp: any) => {
+              expect(resp.body).to.eql({
+                connector_id: simulatedActionId,
+                status: 'error',
+                retry: false,
+                message:
+                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [addEvent]\n- [1.subAction]: expected value to equal [getChoices]',
+              });
+            });
+        });
+
+        describe('getChoices', () => {
+          it('should fail when field is not provided', async () => {
+            await supertest
+              .post(`/api/actions/connector/${simulatedActionId}/_execute`)
+              .set('kbn-xsrf', 'foo')
+              .send({
+                params: {
+                  subAction: 'getChoices',
+                  subActionParams: {},
+                },
+              })
+              .then((resp: any) => {
+                expect(resp.body).to.eql({
+                  connector_id: simulatedActionId,
+                  status: 'error',
+                  retry: false,
+                  message:
+                    'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [addEvent]\n- [1.subActionParams.fields]: expected value of type [array] but got [undefined]',
+                });
+              });
+          });
+        });
+      });
+
+      describe('Execution', () => {
+        // New connectors
+        describe('Add event', () => {
+          it('should add an event ', async () => {
+            const { body: result } = await supertest
+              .post(`/api/actions/connector/${simulatedActionId}/_execute`)
+              .set('kbn-xsrf', 'foo')
+              .send({
+                params: mockServiceNow.params,
+              })
+              .expect(200);
+            expect(result.status).to.eql('ok');
+          });
+        });
+
+        describe('getChoices', () => {
+          it('should get choices', async () => {
+            const { body: result } = await supertest
+              .post(`/api/actions/connector/${simulatedActionId}/_execute`)
+              .set('kbn-xsrf', 'foo')
+              .send({
+                params: {
+                  subAction: 'getChoices',
+                  subActionParams: { fields: ['priority'] },
+                },
+              })
+              .expect(200);
+
+            expect(proxyHaveBeenCalled).to.equal(true);
+            expect(result).to.eql({
+              status: 'ok',
+              connector_id: simulatedActionId,
+              data: [
+                {
+                  dependent_value: '',
+                  label: '1 - Critical',
+                  value: '1',
+                },
+                {
+                  dependent_value: '',
+                  label: '2 - High',
+                  value: '2',
+                },
+                {
+                  dependent_value: '',
+                  label: '3 - Moderate',
+                  value: '3',
+                },
+                {
+                  dependent_value: '',
+                  label: '4 - Low',
+                  value: '4',
+                },
+                {
+                  dependent_value: '',
+                  label: '5 - Planning',
+                  value: '5',
+                },
+              ],
+            });
+          });
+        });
+      });
+    });
+  });
+}
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itsm.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itsm.ts
index 5ff1663975145..82f43ed4a3040 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itsm.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itsm.ts
@@ -241,10 +241,6 @@ export default function serviceNowITSMTest({ getService }: FtrProviderContext) {
               expect(Object.keys(resp.body)).to.eql(['status', 'message', 'retry', 'connector_id']);
               expect(resp.body.connector_id).to.eql(simulatedActionId);
               expect(resp.body.status).to.eql('error');
-              expect(resp.body.retry).to.eql(false);
-              expect(resp.body.message).to.be(
-                `error validating action params: Cannot destructure property 'Symbol(Symbol.iterator)' of 'undefined' as it is undefined.`
-              );
             });
         });
 
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_sir.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_sir.ts
index bc4ec43fb4c7b..0cdb279ac0746 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_sir.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_sir.ts
@@ -245,10 +245,6 @@ export default function serviceNowSIRTest({ getService }: FtrProviderContext) {
               expect(Object.keys(resp.body)).to.eql(['status', 'message', 'retry', 'connector_id']);
               expect(resp.body.connector_id).to.eql(simulatedActionId);
               expect(resp.body.status).to.eql('error');
-              expect(resp.body.retry).to.eql(false);
-              expect(resp.body.message).to.be(
-                `error validating action params: Cannot destructure property 'Symbol(Symbol.iterator)' of 'undefined' as it is undefined.`
-              );
             });
         });
 
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/swimlane.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/swimlane.ts
index 93d3a6c9e003f..9647d083460fd 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/swimlane.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/swimlane.ts
@@ -322,10 +322,6 @@ export default function swimlaneTest({ getService }: FtrProviderContext) {
               expect(Object.keys(resp.body)).to.eql(['status', 'message', 'retry', 'connector_id']);
               expect(resp.body.connector_id).to.eql(simulatedActionId);
               expect(resp.body.status).to.eql('error');
-              expect(resp.body.retry).to.eql(false);
-              expect(resp.body.message).to.be(
-                `error validating action params: undefined is not iterable (cannot read property Symbol(Symbol.iterator))`
-              );
             });
         });
 
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/index.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/index.ts
index 61bd1bcad34ad..d247e066226e9 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/index.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/index.ts
@@ -27,6 +27,7 @@ export default function actionsTests({ loadTestFile, getService }: FtrProviderCo
     loadTestFile(require.resolve('./builtin_action_types/server_log'));
     loadTestFile(require.resolve('./builtin_action_types/servicenow_itsm'));
     loadTestFile(require.resolve('./builtin_action_types/servicenow_sir'));
+    loadTestFile(require.resolve('./builtin_action_types/servicenow_itom'));
     loadTestFile(require.resolve('./builtin_action_types/jira'));
     loadTestFile(require.resolve('./builtin_action_types/resilient'));
     loadTestFile(require.resolve('./builtin_action_types/slack'));
diff --git a/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts b/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
index 055b4b69ab7a6..e7ea71863352e 100644
--- a/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
+++ b/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
@@ -130,7 +130,7 @@ export default ({ getService }: FtrProviderContext) => {
         const destinationIndex = generateDestinationIndex(analyticsId);
 
         before(async () => {
-          await ml.api.createIndices(destinationIndex);
+          await ml.api.createIndex(destinationIndex);
           await ml.api.assertIndicesExist(destinationIndex);
         });
 
@@ -189,7 +189,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         before(async () => {
           // Mimic real job by creating target index & index pattern after DFA job is created
-          await ml.api.createIndices(destinationIndex);
+          await ml.api.createIndex(destinationIndex);
           await ml.api.assertIndicesExist(destinationIndex);
           await ml.testResources.createIndexPatternIfNeeded(destinationIndex);
         });
diff --git a/x-pack/test/api_integration/apis/ml/job_validation/datafeed_preview_validation.ts b/x-pack/test/api_integration/apis/ml/job_validation/datafeed_preview_validation.ts
new file mode 100644
index 0000000000000..c16050e08c886
--- /dev/null
+++ b/x-pack/test/api_integration/apis/ml/job_validation/datafeed_preview_validation.ts
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { estypes } from '@elastic/elasticsearch';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+import { USER } from '../../../../functional/services/ml/security_common';
+import { COMMON_REQUEST_HEADERS } from '../../../../functional/services/ml/common_api';
+
+const farequoteMappings: estypes.MappingTypeMapping = {
+  properties: {
+    '@timestamp': {
+      type: 'date',
+    },
+    airline: {
+      type: 'keyword',
+    },
+    responsetime: {
+      type: 'float',
+    },
+  },
+};
+
+function getBaseJobConfig() {
+  return {
+    job_id: 'test',
+    description: '',
+    analysis_config: {
+      bucket_span: '15m',
+      detectors: [
+        {
+          function: 'mean',
+          field_name: 'responsetime',
+        },
+      ],
+      influencers: [],
+    },
+    analysis_limits: {
+      model_memory_limit: '11MB',
+    },
+    data_description: {
+      time_field: '@timestamp',
+      time_format: 'epoch_ms',
+    },
+    model_plot_config: {
+      enabled: false,
+      annotations_enabled: false,
+    },
+    model_snapshot_retention_days: 10,
+    daily_model_snapshot_retention_after_days: 1,
+    allow_lazy_open: false,
+    datafeed_config: {
+      query: {
+        bool: {
+          must: [
+            {
+              match_all: {},
+            },
+          ],
+        },
+      },
+      indices: ['ft_farequote'],
+      scroll_size: 1000,
+      delayed_data_check_config: {
+        enabled: true,
+      },
+      job_id: 'test',
+      datafeed_id: 'datafeed-test',
+    },
+  };
+}
+
+export default ({ getService }: FtrProviderContext) => {
+  const esArchiver = getService('esArchiver');
+  const supertest = getService('supertestWithoutAuth');
+  const ml = getService('ml');
+
+  describe('Validate datafeed preview', function () {
+    before(async () => {
+      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/ml/farequote');
+      await ml.testResources.setKibanaTimeZoneToUTC();
+      await ml.api.createIndex('farequote_empty', farequoteMappings);
+    });
+
+    after(async () => {
+      await ml.api.cleanMlIndices();
+      await ml.api.deleteIndices('farequote_empty');
+    });
+
+    it(`should validate a job with documents`, async () => {
+      const job = getBaseJobConfig();
+
+      const { body } = await supertest
+        .post('/api/ml/validate/datafeed_preview')
+        .auth(USER.ML_POWERUSER, ml.securityCommon.getPasswordForUser(USER.ML_POWERUSER))
+        .set(COMMON_REQUEST_HEADERS)
+        .send({ job })
+        .expect(200);
+
+      expect(body.valid).to.eql(true, `valid should be true, but got ${body.valid}`);
+      expect(body.documentsFound).to.eql(
+        true,
+        `documentsFound should be true, but got ${body.documentsFound}`
+      );
+    });
+
+    it(`should fail to validate a job with documents and non-existent field`, async () => {
+      const job = getBaseJobConfig();
+      job.analysis_config.detectors[0].field_name = 'no_such_field';
+
+      const { body } = await supertest
+        .post('/api/ml/validate/datafeed_preview')
+        .auth(USER.ML_POWERUSER, ml.securityCommon.getPasswordForUser(USER.ML_POWERUSER))
+        .set(COMMON_REQUEST_HEADERS)
+        .send({ job })
+        .expect(200);
+
+      expect(body.valid).to.eql(false, `valid should be false, but got ${body.valid}`);
+      expect(body.documentsFound).to.eql(
+        false,
+        `documentsFound should be false, but got ${body.documentsFound}`
+      );
+    });
+
+    it(`should validate a job with no documents`, async () => {
+      const job = getBaseJobConfig();
+      job.datafeed_config.indices = ['farequote_empty'];
+
+      const { body } = await supertest
+        .post('/api/ml/validate/datafeed_preview')
+        .auth(USER.ML_POWERUSER, ml.securityCommon.getPasswordForUser(USER.ML_POWERUSER))
+        .set(COMMON_REQUEST_HEADERS)
+        .send({ job })
+        .expect(200);
+
+      expect(body.valid).to.eql(true, `valid should be true, but got ${body.valid}`);
+      expect(body.documentsFound).to.eql(
+        false,
+        `documentsFound should be false, but got ${body.documentsFound}`
+      );
+    });
+
+    it(`should fail for viewer user`, async () => {
+      const job = getBaseJobConfig();
+
+      await supertest
+        .post('/api/ml/validate/datafeed_preview')
+        .auth(USER.ML_VIEWER, ml.securityCommon.getPasswordForUser(USER.ML_VIEWER))
+        .set(COMMON_REQUEST_HEADERS)
+        .send({ job })
+        .expect(403);
+    });
+
+    it(`should fail for unauthorized user`, async () => {
+      const job = getBaseJobConfig();
+
+      await supertest
+        .post('/api/ml/validate/datafeed_preview')
+        .auth(USER.ML_UNAUTHORIZED, ml.securityCommon.getPasswordForUser(USER.ML_UNAUTHORIZED))
+        .set(COMMON_REQUEST_HEADERS)
+        .send({ job })
+        .expect(403);
+    });
+  });
+};
diff --git a/x-pack/test/api_integration/apis/ml/job_validation/index.ts b/x-pack/test/api_integration/apis/ml/job_validation/index.ts
index 4b75102d7b0bf..be07ae3b1852a 100644
--- a/x-pack/test/api_integration/apis/ml/job_validation/index.ts
+++ b/x-pack/test/api_integration/apis/ml/job_validation/index.ts
@@ -13,5 +13,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./calculate_model_memory_limit'));
     loadTestFile(require.resolve('./cardinality'));
     loadTestFile(require.resolve('./validate'));
+    loadTestFile(require.resolve('./datafeed_preview_validation'));
   });
 }
diff --git a/x-pack/test/api_integration/apis/security/privileges.ts b/x-pack/test/api_integration/apis/security/privileges.ts
index 762fc1642a87a..f234855b84e17 100644
--- a/x-pack/test/api_integration/apis/security/privileges.ts
+++ b/x-pack/test/api_integration/apis/security/privileges.ts
@@ -73,7 +73,7 @@ export default function ({ getService }: FtrProviderContext) {
               'packs_read',
             ],
           },
-          reserved: ['ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
+          reserved: ['fleet-setup', 'ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
         };
 
         await supertest
diff --git a/x-pack/test/api_integration/apis/security/privileges_basic.ts b/x-pack/test/api_integration/apis/security/privileges_basic.ts
index 0efaa25ee57da..ac69bfcd9d5d4 100644
--- a/x-pack/test/api_integration/apis/security/privileges_basic.ts
+++ b/x-pack/test/api_integration/apis/security/privileges_basic.ts
@@ -45,7 +45,7 @@ export default function ({ getService }: FtrProviderContext) {
           },
           global: ['all', 'read'],
           space: ['all', 'read'],
-          reserved: ['ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
+          reserved: ['fleet-setup', 'ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
         };
 
         await supertest
diff --git a/x-pack/test/fleet_api_integration/apis/agents/services.ts b/x-pack/test/fleet_api_integration/apis/agents/services.ts
index be5d2d438f76f..0e28ad647bbc4 100644
--- a/x-pack/test/fleet_api_integration/apis/agents/services.ts
+++ b/x-pack/test/fleet_api_integration/apis/agents/services.ts
@@ -32,12 +32,30 @@ export function getEsClientForAPIKey({ getService }: FtrProviderContext, esApiKe
   });
 }
 
-export function setupFleetAndAgents({ getService }: FtrProviderContext) {
+export function setupFleetAndAgents(providerContext: FtrProviderContext) {
   before(async () => {
-    await getService('supertest').post(`/api/fleet/setup`).set('kbn-xsrf', 'xxx').send();
-    await getService('supertest')
+    // Use elastic/fleet-server service account to execute setup to verify privilege configuration
+    const es = providerContext.getService('es');
+    const {
+      body: { token },
+      // @ts-expect-error SecurityCreateServiceTokenRequest should not require `name`
+    } = await es.security.createServiceToken({
+      namespace: 'elastic',
+      service: 'fleet-server',
+    });
+    const supetestWithoutAuth = getSupertestWithoutAuth(providerContext);
+
+    await supetestWithoutAuth
+      .post(`/api/fleet/setup`)
+      .set('kbn-xsrf', 'xxx')
+      .set('Authorization', `Bearer ${token.value}`)
+      .send()
+      .expect(200);
+    await supetestWithoutAuth
       .post(`/api/fleet/agents/setup`)
       .set('kbn-xsrf', 'xxx')
-      .send({ forceRecreate: true });
+      .set('Authorization', `Bearer ${token.value}`)
+      .send({ forceRecreate: true })
+      .expect(200);
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/epm/setup.ts b/x-pack/test/fleet_api_integration/apis/epm/setup.ts
index 8567cf8069c58..051636ad11f5a 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/setup.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/setup.ts
@@ -14,7 +14,9 @@ import { setupFleetAndAgents } from '../agents/services';
 export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
   const supertest = getService('supertest');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
   const log = getService('log');
+  const es = getService('es');
 
   describe('setup api', async () => {
     skipIfNoDockerRegistry(providerContext);
@@ -47,5 +49,48 @@ export default function (providerContext: FtrProviderContext) {
         );
       });
     });
+
+    it('allows elastic/fleet-server user to call required APIs', async () => {
+      const {
+        body: { token },
+        // @ts-expect-error SecurityCreateServiceTokenRequest should not require `name`
+      } = await es.security.createServiceToken({
+        namespace: 'elastic',
+        service: 'fleet-server',
+      });
+
+      // elastic/fleet-server needs access to these APIs:
+      // POST /api/fleet/setup
+      // POST /api/fleet/agents/setup
+      // GET /api/fleet/agent_policies
+      // GET /api/fleet/enrollment-api-keys
+      // GET /api/fleet/enrollment-api-keys/<id>
+      await supertestWithoutAuth
+        .post('/api/fleet/setup')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      await supertestWithoutAuth
+        .post('/api/fleet/agents/setup')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      await supertestWithoutAuth
+        .get('/api/fleet/agent_policies')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      const response = await supertestWithoutAuth
+        .get('/api/fleet/enrollment-api-keys')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      const enrollmentApiKeyId = response.body.list[0].id;
+      await supertestWithoutAuth
+        .get(`/api/fleet/enrollment-api-keys/${enrollmentApiKeyId}`)
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+    });
   });
 }
diff --git a/x-pack/test/functional/services/ml/api.ts b/x-pack/test/functional/services/ml/api.ts
index abde3bf365384..6ffd95f213c41 100644
--- a/x-pack/test/functional/services/ml/api.ts
+++ b/x-pack/test/functional/services/ml/api.ts
@@ -126,14 +126,20 @@ export function MachineLearningAPIProvider({ getService }: FtrProviderContext) {
       );
     },
 
-    async createIndices(indices: string) {
+    async createIndex(
+      indices: string,
+      mappings?: Record<string, estypes.MappingTypeMapping> | estypes.MappingTypeMapping
+    ) {
       log.debug(`Creating indices: '${indices}'...`);
       if ((await es.indices.exists({ index: indices, allow_no_indices: false })).body === true) {
         log.debug(`Indices '${indices}' already exist. Nothing to create.`);
         return;
       }
 
-      const { body } = await es.indices.create({ index: indices });
+      const { body } = await es.indices.create({
+        index: indices,
+        ...(mappings ? { body: { mappings } } : {}),
+      });
       expect(body)
         .to.have.property('acknowledged')
         .eql(true, 'Response for create request indices should be acknowledged.');
diff --git a/x-pack/test/saved_object_tagging/functional/tests/som_integration.ts b/x-pack/test/saved_object_tagging/functional/tests/som_integration.ts
index 4688cfba4b864..e35b33b3b4475 100644
--- a/x-pack/test/saved_object_tagging/functional/tests/som_integration.ts
+++ b/x-pack/test/saved_object_tagging/functional/tests/som_integration.ts
@@ -21,10 +21,9 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
    */
   const selectTagsInFilter = async (...tagNames: string[]) => {
     // open the filter dropdown
-    // the first class selector before the id is of course useless. Only here to help cleaning that once we got
-    // testSubjects in EUI filters.
+    // This CSS selector should be cleaned up once we have testSubjects in EUI filters.
     const filterButton = await find.byCssSelector(
-      '.euiFilterGroup #field_value_selection_1 .euiFilterButton'
+      '.euiFilterGroup > *:last-child .euiFilterButton'
     );
     await filterButton.click();
     // select the tags
diff --git a/x-pack/test/security_solution_endpoint/services/endpoint.ts b/x-pack/test/security_solution_endpoint/services/endpoint.ts
index 2e774dcd84782..5bcc5c415a0db 100644
--- a/x-pack/test/security_solution_endpoint/services/endpoint.ts
+++ b/x-pack/test/security_solution_endpoint/services/endpoint.ts
@@ -18,7 +18,7 @@ import {
   IndexedHostsAndAlertsResponse,
   indexHostsAndAlerts,
 } from '../../../plugins/security_solution/common/endpoint/index_data';
-import { TransformPivotConfig } from '../../../plugins/transform/common/types/transform';
+import { TransformConfigUnion } from '../../../plugins/transform/common/types/transform';
 import { GetTransformsResponseSchema } from '../../../plugins/transform/common/api_schemas/transforms';
 import { catchAndWrapError } from '../../../plugins/security_solution/server/endpoint/utils';
 import { installOrUpgradeEndpointFleetPackage } from '../../../plugins/security_solution/common/endpoint/data_loaders/setup_fleet_for_endpoint';
@@ -38,9 +38,9 @@ export class EndpointTestResources extends FtrService {
    *
    * @param [endpointPackageVersion] if set, it will be used to get the specific transform this this package version. Else just returns first one found
    */
-  async getTransform(endpointPackageVersion?: string): Promise<TransformPivotConfig> {
+  async getTransform(endpointPackageVersion?: string): Promise<TransformConfigUnion> {
     const transformId = this.generateTransformId(endpointPackageVersion);
-    let transform: TransformPivotConfig | undefined;
+    let transform: TransformConfigUnion | undefined;
 
     if (endpointPackageVersion) {
       await this.transform.api.waitForTransformToExist(transformId);
diff --git a/x-pack/test/spaces_api_integration/common/lib/space_test_utils.ts b/x-pack/test/spaces_api_integration/common/lib/space_test_utils.ts
index 28b19d5db20b6..c047a741e35da 100644
--- a/x-pack/test/spaces_api_integration/common/lib/space_test_utils.ts
+++ b/x-pack/test/spaces_api_integration/common/lib/space_test_utils.ts
@@ -50,6 +50,8 @@ export function getAggregatedSpaceData(es: KibanaClient, objectTypes: string[])
             emit(doc["namespaces"].value);
           } else if (doc["namespace"].size() > 0) {
             emit(doc["namespace"].value);
+          } else if (doc["legacy-url-alias.targetNamespace"].size() > 0) {
+            emit(doc["legacy-url-alias.targetNamespace"].value);
           }
         `,
         },
diff --git a/x-pack/test/spaces_api_integration/common/suites/delete.ts b/x-pack/test/spaces_api_integration/common/suites/delete.ts
index aaca4fa843d67..4bf44d88db8e0 100644
--- a/x-pack/test/spaces_api_integration/common/suites/delete.ts
+++ b/x-pack/test/spaces_api_integration/common/suites/delete.ts
@@ -48,6 +48,7 @@ export function deleteTestSuiteFactory(
       'dashboard',
       'space',
       'index-pattern',
+      'legacy-url-alias',
       // TODO: add assertions for config objects -- these assertions were removed because of flaky behavior in #92358, but we should
       // consider adding them again at some point, especially if we convert config objects to `namespaceType: 'multiple-isolated'` in
       // the future.
@@ -56,6 +57,10 @@ export function deleteTestSuiteFactory(
     // @ts-expect-error @elastic/elasticsearch doesn't defined `count.buckets`.
     const buckets = response.aggregations?.count.buckets;
 
+    // The test fixture contains three legacy URL aliases:
+    // (1) one for "space_1", (2) one for "space_2", and (3) one for "other_space", which is a non-existent space.
+    // Each test deletes "space_2", so the agg buckets should reflect that aliases (1) and (3) still exist afterwards.
+
     // Space 2 deleted, all others should exist
     const expectedBuckets = [
       {
@@ -65,47 +70,37 @@ export function deleteTestSuiteFactory(
           doc_count_error_upper_bound: 0,
           sum_other_doc_count: 0,
           buckets: [
-            {
-              key: 'visualization',
-              doc_count: 3,
-            },
-            {
-              key: 'dashboard',
-              doc_count: 2,
-            },
-            {
-              key: 'space',
-              doc_count: 2,
-            },
-            {
-              key: 'index-pattern',
-              doc_count: 1,
-            },
+            { key: 'visualization', doc_count: 3 },
+            { key: 'dashboard', doc_count: 2 },
+            { key: 'space', doc_count: 2 }, // since space objects are namespace-agnostic, they appear in the "default" agg bucket
+            { key: 'index-pattern', doc_count: 1 },
+            // legacy-url-alias objects cannot exist for the default space
           ],
         },
       },
       {
-        doc_count: 6,
+        doc_count: 7,
         key: 'space_1',
         countByType: {
           doc_count_error_upper_bound: 0,
           sum_other_doc_count: 0,
           buckets: [
-            {
-              key: 'visualization',
-              doc_count: 3,
-            },
-            {
-              key: 'dashboard',
-              doc_count: 2,
-            },
-            {
-              key: 'index-pattern',
-              doc_count: 1,
-            },
+            { key: 'visualization', doc_count: 3 },
+            { key: 'dashboard', doc_count: 2 },
+            { key: 'index-pattern', doc_count: 1 },
+            { key: 'legacy-url-alias', doc_count: 1 }, // alias (1)
           ],
         },
       },
+      {
+        doc_count: 1,
+        key: 'other_space',
+        countByType: {
+          doc_count_error_upper_bound: 0,
+          sum_other_doc_count: 0,
+          buckets: [{ key: 'legacy-url-alias', doc_count: 1 }], // alias (3)
+        },
+      },
     ];
 
     expect(buckets).to.eql(expectedBuckets);
diff --git a/yarn.lock b/yarn.lock
index e5e2f59359c9f..d715897b57e28 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2412,10 +2412,10 @@
   resolved "https://registry.yarnpkg.com/@elastic/eslint-plugin-eui/-/eslint-plugin-eui-0.0.2.tgz#56b9ef03984a05cc213772ae3713ea8ef47b0314"
   integrity sha512-IoxURM5zraoQ7C8f+mJb9HYSENiZGgRVcG4tLQxE61yHNNRDXtGDWTZh8N1KIHcsqN1CEPETjuzBXkJYF/fDiQ==
 
-"@elastic/eui@39.0.0":
-  version "39.0.0"
-  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-39.0.0.tgz#abac19edd466eee13612d5668e5456961dc813b8"
-  integrity sha512-8sf8sbxjpRxV23dFTwbkaWH6LhWrOlMpdUUMVUC9zd0g5iQLj1IxkxQCeyYM/p++SQFl+1hshAuaH//DCz5Xrw==
+"@elastic/eui@39.1.1":
+  version "39.1.1"
+  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-39.1.1.tgz#52e59f1dd6448b2e80047259ca60c6c87e9873f0"
+  integrity sha512-zYCNitpp6Ds7U6eaa9QkJqc20ZMo2wjpZokNtd1WalFV22vdfiVizFg7DMtDjJrCDLmoXcLOOCMasKlmmJ1cRg==
   dependencies:
     "@types/chroma-js" "^2.0.0"
     "@types/lodash" "^4.14.160"
@@ -2441,7 +2441,7 @@
     react-is "~16.3.0"
     react-virtualized-auto-sizer "^1.0.2"
     react-window "^1.8.5"
-    refractor "^3.4.0"
+    refractor "^3.5.0"
     rehype-raw "^5.0.0"
     rehype-react "^6.0.0"
     rehype-stringify "^8.0.0"
@@ -24731,7 +24731,7 @@ reflect.ownkeys@^0.2.0:
   resolved "https://registry.yarnpkg.com/reflect.ownkeys/-/reflect.ownkeys-0.2.0.tgz#749aceec7f3fdf8b63f927a04809e90c5c0b3460"
   integrity sha1-dJrO7H8/34tj+SegSAnpDFwLNGA=
 
-refractor@^3.2.0, refractor@^3.4.0:
+refractor@^3.2.0, refractor@^3.5.0:
   version "3.5.0"
   resolved "https://registry.yarnpkg.com/refractor/-/refractor-3.5.0.tgz#334586f352dda4beaf354099b48c2d18e0819aec"
   integrity sha512-QwPJd3ferTZ4cSPPjdP5bsYHMytwWYnAN5EEnLtGvkqp/FCCnGsBgxrm9EuIDnjUC3Uc/kETtvVi7fSIVC74Dg==